ATD: Spatio-Temporal Model for the Propagation of Internet Traffic Anomalies

该项目旨在开发一个互联网流量异常传播的统计模型。该模型将作为一项持续的多方向努力的工具，旨在提高美国主干互联网网络的安全性，并检测由次优设计或恶意攻击造成的对其运营的威胁。该模型将使用各种互联网流量测量的大量公开数据集来构建。这项工作将涉及数据的统计分析、概率建模和模拟。这项研究将结合统计学和计算机科学研究人员的专业知识。通过将博士生纳入统计学和计算机网络的结合点，它将在国家重要领域培养受过高等教育的人才。在过去20年里，正常网络流量的建模受到了极大的关注，但只解决了异常行为的随机建模的某些局部方面。已使用正常流量模型来提取异常，但它们没有提供有关异常传播和大小的统计特性的信息，也没有暗示可用于模拟异常流动的随机机制。开发网络异常传播的随机模型需要统计时空建模和离散事件模拟技术的新综合。目前用于工业采矿、地球物理、气候和环境研究以及公共健康等各种应用的时空模型不能转移到互联网流量的设置上，在互联网流量的设置中，物理距离不起作用，而网络拓扑和链路利用率变得突出。本研究旨在建立一类新的数学模型，为网络异常传播的研究开辟新的方向。这些模型将基于应用于实际相关的异常交通属性的最先进的统计分析。这项工作还将促进数学科学对这类模型的研究。

This project seeks to develop a statistical model for the propagation of internet traffic anomalies. The model will serve as a tool in an on-going, multidirectional effort aimed at increasing the security of the backbone internet network in the United States and the detection of threats to its operation caused either by suboptimal design or malicious attacks. The model will be constructed using a large publicly available data set of various internet traffic measurements. The work will involve statistical analysis of the data, probabilistic modeling, and simulation. The research will combine expertise of statistics and computer science researchers. By involving Ph.D. students in the field at the nexus of statistics and computer networks, it will train highly educated personnel in an area of national importance.While modeling normal network traffic has received a great deal of attention in the last twenty years, only certain local aspects of stochastic modeling of anomalous behavior have been addressed. Normal traffic models have been used to extract anomalies, but they do not provide information on the statistical properties of the propagation and size of anomalies, nor do they imply a stochastic mechanism that may be used to simulate the flow of anomalies. Developing a stochastic model for the propagation of network anomalies requires a new synthesis of statistical spatio-temporal modeling and discrete event simulation techniques. Spatio-temporal models currently used in various applications including industrial mining, geophysical, climate and environmental research, and public health are not transferable to the setting of internet traffic, where physical distances play no role, while network topology and link utilization become prominent. This research aims to create a new class of mathematical models that will open up new directions of research on network anomaly propagation. The models will be based on state-of-the-art statistical analysis applied to practically-relevant anomaly traffic attributes. The work will also stimulate research in the mathematical sciences on models of this type.