Distributed detection/localization of change-points in high-dimensional network traffic data

DOI10.1007/S11222-011-9240-5zbMATH Open1322.62146arXiv0909.5524OpenAlexW3106045166MaRDI QIDQ746229FDOQ746229

Authors: Alexandre Lung-Yut-Fong, Céline Lévy-Leduc, Olivier Cappé 

Publication date: 16 October 2015

Published in: Statistics and Computing (Search for Journal in Brave)

Abstract: We propose a novel approach for distributed statistical detection of change-points in high-volume network traffic. We consider more specifically the task of detecting and identifying the targets of Distributed Denial of Service (DDoS) attacks. The proposed algorithm, called DTopRank, performs distributed network anomaly detection by aggregating the partial information gathered in a set of network monitors. In order to address massive data while limiting the communication overhead within the network, the approach combines record filtering at the monitor level and a nonparametric rank test for doubly censored time series at the central decision site. The performance of the DTopRank algorithm is illustrated both on synthetic data as well as from a traffic trace provided by a major Internet service provider.

Full work available at URL: https://arxiv.org/abs/0909.5524

Recommendations

• Detection and localization of change-points in high-dimensional network traffic data
• Change-point detection in multichannel and distributed systems
• Detection of intrusions in information systems by sequential change-point methods
• Distributed change detection via average consensus over networks
• Detecting distributed network traffic anomaly with network-wide correlation analysis

zbMATH Keywords

censored datachange-point detectionrank testnetwork anomaly detectiondistributed detection

Mathematics Subject Classification ID

Nonparametric hypothesis testing (62G10) Markov processes: hypothesis testing (62M02) Performance evaluation, queueing, and scheduling in the context of computer systems (68M20)

Cites Work

• Asymptotic Statistics
• Title not available (Why is that?)
• A note on two problems in connexion with graphs
• Title not available (Why is that?)
• Minimax Methods for Multihypothesis Sequential Testing and Change-Point Detection Problems
• Title not available (Why is that?)
• Detection and localization of change-points in high-dimensional network traffic data
• Detection of intrusions in information systems by sequential change-point methods
• A Nonparametric Test for Change in Randomly Censored Data

Cited In (16)

• Detecting distributed network traffic anomaly with network-wide correlation analysis
• BayesProject: fast computation of a projection direction for multivariate changepoint detection
• Change-point detection in multichannel and distributed systems
• A Total Variation Based Method for Multivariate Time Series Segmentation
• Detection and localization of change-points in high-dimensional network traffic data
• Empirical likelihood test for high-dimensional two-sample model
• Principle components and importance ranking of distributed anomalies
• An \(L_0\)-norm regularized method for multivariate time series segmentation
• Computational Science – ICCS 2005
• Sequential hashing: a flexible approach for unveiling significant patterns in high speed networks
• On change-point estimation under Sobolev sparsity
• Note on studying change point of LRD traffic based on Li's detection of DDoS flood attacking
• Asymptotic properties of semiparametric \(M\)-estimators with multiple change points
• An inexact projected gradient method for sparsity-constrained quadratic measurements regression
• Distributed change detection via average consensus over networks
• Consistency of a range of penalised cost approaches for detecting multiple changepoints

This page was built for publication: Distributed detection/localization of change-points in high-dimensional network traffic data

Report a bug (only for logged in users!)Click here to report a bug for this page (MaRDI item Q746229)