ATD: Spatio-Temporal Model for the Propagation of Internet Traffic Anomalies

Colorado State University, Fort Collins CO

Investigators

Abstract

This project seeks to develop a statistical model for the propagation of internet traffic anomalies. The model will serve as a tool in an on-going, multidirectional effort aimed at increasing the security of the backbone internet network in the United States and the detection of threats to its operation caused either by suboptimal design or malicious attacks. The model will be constructed using a large publicly available data set of various internet traffic measurements. The work will involve statistical analysis of the data, probabilistic modeling, and simulation. The research will combine expertise of statistics and computer science researchers. By involving Ph.D. students in the field at the nexus of statistics and computer networks, it will train highly educated personnel in an area of national importance. While modeling normal network traffic has received a great deal of attention in the last twenty years, only certain local aspects of stochastic modeling of anomalous behavior have been addressed. Normal traffic models have been used to extract anomalies, but they do not provide information on the statistical properties of the propagation and size of anomalies, nor do they imply a stochastic mechanism that may be used to simulate the flow of anomalies. Developing a stochastic model for the propagation of network anomalies requires a new synthesis of statistical spatio-temporal modeling and discrete event simulation techniques. Spatio-temporal models currently used in various applications including industrial mining, geophysical, climate and environmental research, and public health are not transferable to the setting of internet traffic, where physical distances play no role, while network topology and link utilization become prominent. This research aims to create a new class of mathematical models that will open up new directions of research on network anomaly propagation. The models will be based on state-of-the-art statistical analysis applied to practically-relevant anomaly traffic attributes. The work will also stimulate research in the mathematical sciences on models of this type.