异常流迹在异常检测中的应用
On the Utility of Anonymized Flow Traces for Anomaly Detection
摘要：
网络痕迹的共享是开发和评估高效异常检测机制的重要前提。不幸的是，隐私问题和数据保护法律阻止网络运营商共享这些数据。在这种情况下，防病毒化是一种很有前途的解决方案;然而，目前还不清楚数据的清理是否保留了流量特征或引入了可能伪造流量分析结果的伪像。在本文中，我们研究了异常检测的匿名流迹的效用。我们定量评估的IP地址匿名化，即变化的排列和截断，对大规模的异常的可检测性的影响。具体来说，我们分析了三个星期的未采样和非匿名的网络痕迹，从一个中型骨干网络。我们发现，所有的匿名化技术，除了前缀保留置换，降低了异常检测数据的效用。我们表明，退化的程度在很大程度上取决于存在于一个跟踪异常的性质和组合。此外，我们提出了一个案例研究，说明了如何通过匿名化扭曲个别主机的流量特征。
英文摘要：
The sharing of network traces is an important prerequisite for the development and evaluation of efficient anomaly detection mechanisms. Unfortunately, privacy concerns and data protection laws prevent network operators from sharing these data. Anonymization is a promising solution in this context; however, it is unclear if the sanitization of data preserves the traffic characteristics or introduces artifacts that may falsify traffic analysis results. In this paper, we examine the utility of anonymized flow traces for anomaly detection. We quantitatively evaluate the impact of IP address anonymization, namely variations of permutation and truncation, on the detectability of large-scale anomalies. Specifically, we analyze three weeks of un-sampled and non-anonymized network traces from a medium-sized backbone network. We find that all anonymization techniques, except prefix-preserving permutation, degrade the utility of data for anomaly detection. We show that the degree of degradation depends to a large extent on the nature and mix of anomalies present in a trace. Moreover, we present a case study that illustrates how traffic characteristics of individual hosts are distorted by anonymization.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
