Internet Traffic Behavior Profiling for Network Security Monitoring

Kuai Xu; Zhi Li Zhang; Supratik Bhattacharyya

doi:10.1109/TNET.2007.911438

Internet Traffic Behavior Profiling for Network Security Monitoring

Kuai Xu, Zhi Li Zhang, Supratik Bhattacharyya

Computer Science and Engineering

Research output: Contribution to journal › Article › peer-review

88 Scopus citations

Abstract

Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and entropy-based techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet.

Original language	English (US)
Pages (from-to)	1241-1252
Number of pages	12
Journal	IEEE/ACM Transactions on Networking
Volume	16
Issue number	6
DOIs	https://doi.org/10.1109/TNET.2007.911438
State	Published - Dec 2008

Bibliographical note

Funding Information:
Manuscript received March 25, 2006; revised March 31, 2007 and July 29, 2007. First published February 22, 2008; current version published December 17, 2008. Approved by IEEE/ACM TRANSACTIONS ON NETWORKING Editor D. Veitch. This work was supported in part by the National Science Foundation (NSF) under Grants CNS-0435444 and CNS-0626812, in part by a University of Minnesota Digital Technology Center DTI grant, and in part by a Sprint ATL gift grant.

Keywords

Anomaly behavior
monitoring
traffic profiling

Access

10.1109/TNET.2007.911438

OpenUrl availability

Full text

Cite this

@article{2077dcaa330f48ed9e65fb64548218fe,

title = "Internet Traffic Behavior Profiling for Network Security Monitoring",

abstract = "Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and entropy-based techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet.",

keywords = "Anomaly behavior, monitoring, traffic profiling",

author = "Kuai Xu and Zhang, {Zhi Li} and Supratik Bhattacharyya",

note = "Funding Information: Manuscript received March 25, 2006; revised March 31, 2007 and July 29, 2007. First published February 22, 2008; current version published December 17, 2008. Approved by IEEE/ACM TRANSACTIONS ON NETWORKING Editor D. Veitch. This work was supported in part by the National Science Foundation (NSF) under Grants CNS-0435444 and CNS-0626812, in part by a University of Minnesota Digital Technology Center DTI grant, and in part by a Sprint ATL gift grant.",

year = "2008",

month = dec,

doi = "10.1109/TNET.2007.911438",

language = "English (US)",

volume = "16",

pages = "1241--1252",

journal = "IEEE/ACM Transactions on Networking",

issn = "1063-6692",

publisher = "Institute of Electrical and Electronics Engineers Inc.",

number = "6",

}

TY - JOUR

T1 - Internet Traffic Behavior Profiling for Network Security Monitoring

AU - Xu, Kuai

AU - Zhang, Zhi Li

AU - Bhattacharyya, Supratik

N1 - Funding Information: Manuscript received March 25, 2006; revised March 31, 2007 and July 29, 2007. First published February 22, 2008; current version published December 17, 2008. Approved by IEEE/ACM TRANSACTIONS ON NETWORKING Editor D. Veitch. This work was supported in part by the National Science Foundation (NSF) under Grants CNS-0435444 and CNS-0626812, in part by a University of Minnesota Digital Technology Center DTI grant, and in part by a Sprint ATL gift grant.

PY - 2008/12

Y1 - 2008/12

N2 - Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and entropy-based techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet.

AB - Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and entropy-based techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet.

KW - Anomaly behavior

KW - monitoring

KW - traffic profiling

UR - http://www.scopus.com/inward/record.url?scp=85008008496&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85008008496&partnerID=8YFLogxK

U2 - 10.1109/TNET.2007.911438

DO - 10.1109/TNET.2007.911438

M3 - Article

AN - SCOPUS:85008008496

SN - 1063-6692

VL - 16

SP - 1241

EP - 1252

JO - IEEE/ACM Transactions on Networking

JF - IEEE/ACM Transactions on Networking

IS - 6

ER -

Internet Traffic Behavior Profiling for Network Security Monitoring

Abstract

Bibliographical note

Keywords

Access

OpenUrl availability

Other files and links

Fingerprint

Cite this