Name
Abstract | ||
|---|---|---|
We study the problem of detecting malicious IP traffic in the network early, by analyzing the contents of packets. Existing systems look at packet contents as a bag of substrings and study characteristics of its base distribution B where B(i) is the frequency of substring i.We propose studying the inverse distribution I where I(f) is the number of substrings that appear with frequency f. As we show using a detailed case study, the inverse distribution shows the emergence of malicious traffic very clearly not only in its "static" collection of bumps, but also in its nascent "dynamic" state when the phenomenon manifests itself only as a distortion of the inverse distribution envelope. We describe our probabilistic analysis of the inverse distribution in terms of Gaussian mixtures, our preliminary solution for discovering these bumps automatically. Finally, we briefly discuss challenges in analyzing the inverse distribution of IP contents and its applications. |
Year | DOI | Venue |
|---|---|---|
2005 | 10.1145/1080173.1080176 | MineNet |
Keywords | Field | DocType |
ip content,malicious network traffic,malicious ip traffic,detailed case study,gaussian mixture,malicious traffic,study characteristic,base distribution b,inverse distribution,packet content,inverse distribution envelope,content analysis,worms | Inverse,Substring,Inverse distribution,Computer science,Network packet,Algorithm,Theoretical computer science,Probabilistic analysis of algorithms,Gaussian,Distortion,Internet traffic,Distributed computing | Conference |
ISBN | Citations | PageRank |
1-59593-026-4 | 16 | 1.27 |
References | Authors | |
10 | 4 | |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Vijay Karamcheti | 1 | 646 | 67.03 |
| Davi Geiger | 2 | 1050 | 353.66 |
| Zvi Kedem | 3 | 710 | 369.44 |
| S. Muthukrishnan | 4 | 8025 | 734.98 |