Network-Wide Security Analysis. Anukool Lakhina. with Mark Crovella and Christophe Diot ... Working Hypothesis: Diagnosis & situational awareness requires a ...
... Traffic Feature Distributions. Anukool Lakhina, Mark Crovella, Christophe Diot ... A general, unsupervised method for reliably detecting and classifying network ...
Window-shopping for a bit not a bad idea. But, beware the 'many masters and no mentor' pitfall ... Remember the PhD is your gift to yourself. Sorry, I don't ...
Network-Wide data we use: Traffic matrix views for Abilene and G ant at 10 min bins ... Worm. Point-Multipoint. 10. Automatically Classifying Anomalies [LCD:SIGCOMM05] ...
to atlanta. to LA. from nyc. 8 ... separate normal & anomalous network-wide traffic ... Then, decompose traffic in all OD flows by projecting onto the two ...
Increasing in sophistication: worm-compromised. hosts and bot-nets are massively distributed ... 1/1000 sampling, 10 min bins. Sprint European commercial network ...
Three Disjoint Views of the Network. Policy: The operator's 'wish list' ... 'WorldCom Inc...suffered a widespread outage on its Internet backbone that ...
'Ground truth' Time period: January 1, 2006 to June 30, 2006. Seattle. 6,766,986. Sunnyvale ... Destination Next-hop AS Path. 130.207.0.0/16. R1. 1..dest. R1 ...
An Illustration. Detect. the time of the anomaly. Identify. the source ... A Geometric Illustration. In general, anomalous traffic results in a large value of ...
Boston U., 2005. C. Faloutsos. 1. School of Computer Science. Carnegie Mellon ... Boston U., 2005. C. Faloutsos. 2. School of Computer Science. Carnegie Mellon ...
to atlanta. to LA. from nyc. 8. Data Collected. Collect sampled NetFlow data from all routers of: ... An approach to separate normal & anomalous network-wide traffic ...
Data Mining using Fractals (fractals for fun and profit) ... New tools: power laws, self-similarity and fractals' work, where traditional assumptions fail ...
to seattle. to atlanta. to LA. from nyc. 10. Why Origin-Destination Flows? ... common (user-driven) daily and weekly cycles: 17. Outline for rest of talk ...
Measurement tools are primitive. Technical challenges are significant. ... Continue to conduct measurements, build more informed models, and validate them. ...
There is no reliable cyber attack early warning system and no reliable ... attack upon a large, complicated network disturbs the fractal nature of that ...