The DOI matches its Crossref record; 17 of the 17 references it cites were found in a registry or an index.
A signal analysis of network traffic anomalies
Abstract
Identifying anomalies rapidly and accurately is critical to the efficient operation of large computer networks. Accurately characterizing important classes of anomalies greatly facilitates their identification; however, the subtleties and complexities of anomalous traffic can easily confound this process. In this paper we report results of signal analysis of four classes of network traffic anomalies: outages, flash crowds, attacks and measurement failures. Data for this study consists of IP flow and SNMP measurements collected over a six month period at the border router of a large university. Our results show that wavelet filters are quite effective at exposing the details of both ambient and anomalous traffic. Specifically, we show that a pseudo-spline filter tuned at specific aggregation levels will expose distinct characteristics of each class of anomaly. We show that an effective way of exposing anomalies is via the detection of a sharp increase in the local variance of the filtered data. We evaluate traffic anomaly signals at different points within a network based on topological distance from the anomaly source or destination. We show that anomalies can be exposed effectively even when aggregated with a large amount of additional traffic. We also compare the difference between the same traffic anomaly signals as seen in SNMP and IP flow data, and show that the more coarse-grained SNMP data can also be used to expose anomalies effectively.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Introduction to Time Series and Forecasting
(2002) · Springer Texts in Statistics · doi:10.1007/b97391 · Cited by 3,807
Bro: a system for detecting network intruders in real-time
Paxson, V. (1999) · Computer Networks · doi:10.1016/s1389-1286(99)00112-7 · Cited by 2,636
Willinger, W., Taqqu, M. S., Sherman, R., & Wilson, D. V. (1997) · IEEE/ACM Transactions on Networking · doi:10.1109/90.554723 · Cited by 1,654
Wavelet analysis of long-range-dependent traffic
Abry, P., & Veitch, D. (1998) · IEEE Transactions on Information Theory · doi:10.1109/18.650984 · Cited by 956
Inferring Internet Denial-of-Service Activity
Moore, D., Voelker, G. M., & Savage, S. (2001) · doi:10.21236/ada400003 · Cited by 863
Framelets: MRA-based constructions of wavelet frames
Daubechies, I., Han, B., Ron, A., & Shen, Z. (2003) · Applied and Computational Harmonic Analysis · doi:10.1016/s1063-5203(02)00511-0 · Cited by 752
Self-citationControlling high bandwidth aggregates in the network
Mahajan, R., Bellovin, S. M., Floyd, S., Ioannidis, J., Paxson, V., & Shenker, S. (2002) · ACM SIGCOMM Computer Communication Review · doi:10.1145/571697.571724 · Cited by 742
Flash crowds and denial of service attacks
Jung, J., Krishnamurthy, B., & Rabinovich, M. (2002) · International World Wide Web Conference (WWW) · doi:10.1145/511446.511485 · Cited by 638
Measurements and analysis of end-to-end Internet dynamics
Paxson, V. (1997) · doi:10.2172/551971 · Cited by 572
Aberrant Behavior Detection in Time Series for Network Monitoring
Brutlag, J. D. (2000) · USENIX Large Installation Systems Administration Conference · Cited by 296
Cited by
Roughan, M., Sen, S., Spatscheck, O., & Duffield, N. (2004) · Proceedings of the 4th ACM SIGCOMM conference on Internet measurement · doi:10.1145/1028788.1028805 · Cited by 494
Structural analysis of network traffic flows
Lakhina, A., Papagiannaki, K., Crovella, M., Diot, C., Kolaczyk, E. D., & Taft, N. (2004) · Proceedings of the joint international conference on Measurement and modeling of computer systems · doi:10.1145/1005686.1005697 · Cited by 451
A comprehensive survey on network anomaly detection
Fernandes, G., Rodrigues, J. J. P. C., Carvalho, L. F., Al-Muhtadi, J. F., & Proença, M. L. (2019) · Telecommunication Systems · doi:10.1007/s11235-018-0475-8 · Cited by 382
Sensitivity of PCA for traffic anomaly detection
Ringberg, H., Soule, A., Rexford, J., & Diot, C. (2007) · Proceedings of the 2007 ACM SIGMETRICS international conference on Measurement and modeling of computer systems · doi:10.1145/1254882.1254895 · Cited by 353
Detecting anomalies in network traffic using maximum entropy estimation
Gu, Y., McCallum, A., & Towsley, D. (2005) · Internet Measurement Conference · doi:10.5555/1251086.1251118 · Cited by 305
Metadata
- Authors
- Barford, P., Kline, J., Plonka, D., & Ron, A.
- Venue
- Proceedings of the second ACM SIGCOMM Workshop on Internet measurment - IMW '02
- Publisher
- ACM Press
- Published
- 2002
- Pages
- 71
- OpenAlex
- W2121511513
- Cited by
- 787
- References
- 17
- Type
- conference abstract
- Language
- en
- Open access
- closed
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
How to cite
Cite CoChat for the checks on this page, and the paper for its own findings.
- This page
- CoChat. (2026). Citation check: A signal analysis of network traffic anomalies. https://app.cochat.ai/papers/10.1145/637201.637210
- The paper
- Barford, P., Kline, J., Plonka, D., & Ron, A. (2002). A signal analysis of network traffic anomalies. Proceedings of the second ACM SIGCOMM Workshop on Internet measurment - IMW '02. https://doi.org/10.1145/637201.637210
Data sources
Bibliographic data: Semantic Scholar, OpenAlex, Crossref.
Contains information from the Semantic Scholar Academic Graph Datasets, made available under the ODC Attribution License (ODC-BY 1.0).
Semantic Scholar’s data is described in: Kinney, R., et al. (2023). The Semantic Scholar Open Data Platform. arXiv:2301.10140.
