Sciweavers

Share
GLOBECOM
2008
IEEE

Correlation Among Piecewise Unwanted Traffic Time Series

8 years 2 months ago
Correlation Among Piecewise Unwanted Traffic Time Series
In this paper, we investigate temporal and spatial correlations of time series of unwanted traffic (i.e., darknet or network telescope traffic) in order to estimate statistical behavior of unwanted activities from a small size of darknet address block. First, from the analysis of long-range dependency, we point out that TCP time series has a weak temporal correlation though UDP time series without huge flooding is well-modeled using a Poisson process. Next, we analyze the spatial correlation between two traffic time series divided by different sized darknet address blocks. We confirm that a TCP SYN traffic time series (e.g, virus or worm) has a clear spatial correlation in the arrival of packets between two neighboring address blocks. Indeed, this spatial correlation remains in traffic time series 1,000 addresses far from the target time series, even if a darknet address block is small (e.g., /26). On the other hand, TCP SYNACK traffic (e.g., backscatter) and UDP traffic (e.g., virus o...
Kensuke Fukuda, Toshio Hirotsu, Osamu Akashi, Tosh
Added 08 Dec 2010
Updated 08 Dec 2010
Type Conference
Year 2008
Where GLOBECOM
Authors Kensuke Fukuda, Toshio Hirotsu, Osamu Akashi, Toshiharu Sugawara
Comments (0)
books