Low-Rate, Flow-Level Periodicity Detection
Genevieve Bartlett, John Heidemann, and Christos PapadopoulosUSC/Information Sciences Institute
Abstract
As desktops and servers become more complicated, they employ an increasing amount of automatic, non-user initiated communication. Such communication can be good (OS updates, RSS feed readers, and mail polling), bad (keyloggers, spyware, and botnet command-and-control), or ugly (adware or unauthorized peer-to-peer applications). Communication in these applications is often regular, but with very long periods, ranging from minutes to hours. This infrequent communication and the complexity of today's systems makes these applications difficult for users to detect and diagnose. In this paper we present a new approach to identify low-rate periodic network traffic and changes in such regular communication. We employ signal-processing techniques, using discrete wavelets implemented as a fully decomposed, iterated filter bank. This approach not only detects low-rate periodicities, but also identifies approximate times when traffic changed. We implement a self-surveillance application that externally identifies changes to a user's machine, such as interruption of periodic software updates, or an installation of a keylogger.Availability
This paper is available in several formats: abstract web page with pointers and cites, PDF, paper copies can be obtained by mail to the authors. Copyright terms for this paper appear below.
Reference
- Bartlett11a
- Genevieve Bartlett, John Heidemann, and Christos Papadopoulos. Low-Rate, Flow-Level Periodicity Detection. In Proceedings of the 14th IEEE Global Internet Symposium, p. to appear. Shanghai, China, IEEE. April, 2011. <doi:xxx>, <http://www.isi.edu/~johnh/PAPERS/Bartlett11a.html>.
@inproceedings{Bartlett11a,
author = "Genevieve Bartlett and John Heidemann and Christos Papadopoulos",
title = "Low-Rate, Flow-Level Periodicity Detection",
booktitle = "Proceedings of the 14th {IEEE} Global Internet Symposium",
year = "2011",
pages = "to appear",
address = "Shanghai, China",
month = "April",
publisher = "{IEEE}",
myorganization = "USC/Information Sciences Institute",
copyrightholder = "{IEEE}",
keywords = "low-rate periodic detection, wavelet, traffic",
url = "http://www.isi.edu/~johnh/PAPERS/Bartlett11a.html",
pdfurl = "http://www.isi.edu/~johnh/PAPERS/Bartlett11a.pdf",
doi = "xxx",
}