Detection of anomalous network behavior based on one-way delay measurements

E. S. Sagatov; D. P. Chernysh; S. Mayhoub; A. M. Sukhov

doi:10.1007/s43926-025-00242-1

Detection of anomalous network behavior based on one-way delay measurements

E. S. Sagatov
, D. P. Chernysh
, S. Mayhoub
, A. M. Sukhov^*

^*Corresponding author for this work

Research output: Contribution to journal › Article › peer-review

1 Downloads (Pure)

Abstract

A global network monitoring system measuring IP network performance metrics (IPPM) is presented, which is proposed for use in network security. The monitoring system measures network latency and related values. The dependence of IPPM on the power of a DDoS attack is used to determine the moment of the attack. Another method of attack detection is to study changes in routes between measurement nodes. A change in route is accompanied by a sudden change in one-way delay (OWD). Recent reviews on OWD recommend the use of the One-way Active Measurement Protocol (OWAMP protocol). Studies have shown that using the OWAMP protocol to measure OWD gives two different results for the same route. An updated mechanism for measuring one-way delay has been proposed. The novelty of the method lies in the use of a new type of timestamp, which is set directly at the moment of sending and receiving the measurement packet. A new measurement utility has been created that eliminates measurement errors.

Original language	English
Article number	129
Number of pages	16
Journal	Discover Internet of Things
Volume	5
DOIs	https://doi.org/10.1007/s43926-025-00242-1
Publication status	Published - 10 Nov 2025

Bibliographical note

Copyright © The Author(s) 2025. This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit https://creativecommons.org/licenses/by-nc-nd/4.0/.

Funding

The research was funded by the grant Russian Science Foundation 24-29-00041.

Keywords

Measurement of one way delay
NetTestBox
Review of delay measurement utilities
Timescale synchronisation methods
Timestamps in Linux

Access to Document

10.1007/s43926-025-00242-1Licence: CC BY-NC-ND 4.0

Detection of anomalous network behavior based on one-way delay measurements
© The Author(s) 2025. This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.
Final published version, 466 KBLicence: CC BY-NC-ND 4.0

Cite this

@article{dc51494b5aa04e639148cc7b6f9b89bf,

title = "Detection of anomalous network behavior based on one-way delay measurements",

abstract = "A global network monitoring system measuring IP network performance metrics (IPPM) is presented, which is proposed for use in network security. The monitoring system measures network latency and related values. The dependence of IPPM on the power of a DDoS attack is used to determine the moment of the attack. Another method of attack detection is to study changes in routes between measurement nodes. A change in route is accompanied by a sudden change in one-way delay (OWD). Recent reviews on OWD recommend the use of the One-way Active Measurement Protocol (OWAMP protocol). Studies have shown that using the OWAMP protocol to measure OWD gives two different results for the same route. An updated mechanism for measuring one-way delay has been proposed. The novelty of the method lies in the use of a new type of timestamp, which is set directly at the moment of sending and receiving the measurement packet. A new measurement utility has been created that eliminates measurement errors.",

keywords = "Measurement of one way delay, NetTestBox, Review of delay measurement utilities, Timescale synchronisation methods, Timestamps in Linux",

author = "Sagatov, \{E. S.\} and Chernysh, \{D. P.\} and S. Mayhoub and Sukhov, \{A. M.\}",

note = "Copyright {\textcopyright} The Author(s) 2025. This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article{\textquoteright}s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article{\textquoteright}s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit https://creativecommons.org/licenses/by-nc-nd/4.0/.",

year = "2025",

month = nov,

day = "10",

doi = "10.1007/s43926-025-00242-1",

language = "English",

volume = "5",

}

TY - JOUR

T1 - Detection of anomalous network behavior based on one-way delay measurements

AU - Sagatov, E. S.

AU - Chernysh, D. P.

AU - Mayhoub, S.

AU - Sukhov, A. M.

N1 - Copyright © The Author(s) 2025. This article is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License, which permits any non-commercial use, sharing, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if you modified the licensed material. You do not have permission under this licence to share adapted material derived from this article or parts of it. The images or other third party material in this article are included in the article’s Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article’s Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit https://creativecommons.org/licenses/by-nc-nd/4.0/.

PY - 2025/11/10

Y1 - 2025/11/10

N2 - A global network monitoring system measuring IP network performance metrics (IPPM) is presented, which is proposed for use in network security. The monitoring system measures network latency and related values. The dependence of IPPM on the power of a DDoS attack is used to determine the moment of the attack. Another method of attack detection is to study changes in routes between measurement nodes. A change in route is accompanied by a sudden change in one-way delay (OWD). Recent reviews on OWD recommend the use of the One-way Active Measurement Protocol (OWAMP protocol). Studies have shown that using the OWAMP protocol to measure OWD gives two different results for the same route. An updated mechanism for measuring one-way delay has been proposed. The novelty of the method lies in the use of a new type of timestamp, which is set directly at the moment of sending and receiving the measurement packet. A new measurement utility has been created that eliminates measurement errors.

AB - A global network monitoring system measuring IP network performance metrics (IPPM) is presented, which is proposed for use in network security. The monitoring system measures network latency and related values. The dependence of IPPM on the power of a DDoS attack is used to determine the moment of the attack. Another method of attack detection is to study changes in routes between measurement nodes. A change in route is accompanied by a sudden change in one-way delay (OWD). Recent reviews on OWD recommend the use of the One-way Active Measurement Protocol (OWAMP protocol). Studies have shown that using the OWAMP protocol to measure OWD gives two different results for the same route. An updated mechanism for measuring one-way delay has been proposed. The novelty of the method lies in the use of a new type of timestamp, which is set directly at the moment of sending and receiving the measurement packet. A new measurement utility has been created that eliminates measurement errors.

KW - Measurement of one way delay

KW - NetTestBox

KW - Review of delay measurement utilities

KW - Timescale synchronisation methods

KW - Timestamps in Linux

UR - https://link.springer.com/article/10.1007/s43926-025-00242-1

UR - https://www.scopus.com/pages/publications/105021300943

U2 - 10.1007/s43926-025-00242-1

DO - 10.1007/s43926-025-00242-1

M3 - Article

AN - SCOPUS:105021300943

VL - 5

JO - Discover Internet of Things

JF - Discover Internet of Things

M1 - 129

ER -

Detection of anomalous network behavior based on one-way delay measurements

Abstract

Bibliographical note

Funding

Keywords

Access to Document

Other files and links

Fingerprint

Cite this