TY - GEN
T1 - Discovering patterns of interest in ip traffic using cliques in bipartite link streams
AU - Viard, Tiphaine
AU - Fournier-S’niehotta, Raphaël
AU - Magnien, Clémence
AU - Latapy, Matthieu
N1 - Publisher Copyright:
© Springer International Publishing AG 2018.
PY - 2018/1/1
Y1 - 2018/1/1
N2 - Studying IP traffic is crucial for many applications. We focus here on the detection of (structurally and temporally) dense sequences of interactions that may indicate botnets or coordinated network scans. More precisely, we model a MAWI capture of IP traffic as a link streams, i.e., a sequence of interactions (t1, t2, u, v) meaning that devices u and v exchanged packets from time t1 to time t2 . This traffic is captured on a single router and so has a bipartite structure: Links occur only between nodes in two disjoint sets. We design a method for finding interesting bipartite cliques in such link streams, i.e., two sets of nodes and a time interval such that all nodes in the first set are linked to all nodes in the second set throughout the time interval. We then explore the bipartite cliques present in the considered trace. Comparison with the MAWILab classification of anomalous IP addresses shows that the found cliques succeed in detecting anomalous network activity.
AB - Studying IP traffic is crucial for many applications. We focus here on the detection of (structurally and temporally) dense sequences of interactions that may indicate botnets or coordinated network scans. More precisely, we model a MAWI capture of IP traffic as a link streams, i.e., a sequence of interactions (t1, t2, u, v) meaning that devices u and v exchanged packets from time t1 to time t2 . This traffic is captured on a single router and so has a bipartite structure: Links occur only between nodes in two disjoint sets. We design a method for finding interesting bipartite cliques in such link streams, i.e., two sets of nodes and a time interval such that all nodes in the first set are linked to all nodes in the second set throughout the time interval. We then explore the bipartite cliques present in the considered trace. Comparison with the MAWILab classification of anomalous IP addresses shows that the found cliques succeed in detecting anomalous network activity.
UR - https://www.scopus.com/pages/publications/85054342702
U2 - 10.1007/978-3-319-73198-8_20
DO - 10.1007/978-3-319-73198-8_20
M3 - Conference contribution
AN - SCOPUS:85054342702
SN - 9783319731971
T3 - Springer Proceedings in Complexity
SP - 233
EP - 241
BT - Springer Proceedings in Complexity
A2 - Cornelius, Sean
A2 - Coronges, Kate
A2 - Goncalves, Bruno
A2 - Sinatra, Roberta
A2 - Vespignani, Alessandro
PB - Springer Science and Business Media B.V.
T2 - 9th International Conference on Complex Networks, CompleNet 2018
Y2 - 5 March 2018 through 8 March 2018
ER -