• Documents
  • Authors
  • Tables
  • Other Seers ▼
    RefSeer AckSeer CollabSeer SeerSeer
  • Log in
  • Sign up
  • MetaCart

CiteSeerX logo

Advanced Search Include Citations
Advanced Search Include Citations | Disambiguate

Network anomography (2005)

Cached

  • Download as a PDF

Download Links

  • [www.cs.utexas.edu]
  • [www.cs.utexas.edu]
  • [www.imconf.net]
  • [www.cs.utexas.edu]
  • [www.cs.utexas.edu]
  • [www.cs.utexas.edu]
  • [www.maths.adelaide.edu.au]
  • [internal.maths.adelaide.edu.au]

  • Other Repositories/Bibliography

  • DBLP
  • Save to List
  • Add to Collection
  • Correct Errors
  • Monitor Changes
by Yin Zhang , Zihui Ge , Albert Greenberg , Matthew Roughan
Venue:In IMC
Citations:49 - 10 self
  • Summary
  • Active Bibliography
  • Co-citation
  • Clustered Documents
  • Version History

BibTeX

@INPROCEEDINGS{Zhang05networkanomography,
    author = {Yin Zhang and Zihui Ge and Albert Greenberg and Matthew Roughan},
    title = {Network anomography},
    booktitle = {In IMC},
    year = {2005}
}

Years of Citing Articles

Bookmark

citeulike Connotea Bibsonomy Del.icio.us Digg Reddit

OpenURL

 

Abstract

Anomaly detection is a first and important step needed to respond to unexpected problems and to assure high performance and security in IP networks. We introduce a framework and a powerful class of algorithms for network anomography, the problem of inferring network-level anomalies from widely available data aggregates. The framework contains novel algorithms, as well as a recently published approach based on Principal Component Analysis (PCA). Moreover, owing to its clear separation of inference and anomaly detection, the framework opens the door to the creation of whole families of new algorithms. We introduce several such algorithms here, based on ARIMA modeling, the Fourier transform, Wavelets, and Principal Component Analysis. We introduce a new dynamic anomography algorithm, which effectively tracks routing and traffic change, so as to alert with high fidelity on intrinsic changes in network-level traffic, yet not on internal routing changes. An additional benefit of dynamic anomography is that it is robust to missing data, an important operational reality. To the best of our knowledge, this is the first anomography algorithm that can handle routing changes and missing data. To evaluate these algorithms, we used several months of traffic data collected from the Abilene network and from a large Tier-1 ISP network. To compare performance, we use the methodology put forward earlier for the Abilene data set. The findings are encouraging. Among the new algorithms introduced here, we see: high accuracy in detection (few false negatives and few false positives), and high robustness (little performance degradation in the presence of measurement noise, missing data and routing changes). 1.

Citations

1468 A Wavelet Tour of Signal Processing - Mallat - 1999
1317 Biorthogonal bases of compactly supported wavelets - 8Cohen, Daubechies, et al. - 1990
228 Deriving traffic demands for operational ip networks: Methodology and experience - Feldmann, Greenberg, et al.
192 Orthogonal matching pursuit: recursive function approximation with applications to wavelet decomposition - Pati, Rezaiifar, et al. - 1993
185 A signal analysis of network traffic anomalies - Barford, Kline, et al. - 2002
184 Diagnosing network-wide traffic anomalies - Lakhina, Crovella, et al.
170 Network tomography: Estimating source-destination traffic intensities from link data - Vardi - 1996
141 Traffic matrix estimation: existing techniques and new directions - Medina, Taft, et al. - 2002
119 Fast accurate computation of large-scale IP traffic matrices from link loads - Zhang, Roughan, et al. - 2003
117 Netscope: Traffic engineering for ip networks - Feldmann, Greenberg, et al. - 2000
97 An informationtheoretic approach to traffic matrix estimation - Zhang, Roughan, et al. - 2003
95 Sketch-based change detection: Methods, evaluation, and applications - Krishnamurthy, Sen, et al.
88 Structural analysis of network traffic flows - Lakhina, Papagiannaki, et al. - 2004
83 Schemes for fault identification in communication networks - Katzela, Schwartz - 1995
67 Bayesian inference on network traffic using link count data (with discussion - Tebaldi, West - 1998
52 Proactive network fault detection - Hood, Ji - 1997
52 Characterization of network-wide anomalies in traffic flows - Lakhina, Crovella, et al.
49 Time-varying network tomography - Cao, Davis, et al. - 2000
38 For most large underdetermined systems of equations, the minimal l1-norm near-solution approximates the sparsest near-solution - Donoho
31 Traffic matrix estimation on a large ip backbone– a comparison on real data - Gunnar, Johansson, et al. - 2004
31 A case study of OSPF behavior in a large enterprise network - Shaikh, Isett, et al.
29 Traffic Matrix Reloaded: Impact of Routing Changes - Teixeira, Duffield, et al. - 2005
22 Internet service performance failure detection. Performance Evaluation Review - Ward, Glynn, et al. - 1998
19 Proactive anomaly detection using distributed intelligent agents - THOTTAN, JI - 1998
14 Forwarding Anomalies and Improving their Detection Using Multiple Data Sources - Roughan, Griffin, et al. - 2004
11 Introduction to Time Series and Forecasting. Springer Texts in Statistics - BROCKWELL, DAVIS - 1996
7 Aberrant behavior detection and control in time series for network monitoring - BRUTAG - 2000
5 Design of IGP link weights for estimation of traffic matrices - Nucci, Cruz, et al. - 2004
4 Falcon: Fault management via alarm warehousing and mining - Grossglauser, Koudas, et al. - 2001
1 Lectures on Wavelets, volume 41 - Ten - 1992
1 Amara’s wavelet page - Graps - 2004
1 online document. Equations for the smoothing models - SAS - 2004
1 Network anomography. UT-Austin - Zhang, Ge, et al.
The National Science Foundation
  • About CiteSeerX
  • Submit Documents
  • Privacy Policy
  • Help
  • Data
  • Source
  • Contact Us

Developed at and hosted by The College of Information Sciences and Technology

© 2007-2010 The Pennsylvania State University