search menu icon-carat-right cmu-wordmark

Anomaly Detection Through Blind Flow Analysis Inside a Local Network (Presentation)

October 2006 Presentation
Ron McLeod (Corporate Development Telecom Applications Research Alliance), Vagishwari Nagaonkar (Wipro Technologies)

In this presentation, the authors describe how hosts may be clustered into user workstations, servers, printers, and hosts compromised by worms.


Software Engineering Institute


In August of 2006, 4 months of Netflow records that were collected inside a small private network were subjected to a Blind Flow Analysis. Such an analysis is characterized by having access to the flow records from inside the network but no access to the payload data and no physical access to the hosts generating the traffic. Experiments were conducted to discover if useful behavioural clusters could be constructed with such minimal access and whether individual classes of hosts could be clustered into standard ranges including clusters indicative of compromised hosts. Early results are promising in that hosts may be clustered into User Workstations, Servers, Printers and hosts Compromised by Worms.