Identifying Anomalous Traffic Sources Using Flow Statistics
Ryoichi Kawahara, Noriaki Kamiyama, Shigeaki Harada, Haruhisa Hasegawa, Shoichiro Asano · 2008
We propose a method of identifying anomalous traffic sources using flow statistics. We have investigated a way of detecting whether or not anomalies occur by observing the behavior of several time-series of flow statistics such as the number of flows. After detecting the occurrences of network anomalies, we need to identify the source of the anomalies. In this paper, we describe a method of identifying anomalous traffic sources. For this purpose, we apply data mining approaches such as the K-nearest neighbor method, naive Bayesian classifier, neural network, and support vector machine. We show how to use such approaches to identify anomalous traffic sources by using flow statistics. We also show evaluation results for the effectiveness of our approach using two measurement data sets.