Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms

蔡忠闽 1; 2; 秦涛 1; 2

您当前的位置：

首页 >

文章列表页 >

Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms

更新时间：2025-12-08

- Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms
- Vol. 41, Issue 4, Pages: 393-397(2007)
- 作者机构：
  
  1. 西安交通大学智能网络与网络安全教育部重点实验室,西安,710049
  2. 西安交通大学机械制造系统工程国家重点实验室,西安,710049
- 作者简介：
- 基金信息：
- DOI：
  CLC： TP393
- Online First：10 April 2007，
  
  Published：2007
- 稿件说明：
移动端阅览
蔡忠闽 1, 2, 秦涛 1, et al. Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms[J]. 2007, 41(4): 393-397.
DOI：

蔡忠闽 1, 2, 秦涛 1, et al. Stratified Analysis of Network Flows and Its Application to Early Detection of Internet Worms[J]. 2007, 41(4): 393-397. DOI：

摘要

在NetFlow的基础上定义了2种新的网络流:主机层网络流和区域层网络流

并提出了相应的流量特征刻画方法.该定义从主机层和网络层对网络流量进行抽象

实现了底层网络流信息的合并

在不损失关键流量特征的前提下

可大大缩减网络流记录的数量.采用指数加权移动平均控制图模型对所提取的网络流特征进行预测和估计

并结合网络蠕虫的传播特征给出了一种网络蠕虫的早期检测方法.实验结果表明

所提检测方法可以准确地检测到蠕虫在局域网内的早期传播

进而为控制蠕虫传播赢得了宝贵的时间.

Abstract

Based on NetFlow

the definition of two net-flows

Host-Net-Flow and Region-Net-Flow

as well as a depictive method for corresponding network traffic characteristics are proposed. The netflows are abstracted from the host level and network level by the definition. The incorporation of netflow information in bottom level is implemented

and the number of netflow records can significantly be reduced without losing key network traffic characteristics. EWMA(exponential weighted moving average)control chart models are employed to forecast and estimate the distilled network traffic features

then an early net-worm propagation detection method is presented considering the features of network worm propagation. The experimental results show that the early worm propagation in local networks can be detected both quickly and accurately by the proposed method

thereby worm propagation can be controlled as soon as possible.

关键词

Keywords

references

Staniford S, Paxson V, Weaver N. How to own the Internet in your spare time[C]∥Proceedings of the 11th USENIX Security Symposium. Berkeley, USA:USENIX Assoc., 2002:149-167.

Cisco systems Inc. CISCO NetFlow [EB/OL]. [2006-02-11].http:∥www.cisco.com/en/US/products/ps6601/products_ white_ paper09186a00800a3db9. shtml.

Laffy K C, Braun H W, Olyzos G C. A parameterizable methodology for Internet traffic flow profiling [J]. IEEE Journal of Selected Areas in Communications, 1995, 13(8):1481-1494.

Lakhina A, Crovella M, Diot C.Characterization of network-wide anomalies in traffic flows, BUCS-2004-020 [R]. Boston:Boston University, 2004.

Buchholz F, Daniels T E, Early J P, et al. Digging for worms, fishing for answers [C]∥Proceedings of Computer Security Applications Conference. Los Alamitos, USA: IEEE Computer Society, 2002:219-226.

Box G, Lceno A. Statistical control by monitoring and feedback adjustment [M]. New York: John Wiley Sons, 1999:158-263.

Moore D, Keys K, Koga R, et al. The CoralReef software suite as a tool for system and network administrators [EB/OL]. [2005-01-21]. http:∥www. caida. org/tools/measurement/coralreef.

Leland W, Taqqu M, Willinger W, et al. On the self-similar nature of Ethernet traffic(extended version)[J]. IEEE/ACM Transactions on Networking, 1994, 2(1):1-15.

Fiorini P M. On modeling concurrent heavy-tailed network traffic sources and its impact upon QoS [C]∥1999 IEEE International Conference on Communications. Piscataway,USA:IEEE, 1999:716-720.

Views

下载量

CSCD

Alert me when the article has been cited

提交

Tools

Publicity Resources

Detecting Domain Flux Through Patterns of Domain Names' Alphanumeric Characters and Querying Behavior of Hosts

Network Security Assessment Based on Triangular Fuzzy Matrix Game

A New Approach of IP Traceback with Multiple Marking Tags for DoS Attacks

Effects of Steam Addition on the Swirl Combustion and Emission Characteristics of Cracked Ammonia

A Structure-Semantics-Residual Collaborative Image Compression Framework：Towards Privacy Protection and High-Fidelity Reconstruction

Related Author

张永斌

陆寅

张艳宁

高翔

祝跃飞

刘胜利

陈秀真 1

李生红 3

Related Institution

School of Computer Science, Northwestern Polytechnical University

State Key Laboratory of Mathematical Engineering and Advanced Computing, PLA Information Engineering University

State Key Laboratory for Manufacturing Systems Engineering, Xi'an Jiaotong University

School of Information Security Engineering, Shanghai Jiaotong University

⁰