An efficient online anomalies detection mechanism for high-speed networks - Archive ouverte HAL Accéder directement au contenu
Communication Dans Un Congrès Année : 2007

An efficient online anomalies detection mechanism for high-speed networks

Sandrine Vaton
Annie Gravey

Résumé

In this paper, we propose an efficient framework for online detection and identification of network anomalies, in early stage of its occurrence, to quickly react by taking the appropriate countermeasures. The proposed framework is based on online detection of change point in a multi-layer reversible sketch, which aggregates multiple data streams from high speeds links in a stretched database. To detect network anomalies, we apply non-parametric multi-channel CUSUM algorithm at the counter value in each bucket of the proposed reversible sketch, in order to undermine flows with abrupt change, and to discover the keys of culprit flows via sketch inversion. Theoretical framework for detection and classification of attacks are presented. We also give the results of our experiments analysis at two data traces collected with Netflow and Endace DAG-3 card. Our analysis results from real-time internet traffic and online implementation show that our proposed architecture is able to detect culprit flows quickly with a high level of accuracy.
Fichier non déposé

Dates et versions

hal-00504314 , version 1 (20-07-2010)

Identifiants

  • HAL Id : hal-00504314 , version 1

Citer

Osman Salem, Sandrine Vaton, Annie Gravey. An efficient online anomalies detection mechanism for high-speed networks. MonAM 2007 : Second IEEE Workshop on Monitoring, Attack Detection and Mitigation, Nov 2007, Toulouse, France. pp.1-6. ⟨hal-00504314⟩
13 Consultations
0 Téléchargements

Partager

Gmail Facebook X LinkedIn More