Paul Barford Research Group

University of Wisconsin-Madison

How can Internet traffic measurements detect and distinguish malicious attacks, fraud, and traffic anomalies in real time? The group measures and analyzes Internet data, communication protocols, and network topology to quantify normal and abnormal behaviors. Researchers develop and evaluate detection techniques for fraud, traffic anomalies, and intrusions using large-scale datasets and analytic methods to identify patterns of malicious activity. The lab operates experimental infrastructure and software for collecting network measurements and producing datasets used to test detection algorithms. Studies combine protocol-level analysis, topological measurement, and anomaly detection to improve understanding of Internet security and measurement accuracy.