Fast monitoring of traffic subpopulations

Proceedings of the ACM SIGCOMM Internet Measurement Conference, IMC

Volumn , Issue , 2008, Pages 257-270

  Ramachandran, Anirudh ^a   Seetharaman, Srinivasan ^a   Feamster, Nick ^a   Vazirani, Vijay ^a  

^a Georgia Institute of Technology   (United States)

Author keywords

Counters; Flexsample; Sampling; Traffic statistics; Traffic subpopulations

Indexed keywords

CONVENTIONAL APPROACHES; COUNTER ARRAYS; COUNTERS; FLEXSAMPLE; HIGH-DEGREE NODES; HIGH-SPEED LINKS; NETWORK ACCOUNTINGS; NETWORK DEVICES; NETWORK OPERATORS; NETWORK TRAFFICS; PACKET HEADER FIELDS; PACKET SAMPLINGS; PERFORMANCE MONITORING; PORT SCANS; RANDOM SAMPLINGS; SAMPLING SCHEMES; TRAFFIC MONITORING; TRAFFIC SAMPLINGS; TRAFFIC STATISTICS; TRAFFIC SUBPOPULATIONS; VOLUME FLOWS;

APPLICATIONS; FORESTRY; INTERNET; MONITORING; ROUTERS; SEMICONDUCTING INTERMETALLICS; TRAFFIC SURVEYS;

SAMPLING;

EID: 63049111118     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1452520.1452551     Document Type: Conference Paper

References (45)

1. Idle-scanning and Related IPID Games. http://nmap.org/idlescan.html.
2. Original posting describing FTP bounce scan. http://nmap.org/hobbit. ftpbounce.txt.
3. Arbor Networks. http://www.arbornetworks.com.
4. P. Barford, J. Kline, D. Plonka, and A. Ron. A Signal Analysis of Network Traffic Anomalies. In Proc. ACM SIGCOMM Internet Measurement Workshop, Marseille, France, Nov. 2002.
5. D. Brauckhoff, B. Tellenbach, A. Wagner, A. Lakhina, and M. May. Impact of Traffic Sampling on Anomaly Detection Metrics. In Proc. ACM SIGCOMM Internet Measurement Conference, Rio de Janeiro, Brazil, Oct. 2006.
6. G. Cantieni, G. Iannaccone, P. Thiran, C. Barakat, and C. Diot. Reformulating the monitor placement problem: Optimal network-wide sampling. Intel Research Technical Report, Feb. 2006. [7] B.-Y. Choi and S. Bhattacharyya. On the Accuracy and Overhead of Cisco Sampled NetFlow. In Proceedings of ACM SIGMETRICS Workshop on Large Scale Network Inference (LSNI), June 2005.
7. K. C. Claffy, G. C. Polyzos, and H.-W. Braun. Application of sampling methodologies to network traffic characterization. In Proc. ACM SIGCOMM, pages 194-203, San Francisco, CA, Sept. 1993.
8. N. Duffield. A Framework for Packet Selection and Reporting. IETF Internet Draft draft-ietf-psamp-framework-12.txt, June 2007.
9. N. Duffield, C. Lund, and M. Thorup. Charging from Sampled Network Usage. In Proc. ACM SIGCOMM Internet Measurement Workshop, San Fransisco, CA, Nov. 2001.
10. N. Duffield, C. Lund, and M. Thorup. Estimating flow distributions from sampled flow statistics. In Proc. ACM SIGCOMM, pages 325-336, Karlsruhe, Germany, Aug. 2003.
11. N. Duffield, C. Lund, and M. Thorup. Predicting Resource Usage and Estimation Accuracy in an IP Flow Measurement Collection Infrastructure. In Proc. ACM SIGCOMM Internet Measurement Conference, pages 179-191, Miami, FL, Oct. 2003.
12. N. Duffield, F. L. Presti, V. Paxson, and D. Towsley. Inferring Link Loss Using Striped Unicast Probes. In Proc. IEEE INFOCOM, Anchorage, AK, Apr. 2001.
13. C. Estan, K. Keys, D. Moore, and G. Varghese. Building a Better NetFlow. In Proc. ACM SIGCOMM, Portland, OR, Aug. 2004.
14. C. Estan and G. Varghese. New directions in traffic measurement and accounting: Focusing on the elephants, ignoring the mice. ACM Transactions on Computer Systems, 21(3):270-313, Aug. 2003.
15. L. Fan, P. Cao, J. Almeida, and A. Z. Broder. Summary cache: A scalable wide-area Web cache sharing protocol. In Proc. ACM SIGCOMM, pages 254-265, Vancouver, Canada, Sept. 1998.
16. A. Feldmann, A. Greenberg, C. Lund, N. Reingold, J. Rexford, and F. True. Deriving Traffic Demands for Operational IP Networks: Methodology and Experience. IEEE/ACM Transactions on Networking, 9(3):257-270, June 2001.
17. N. Hohn and D. Veitch. Inverting sampled traffic. In Proc. ACM SIGCOMM Internet Measurement Conference, Miami, FL, Oct. 2003.
18. Y. Huang and J. Pullen. Countering Denial of Service Attacks using Congestion Triggered Packet Sampling and Filtering. In Proceedings of International Conference on Computer Communications and Networks, pages 490-494, 2001.
19. InMon sFlow. http://www.inmon.com/technology.
20. Juniper traffic sampling and forwarding overview. http://www.juniper.net/ techpubs/software/junos/junos71/swconfig71-policy/html/sampling-overview.html.
21. T. Karagiannis, K. Papagiannaki, and M. Faloutsos. BLINC: multilevel traffic classification in the dark. In Proc. ACM SIGCOMM, pages 229-240, Philadelphia, PA, Aug. 2005.
22. R. Kompella and C. Estan. The Power of Slicing in Internet Flow Measurement. In Proc. ACM SIGCOMM Internet Measurement Conference, Berkeley, CA, Oct. 2005.
23. A. Kumar, M. Sung, J. Xu, and J. Wang. Data streaming algorithms for efficient and accurate estimation of flow size distribution. In Proc. ACM SIGMETRICS, pages 177-188, New York, NY, June 2004.
24. A. Kumar, M. Sung, J. Xu, J. Wang, and E. W. Zegura. A Data Streaming Algorithm for Estimating Subpopulation Flow Size Distribution. In Proc. ACM SIGMETRICS, Banff, Canada, June 2005.
25. A. Kumar and J. Xu. Sketch Guided Sampling - Using On-Line Estimates of Flow Size for Adaptive Data Collection. In Proc. IEEE INFOCOM, Barcelona, Spain, Mar. 2006.
26. Y. Lu, S. Dharmapurikar, A. K. Kabbani, A. Montanari, and B. Prabhakar. Counter Braids: An Efficient Minimum-Space Statistics Counter Architecture. In To appear in the Proceedings of ACM SIGMETRICS, June 2008.
27. H. V. Madhyastha and B. Krishnamurthy. A Generic Language for Application-Specific Flow Sampling. ACM Computer Communication Review, 38(2), April 2008.
28. J. Mai, C.-N. Chuah, A. Sridharan, T. Ye, and H. Zang. Is Sampled Data Sufficient for Anomaly Detection? In Proc. ACM SIGCOMM Internet Measurement Conference, Rio de Janeiro, Brazil, Oct. 2006.
29. G. Maier, R. Sommer, H. Dreger, A. Feldmann, V. Paxson, and F. Schneider. Enriching Network Security Analysis with Time Travel. In Proc. ACM SIGCOMM, Seattle, WA, Aug. 2008.
30. Cisco NetFlow. http://www.cisco.com/en/US/products/ps6601/products-ios- protocol-group-home.html.
31. A. Ramachandran and N. Feamster. Understanding the network-level behavior of spammers. In Proc. ACM SIGCOMM, Pisa, Italy, Sept. 2006. An earlier version appeared as Georgia Tech TR GT-CSS-2006-001.
32. H. Ringberg, A. Soule, and M. Caeser. Behavior Of Bots In Traffic Traces. Technical report, Princeton University, 2008. Number forthcoming.
33. L. A. Sanchez, W. C. Milliken, A. C. Snoeren, F. Tchakountio, C. E. Jones, S. T. Kent, C. Partridge, and W. T. Strayer. Hardware Support for a Hash-Based IP Traceback. In Proceedings of DARPA Information Survivability Conference and Exposition (DISCEX), 2001.
34. V. Sekar, M. K. Reiter, W. Willinger, H. Zhang, R. R. Kompella, and D. G. Andersen. cSamp: A system for network-wide flow monitoring. In Proc. 5th USENIX NSDI, San Francisco, CA, Apr. 2008.
35. H. Song, S. Dharmapurikar, J. Turner, and J. Lockwood. Fast Hash Table Lookup Using Extended Bloom Filter: An Aid To Network Processing. In Proc. ACM SIGCOMM, Philadelphia, PA, Aug. 2005.
36. G. Varghese. Network Algorithmics: An Interdisciplinary Approach to Designing Fast Networked Devices. Morgan Kaufmann Publishers Inc., 2004.
37. F. Vaskovich. Nmap stealth port scanner. http://www.insecure.org/nmap/ index.html, 2002.
38. Average spam message size at record low. http://www.virusbtn.com/news/ 2008/04-03a.xml?rss
39. Report: 95 percent of all email has that spammy smell. http://arstechnica.com/news.ars/post/20071212-report-95-percent-of-all-e-mail- has-that-spammy-smell.html.
40. K. Xu, Z.-L. Zhang, and S. Bhattacharyya. Profiling Internet Backbone Traffic: Behavior Models and Applcations. In Proc. ACM SIGCOMM, Philadelphia, PA, Aug. 2005.
41. B. Yang, R. Karri, and D. A. McGrew. Divide and Concatenate: An Architectural Level Optimization Technique for Universal Hash Functions. In Proceedings of the Design Automation Conference, San Diego, CA, 2004.
42. L. Yuan, C.-N. Chuah, and P. Mohapatra. ProgME: Towards Programmable Network MEasurement. In Proc. ACM SIGCOMM, Kyoto, Japan, Aug. 2007.
43. Y. Zhang, M. Roughan, C. Lund, and D. Donoho. An Information-Theoretic Approach to Traffic Matrix Estimation. In Proc. ACM SIGCOMM, pages 301-312, Karlsruhe, Germany, Aug. 2003.
44. Y. Zhang, S. Singh, S. Sen, N. Duffield, and C. Lund. Online Identification of Hierarchical Heavy Hitters: Algorithms, Evaluation, and Applications. In Proc. ACM SIGCOMM Internet Measurement Conference, Taormina, Sicily, Italy, Oct. 2004.
45. T. Zseby, M. Molina, N. Duffield, S. Niccolini, and F. Raspall. Sampling and Filtering Techniques for IP Packet Selection, Internet-Draft, draft-ietf-psamp-sample-tech-07.txt, Work in Progress, 2005.