Philippe Owezarski
email: owe@laas.fr

A Near Real-Time Algorithm for Autonomous Identification and Characterization of Honeypot Attacks

Keywords: Honeypot attack identification, Anomaly characterization, unsupervised machine learning, big tra c data, autonomous security systems

Monitoring communication networks and their tra c is of essential importance for estimating the risk in the Internet, and therefore designing suited protection systems for computer networks. Network and tra c analysis can be done thanks to measurement devices or honeypots. However, analyzing the huge amount of gathered data, and characterizing the anomalies and attacks contained in these traces remain complex and time consuming tasks, done by network and security experts using poorly automatized tools, and are consequently slow and costly. In this paper, we present an unsupervised algorithm -called UNADA for Unsupervised Network Anomaly Detection Algorithm -for identification and characterization of security related anomalies and attacks occurring in honeypots. This automatized method does not need any attack signature database, learning phase, or labeled tra c. This corresponds to a major step towards autonomous security systems. This paper also shows how it is possible from anomalies characterization results to infer filtering rules that could serve for automatically configuring network routers, switches or firewalls. The performances of UNADA in terms of attacks identification accuracy are evaluated using honeypot tra c traces gathered on the honeypot network of the University of Maryland. The time latency for producing such accurate results are also presented, especially showing how the parallelization capabilities of the algorithm help reducing this latency.

INTRODUCTION

Monitoring communication networks and their tra c is an important advance for protecting computers systems. Several methods exist. For example, using monitoring devices at the interconnection points of networks allows the analysis of all incoming and outgoing flows. Another method consists in installing honeypots in the network. Honeypots provide more or less emulated services (according to the expected interaction level with the attackers), and allows supervising the use of the provided services by attackers. Thus, gathered data allows security experts on one hand to detect and analyze computer systems weaknesses, and on the other hand to collect useful information on the attacker activities that allows the analysis of their attacking methods, objectives, and strategies. Estimating and analyzing the risk related to illegitimate activities on the Internet are essential for security experts to design and develop adapted and e cient defense and protection systems with regard to the actual risk.

Characterizing and classifying current anomalies and attacks of the Internet are very complex and time consuming tasks, done by experts. Such tasks are therefore slow and costly. The main di culty related to the identification and analysis of the di↵erent classes of illegitimate tra c is their fast evolution, amplification, and renewing capabilities. Designing autonomous identification and characterization processes is crucial for easy to deploy and to use defense systems. Hence, modern identification and classification systems must not rely on human expert knowledge, and must be able to autonomously adapt to the evolution of all tra c components, be they legitimate or not (this paper obviously focuses on illegitimate ones). For this purpose, we propose to take advantage of unsupervised machine learning techniques that do not require the help of any human expert. In this paper we then present an unsupervised method for identifying and characterizing anomalies and attacks contained in tra c gathered on honeypot networks. This method does not take advantage of any attack signature, learning stage, or labeled tra c, what constitutes a major advance towards autonomous security systems. This approach uses robust clustering techniques, as sub-space clustering, density-based clustering, and evidence accumulation for classifying flow ensembles in tra c classes, and builds easily understandable associated signatures. This method was first proposed in our previous work [START_REF] Mazel | Sub-space clustering, interclustering results association & anomaly correlation for unsupervised network anomaly detection[END_REF] that aims at detecting, classifying and characterizing anomalies in the full network traffic. This method has been adapted and extended in order to cope with the specific honeypot network tra c. Indeed, honeypot network tra c only contains illegitimate tra c (attacks, anomalies, intrusion attempts, ...) what significantly changes the way classification and characterization can be done. This paper mainly deals with taking into account the illegitimate nature of tra c to be analyzed, and designing adapted and optimized identification and charac-terization algorithms.

These algorithms are illustrated by the analysis of honeypot tra c gathered at the University of Maryland, at the Netflow format [START_REF] Berthier | Nfsight: Netflow-based network awareness tool[END_REF]. The University of Maryland put measurement devices on routers at the border of the honeypots networks. This allows the capture of the tra c exchanged between honeypots and the Internet by monitoring only very few network devices. We nevertheless do not have the communication traces between the honeypots of the same network. The tra c traces we have been working on have been captured on a duration of more than one year.

The rest of the paper is as follows: section 2 presents related work in the domain of attack and anomalies detection and characterization, covering the full set of approaches from signature to statistical profile based, and finishing with approaches based on data mining and machine learning, especially unsupervised ones. This section also presents supervised and semi-supervised classification methods. Section 3 presents our previous unsupervised anomaly detection algorithm. This algorithm has already been published in [START_REF] Mazel | Sub-space clustering, interclustering results association & anomaly correlation for unsupervised network anomaly detection[END_REF]. We nevertheless add a presentation of this algorithm in this paper to make it self-contained. Interested readers can find an extended version of the algorithms description in [START_REF] Mazel | Unsupervised network anomaly detection[END_REF]. However this algorithm originally works on full tra c, i.e. normal tra c on Internet links, and the objective is then to detect anomalies and attacks. Given the nature of the tra c we are considering in this paper -i.e. tra c between honeypots and the Internet -we know that it is completely illegitimate. This is a strong hypothesis that can help going further for characterizing and identifying the di↵erent component of this illicit tra c, and estimating the risk in the Internet. This section 3 then presents the sub-space clustering approach that aims at increasing the robustness of clustering algorithms, limiting its sensitivity, etc. It also presents the recombination mechanisms based on evidence accumulation and inter-clustering associations. As a strong improvement of the previous algorithm, section 4 describes how we can show correlation existing between clusters in di↵erent subspaces, these correlations exhibiting that such clusters could correspond to the same attack or anomaly. This is a strong help for more accurately and completely identifying and characterizing all attacks contained in the honeypots tra c. Section 5 then proposes a way to automatically characterize the identified anomalies and attacks. It relies on the clustering and correlation results. Section 6 proposes a method for ranking the risk an attack represents. Such ranking is aimed at helping security experts or network operators to prioritize their work, focusing first on the most dangerous ones. Section 7 illustrates the results of this characterization algorithm by showing a set of attacks and anomalies that have been identified in the real tra c traces of the University of Maryland, and the characterizing signatures that have been issued. Section 8 presents the performance evaluation of our algorithm in terms of good identification, especially comparing it with other unsupervised methods. Section 9 then explains the parallelization capabilities of our identification algorithm, and exhibits its strong performance in terms of low latencies, especially when computings can be e↵ectively parallelized on multi-processor or multi-core machines. Last, section 10 concludes this paper.

RELATED WORK

The problem of network anomaly detection has been ex-tensively studied during the last decade. Most of the approaches analyze statistical variations of tra c volume (e.g. number of packets, bytes or new flows) and/or tra c features (e.g. IP addresses and ports), using either single-link measurements or network-wide data. A non-exhaustive list of standard methods includes the use of signal processing techniques (e.g. ARIMA -Autoregressive Integrated Moving Average -modeling, wavelets-based filtering) on singlelink tra c measurements [START_REF] Barford | A signal analysis of network tra c anomalies[END_REF][START_REF] Brutlag | Aberrant behavior detection in time series for network monitoring[END_REF], PCA (Principal Component Analysis) for network-wide anomaly detection [START_REF] Lakhina | Characterization of network-wide anomalies in tra c flows[END_REF][START_REF] Lakhina | Mining anomalies using tra c feature distributions[END_REF][START_REF] Lakhina | Diagnosing network-wide tra c anomalies[END_REF], and Sketches applied to IP-flows [START_REF] Krishnamurthy | Sketch-based change detection: Methods, evaluation, and applications[END_REF][START_REF] Li | Detection and identification of network anomalies using sketch subspaces[END_REF].

The simultaneous detection and characterization of traffic anomalies has also received quite a lot of attention in the past, but results are few and present important limitations, either because they rely on some kind of training data and/or anomaly signatures, or because they do not provide meaningful and tractable information to a human network operator, who has to take the final decision about the nature of the detected problem. Authors in [START_REF] Lakhina | Characterization of network-wide anomalies in tra c flows[END_REF] characterize network-wide anomalies in highly aggregated tra c (Origin-Destination flows or OD flows for short), using PCA and the sub-space approach [START_REF] Lakhina | Diagnosing network-wide tra c anomalies[END_REF]. An important limitation of this approach is that the information obtained from OD flow data is too coarse-grained to provide meaningful information to the network operator. Papers like Lakhina et al. [START_REF] Lakhina | Mining anomalies using tra c feature distributions[END_REF] and Biang et al. [START_REF] Li | Detection and identification of network anomalies using sketch subspaces[END_REF] detect and characterize anomalies using finer-grained tra c information, basically applying the same PCA approach to the sample entropy of the empirical distribution of specific tra c features. One clear limitation of these approaches is that the information they provide is not immediately usable and easy-to-understand by the network operator, who may not even be familiar with concepts distant from his tasks such as sample entropy. Besides, the PCA approach is highly sensitive to noise when used for anomaly detection [START_REF] Casas | Optimal volume anomaly detection and isolation in large-scale ip networks using coarse-grained measurements[END_REF][START_REF] Ringberg | Sensitivity of pca for tra c anomaly detection[END_REF], requiring in practice a fine-tuning and data-dependent calibration step to work.

UNADA (Unsupervised Network Anomaly detection Algorithm) [START_REF] Casas | Unada: Unsupervised network anomaly detection using sub-space outliers ranking[END_REF] falls within the unsupervised anomaly detection domain, a novel research area that has drawn quite a lot of interest in the research community, but that still represents a rather immature field. Most work on unsupervised network anomaly detection has been devoted to the IDS field, generally targeting the detection of network intrusions in the very well known KDD'99 dataset. The great majority of the detection schemes proposed in the literature are based on clustering techniques and outliers detection, being [START_REF] Eskin | A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data[END_REF][START_REF] Leung | Unsupervised anomaly detection in network intrusion detection using clustering[END_REF][START_REF] Portnoy | Intrusion detection with unlabeled data using clustering[END_REF] some examples. The objective of clustering is to partition a set of unlabeled patterns into homogeneous groups of "similar" characteristics, based on some similarity measure. Outliers detection consists in identifying those patterns that do not belong to any of these clusters. In [START_REF] Portnoy | Intrusion detection with unlabeled data using clustering[END_REF], authors use a simple single-linkage hierarchical clustering method to cluster data from the KDD'99 dataset, based on the standard Euclidean distance for inter-pattern similarity. Eskin et al. [START_REF] Eskin | A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data[END_REF] reports improved results in the same dataset, using three di↵erent clustering algorithms: the Fixed-Width clustering algorithm, an optimized version of the k-NN algorithm, and the one class SVM algorithm. Leung and Leckie [START_REF] Leung | Unsupervised anomaly detection in network intrusion detection using clustering[END_REF] present a combined density-based and grid-based clustering algorithm to improve computational complexity, obtaining similar detection results.

Previous work of our own permits to automatically characterize network tra c anomalies [START_REF] Fernandes | Automated classification of network tra c anomalies[END_REF], but using a-priori well-defined anomaly signatures. Closer to our current work, authors in [START_REF] Silveira | Rca: Pulling anomalies by their root causes[END_REF] present URCA (Unsupervised Root Cause Analysis), a two-steps algorithm to characterize network anomalies in an unsupervised fashion. URCA uses as input the tra c in the anomalous time slots detected by any generic time-slot-based detection algorithm [START_REF] Cormode | What's new: Finding significant di↵erences in network data streams[END_REF]. In the first step, it identifies the anomaly by iteratively removing from the anomalous time slots those flows that seem normal. In the second step, the algorithm uses a hierarchical clustering method to characterize the particular flows identified as anomalous. We identify some serious drawbacks and omissions in URCA: authors claim that the approach is unsupervised, which is not true, simply because it uses previously labeled anomalous events for the characterization. As in previous works, the algorithm uses di cult-to-interpret tra c descriptors for the clustering step (e.g. sample entropy of the distribution of IP addresses, aggregated at di↵erent levels), obscuring the comprehension of the network operator. Finally, the algorithm removes those flows that seem normal before the characterization step, which drags possible errors to the clustering step.

Our Unsupervised Anomaly Detection and Characterization algorithm [START_REF] Mazel | Sub-space clustering, interclustering results association & anomaly correlation for unsupervised network anomaly detection[END_REF] presents several advantages w.r.t. current state of the art. First and most important, it works in a completely unsupervised fashion, which means that it can be directly plugged into any monitoring system and start to work from scratch. Secondly, we perform anomaly detection based not only on outliers detection, but also by identifying small-clusters. This is achieved by using different levels of tra c aggregation, both at the source and destination of the tra c; this additionally permits to discover low-intensity and distributed anomalies. Thirdly, we avoid the lack of robustness of general clustering approaches, by combining the notions of Sub-Space Clustering [START_REF] Parsons | Subspace clustering for high dimensional data: a review[END_REF] and multiple Evidence Accumulation [START_REF] Fred | Combining multiple clusterings using evidence accumulation[END_REF]. In particular, our algorithm is immune to general clustering problems like sensitivity to initialization, specification of number of clusters, or structure-masking by irrelevant features. Fourthly, the algorithm performs clustering in low-dimensional feature spaces, using simple tra c descriptors like number of source IP addresses or fraction of SYN packets. This simplifies the characterization of the anomaly, and avoids well-known clustering problems when working with high-dimensional data [START_REF] Jain | Data clustering: 50 years beyond k-means[END_REF]. Our algorithm ranks the multiple evidence of an anomaly detected in di↵erent sub-spaces, combining the most relevant tra c descriptors into a compact and easy-to-interpret signature that characterizes the problem. This permits to reduce the time spent by the network operator to understand the nature of the anomaly. Finally, this algorithm is designed to work in an on-line fashion, analyzing tra c from consecutive time slots in near real time. This is possible even when working with large number of tra c descriptors, because the sub-space clustering and the evidence accumulation algorithms are perfectly adapted for parallelization (see [START_REF] Mazel | Sub-space clustering, interclustering results association & anomaly correlation for unsupervised network anomaly detection[END_REF]).

To the best of our knowledge, there is no paper in the literature on the use of unsupervised classification and characterization algorithms on honeypot tra c, or for intrusion or attacks characterization on big data sets of attack traces. Some very recent work exists, especially by Symantec and the TRIAGE project (Data Analytics Framework for Intelligence Analysis) that aims to use autonomous data mining techniques for the analysis of all the gathered traces of at-tacks. However, TRIAGE aims at designing visualization techniques for the experts to make decision, while in this paper we propose to autonomously apply countermeasures for cheaper and faster defense.

UNSUPERVISED ANOMALY DETECTION

Our anomaly detection works on single-link packet-level tra c captured in consecutive time-slots of fixed length T . The first analysis stage consists in change detection. At each time-slot, tra c is aggregated in 9 di↵erent flow levels li. These include (from finer to coarser-grained resolution): source IPs (l1: IPsrc), destination IPs (l2: IPdst), source Network Prefixes (l3,4,5: IPsrc/24, /16, /8), destination Network Prefixes (l6,7,8: IPdst/24, /16, /8), and tra c per Time Slot (l9: tpTS). Time series Z l i t are built for basic tra c metrics such as number of bytes, packets, and IP flows per time slot, using the 9 flow resolutions l1...9. Analyzing honeypot tra c at multiple aggregation levels permits to detect both single source-destination and distributed attacks of very di↵erent intensities.

The unsupervised anomaly detection stage takes as input all the flows in the time slot flagged as anomalous, aggregated according to one of the di↵erent levels used in the first stage. An anomaly will generally be detected in di↵erent aggregation levels, and there are many ways to select a particular aggregation to use in the unsupervised stage; for the sake of simplicity, we shall skip this issue, and use any of the aggregation levels in which the anomaly was detected. Without loss of generality, let Y = {y1, .., yF } be the set of F flows in the flagged time slot, referred to as patterns in more general terms. Each flow y f 2 Y is described by a set of A tra c attributes or features. In this paper, we use a list of common tra c attributes. The list includes A = 9 tra c features: number of source/destination IP addresses and ports, ratio of number of sources to number of destinations, packet rate, ratio of packets to number of destinations, and fraction of ICMP and SYN packets. According to our previous work on signature-based anomaly characterization [START_REF] Fernandes | Automated classification of network tra c anomalies[END_REF], such simple tra c descriptors permit characterization of general tra c anomalies in easy-to-interpret terms. The list is therefore by no means exhaustive, and more features can be easily plugged-in to improve results. Let x f = (x f (1), .., x f (A)) 2 R A be the corresponding vector of tra c features describing flow y f , and X = (x1; ..; xF ) the complete matrix of features, referred to as the feature space.

The unsupervised detection algorithm is based on clustering techniques applied to X. The objective of clustering is to partition a set of unlabelled patterns into homogeneous groups of similar characteristics, based on some measure of similarity. Table 1 explains the characteristics of each anomaly in terms of type, distributed nature, aggregation type and netmask used, and impact on tra c features. On one hand, a SYN DDoS which targets one machine from a high number of hosts located in several /24 addresses will constitute a cluster if flows are aggregated in l3. In fact, each of these /24 addresses will have tra c attributes values di↵erent from the ones of normal tra c: a high number of packet, a single destination and many SYN packets. It is the whole set of these flows that will create a cluster. On the other hand, if flows are aggregated in l6, the only destination address will be an outlier characterized by many sources and a high proportion of SYN packets. Our particular goal is to identify and to isolate the different flows that compose the anomaly flagged in the first stage, both in a robust way. Unfortunately, even if hundreds of clustering algorithms exist [START_REF] Jain | Data clustering: 50 years beyond k-means[END_REF], it is very di cult to find a single one that can handle all types of cluster shapes and sizes, or even decide which algorithm would be the best for our particular problem. Di↵erent clustering algorithms produce di↵erent partitions of data, and even the same clustering algorithm provides di↵erent results when using di↵erent initializations and/or di↵erent algorithm parameters. This is in fact one of the major drawbacks in current cluster analysis techniques: the lack of robustness.

To avoid such a limitation, we have developed a divide and conquer clustering approach, using the notions of clustering ensemble [START_REF] Strehl | Cluster ensembles -a knowledge reuse framework for combining multiple partitions[END_REF] and multiple clusterings combination. A clustering ensemble P consists of a set of N partitions Pn produced for the same data with n = 1, .., N. Each of these partitions provides a di↵erent and independent evidence of data structure, which can be combined to construct a global clustering result for the whole feature space. There are di↵erent ways to produce a clustering ensemble. We use Sub-Space Clustering (SSC) [START_REF] Parsons | Subspace clustering for high dimensional data: a review[END_REF] to produce multiple data partitions, applying the same clustering algorithm to N different sub-spaces Un ⇢ X of the original space.

Clustering Ensemble and Sub-Space Clustering

Each of the N sub-spaces Un ⇢ X is obtained by selecting R features from the complete set of A attributes. The number of sub-spaces N hence is equal to R-combinationsobtained-from-A. To set the sub-space dimension R, we take a very useful property of monotonicity in clustering sets, known as the downward closure property: "if a collection of points is a cluster in a d-dimensional space, then it is also part of a cluster in any (d 1) projections of this space" [START_REF] Agrawal | Automatic subspace clustering of high dimensional data for data mining applications[END_REF]. This directly implies that, if there exists any evidence of density in X, it will certainly be present in its lowest-dimensional sub-spaces. Using small values for R provides several advantages: firstly, doing clustering in low-dimensional spaces is more e cient and faster than clustering in bigger dimensions. Secondly, densitybased clustering algorithms provide better results in lowdimensional spaces [START_REF] Agrawal | Automatic subspace clustering of high dimensional data for data mining applications[END_REF], because high-dimensional spaces are usually sparse, making it di cult to distinguish between high and low density regions. We shall therefore use R = 2 in our SSC algorithm, which gives N = C A R = A(A 1)/2 partitions.

Combining Multiple Partitions

Having produced the N partitions, we now explore di↵erent methods to combine these partitions in order to build a single partition where anomalous flows are easily distinguishable from normal-operation tra c: the classical Evidence Accumulation (EA) and the new Inter-Clustering Result Association (ICRA) method.

Combining Multiple Partitions using Evidence Accumulation

A possible answer is provided in [START_REF] Fred | Combining multiple clusterings using evidence accumulation[END_REF], where authors introduced the idea of multiple-clusterings Evidence Accumulation (EA). By simple definition of what it is, an anomaly may consist of either outliers or small-size clusters, depending on the aggregation level of flows in Y (cf table 1). EA then uses the cluster ensemble P to build two inter-pattern similarity measures between the flows in Y. These similarity measures are stored in two elements: a similarity matrix S to detect small clusters and a vector D used to rank outliers. S(p, q) represents the similarity between flows p and q. This value increases when the flows p and q are in the same cluster many times and when the size of this cluster is small. These two parameters allows the algorithm to target small clusters. D(o) represents the abnormality of the outlier o. This value increases when the outlier has been classified as such several times and when the separation between the outlier and the normal tra c is important. As we are only interested in finding the smallest-size clusters and the most dissimilar outliers, the detection consists in finding the flows with the biggest similarity in S and the biggest dissimilarity in D. Any clustering algorithm can then be applied on the matrix S values to obtain a final partition of X that isolates small-size clusters of close similarity values. A variable detection threshold over the values in S is also able to detect small-size cluster. Concerning dissimilar outliers, they can be isolated though a threshold applied on the values in D.

Combining Multiple Partitions using Inter-Clustering result Association

However, by reasoning over the similarities between patterns (here flows), EA introduces several potential errors. Let us consider two pattern sets Pi and Pj, if the cardinality of these pattern sets is close and if they are present in a similar number of sub-spaces, then EA will produce a very close (potentially the same) similarity value for both flow sets. They will then likely be falsely considered as belong-ing to the same cluster. This possibility has to be considered very seriously as it can induce a huge error: di↵erent anomalies will be merged together and will then likely be wrongly identified and characterized. Another source of potential error when using a clustering algorithm over S values is the algorithm sensitivity to wrong parameters. Furthermore, the use of a threshold over S and/or D can decrease the system performance in case of a wrong value used.

In order to avoid the previously exposed sources of error, we introduce a new way of combining clustering results obtained from sub-spaces: Inter-Clustering Results Association. The idea is to address the problem in terms of cluster of flows and outlier of flow similarity instead of pattern (or flow) similarity. Hence, we shift the similarity measure from the patterns to the clustering results. The problem can then be split in two sub-problems: correlate clusters through Inter-CLuster Association (ICLA), and correlate outlier through Inter-Outlier Association (IOA).

In each case, a graph is used to express similarity between either clusters or outliers. Each vertex is a cluster/outlier from any sub-space Un and each edge represents the fact that two connected vertices are similar. The underlying idea is straightforward: identify clusters or outliers present in different sub-spaces that contain the same flows. To do so, we first define a cluster similarity measure called CS between two clusters Cr and Cs: CS(Cr, Cs) = card(Cr \Cs) max(card(Cr ),card(Cs) , card being the function that associates a pattern set with its cardinality, and Cr \ Cs the intersection of Cr and Cs. Each edge in the cluster similarity graph between two Cr and Cs means CS(Cr, Cs) > 0.9, being this an empirically chosen value. The value 0.9 guarantees that the vast majority of patterns are located in both clusters with a small margin of error. IOA uses an outlier similarity graph built by linking every outlier to every other outlier that contains the same pattern. Once these graphs are built, we need to find cluster sets where every cluster contains the same flows. In terms of vertices, we need to find vertex sets where every vertex is linked to every other vertex. In graph theory, such vertex set is called a clique. The clique search problem is a NP-hard problem. Most existing solutions use exhaustive search inside the vertex set which is too slow for our application. We then make the hypothesis that a vertex can only be part of a single clique. A greedy algorithm is then used to build each clique. Anomalous flow set are finally identified as the intersection of all the flow sets present in the clusters or outliers within each clique.

CORRELATING ANOMALOUS TRAFFIC CLASSES 4.1 Address related correlation

Thanks to previous algorithm, we can detect several classes of illegitimate tra c, but these classes can appear in di↵erent aggregation levels. We know that such classes present at di↵erent levels can be related to each other. Indeed, two tra c classes in two di↵erent aggregation levels are related for example when their flows come from the same sources and go towards the same destinations. For a better characterization of tra c classes, it is then important to link classes corresponding to the same single anomaly. Correlating illegitimate tra c classes is a solution for that purpose; it is able to determine the similarity between classes at each aggregation level, for possibly grouping them if they belong to the same anomaly.

For estimating the similarity between two illegitimate traffic classes on two di↵erent aggregation levels, we use a comparison function. It relies on IP addresses comparison [START_REF] Mazel | Sub-space clustering, interclustering results association & anomaly correlation for unsupervised network anomaly detection[END_REF]. The comparison method then uses the IP source and destination addresses of the di↵erent tra c classes a1 and a2. It then compares source IP addresses with each other, and destination IP addresses with each other, using function [START_REF] Agrawal | Automatic subspace clustering of high dimensional data for data mining applications[END_REF].

Sim @ (@1, @2) = |@1 \ @2| max(|@1|, |@2|) (1)
where @n is a set of IP addresses, and |@n| the number of addresses in this set. It exists a similarity between two illegitimate tra c classes if equation ( 2) is true. tT SAddrSims is a threshold to be defined.

Simsrc(@1, @2) > tT SAddrSims ^Sim dest (@1, @2) > tT SAddrSims [START_REF] Barford | A signal analysis of network tra c anomalies[END_REF] This method as defined in our previous work [START_REF] Mazel | Sub-space clustering, interclustering results association & anomaly correlation for unsupervised network anomaly detection[END_REF] has some lacks, and especially because it does not consider time. It appears when testing this method on the Maryland data that some flows of the same class are separated in time by several months. It is then clear that it is not satisfactory to consider only IP addresses. For example, illegitimate tra c classes detailed in tables 2 and 3 are completely di↵erent from a behavior point of view. For the first class, the number of sent packets in each flow is around 54, whereas it is around 4 in the second class. In addition, the time difference between these sendings is around two months. The only similarity between these two classes is related to their source IP addresses (saddr), and destination IP addresses (daddr). In this case the similarity value between the two classes with the previous function is 66%, what is significantly high, and would indicate a strong link between them. Given the time at which they happened it is certainly not true, and malware infecting the machines are certainly not the same. As a consequence, we added temporal features to the correlation function.

Let us consider two illegitimate tra c classes a1 and a2. T1 and T2 are the set of time intervals in which traces of a1 and a2 appear. @ n 1 and @ n 2 are the set of source and destination IP addresses of classes a1 and a2 for the interval tn 2 T1. The new similarity function is then defined as:

SimT ime @ = X t2T 1 Sim @ (@ t 1 , @ t 2 ) max(|@ t 1 |, |@ t 2 |) (3)
However, if it exists time intervals between two classes, the similarity function equals a value very close from zero, whereas these two classes can be highly similar for other features. We then still need to keep in the computing of the similarity function the IP addresses of the anomaly classes a1 and a2. But the addresses must be computed intependentely from any temporal feature.

SimGlobal @ = Sim @ (@1, @2) max(|@1|, |@2|) (4)
We then obtain the simlarity function defined by equation [START_REF] Casas | Unada: Unsupervised network anomaly detection using sub-space outliers ranking[END_REF] ^(SimT imeDest(a1, a2) >

^(SimGlobalSrc(a1, a2) >

2)

^(SimGlobalDest(a1, a2) >

2)

(5)

The result of this function is a boolean value which is true if a1 and a2 are similar.

Time related correlation

Let's take again the examples of classes detailed in tables 2 and 3. It is clear that there is no link between these two classes because they happened at very di↵erent times. Let's apply equation ( 5). Let's consider IP addresses of the first class on February 1st at 2h40 am. Source IP addresses are 192.168.0.1 and 192.168.0.2. At that time, the second class is empty (it happened on April 10th to 13th). The similarity is then correctly estimated as false. By continuing with other times and the same method, we always obtain a false value for the similarity. The new similarity function then correctly does not find any similarity between these two illegitimate tra c classes.

Nevertheless, it is required with this new method to fix correct threshold values. If thresholds are not well selected returned values could be erroneous. With a small 1 value, each time a small temporal similarity will appear between two illegitimate classes, it will be the global similarity value that will determine the final similarity result between the two classes. If 1 is high, the two classes will be considered as similar if they sent packet almost at the same time, from the same source and to the same destinations. This is a strong constraint and forbids any time di↵erence in the sendings. The global similarity will then be of less importance. Based on our experience with the traces of University or Maryland, we empirically recommend to select for 1 a low threshold value, between 10% and 30%, and for 2 a threshold value greater than 25%.

Illegitimate tra c classes that appear as di↵erent after the sub-space clustering phase can then be grouped, as it is shown that they correspond to the same anomaly.

AUTOMATIC CHARACTERIZATION OF ANOMALIES

At this stage, the global tra c from and towards honeypots has been decomposed into tra c classes that exhibit di↵erent behaviors. Classification techniques of the Internet tra c have now to identify the type of each of these tra c classes, the generating application, or the type of attack or anomaly, each of these clusters is related to. Most advanced classification techniques, i.e. semi-supervised techniques, take advantage of signatures that specifically identify one of the possible tra c families, applications, or attacks. These signatures come either from a previous knowledge or expertise in this domain, either on a training stage on a known tra c, whose application components have already been labeled. This is obviously a strong requirement for classification purposes, but it remains a severe limit for designing a fully autonomous method.

However, in this work, at the opposite of what has been already done in the research area of autonomous tra c classification, this constraint does not exist because of the tra c nature that we have to analyze: illegitimate tra c. It is thus not needed to perfectly identify the anomaly kind (or attack), or to name it. Indeed, all tra c classes that have been isolated by the sub-space clustering algorithm, and evidence accumulation are anomalies or attacks. Therefore, the computing to be performed for each tra c anomaly or attack, in fine, consists in discarding them, after having identified any necessary feature required for instance for estimating the risk they represent in the Internet.

We then propose for this purpose to automatically generate the rules characterizing the anomaly classes. Based on these rules, it is easy to understand the anomalies characteristics and to infer the countermeasures to be performed (and of course, this can be done by a computer process).

At this stage, the sub-space clustering / evidence accumulation / correlation algorithm has identified several correlated anomalies containing a set of tra c flows in Y far out the rest of the tra c. The following task is to produce the appropriate filtering rules to correctly isolate and characterize each of these anomalies.

In order to produce filtering rules, the algorithm selects those sub-spaces Un where the separation between the considered anomalous flows and the rest of the tra c is the biggest. We define two di↵erent classes of filtering rule: absolute rules F RA(Y) and relative rules F RR(Y). Absolute rules do not depend on the separation between flows, and correspond to the presence of dominant features in the considered flows. An absolute rule for a certain feature j characterizing a certain flow set Yg has the form F RA(Yg, a) = {8y f 2 Yg ⇢ Y : x f (a) == }. For example, in the case of an ICMP flooding attack, the If two or more rules overlap (i.e., they are associated to the same feature), the algorithm keeps the one that covers the rest.

In order to construct a compact signature of the anomaly, we have to devise a procedure to select the most discriminant filtering rules. Absolute rules are important, because they define inherent characteristics of the anomaly. As regards relative rules, their relevance is directly tied to the degree of separation between anomalous and normal flows. In the case of outliers, we select the K features for which the Mahalanobis distance to the normal-operation tra c is among the top-K biggest distances. In the case of small-size clusters, we rank the relatives rules according to the degree of separation to the normal anomaly using the well-known Fisher Score (FS) which uses the variance in each cluster (normal and anomalous). To finally construct the signature, the absolute rules and the top-K relative rules are combined into a single inclusive predicate, using the covering relation in case of overlapping rules.

What follows gives a real example of the generation of filtering rules based on an anomaly characterization. It is depicted on Figure 1. Clusters 2 and 3 have their value nSyn/nPkts always equal to 1. It then exists for them an absolute rule {nSyn/nP kts == 1}.

On Figure 1, there exists a relative rule between cluster 1 and cluster 4. For generating it, we draw the median between clusters 1 and 4. Based on this median value, we can create the relative rule {nDif f DestAddr < 9}.

RISK BASED ANOMALIES RANKING

Estimating the risk related to an anomaly can help a security expert, in the general case, selecting the tra c classes that require to be computed in priority. In our specific case where all tra c classes identified are illegitimate, it can help to distinguish for instance between anomalies that are real attacks from scanning which in general just serves for preparing a possible future attack. In that case, the risk ranking can help superposing relative filtering rules, targeting in priority the most risky one.

The way our risk ranking is done depends on the amount of communication; the more communication in an anomaly or attack, the more risky. In addition, anomalies that appear in many sub-spaces are considered as more dangerous than the ones appearing in a single or on very few sub-spaces. Three features are considered for estimating the risk related to an anomaly. The first one is the number of packets of the anomaly, because, if there are many packets exchanged between the attacking and the victim machines, there exist potentially machines infected by a virus, or a flooding attack attempt. The second feature is the amount of bytes exchanged in the anomaly, because, even if the number of exchanged packets is reduced, a large amount of bytes could have been exchanged. This may correspond to the download of information from a victim machine by an attacker, or the upload of viruses on several victim machines from the attacker machine. Last, the third feature is the communication duration between the attacker and a target machine. The longer the communication duration, the more probable an attacker performing a download, or having an open shell on the victim machine.

The formula used for the risk estimation is: risk = C ⇤ (log(nP kts) + log(nBytes) + log(duration + 1)) (6) where C is the number of sub-spaces in which the anomaly appears, nP kts is the number of exchanged packets in the anomaly, nBytes is the number of exchanged bytes, and duration is the duration of the anomaly. +1 appears in log(duration + 1) for avoiding some errors as duration 2 R+ whereas (nP kts, nBytes) 2 R ⇤ + . The communication duration can be assimilated as zero because it can be so small that measurement devices can measure it as zero. On the other side, the number of packets or bytes are necessarily greater or equal to 1.

EXPERIMENTAL EVALUATION IN REAL TRAFFIC

We run the algorithm described in this paper on the honeypot tra c traces gathered at the University of Maryland. For obvious privacy reasons, as well as space limit, we will not present the complete set of attacks evidenced. But we will show on an example how the algorithm behaves, and how it succeed in classifying attacks and anomalies, how it builds the anomaly classes characteristics based on subspace clustering, evidence accumulation, and anomaly correlation. It also presents the filtering rules that have been autonomously generated and that can serve for automatically configuring security devices as filtering functions of routers, or firewalls. This section starts by showing the complete behavior of the algorithm applied on a single anomaly (designated as anomaly [327]). Figure 2 shows 5 sub-spaces in which anomalies mentioned in this section appear (all sub-spaces in which the anomaly appears are not depicted on figure 2 for space limit reason). On each of these sub-spaces, clusters clearly appear, each corresponding to di↵erent anomalies. Figure 3 shows the cliques that have been built for correlating the clusters found in di↵erent sub-spaces, and then linking the ones that correspond to the same anomaly or attack.

Anomaly [327] appears in Figure 2 on subspaces (d) with the blue cluster, and (e), with the green cluster corresponding to nRstnP kts = 0.5. At the end of the UNADA process, the algorithm generated the following signature that fully characterizes anomaly [327]:

Characteristics of attack [327]:

(nBytes/nF low < 93.6666666666667)^(nBytes/nF low > 74) ^(nDif f SrcAddr = 1) ^(nF in/nP kts = 0)( nF inT cp/nP ktsT cp = 0) ^(nP kts = 2) ^(nP ktsT cp = 2) ^(nRst/nP kts = 0.5) ^(nSyn/nP kts = 0.5)( nSynT cp/nP ktsT cp = 0.5) Thanks to this process that issues such a signature, it is easy for a security expert to analyze the anomaly: it corresponds to a well-known DoS attack which consists in requesting the opening of a new TCP connection by sending a SYN packet, and then a RST packet for closing it in an un-negociated way. It then makes the receiver allocate resources, and desallocate them immediately. The receiver is then overwhelmed with the slow operations it has to perform on the machine memory. The advantage with issuing automatically such signature is that the appropriate countermeasures which consists in blocking the related tra c can be performed automatically without the help of the network administrator who can then focus on trickiest attacks. The analysis of this anomaly is more tricky than the three previous ones. It does not correspond to a basic DoS attacks. It is nevertheless a kind of TCP flooding attack with an advanced strategy for targeting specific address and port ranges making it look like a legitimate application tra c. It then makes it di cult to detect with classical detection tools.

Anomaly [326] appears in

EXPERIMENTAL EVALUATION

Figure 4 depicts the True Positives Rate (TPR) as a function of the False Positives Rates (FTR) in the identification of the di↵erent attacks contained in the honeypot tra c traces from the University of Maryland. The presented results are based on a manual analysis of the detection and/or identification algrithms under evaluation. This manual analysis made possible labeling all attacks in the honeypot tra c of the University of Maryland. This set of labels serves for the evaluations as the reference ground truth. Actually, they permit an accurate evaluation of any detection, characterization or classification algorithm.

We compare the performance of UNADA against three previous approaches for unsupervised anomaly detection: DBSCAN-based, k-means-based, and PCA-based outliers detection. The first two consist in applying either DBSCAN or k-means to the complete feature space X, identify the largest cluster Cmax, and compute the Mahalanobis distance of all the flows lying outside Cmax to its centroid. The ROC is finally obtained by comparing the sorted distances to a variable detection threshold. These approaches are similar to those used in previous work [START_REF] Eskin | A geometric framework for unsupervised anomaly detection: Detecting intrusions in unlabeled data[END_REF][START_REF] Leung | Unsupervised anomaly detection in network intrusion detection using clustering[END_REF][START_REF] Portnoy | Intrusion detection with unlabeled data using clustering[END_REF]. In the PCA-based approach, PCA and the sub-space methods [START_REF] Lakhina | Mining anomalies using tra c feature distributions[END_REF][START_REF] Lakhina | Diagnosing network-wide tra c anomalies[END_REF] are applied to the complete matrix X, and the attacks are detected by comparing the residuals to a variable threshold. Both the k-means and the PCA-based approaches require fine tuning: in k-means, we repeat the clustering for di↵erent values of clusters k, and take the average results. In the case of PCA we present the best performance obtained for each evaluation scenario.

Obtained results permit to evidence the great advantage of using the SSC-Density-based algorithm in the clustering step with respect to previous approaches. In particular, all the approaches used in the comparison generally fail to detect all the attacks with a reasonable false alarm rate. Both the DBSCAN-based and the k-means-based algorithms get confused by masking features when analyzing the complete feature space X. The PCA approach shows to be not sensitive enough to discriminate di↵erent kinds of attacks of very di↵erent intensities, using the same representation for normal-operation tra c.

COMPUTATIONAL TIME AND PARAL-LELIZATION

The last issue that we analyze is the Computational Time (CT) of the algorithm. The SSC-EA-based algorithm performs multiple clusterings in N (m) low-dimensional subspaces Xi ⇢ X. This multiple computation imposes scalability issues for on-line detection of attacks in very-highspeed networks. Two key features of the algorithm are exploited to reduce scalability problems in number of features m and the number of aggregated flows n to analyze. Firstly, clustering is performed in very-low-dimensional subspaces, Xi 2 R 2 , which is faster than clustering in highdimensional spaces [START_REF] Jain | Data clustering: 50 years beyond k-means[END_REF]. Secondly, each sub-space can be clustered independently of the other sub-spaces, which is perfectly adapted for parallel computing architectures. Parallelization can be achieved in di↵erent ways: using a single multi-processor and multi-core machine, using networkprocessor cards and/or GPU (Graphic Processor Unit) capabilities, using a distributed group of machines, or combining these techniques. We shall use the term "slice" as a reference to a single computational entity.

Figures 5 and6 depict the CT of the SSC-EA-based algorithm, as a function of the number of features m used to describe tra c flows and as a function of the number of flows n to analyze, respectively. Figure 5 compares the CT obtained when clustering the complete feature space X, referred to as CT(X), against the CT obtained with SSC, varying m from 2 to 29 features. We analyze a large number of aggregated flows, n = 10 4 , and use two di↵erent number of slices, M = 40 and M = 100. The analysis is done with tra c from the WIDE network, combining di↵erent traces to attain the desired number of flows. To estimate the CT of SSC for a given value of m and M , we proceed as follows: first, we separately cluster each of the N = m(m 1)/2 sub-spaces Xi, and take the worst-case of the obtained clustering time as a representative measure of the CT in a single sub-space, i.e., CT(XSSCwc) = maxi CT(Xi). Then, if N 6 M , we have enough slices to completely parallelize the SSC algorithm, and the total CT corresponds to the worst-case, CT(XSSCwc). On the contrary, if N > M, some slices have to cluster various sub-spaces, one after the other, and the total CT becomes (N %M + 1) times the worst-case CT(XSSCwc), where % represents integer division. The first interesting observation from figure 5 regards the increase of CT(X) when m increases, going from about 8 seconds for m = 2 to more than 200 seconds for m = 29. As we said before, clustering in low-dimensional spaces is faster, which reduces the overhead of multiple clusterings computation. The second paramount observation is about parallelization: if the algorithm is implemented in a parallel computing architecture, it can be used to analyze large volumes of tra c using many tra c descriptors in an on-line basis; for example, if we use 20 tra c features and a parallel architecture with 100 slices, we can analyze 10000 aggregated flows in less than 20 seconds.

Figure 6 compares CT(X) against CT(XSSCwc) for an increasing number of flows n to analyze, using m = 20 tra c features and M = N = 190 slices (i.e., a completely parallelized implementation of the SSC-EA-based algorithm). As before, we can appreciate the di↵erence in CT when clustering the complete feature space vs. using low-dimensional sub-spaces: the di↵erence is more than one order of magnitude, independently of the number of flows to analyze. Regarding the volume of tra c that can be analyzed with this 100% parallel configuration, the SSC-EA-based algorithm can analyze up to 50000 flows with a reasonable CT, about 4 minutes in this experience. In the presented evaluations, the number of aggregated flows in a time slot of T = 20 seconds rounds the 2500 flows, which represents a value of CT(XSSCwc) ⇡ 0.4 seconds. For the m = 9 features that we have used (N = 36), and even without doing parallelization, the total CT is N ⇥ CT(XSSCwc) ⇡ 14.4 seconds.

CONCLUSION

This paper presents an unsupervised algorithm for classifying illicit tra c. This algorithm has several advantages compared to previous work: (i) it works in a completely unsupervised manner, what makes it able to work on top of any monitoring system, and directly usable, without preliminary configuration or knowledge. (ii) It combines robust clustering techniques to avoid classical issues of clustering algorithms, e.g. sensitivity to initial configuration, the required a priori indication of teh number of clusters to be identified, or the sensitivity of results when using less pertinent features. (iii) It automatically builds simple and small signatures fully characterizing attacks; theses signature can then be used in a filtering security device. (iv) It is designed to run in real time by making possible to take advantage of the parallelism of our clustering approach.

This algorithm thus opens new perspectives for performing a risk analysis in the Internet -taking advantage of honeypot tra c -and automatically configuring related filtering rules on routers, switches, or firewalls.

Figure 1 :

 1 Figure 1: The di↵erent filtering rules for sub-spaces (nSyn/nPkts, nDi↵DestAddr)

Figure 2 :

 2 Figure 2: Sub-spaces in which anomalies [44], [224], and [327] appear. These sub-spaces correspond to di↵erent IP address aggregation levels and di↵erent temporal granularities

Figure 3 :

 3 Figure 3: Two levels of cliques appearing when correlating anomalies in di↵erent sub-spaces

  Figure 2 on subspaces (d) with the blue cluster, and (e), with the green cluster. The algorithm generated the following signature that fully characterizes anomaly [326]: Characteristics of attack [326]: (avgSport < 21796)^(avgSport > 18635)^(nBytes/nF low < 93.6666666666667)^(nBytes/nF low > 74)^(nDif f SrcAddr = 1) ^(nP kts = 2) ^(nP ktsT cp = 2) ^(nRst/nP kts = 0.5) ^(nSyn/nP kts = 0.5) ^(nSynT cp/nP ktsT cp = 0.5) Anomaly [326] is very similar to anomaly [327]. It relies of the same principle of sending a SYN packet followed by a RST packet for uselessly exhausting receiver resources, and then performing a DoS attack. The only di↵erence is in the port numbers that origin the connection attempts. Anomaly [44] appears in Figure 2 on subspaces (b) with the black cluster corresponding to nSynnP kts = 1 and (c), with the pink cluster corresponding to nRstnP kts = 1. The algorithm generated the following signature that fully characterizes anomaly [44]: Characteristics of attack [44]: (bpp = 40) ^(nBytesnF low = 40) ^(nDif f DestAddr = 1) ^(nP kts = 1) ^(nP kts/nF low = 1) ^(nP ktsT cp = 1) ^(nRst/nP kts = 1) ^(nSyn/nP kts = 0) This anomaly is also very simple to analyze based on the issued signature. It also corresponds to a DoS attack called RST attacks which consists in sending RST packets in order to close ongoing connections. The last anomalies described in this paper is anomaly [224] that appears in Figure 2 on subspaces (c) and (e), on the red cluster with nRstnP kts = 0. The algorithm generated the following signature that fully characterizes anomaly [224]: Characteristics of attack [224]: (avgSport > 51209.3738990333)^(avgSport < 42107.1671947005)( bgstDestP ortT cp/tN bOccuDestP ortT cp < 262.25)( destP ortT cpM ax < 291) ^(destP ortT cpM in < 291) (nBytes > 19187.5)^(nBytes < 118272)^(nBytes/nF low > 843.428571428571)^(nBytes/nF low < 1425.16666666667)( nDif f DestP ort = 1)^(nDif f SrcAddr = 1)^(nDif f SrcP ort < 40.5) ^(nP kts > 198) ^(nP kts < 1200.5) ^(nP ktsIcmp = 0)^(nP kts/nF low > 21.5)^(nP kts/nF low < 11.3333333333333)( nP ktsU dp = 0) ^(nRst/nP kts = 0) ^(nSyn/nP kts > 0.115691489361702)^(nSyn/nP kts < 0.183333333333333)( nSynT cp/nP ktsT cp < 0.291666666666667)^(srcP ortT cpM ax < 61502) ^(srcP ortT cpM ax > 34033.5) ^(srcP ortT cpM in < 61502) ^(srcP ortT cpM in > 34033.5)

Figure 4 :

 4 Figure 4: True Positives Rate vs False Alarms.

  complete Feature Space Distributed Sub-Space Clustering, 40 slices Distributed Sub-Space Clustering, 100 slices

Figure 5 :

 5 Figure 5: Computational Time as a function of number of features to analyze. The number of aggregated flows is n = 10000.

Figure 6 :

 6 Figure 6: Computational Time as a function of number of flows to analyze. The number of features and slices is m = 20 and M = 190 respectively.

Table 1 :

 1 Feature used for the detection of DoS, DDoS, network/port scans, and spreading worms. Anomalies of distributed nature 1-to-N or N-to-1 involve several /24 (source or destinations) addresses contained in a single /16 address. , nPkts/sec > 1 , avgPktsSize < 2 , IPdst/⇤ Outlier (nICMP/nPkts > 3 _nSYN/nPkts > 4 ).

	Anomaly	Distributed nature	Aggregation type	Clustering result	Impact on tra c features
	DoS (ICMP _ SYN) nSrcs = nDsts = 1DDoS (ICMP _ SYN) 1-to-1 IPsrc/⇤ Outlier IPsrc/24 (l3) Cluster nDsts = 1, nSrcs > ↵1, nPkts/sec > ↵2, avgPktsSize < ↵3, N-to-1 to several @IP/24 IPsrc/16 (l4) Outlier (nICMP/nPkts > ↵4 _ nSYN/nPkts > ↵5). IPdst/⇤ Outlier
	Port scan	1-to-1	IPsrc/⇤ IPdst/⇤	Outlier Outlier	nSrcs = nDsts = 1, nDstPorts > 1 , avgPktsSize < 2 , nSYN/nPkts > 3 .
	Network scan to several @IP/24	1-to-1	IPsrc/⇤ IPdst/24 (l6) IPdst/16 (l7)	Outlier Cluster Outlier	nSrcs = 1, nDsts > 1 , nDstPorts > 2 , avgPktsSize < 3 , nSYN/nPkts > 4 .
	Spreading worms to several @IP/24	1-to-N	IPsrc/⇤ IPdst/24 (l6) IPdst/16 (l7)	Outlier Cluster Outlier	nSrcs = 1, nDsts > ⌘1, nDstPorts < ⌘2, avgPktsSize < ⌘3, nSYN/nPkts > ⌘4.

Table 2 :

 2 . First example of an illegitimate tra c class (IP addresses have been anonymised)

	month day hour min	saddr	daddr	nPkts nBytes nSyn/nPkts
	02	01	02	4	192.168.0.1, 192.168.0.2 172.16.4.16, 172.16.4.21	54	4726	0.1481481
	02	01	03	40	192.168.0.1, 192.168.0.3 172.16.4.16, 172.16.4.21	54	4869	0.1481481
	02	01	18	05	192.168.0.1, 192.168.0.3 172.16.4.16, 172.16.4.21	53	3996	0.0754717
	02	01	19	55	192.168.0.1, 192.168.0.2 172.16.4.16, 172.16.4.21	54	4545	0.1481481
	month day hour min	saddr	daddr	nPkts nBytes nSyn/nPkts
	04	10	01	30	192.168.0.1, 192.168.0.2 172.16.4.16, 172.16.4.21	5	20	1
	04	11	01	30	192.168.0.1, 192.168.0.3 172.16.4.16, 172.16.4.21	4	160	1
	04	12	01	30	192.168.0.1, 192.168.0.2 172.16.4.16, 172.16.4.21	5	20	1
	04	13	01	30	192.168.0.1	172.16.4.16, 172.16.4.21	4	160	1

Table 3 :

 3 Second example of an illegitimate tra c class (IP addresses have been anonymised)

	SimAnomalies(a1, a2) = (SimT imeSrc(a1, a2) >	1)

Acknowledgements

The author sincerely thanks Michel Cukier and Bertrand Sobesto for providing the tra c traces gathered on the honeypots of the University of Maryland. The author thanks Johan Mazel and Pedro Casas who have been first involved in the research work on the sub-space clustering algorithm applied to the full Internet tra c. The author also thanks Richard Turc who started this work on the analysis of the honeypot tra c during his master internship at LAAS. This work is supported by the ONTIC project, funded by the European commission under grant FP7-ICT-2013-11/619633.