ATD: Spatio-Temporal Model for the Propagation of Internet Traffic Anomalies

该项目旨在为互联网流量异常的传播开发一个统计模型。该模型将作为一种工具，用于正在进行的多向努力，旨在提高美国骨干互联网网络的安全性，并检测由次优设计或恶意攻击引起的对其运行的威胁。该模型将使用各种互联网流量测量的大型公开数据集来构建。这项工作将涉及数据的统计分析、概率建模和模拟。这项研究将结合统计学和计算机科学研究人员的专业知识。通过让统计和计算机网络领域的博士生参与进来，它将在一个具有国家重要性的领域培养受过高等教育的人才。在过去的二十年中，对正常网络流量的建模受到了极大的关注，但对异常行为的随机建模的某些局部方面已经得到了解决。正常交通模型已被用于提取异常，但它们不提供关于异常传播和大小的统计特性的信息，也不意味着可以用来模拟异常流的随机机制。建立网络异常传播的随机模型需要统计时空建模和离散事件模拟技术的新综合。目前在工业采矿、地球物理、气候和环境研究以及公共卫生等各种应用中使用的时空模型不能转移到互联网流量的设置中，物理距离不起作用，而网络拓扑和链路利用变得突出。本研究旨在建立一类新的数学模型，为网络异常传播的研究开辟新的方向。这些模型将基于应用于实际相关异常流量属性的最新统计分析。这项工作还将刺激数学科学对这类模型的研究。

This project seeks to develop a statistical model for the propagation of internet traffic anomalies. The model will serve as a tool in an on-going, multidirectional effort aimed at increasing the security of the backbone internet network in the United States and the detection of threats to its operation caused either by suboptimal design or malicious attacks. The model will be constructed using a large publicly available data set of various internet traffic measurements. The work will involve statistical analysis of the data, probabilistic modeling, and simulation. The research will combine expertise of statistics and computer science researchers. By involving Ph.D. students in the field at the nexus of statistics and computer networks, it will train highly educated personnel in an area of national importance.While modeling normal network traffic has received a great deal of attention in the last twenty years, only certain local aspects of stochastic modeling of anomalous behavior have been addressed. Normal traffic models have been used to extract anomalies, but they do not provide information on the statistical properties of the propagation and size of anomalies, nor do they imply a stochastic mechanism that may be used to simulate the flow of anomalies. Developing a stochastic model for the propagation of network anomalies requires a new synthesis of statistical spatio-temporal modeling and discrete event simulation techniques. Spatio-temporal models currently used in various applications including industrial mining, geophysical, climate and environmental research, and public health are not transferable to the setting of internet traffic, where physical distances play no role, while network topology and link utilization become prominent. This research aims to create a new class of mathematical models that will open up new directions of research on network anomaly propagation. The models will be based on state-of-the-art statistical analysis applied to practically-relevant anomaly traffic attributes. The work will also stimulate research in the mathematical sciences on models of this type.