![]() |
Fig.1 : Hierarchical Module of 'censoring sensors' change detector |
![]() |
Fig.2 : Wednesday, 12-Jan-2005 at 20:15 UTD:
Legend: The 4-week mean location (o) is connected to the current estimate (O) by a dashed red line (- - - -).
The shading of the circle is proportional to the residual value e_i: dark indicates high residual and white indicates
low residual. Event Description: There is a large anomaly of 71,000 flows at the STTL, LOSA, and SNVA routers.
These flows are single, 29-byte UDP packet flows from source IP address 163.30.88.0/21 (possibly tyc.edu.tw) to destination
IP address 134.71.24.0/21 (csupomona.edu, California Poly in Pomona). The packets are from source port 40150 to random
destination ports. Since the traffic was observed on LOSA, SNVA, and STTL but no other router, these routers are placed far
away to the West, while the rest of the routers, due to the constraint on total distances, are placed very close together.
|
![]() |
Fig. 3: Total traffic, and port 80 traffic on the Abilene Backbone on 05-Jan-2005,
displayed using the Java-based space-time traffic visualization applet.
The router map is calculated for 08:25 UTD, during scheduled maintenance of the CHIN-IPLS link, during which traffic drops at CHIN and
IPLS and increases dramatically at the HSTN and ATLA routers.
|