Name
Abstract | ||
|---|---|---|
In recent work, we proposed D-Trigger, a framework for tracking a global condition over a large network that allows us to detect anomalies while only collecting a very limited amount of data from distributed monitors. In this paper, we expand our previous work by designing a new class of queries (conditions) that can be tracked for anomaly violations. We show how security violations can be detected over a time window of any size. This is important because security operators do not know in advance the window of time in which measurements should be made to detect anomalies. We also present an algorithm that determines how each machine should filter its time series measurements before back-hauling them to a central operations center. Our filters are computed analytically such that upper bounds on false positive and missed detection rates are guaranteed. In our evaluation, we show that botnet detection can be carried out successfully over a distributed set of machines, while simultaneously filtering out 80 to 90% of the measurement data. |
Year | DOI | Venue |
|---|---|---|
2007 | 10.1109/ICDCS.2007.93 | ICDCS |
Keywords | Field | DocType |
distributed monitors,previous work,time series measurement,distributed triggering,anomaly detection,anomaly violation,security violations,botnet detection,time window,distributed cumulative triggers,cumulative triggers,network monitoring,data aggregation,recent work,anomaly violations,detection rate,measurement data,security operator,d-trigger,communication-efficient tracking,queueing theory.,security of data,security violation,filtering,scalability,cumulant,false positive,queueing theory,remote monitoring,time series,time measurement,upper bound,data security | Anomaly detection,Data security,Upper and lower bounds,Botnet,Computer science,Filter (signal processing),Real-time computing,Condition monitoring,Network monitoring,Scalability,Distributed computing | Conference |
ISSN | ISBN | Citations |
1063-6927 E-ISBN : 0-7695-2837-3 | 0-7695-2837-3 | 16 |
PageRank | References | Authors |
0.79 | 22 | 4 |
Name | Order | Citations | PageRank |
|---|---|---|---|
| Ling Huang | 1 | 2496 | 118.80 |
| Minos Garofalakis | 2 | 4904 | 664.22 |
| D. Joseph | 3 | 5463 | 492.96 |
| Nina Taft | 4 | 2109 | 154.92 |