Network-Wide Security Analysis. Anukool Lakhina. with Mark Crovella and Christophe Diot ... Working Hypothesis: Diagnosis & situational awareness requires a ...
... Traffic Feature Distributions. Anukool Lakhina, Mark Crovella, Christophe Diot ... A general, unsupervised method for reliably detecting and classifying network ...
in the quark model. Olga Lakhina. University of Pittsburgh. Research Advisor. Eric Swanson ... Using SHO meson wave functions. Dipole (long wave-length) approximation ...
Christophe Diot. 3. Anomaly detection in large networks ... Validated against multiple networks at different time. Abilene 03, Geant 04, Sprint Europe 03 ...
The Probability Distribution of Extreme Geomagnetic Events in the Auroral Zone R.S. Weigel Space Weather Laboratory Department of Computational and Data Sciences
Data collection: phone call records and summaries of an account's previous history ... Sn exceeds a threshold w. Change point detection in network traffic. Data ...
Interpolate degree-k polynomial q(zj) = S1 zj. Output q(0) Multiplicative ... For what other problems can we use this 'generalize-then-interpolate' strategy? ...
Anomalies can often indicate network problems. DDoS, worms, flash crowds, outages, ... Tomography. Infer volume anomalies from link traffic measurements. Early Inverse ...
Three Disjoint Views of the Network. Policy: The operator's 'wish list' ... 'WorldCom Inc...suffered a widespread outage on its Internet backbone that ...
1. Is Statistical Machine Learning Safe in an Adversarial Environment. Blaine Nelson, RAD Lab ... Blaine Nelson Marco Barreno Fuching Jack Chi. Ling Huang ...
(opening it up can. disturb the system) too complex to measure everywhere, all the time ... Convergence analysis of [Crisan, Doucet 01; Le Gland, Oudjane 02] applies. ...
'Ground truth' Time period: January 1, 2006 to June 30, 2006. Seattle. 6,766,986. Sunnyvale ... Destination Next-hop AS Path. 130.207.0.0/16. R1. 1..dest. R1 ...
PCA (subspace method) in one . Challenges with current PCA methodology ... Cattell's Scree Test. Humphrey-Ilgen. Kaiser's Criterion. None are reliable. 11 ...
Each principal axis in the direction of maximum (remaining) energy ... Cattell's Scree Test - Humphrey-Ilgen - Kaiser's Criterion. None are reliable. 17 ...
A. Barrat, LPT, Universit Paris-Sud, France. I. Alvarez ... Apparent complexity of Internet's structure. Problem of sampling biases. Model for traceroute ...
Boston U., 2005. C. Faloutsos. 1. School of Computer Science. Carnegie Mellon ... Boston U., 2005. C. Faloutsos. 2. School of Computer Science. Carnegie Mellon ...
An Illustration. Detect. the time of the anomaly. Identify. the source ... A Geometric Illustration. In general, anomalous traffic results in a large value of ...
Window-shopping for a bit not a bad idea. But, beware the 'many masters and no mentor' pitfall ... Remember the PhD is your gift to yourself. Sorry, I don't ...
Increasing in sophistication: worm-compromised. hosts and bot-nets are massively distributed ... 1/1000 sampling, 10 min bins. Sprint European commercial network ...
How to extract meaning from this high dimensional structure in a systematic fashion? ... Can we get a high-level understanding of a set of OD flows in terms of ...
Network-Wide data we use: Traffic matrix views for Abilene and G ant at 10 min bins ... Worm. Point-Multipoint. 10. Automatically Classifying Anomalies [LCD:SIGCOMM05] ...
to atlanta. to LA. from nyc. 8 ... separate normal & anomalous network-wide traffic ... Then, decompose traffic in all OD flows by projecting onto the two ...
Anomaly and sequential detection with time series data. XuanLong Nguyen ... Time series is a sequence of data points, measured typically at successive times, ...
Need for Internet measurements arises due to commercial, social, and technical issues ... Measurement for network operations. Detecting and diagnosing problems ...
Two measurement sessions in Sigcomm03, Sigcomm04. Even in SOSP, OSDI... Everybody hates TCP. Available bandwidth tools. Again, too many similar tools ...
Data Mining using Fractals (fractals for fun and profit) ... New tools: power laws, self-similarity and fractals' work, where traditional assumptions fail ...
My (biased) opinion: The bar should now be very high for observation/interpretation. ... My (biased) opinion: this is one useful approach; but not the end of ...
A Brief History of Lognormal and Power Law Distributions and an Application to File Size Distributions Michael Mitzenmacher Harvard University Motivation: General ...
Power laws (and/or scale-free networks) are now everywhere. ... In computer science: file sizes, download times, Internet topology, Web graph, etc. ...
Measurement tools are primitive. Technical challenges are significant. ... Continue to conduct measurements, build more informed models, and validate them. ...
Recent work on file size distributions ... Start with an organism of size X0. ... At each time interval, suppose size either increases by a factor of 2 with ...
to atlanta. to LA. from nyc. 8. Data Collected. Collect sampled NetFlow data from all routers of: ... An approach to separate normal & anomalous network-wide traffic ...
to seattle. to atlanta. to LA. from nyc. 10. Why Origin-Destination Flows? ... common (user-driven) daily and weekly cycles: 17. Outline for rest of talk ...
Can lead to large scale 'failures' Inability of access or diversion to malicious sites. ... Aggregation of large un-owned IP blocks. Incompatible policies among AS'es ...
Dans quelle proportion les routes ne sont pas des plus courts chemins? ... R.Siamwalla, R.Sharma and S.Keshav. Discovering Internet Topology. Q. Chen and H. Chang ...
Process of collecting data that measure certain phenomena about the network. Should be a science ... Packet captures (e.g., tcpdump, DAG) Flow records (e.g., netflow) ...