HAL : hal-00420862, version 2

arXiv : 0909.5524

DOI : 10.1007/s11222-011-9240-5

Fiche détaillée

Récupérer au format BibTeX - EndNote - TEI - RefWorks -

Statistics and Computing (2011) 1-12

Versions disponibles :

v1 (30-09-2009)

v2 (20-09-2011)

Distributed detection/localization of change-points in high-dimensional network traffic data

Alexandre Lung-Yut-Fong 1, Céline Lévy-Leduc 1, Olivier Cappé 1

(2011)

We propose a novel approach for distributed statistical detection of change-points in high-volume network traffic. We consider more specifically the task of detecting and identifying the targets of Distributed Denial of Service (DDoS) attacks. The proposed algorithm, called DTopRank, performs distributed network anomaly detection by aggregating the partial information gathered in a set of network monitors. In order to address massive data while limiting the communication overhead within the network, the approach combines record filtering at the monitor level and a nonparametric rank test for doubly censored time series at the central decision site. The performance of the DTopRank algorithm is illustrated both on synthetic data as well as from a traffic trace provided by a major Internet service provider.

1 :	Laboratoire traitement et communication de l'information (LTCI)
	CNRS : UMR5141 – Institut Télécom – Télécom ParisTech

Domaine

:

Mathématiques/Statistiques Statistiques/Théorie Informatique/Réseaux et télécommunications Statistiques/Applications

Mots Clés : Distributed detection – change-point detection – rank tests – censored data – network anomaly detection – high-dimensional data

hal-00420862, version 2

http://hal.archives-ouvertes.fr/hal-00420862

oai:hal.archives-ouvertes.fr:hal-00420862

Contributeur : Alexandre Lung-Yut-Fong <>

Soumis le : Mardi 20 Septembre 2011, 15:41:50

Dernière modification le : Mardi 20 Septembre 2011, 18:58:23