Imperial College London

Professor Nick Heard

Faculty of Natural SciencesDepartment of Mathematics

Chair in Statistics



+44 (0)20 7594 1490n.heard Website




543Huxley BuildingSouth Kensington Campus






BibTex format

author = {Heard, N and Rubin-Delanchy, P and Lawson, D},
doi = {10.1109/JISIC.2014.52},
pages = {268--271},
publisher = {IEEE},
title = {Filtering automated polling traffic in computer network flow data},
url = {},
year = {2014}

RIS format (EndNote, RefMan)

AB - Detecting polling behaviour in a computer network has two important applications. First, the polling can be indicative of malware beaconing, where an undetected software virus sends regular communications to a controller. Second, the cause of the polling may not be malicious, since it may correspond to regular automated update requests permitted by the client, to build models of normal host behaviour for signature-free anomaly detection, this polling behaviour needs to be understood. This article presents a simple Fourier analysis technique for identifying regular polling, and focuses on the second application: modelling the normal behaviour of a host, using real data collected from the computer network of Imperial College London.
AU - Heard,N
AU - Rubin-Delanchy,P
AU - Lawson,D
DO - 10.1109/JISIC.2014.52
EP - 271
PY - 2014///
SP - 268
TI - Filtering automated polling traffic in computer network flow data
UR -
UR -
UR -
ER -