Measuring the Histogram Feature Vector for Anomaly Network Traffic

Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 3802)


Recent works have shown that Internet traffics are self- similar over several time scales from microseconds to minutes. On the other hand, the dramatic expansion of Internet applications give rise to a fundamental challenge to the network security. This paper presents a statistical analysis of the Internet traffic Histogram Feature Vector, which can be applied to detect the traffic anomalies. Besides, the Variant Packet Sending-interval Link Padding based on heavy-tail distribution is proposed to defend the traffic analysis attacks in the low or medium speed anonymity system.


Pareto Distribution Link Group Constant Length Tail Index Heavy Tail Distribution 
These keywords were added by machine and not by the authors. This process is experimental and the keywords may be updated as the learning algorithm improves.


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Paxson, V., Floyd, S.: Wide-area traffic: the failure of Poisson modeling. In: Proceedings of ACM Sigcomm, pp. 257–268 (1994)Google Scholar
  2. 2.
    Park, K., Willinger, W.: Self-similar network traffic and performance evaluation, pp. 17–19. John Wiley & Sons Inc., Chichester (2000)CrossRefGoogle Scholar
  3. 3.
    Mark, E., Bestavroe, A.: Explaining World Wide Web Traffic Self-Similarity. Technical Report TR-95-015 (1995)Google Scholar
  4. 4.
    Sturges, H.: The choice of a class-interval. The American Statistical Association 21, 65–66 (1926)Google Scholar
  5. 5.
  6. 6.
    Doane, D.: Aesthetic frequency classification. American Statistician 30, 181–183 (1976)CrossRefGoogle Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2005

Authors and Affiliations

  • Wei Yan
    • 1
  1. 1.McAfee Inc 

Personalised recommendations