Nothing Special   »   [go: up one dir, main page]

Hammerschmidt et al., 2016 - Google Patents

Efficient learning of communication profiles from ip flow records

Hammerschmidt et al., 2016

View PDF
Document ID
7713413997578793315
Author
Hammerschmidt C
Marchal S
State R
Pellegrino G
Verwer S
Publication year
Publication venue
2016 IEEE 41st Conference on Local Computer Networks (LCN)

External Links

Snippet

The task of network traffic monitoring has evolved drastically with the ever-increasing amount of data flowing in large scale networks. The automated analysis of this tremendous source of information often comes with using simpler models on aggregated data (eg IP flow …
Continue reading at orbilu.uni.lu (PDF) (other versions)

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1425—Traffic logging, e.g. anomaly detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/26—Monitoring arrangements; Testing arrangements
    • H04L12/2602—Monitoring arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/02—Arrangements for monitoring or testing packet switching networks involving a reduction of monitoring data
    • H04L43/026—Arrangements for monitoring or testing packet switching networks involving a reduction of monitoring data using flow generation
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1433—Vulnerability analysis
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/08—Monitoring based on specific metrics
    • H04L43/0823—Errors
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/08—Monitoring based on specific metrics
    • H04L43/0852—Delays
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance or administration or management of packet switching networks
    • H04L41/14—Arrangements for maintenance or administration or management of packet switching networks involving network analysis or design, e.g. simulation, network model or planning
    • H04L41/142—Arrangements for maintenance or administration or management of packet switching networks involving network analysis or design, e.g. simulation, network model or planning using statistical or mathematical methods
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/06—Report generation
    • H04L43/062—Report generation for traffic related reporting
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/50—Testing arrangements
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/10—Arrangements for monitoring or testing packet switching networks using active monitoring, e.g. heartbeat protocols, polling, ping, trace-route
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L41/00—Arrangements for maintenance or administration or management of packet switching networks
    • H04L41/12—Arrangements for maintenance or administration or management of packet switching networks network topology discovery or management
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing packet switching networks
    • H04L43/12—Arrangements for monitoring or testing packet switching networks using dedicated network monitoring probes
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING; COUNTING
    • G06N—COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS
    • G06N99/00—Subject matter not provided for in other groups of this subclass
    • G06N99/005—Learning machines, i.e. computer in which a programme is changed according to experience gained by the machine itself during a complete run
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/54—Store-and-forward switching systems

Similar Documents

Publication Publication Date Title
Tan et al. A system for denial-of-service attack detection based on multivariate correlation analysis
Gogoi et al. MLH-IDS: a multi-level hybrid intrusion detection method
CN108768883B (en) Network traffic identification method and device
CN108595655B (en) Abnormal user detection method based on session feature similarity fuzzy clustering
Su et al. Hierarchical clustering based network traffic data reduction for improving suspicious flow detection
CN108809989B (en) Botnet detection method and device
CN112615888B (en) Threat assessment method and device for network attack behavior
Hammerschmidt et al. Efficient learning of communication profiles from ip flow records
CN114143037B (en) Malicious encrypted channel detection method based on process behavior analysis
CN108629183A (en) Multi-model malicious code detecting method based on Credibility probability section
CN115643035A (en) Network security situation assessment method based on multi-source log
CN111835681A (en) Large-scale abnormal flow host detection method and device
Özdel et al. Payload-based network traffic analysis for application classification and intrusion detection
Li et al. Detecting anomaly in large-scale network using mobile crowdsourcing
Oudah et al. A novel features set for internet traffic classification using burstiness
CN112235254B (en) Rapid identification method for Tor network bridge in high-speed backbone network
Muthukumar et al. Denoising internet delay measurements using weak supervision
CN115277178B (en) Abnormality monitoring method, device and storage medium based on enterprise network flow
Shaman et al. User profiling based on application-level using network metadata
Coull et al. On Measuring the Similarity of Network Hosts: Pitfalls, New Metrics, and Empirical Analyses.
CN115085948A (en) Network security situation assessment method based on improved D-S evidence theory
Wu et al. Bcac: Batch classifier based on agglomerative clustering for traffic classification in a backbone network
Shi et al. An approach for detecting LDoS attack based on cloud model
Sheng et al. How to fingerprint attack traffic against industrial control system network
Ádám et al. Methods of the data mining and machine learning in computer security