Host Behavior in Computer Network: One-Year Study

J 2021

Host Behavior in Computer Network: One-Year Study

JIRSÍK, Tomáš a Petr VELAN

Základní údaje

Originální název

Host Behavior in Computer Network: One-Year Study

Autoři

JIRSÍK, Tomáš (203 Česká republika, garant, domácí) a Petr VELAN (203 Česká republika, domácí)

Vydání

IEEE Transactions on Network and Service Management, 2021, 1932-4537

Další údaje

Jazyk

angličtina

Typ výsledku

Článek v odborném periodiku

Obor

10201 Computer sciences, information science, bioinformatics

Stát vydavatele

Spojené státy

Utajení

není předmětem státního či obchodního tajemství

Odkazy

URL URL

Impakt faktor

Impact factor: 4.758

Kód RIV

RIV/00216224:14610/21:00121022

Organizační jednotka

Ústav výpočetní techniky

DOI

http://dx.doi.org/10.1109/TNSM.2020.3036528

UT WoS

000628914700056

Klíčová slova anglicky

Stability analysis;Security;Labeling;Business;Tools;IP networks;Computer science;Network measurement;Host profiling;Netflow;Clustering;Temporal patterns

Štítky

J-D1, rivok

Příznaky

Mezinárodní význam, Recenzováno

Změněno: 16. 5. 2022 14:42, Mgr. Alena Mokrá

Anotace

V originále

An analysis of a host behavior is an essential key for modern network management and security. A robust behavior profile enables the network managers to detect anomalies with high accuracy, predict the host behavior, or group host to clusters for better management. Hence, host profiling methods attract the interest of many researchers, and novel methods for host profiling are being introduced. However, these methods are frequently developed on preprocessed and small datasets. Therefore, they do not reflect the real-world artifacts of the host profiling, such as missing observations, temporal patterns, or variability in the profile characteristics in time. To provide the needed insight into the artifacts of host profiling in real-world settings, we present a study of the host behavior in a network conducted on a one-year-long real-world network dataset. In the study, we inspect the availability of the data for host profiling, identify the temporal patterns in host behavior, introduce a method for stable labeling of the hosts, and assess the variability of the host characteristics in the course of the year using the coefficient of variance. Moreover, we make the one-year dataset containing nine characteristics used for host behavior analysis available for public use and further research, including selected use cases representing host profiling caveats. We also share the record of analyses presented in the paper.

Návaznosti

EF16_019/0000822, projekt VaV

Název: Centrum excelence pro kyberkriminalitu, kyberbezpečnost a ochranu kritických informačních infrastruktur

833418, interní kód MU

Název: Sharing and Automation for Privacy Preserving Attack Neutralization (Akronym: SAPPAN)

Investor: Evropská unie, Sharing and Automation for Privacy Preserving Attack Neutralization, Secure societies - Protecting freedom and security of Europe and its citizens (Societal Challenges)

Citovat

JIRSÍK, Tomáš a Petr VELAN. Host Behavior in Computer Network: One-Year Study. IEEE Transactions on Network and Service Management. 2021, roč. 18, č. 1, s. 822-838. ISSN 1932-4537. Dostupné z: https://dx.doi.org/10.1109/TNSM.2020.3036528.

@article{1733718,
   author = {Jirsík, Tomáš and Velan, Petr},
   article_number = {1},
   doi = {http://dx.doi.org/10.1109/TNSM.2020.3036528},
   keywords = {Stability analysis;Security;Labeling;Business;Tools;IP networks;Computer science;Network measurement;Host profiling;Netflow;Clustering;Temporal patterns},
   language = {eng},
   issn = {1932-4537},
   journal = {IEEE Transactions on Network and Service Management},
   title = {Host Behavior in Computer Network: One-Year Study},
   url = {https://doi.org/10.1109/TNSM.2020.3036528},
   volume = {18},
   year = {2021}
}

TY  - JOUR
ID  - 1733718
AU  - Jirsík, Tomáš - Velan, Petr
PY  - 2021
TI  - Host Behavior in Computer Network: One-Year Study
JF  - IEEE Transactions on Network and Service Management
VL  - 18
IS  - 1
SP  - 822-838
EP  - 822-838
SN  - 19324537
KW  - Stability analysis;Security;Labeling;Business;Tools;IP networks;Computer science;Network measurement;Host profiling;Netflow;Clustering;Temporal patterns
UR  - https://doi.org/10.1109/TNSM.2020.3036528
N2  - An analysis of a host behavior is an essential key for modern network management and security. A robust behavior profile enables the network managers to detect anomalies with high accuracy, predict the host behavior, or group host to clusters for better management. Hence, host profiling methods attract the interest of many researchers, and novel methods for host profiling are being introduced. However, these methods are frequently developed on preprocessed and small datasets. Therefore, they do not reflect the real-world artifacts of the host profiling, such as missing observations, temporal patterns, or variability in the profile characteristics in time. To provide the needed insight into the artifacts of host profiling in real-world settings, we present a study of the host behavior in a network conducted on a one-year-long real-world network dataset. In the study, we inspect the availability of the data for host profiling, identify the temporal patterns in host behavior, introduce a method for stable labeling of the hosts, and assess the variability of the host characteristics in the course of the year using the coefficient of variance. Moreover, we make the one-year dataset containing nine characteristics used for host behavior analysis available for public use and further research, including selected use cases representing host profiling caveats. We also share the record of analyses presented in the paper.
ER  -

JIRSÍK, Tomáš a Petr VELAN. Host Behavior in Computer Network: One-Year Study. \textit{IEEE Transactions on Network and Service Management}. 2021, roč.~18, č.~1, s.~822-838. ISSN~1932-4537. Dostupné z: https://dx.doi.org/10.1109/TNSM.2020.3036528.

Podrobný výpis o publikaci