Internet availability on a campus is not metered. Internet link bandwidths are vulnerable as they can be misused. Moreover, websites blacklist campuses for misuse. Especially blacklisting by academic websites like IEEE and ACM can lead to serious researchers being denied access to information. The objective of this paper is to proactively classify anomalous accesses. This will enable campus ISPs to deny access to users, misusing the Internet. In particular URLs are classified using the short snippets(meta-data) that are available. New Features, namely random walk term weights, within class popularity in tandem with non negative matrix factorization show a lot of promise for classifying URLs. The classification accuracy is as a high as 92.96% on 10 gigabytes of proxy data. © 2014 IEEE.

Hema Murthy

Department of Computer Science and Engineering

Shreya Khare

Akshay Bhandari

Websites

Classification accuracy

Internet links

nonnegative matrix factorization

PROXY DATA

Random Walk

TERM WEIGHT

WEB PAGE CLASSIFICATION

WITHIN CLASS

Internet service providers

IIT Madras is a public technical and research university located in Chennai, Tamil Nadu. Founded in 1959, it is recognised as an Institute of National Importance.

IIT Madras has been ranked as the top engineering institute in India for four years in a row by the National Institutional Ranking Framework of the MHRD

It currently offers undergraduate, postgraduate and research degrees across 16 disciplines in Engineering, Sciences, Humanities and Management. About 596 faculty belonging to science and engineering departments and centres of the Institute are engaged in teaching, research and industrial consultancy.

IIT Madras

URL classification using non negative matrix factorization

2014 20th National Conference on Communications, NCC 2014

The Internet has become a vital source of information; internal and external attacks threaten the integrity of the LAN connected to the Internet. In this work, several techniques have been described for detection of such threats. We have focussed on anomaly-based intrusion detection in the campus environment at the network edge. A campus LAN consisting of more than 9000 users with a 90 Mbps internet access link is a large network. Therefore, efficient techniques are required to handle such big data and to model user behaviour. Proxy server logs of a campus LAN and edge router traces have been used for anomalies like abusive Internet access, systematic downloading (internal threats) and DDoS attacks (external threat); our techniques involve machine learning and time series analysis applied at different layers in TCP/IP stack. Accuracy of our techniques has been demonstrated through extensive experimentation on huge and varied datasets. All the techniques are applicable at the edge and can be integrated into a Network Intrusion Detection System. © 2015, Indian Academy of Sciences.

Fulltext

Sadhana - Academy Proceedings in Engineering Sciences

Multi-level anomaly detection: Relevance of big data analytics in networks

In a LAN, Internet access should be managed well for a better user experience. Those using a larger share of the bandwidth may be restricted during peak hours to enable others to use the Internet. This can be viewed as a problem of classifying the users based on their Internet usage into normal and high categories, following which control policies may be applied. For this purpose, a proxy-based mechanism has been proposed for classification of users according to the share of their Internet access. The advantage of this approach is that users sharing the same computer can be distinguished by the proxy server and appropriate control policies can be exercised. To understand user behaviour, data is collected at the proxy server in a campus LAN. Machine learning algorithms are then used to learn and characterise user behaviour. In particular, Naive Bayes' and Gaussian Mixture Model based classifiers are used. It is observed that the algorithms are able to scale in that users are clustered into two different groups. Performance evaluation on a held out data set indicates that users can be accurately distinguished 94.96% of the time. The algorithm is also practical since the time consuming task of model building need be done only once a month offline, while the daily task of classification may be accomplished in a period of 20 mins for GMMs. It has also been shown how the user behavior of the two groups of users may be characterized. This would be a useful aid in the design of policies and algorithms for Internet access control. © 2012 IEEE.

6th International Conference on Signal Processing and Communication Systems, ICSPCS 2012 - Proceedings

User traffic classification for proxy-server based internet access control

The availability of the Internet at the click of a mouse brings with it a host of new problems. Although the World Wide Web was first started by physicists at CERN to enable collation and exchange of data, today, it is used for a wide range of applications. The requirements on bandwidth for each of the applications is also varied. An Internet Service Provider must ensure satisfaction across the entire spectrum of users. To ensure this, analysis of Internet usage becomes essential. Further, an administrator can keep a record of user's Internet activity and prevent unethical activities, since the Internet is also an excellent resource for providing anonymity. This analysis can also help in resource provisioning and monitoring. In this work, a web-based tool is first proposed to analyse the Internet activity. Next, data is collected from a proxy server at a campus-wide network. Traffic patterns of different types of users are studied. Finally, the paper concludes with strategies for monitoring and control of traffic. ©2010 IEEE.

Journal	Data powered by Typeset2014 20th National Conference on Communications, NCC 2014
Publisher	Data powered by TypesetIEEE Computer Society
Open Access	No