Detecting anomalous traffic using communication graphs

Keisuke Ishibashi, Tsuyoshi Kondoh, Shigeaki Harada, Tatsuya Mori, Ryoichi Kawahara, Shoichiro Asano

Research output: Contribution to conferencePaperpeer-review

6 Citations (Scopus)


We present a method to detect anomalies in a time series of inter-host communication patterns. There are many existing methods for anomaly detection in a time series of traffic volume data, such as number of packets or bytes. However, there is no established method detecting anomalies in a time series of communication patterns that can be represented as graphs. Extracting communication structure enables us to identify low-intensity anomalous network events, e.g., botnet command and control communications, which cannot be detected with conventional volume-based anomaly detection schemes. In this paper, we first define the similarity of two graphs, and then we present a method to detect any anomalous graph that has little similarity with other graphs. This method was evaluated with actual traffic data, and anomalous graphs in which new clusters appeared were detected.

Original languageEnglish
Number of pages6
Publication statusPublished - 2010
Externally publishedYes
EventWorld Telecommunications Congress 2010, WTC 2010 - Wien, Austria
Duration: 2010 Sept 132010 Sept 14


ConferenceWorld Telecommunications Congress 2010, WTC 2010

ASJC Scopus subject areas

  • Computer Networks and Communications


Dive into the research topics of 'Detecting anomalous traffic using communication graphs'. Together they form a unique fingerprint.

Cite this