Low-Rate, Flow-Level Periodicity Detection. Bartlett, G., Heidemann, J., & Papadopoulos, C. In Proceedings of the 14thIEEE Global Internet Symposium, pages 804–809, Shanghai, China, April, 2011. IEEE. ![Low-Rate, Flow-Level Periodicity Detection [link]](https://bibbase.org/img/filetypes/link.svg "link")
Paper doi abstract bibtex As desktops and servers become more complicated, they employ an increasing amount of automatic, non-user initiated communication. Such communication can be good (OS updates, RSS feed readers, and mail polling), bad (keyloggers, spyware, and botnet command-and-control), or ugly (adware or unauthorized peer-to-peer applications). Communication in these applications is often regular, but with very long periods, ranging from minutes to hours. This infrequent communication and the complexity of today's systems makes these applications difficult for users to detect and diagnose. In this paper we present a new approach to identify low-rate periodic network traffic and changes in such regular communication. We employ signal-processing techniques, using discrete wavelets implemented as a fully decomposed, iterated filter bank. This approach not only detects low-rate periodicities, but also identifies approximate times when traffic changed. We implement a self-surveillance application that externally identifies changes to a user's machine, such as interruption of periodic software updates, or an installation of a keylogger.
@InProceedings{Bartlett11a,
author = "Genevieve Bartlett and John Heidemann and Christos Papadopoulos",
title = "Low-Rate, Flow-Level Periodicity Detection",
booktitle = "Proceedings of the " # "14th" # " IEEE Global Internet Symposium",
year = 2011,
sortdate = "2011-04-01",
pages = "804--809",
address = "Shanghai, China",
month = apr,
publisher = "IEEE",
jlocation = "johnh: pafile",
myorganization = "USC/Information Sciences Institute",
copyrightholder = "IEEE",
copyrightterms = " Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. ",
keywords = "low-rate periodic detection, wavelet, traffic",
project = "ant, lacrend, lander",
jsubject = "spectral_network",
jlocation = "johnh: pafile",
url = "https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.html",
pdfurl = "https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.pdf",
doi = "http://dx.doi.org/10.1109/INFCOMW.2011.5928922",
abstract = "
As desktops and servers become more complicated, they employ an
increasing amount of automatic, non-user initiated communication. Such
communication can be good (OS updates, RSS feed readers, and mail
polling), bad (keyloggers, spyware, and botnet command-and-control),
or ugly (adware or unauthorized peer-to-peer
applications). Communication in these applications is often regular,
but with very long periods, ranging from minutes to hours. This
infrequent communication and the complexity of today's systems makes
these applications difficult for users to detect and diagnose. In this
paper we present a new approach to identify low-rate periodic network
traffic and changes in such regular communication. We employ
signal-processing techniques, using discrete wavelets implemented as a
fully decomposed, iterated filter bank. This approach not only detects
low-rate periodicities, but also identifies approximate times when
traffic changed. We implement a self-surveillance application that
externally identifies changes to a user's machine, such as
interruption of periodic software updates, or an installation of a
keylogger.
"
}
Downloads: 0
{"_id":"TmP7anRHYmRWwG6YK","bibbaseid":"bartlett-heidemann-papadopoulos-lowrateflowlevelperiodicitydetection-2011","author_short":["Bartlett, G.","Heidemann, J.","Papadopoulos, C."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Genevieve"],"propositions":[],"lastnames":["Bartlett"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]},{"firstnames":["Christos"],"propositions":[],"lastnames":["Papadopoulos"],"suffixes":[]}],"title":"Low-Rate, Flow-Level Periodicity Detection","booktitle":"Proceedings of the 14thIEEE Global Internet Symposium","year":"2011","sortdate":"2011-04-01","pages":"804–809","address":"Shanghai, China","month":"April","publisher":"IEEE","jlocation":"johnh: pafile","myorganization":"USC/Information Sciences Institute","copyrightholder":"IEEE","copyrightterms":"Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. ","keywords":"low-rate periodic detection, wavelet, traffic","project":"ant, lacrend, lander","jsubject":"spectral_network","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.pdf","doi":"http://dx.doi.org/10.1109/INFCOMW.2011.5928922","abstract":"As desktops and servers become more complicated, they employ an increasing amount of automatic, non-user initiated communication. Such communication can be good (OS updates, RSS feed readers, and mail polling), bad (keyloggers, spyware, and botnet command-and-control), or ugly (adware or unauthorized peer-to-peer applications). Communication in these applications is often regular, but with very long periods, ranging from minutes to hours. This infrequent communication and the complexity of today's systems makes these applications difficult for users to detect and diagnose. In this paper we present a new approach to identify low-rate periodic network traffic and changes in such regular communication. We employ signal-processing techniques, using discrete wavelets implemented as a fully decomposed, iterated filter bank. This approach not only detects low-rate periodicities, but also identifies approximate times when traffic changed. We implement a self-surveillance application that externally identifies changes to a user's machine, such as interruption of periodic software updates, or an installation of a keylogger. ","bibtex":"@InProceedings{Bartlett11a,\n\t author = \"Genevieve Bartlett and John Heidemann and Christos Papadopoulos\",\n\t title = \"Low-Rate, Flow-Level Periodicity Detection\",\n\tbooktitle = \t\"Proceedings of the \" # \"14th\" # \" IEEE Global Internet Symposium\",\n\tyear = \t\t2011,\n\tsortdate = \t\t\"2011-04-01\",\n\tpages = \t\"804--809\",\n\taddress = \t\"Shanghai, China\",\n\tmonth = \tapr,\n\tpublisher = \t\"IEEE\",\n\tjlocation = \t\"johnh: pafile\",\n\t myorganization =\t\"USC/Information Sciences Institute\",\n\t copyrightholder = \"IEEE\",\n\t copyrightterms = \"\tPersonal use of this material is permitted. Permission from IEEE must \tbe obtained for all other uses, in any current or future media, \tincluding reprinting/republishing this material for advertising or \tpromotional purposes, creating new collective works, for resale or \tredistribution to servers or lists, or reuse of any copyrighted \tcomponent of this work in other works. \",\n\t keywords =\t\"low-rate periodic detection, wavelet, traffic\",\n\tproject = \"ant, lacrend, lander\",\n\tjsubject = \"spectral_network\",\n\t jlocation =\t\"johnh: pafile\",\n\t url =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.html\",\n\t pdfurl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.pdf\",\n\tdoi = \t\"http://dx.doi.org/10.1109/INFCOMW.2011.5928922\",\n\tabstract = \"\nAs desktops and servers become more complicated, they employ an\nincreasing amount of automatic, non-user initiated communication. Such\ncommunication can be good (OS updates, RSS feed readers, and mail\npolling), bad (keyloggers, spyware, and botnet command-and-control),\nor ugly (adware or unauthorized peer-to-peer\napplications). Communication in these applications is often regular,\nbut with very long periods, ranging from minutes to hours. This\ninfrequent communication and the complexity of today's systems makes\nthese applications difficult for users to detect and diagnose. In this\npaper we present a new approach to identify low-rate periodic network\ntraffic and changes in such regular communication. We employ\nsignal-processing techniques, using discrete wavelets implemented as a\nfully decomposed, iterated filter bank. This approach not only detects\nlow-rate periodicities, but also identifies approximate times when\ntraffic changed. We implement a self-surveillance application that\nexternally identifies changes to a user's machine, such as\ninterruption of periodic software updates, or an installation of a\nkeylogger.\n\"\n}\n\n","author_short":["Bartlett, G.","Heidemann, J.","Papadopoulos, C."],"bibbaseid":"bartlett-heidemann-papadopoulos-lowrateflowlevelperiodicitydetection-2011","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Bartlett11a.html"},"keyword":["low-rate periodic detection","wavelet","traffic"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["DTXTQhi8vCYSmtrPK","YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["low-rate periodic detection","wavelet","traffic"],"search_terms":["low","rate","flow","level","periodicity","detection","bartlett","heidemann","papadopoulos"],"title":"Low-Rate, Flow-Level Periodicity Detection","year":2011}