Detection accuracy of network anomalies using sampled flow statistics

Ryoichi Kawahara*, Keisuke Ishibashi, Tatsuya Mori, Noriaki Kamiyama, Shigeaki Harada, Haruhisa Hasegawa, Shoichiro Asano

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

5 Citations (Scopus)


We investigated the detection accuracy of network anomalies when using flow statistics obtained through packet sampling. Through a case study based on measurement data, we showed that network anomalies generating a large number of small flows, such as network scans or SYN flooding, become difficult to detect during packet sampling. We then developed an analytical model that enables us to quantitatively evaluate the effect of packet sampling and traffic conditions, such as anomalous traffic volume, on detection accuracy. We also investigated how the detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning monitored traffic into groups makes it possible to increase detection accuracy. We also developed a method of determining an appropriate number of partitioned groups, and we show its effectiveness.

Original languageEnglish
Pages (from-to)513-535
Number of pages23
JournalInternational Journal of Network Management
Issue number6
Publication statusPublished - 2011 Nov
Externally publishedYes

ASJC Scopus subject areas

  • Computer Science Applications
  • Computer Networks and Communications


Dive into the research topics of 'Detection accuracy of network anomalies using sampled flow statistics'. Together they form a unique fingerprint.

Cite this