GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN

Taku Wakui; Takao Kondo; Fumio Teraoka

doi:10.1007/978-3-030-45778-5_13

GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN

Taku Wakui, Takao Kondo, Fumio Teraoka

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

2 Citations (Scopus)

Abstract

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS_PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.

Original language	English
Title of host publication	Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers
Editors	Selma Boumerdassi, Éric Renault, Paul Mühlethaler
Publisher	Springer
Pages	196-211
Number of pages	16
ISBN (Print)	9783030457778
DOIs	https://doi.org/10.1007/978-3-030-45778-5_13
Publication status	Published - 2020
Event	2nd International Conference on Machine Learning for Networking, MLN 2019 - Paris, France Duration: 2019 Dec 3 → 2019 Dec 5

Publication series

Name	Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)
Volume	12081 LNCS
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	2nd International Conference on Machine Learning for Networking, MLN 2019
Country/Territory	France
City	Paris
Period	19/12/3 → 19/12/5

Keywords

General-Purpose Anomaly Detection
Internet Backbone
LSTM-RNN
Network Traffic Analysis

ASJC Scopus subject areas

Theoretical Computer Science
Computer Science(all)

Access to Document

10.1007/978-3-030-45778-5_13

Cite this

Wakui, T., Kondo, T., & Teraoka, F. (2020). GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. In S. Boumerdassi, É. Renault, & P. Mühlethaler (Eds.), Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers (pp. 196-211). (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12081 LNCS). Springer. https://doi.org/10.1007/978-3-030-45778-5_13

GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. / Wakui, Taku; Kondo, Takao; Teraoka, Fumio.
Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers. ed. / Selma Boumerdassi; Éric Renault; Paul Mühlethaler. Springer, 2020. p. 196-211 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics); Vol. 12081 LNCS).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution

Wakui, T, Kondo, T & Teraoka, F 2020, GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. in S Boumerdassi, É Renault & P Mühlethaler (eds), Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers. Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), vol. 12081 LNCS, Springer, pp. 196-211, 2nd International Conference on Machine Learning for Networking, MLN 2019, Paris, France, 19/12/3. https://doi.org/10.1007/978-3-030-45778-5_13

Wakui T, Kondo T, Teraoka F. GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. In Boumerdassi S, Renault É, Mühlethaler P, editors, Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers. Springer. 2020. p. 196-211. (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)). doi: 10.1007/978-3-030-45778-5_13

Wakui, Taku ; Kondo, Takao ; Teraoka, Fumio. / GAMPAL : Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN. Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers. editor / Selma Boumerdassi ; Éric Renault ; Paul Mühlethaler. Springer, 2020. pp. 196-211 (Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)).

@inproceedings{584644a694c340d68a94fced240b2337,

title = "GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN",

abstract = "This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS_PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.",

keywords = "General-Purpose Anomaly Detection, Internet Backbone, LSTM-RNN, Network Traffic Analysis",

author = "Taku Wakui and Takao Kondo and Fumio Teraoka",

note = "Publisher Copyright: {\textcopyright} 2020, IFIP International Federation for Information Processing.; 2nd International Conference on Machine Learning for Networking, MLN 2019 ; Conference date: 03-12-2019 Through 05-12-2019",

year = "2020",

doi = "10.1007/978-3-030-45778-5_13",

language = "English",

isbn = "9783030457778",

series = "Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)",

publisher = "Springer",

pages = "196--211",

editor = "Selma Boumerdassi and {\'E}ric Renault and Paul M{\"u}hlethaler",

booktitle = "Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers",

}

TY - GEN

T1 - GAMPAL

T2 - 2nd International Conference on Machine Learning for Networking, MLN 2019

AU - Wakui, Taku

AU - Kondo, Takao

AU - Teraoka, Fumio

PY - 2020

Y1 - 2020

N2 - This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS_PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.

AB - This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS_PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.

KW - General-Purpose Anomaly Detection

KW - Internet Backbone

KW - LSTM-RNN

KW - Network Traffic Analysis

UR - http://www.scopus.com/inward/record.url?scp=85084178615&partnerID=8YFLogxK

UR - http://www.scopus.com/inward/citedby.url?scp=85084178615&partnerID=8YFLogxK

U2 - 10.1007/978-3-030-45778-5_13

DO - 10.1007/978-3-030-45778-5_13

M3 - Conference contribution

AN - SCOPUS:85084178615

SN - 9783030457778

T3 - Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics)

SP - 196

EP - 211

BT - Machine Learning for Networking - 2nd IFIP TC 6 International Conference, MLN 2019, Revised Selected Papers

A2 - Boumerdassi, Selma

A2 - Renault, Éric

A2 - Mühlethaler, Paul

PB - Springer

Y2 - 3 December 2019 through 5 December 2019

ER -

GAMPAL: Anomaly Detection for Internet Backbone Traffic by Flow Prediction with LSTM-RNN

Abstract

Publication series

Conference

Keywords

ASJC Scopus subject areas

Access to Document

Other files and links

Fingerprint

Cite this