Detection and mitigation of abnormal traffic behaviour in autonomic networked environments

ABSTRACT

Autonomic network environments are required to be resilient. Resilience is defined as the ability for a network to provide and maintain an acceptable level of service in the face of various challenges to normal operation [1]. Traffic abnormalities are a great challenge and it is vital for any network to be supported by resilient mechanisms in order to detect and mitigate such events. In this document we present our measurement-based resilience architecture and we argue that the correct combination of already proposed theoretical methodologies and mechanisms present in our architecture compose a powerful defence mechanism that satisfies autonomic properties such as self-protection and self-optimization. In addition we refer to our intentions of testing our proposed architecture within the ANA project [2] in order to justify our hypothesis.

REFERENCES

• 1: Hutchison, D., Sterbenz, J. P. G, Jabbar, A. Sholler, M., 2006 D3.2: Resilience/Security Framework, Deliverable D3.2 ANA December 2006
• 2: ANA project: http://www.ana-project.org
• 3: Anukool Lakhina , Mark Crovella , Christophe Diot, Mining anomalies using traffic feature distributions, Proceedings of the 2005 conference on Applications, technologies, architectures, and protocols for computer communications, August 22-26, 2005, Philadelphia, Pennsylvania, USA
• 4: Zuev, D., Moore, W., A., 2005 Traffic Classification using a Statistical Approach, Intel Research Paper, 2005

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

General Terms:
Performance, Security

Keywords:
anomaly classification, anomaly detection, autonomic networks, resilience