1. Impact of Packet Sampling on Anomaly Detection Metrics
Daniela Brauckhoff*, Bernhard Tellenbach*, Arno Wagner*,
Anukool Lakhina **, Martin May*
*ETH Zurich, ** Boston University
IMC '06 Proceedings of the 6th ACM SIGCOMM conference on Internet measurement. New York, NY, USA 2006
Citations: 226
Otto

2. Motivation The general opinion about sampling
Valuable information lost
Needed anyway
Size constraints
Cannot get unsampled netflow from some routers
Interesting questions arise:
How much information is actually lost?
Are all anomalies equally affected by sampling?
Are all detection metrics equally affected by sampling?
At which sampling rate is a certain anomaly still detectable?
Can we estimate the original anomaly size from a sampled view?
Otto

3. Article Goal Dataset Study impact of packet sampling on Blaster worm
Visibility
Anomaly detection metrics
Bytes
Packets
Flows
Traffic Features
Others
Dataset
Unsampled Netflow records
One week capture
Backbone router of a national ISP
Known Blaster outbreak in data
Otto

4. Article Goal Dataset Study impact of packet sampling on Blaster worm
Visibility
Anomaly detection metrics
Bytes
Packets
Flows
Traffic Features
Others
Dataset
Unsampled Netflow records
One week capture
Backbone router of a national ISP
Known Blaster outbreak in data
Otto

5. Entropy as a Detection Metric
Otto

6. Entropy as a Detection Metric
Otto

7. Entropy as a Detection Metric
Otto

8. Used variables
Otto

9. Sampling Metodology
For individual packets in the flow trace, determine
Packet size (bytes)
packet_size = flow_size/num_packets (average packet size)
Timestamps
timestamp randomly chosen within flow bounds
Randomly sample every
10th
100th
250th
1000th
Otto

10. Baseline Metodology One baseline per metric and sampling rate
AD algorithms measure distance
from (predicted) baseline
to (actual) observed metrics
Each AD method uses it’s own algorithm to determine the baseline model
Anomaly is known
Construction of an “ideal baseline”
By removing all blaster packets from the observed trace
destination port: TCP 135
Length: 40, 44, 48 bytes
Otto

11. Baseline Metodology
Otto

12. Sampling
Baseline flow counts
Flow counts
Otto

13. Sampling
Baseline flow dst IP entropy
Flow dst IP entropy
Otto

14. Sampling Comparison
Otto

15. Baselines
Otto

16. Anomaly Distance
Otto

17. Distance vs Sampling Rate: During Attack
Otto

18. Scaling Metodology Identification of Blaster packets based on
dst port, packet size, tcp
Amplification of the Blaster worm
Insertion of new packets
Same src IP, and dst IP
Random selection from SWITCH IP range
Attenuation of the Blaster worm
Randomly throwing out of some of the Blaster packets
Otto

19. Scaling
Otto

20. Scaling
Otto

21. Conclusion Some metrics are more resilient to sampling Future work
Flow DST IP entropy is most resilient for Blaster
Future work
Other types of anomalies, anomaly intensities
Other distance metrics
Different bin sizes
Further anomaly metrics
Anomaly detectability at different sampling rates
Otto