Low-rate, flow-level periodicity detection
Abstract
As desktops and servers become more complicated, they employ an increasing amount of automatic, non-user initiated communication. Such communication can be good (OS updates, RSS feed readers, and mail polling), bad (keyloggers, spyware, and botnet command-and-control), or ugly (adware or unauthorized peer-to-peer applications). Communication in these applications is often regular, but with very long periods, ranging from minutes to hours. This infrequent communication and the complexity of today's systems makes these applications difficult for users to detect and diagnose. In this paper we present a new approach to identify low-rate periodic network traffic and changes in such regular communication. We employ signal-processing techniques, using discrete wavelets implemented as a fully decomposed, iterated filter bank. This approach not only detects low-rate periodicities, but also identifies approximate times when traffic changed. We implement a self-surveillance application that externally identifies changes to a user's machine, such as interruption of periodic software updates, or an installation of a keylogger. © 2011 IEEE.
Publication Title
2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011
Recommended Citation
Bartlett, G., Heidemann, J., & Papadopoulos, C. (2011). Low-rate, flow-level periodicity detection. 2011 IEEE Conference on Computer Communications Workshops, INFOCOM WKSHPS 2011, 804-809. https://doi.org/10.1109/INFCOMW.2011.5928922
