GraphPrints: Towards a Graph Analytic Method for Network Anomaly Detection

This paper introduces a novel graph-analytic approach for detecting anomalies in network flow data called GraphPrints. Building on foundational network-mining techniques, our method represents time slices of traffic as a graph, then counts graphlets -- small induced subgraphs that describe local top...

Full description

Saved in:
Bibliographic Details
Published inarXiv.org
Main Authors Harshaw, Christopher R, Bridges, Robert A, Iannacone, Michael D, Reed, Joel W, Goodall, John R
Format Paper Journal Article
LanguageEnglish
Published Ithaca Cornell University Library, arXiv.org 02.02.2016
Subjects
Anomalies
Computer Science - Cryptography and Security
Data analysis
Graph theory
Outliers (statistics)
Statistics - Machine Learning
Topology
Online AccessGet full text

Cover

More Information
Summary:This paper introduces a novel graph-analytic approach for detecting anomalies in network flow data called GraphPrints. Building on foundational network-mining techniques, our method represents time slices of traffic as a graph, then counts graphlets -- small induced subgraphs that describe local topology. By performing outlier detection on the sequence of graphlet counts, anomalous intervals of traffic are identified, and furthermore, individual IPs experiencing abnormal behavior are singled-out. Initial testing of GraphPrints is performed on real network data with an implanted anomaly. Evaluation shows false positive rates bounded by 2.84% at the time-interval level, and 0.05% at the IP-level with 100% true positive rates at both.
ISSN:2331-8422
DOI:10.48550/arxiv.1602.01130