Non-Gaussian and Long Memory Statistical Characterisations for Internet Traffic with Anomalies

Antoine Scherrer 1 Nicolas Larrieu 2 Philippe Owezarski 2 Pierre Borgnat 1 Patrice Abry 1
1 Phys-ENS - Laboratoire de Physique de l'ENS Lyon
2 LAAS - Laboratoire d'analyse et d'architecture des systèmes
Abstract : The goals of the present contribution are twofold. First, we propose the use of a non-Gaussian long-range dependent process to model Internet traffic aggregated time series. We give the definitions and intuition behind the use of this model. We detail numerical procedures that can be used to synthesize artificial traffic exactly following the model prescription. We also propose original and practically effective procedures to estimate the corresponding parameters from empirical data. We show that this empirical model relevantly describes a large variety of Internet traffic, including both regular traffic obtained from public reference repositories and traffic containing legitimate (flash crowd) or illegitimate (DDoS attack) anomalies. We observe that the proposed model accurately fits the data for a wide range of aggregation levels. The model provides us with a meaningful multiresolution (i.e., aggregation level dependent) statistics to characterize the traffic: the evolution of the estimated parameters with respect to the aggregation level. It opens the track to the second goal of the paper: anomaly detection. We propose the use of a quadratic distance computed on these statistics to detect the occurrences of DDoS attack and study the statistical performance of these detection procedures. Traffic with anomalies was produced and collected by us so as to create a controlled and reproducible database, allowing for a relevant assessment of the statistical performance of the proposed (modeling and detection) procedures.
Keywords : Internet traffic Statistical Signal Processing Traffic statistical modeling DoS attack flash crowd non-Gaussian long-range dependent process
Document type :
Journal articles
Complete list of metadatas

Cited literature [53 references]  Display  Hide  Download
https://hal-ens-lyon.archives-ouvertes.fr/ensl-00175477
Contributor : Pierre Borgnat <>
Submitted on : Friday, September 28, 2007 - 12:34:08 PM
Last modification on : Tuesday, November 19, 2019 - 2:37:52 AM
Long-term archiving on : Friday, April 9, 2010 - 3:04:12 AM

File

TDSC-0109-0805-1.pdf
Publisher files allowed on an open archive

Identifiers

  • HAL Id : ensl-00175477, version 1

Collections

CNRS | ENS-LYON | LAAS-RESEAUX-ET-COMMUNICATIONS | LAAS-SARA | LAAS | INSA-TOULOUSE | UNIV-LYON1 | INSA-GROUPE | UNIV-TLSE3 | UT1-CAPITOLE | UNIV-TLSE2

Citation

Antoine Scherrer, Nicolas Larrieu, Philippe Owezarski, Pierre Borgnat, Patrice Abry. Non-Gaussian and Long Memory Statistical Characterisations for Internet Traffic with Anomalies. IEEE Transactions on Dependable and Secure Computing, Institute of Electrical and Electronics Engineers, 2007, 4 (1), pp.56-70. ⟨ensl-00175477⟩

Export

BibTeX TEI DC DCterms EndNote

Share

Metrics

Record views

217

Files downloads

405

Contact

CCSD