Entropy based adaptive flow aggregation

IEEE/ACM Transactions on Networking

Volumn 17, Issue 3, 2009, Pages 698-711

  Hu, Ya ^a   Chiu, Dah Ming ^a   Lui, John C S ^a  

^a CHINESE UNIVERSITY OF HONG KONG   (Hong Kong)

Author keywords

Data summarization; Information theory; Network monitoring; Traffic measurement

Indexed keywords

ADAPTIVE FLOWS; ATTACK FLOW; CONFIGURABLE; CONTROL PROCESSORS; DATA SUMMARIZATION; INTERNET TRAFFIC; MEMORY USAGE; NETFLOW; NETWORK BANDWIDTH; NETWORK MONITORING; PERFORMANCE STUDY; REAL TIME; REAL TRACE; SAMPLING RATES; TRAFFIC MEASUREMENT; TRAFFIC RATE;

ADAPTIVE ALGORITHMS; BANDWIDTH; FLOW MEASUREMENT; FLOWMETERS; INFORMATION THEORY; INTERNET; MONITORING; TELECOMMUNICATION TRAFFIC; TRAFFIC SURVEYS;

NETWORK MANAGEMENT;

EID: 67650175988     PISSN: 10636692     EISSN: None     Source Type: Journal    
DOI: 10.1109/TNET.2008.2002560     Document Type: Article

References (27)

1. M. Roesch, "Snort: Lightweight intrusion detection for networks," in Proc. USENIX Systems Administration Conf. (LISA , Seattle, WA, 1999.
2. V. Paxson, "BRO: A system for detecting network intruders in real-time," in Proc. 7th USENIX Security Symp., San Antonio, TX, 1998.
3. K. McCloghrie and M. Rose, "Management information base for network management of TCP/IP-based Internets: MIB-II," RFC 1213, 1991.
4. C. Estan, K. Keys, D. Moore, and G. Varghese, "Building a better Net-Flow," in Proc. ACM SIGCOMM'04, Portland, OR, 2004.
5. IPFIX Flow Aggregation. Internet Draft [Online]. Available: http:// tools.ietf.org/html/draft-dressler-ipfix-aggregation-05.
6. C. Estan and G. Varghese, "New directions in traffic measurement and accounting," in Proc. ACM SIGCOMM'02, Pittsburgh, PA, 2002.
7. B.-Y. Choi, J. Park, and Z.-L. Zhang, "Adaptive random sampling for load change detection," in Proc. ACM SIGMETRICS'02 (Extended Abstract), Marina Del Rey, CA, 2002.
8. N. Duffield, C. Lund, and M. Thorup, "Estimating flow distributions from sampled flowstatistics," in Proc. ACMSIGCOMM '03, Karlsruhe, Germany, 2003.
9. N. Hohn and D. Veitch, "Inverting sampled traffic," in Proc. ACM Internet Measurement Conf. (IMC'03), Miami, FL, 2003.
10. D. Plonka, "Flowscan: A network traffic flow reporting and visualization tool," in Proc. USENIX Systems Administration Conf. (LISA), New Orleans, LA, 2000.
11. D. Moore, K. Keys, R. Koga, E. Lagache, and K. C. Claffy, "Coralreef software suite as a tool for system and network administrators," in Proc. USENIX Systems Administration Conf. (LISA), San Diego, CA, 2001.
12. C. Estan, S. Savage, and G. Varghese, "Automatically inferring patterns of resource consumption in network traffic," in Proc. ACM SIGCOMM'03 Karlsruhe, Germany, 2003.
13. K. Keys, D. Moore, and C. Estan, "A robust system for accurate real-time summaries of internet traffic," in Proc. ACM SIGMETRICS'05 Banff, Alberta, Canada, 2005.
14. Y. Zhang, M. Roughan, C. Lund, and D. Donoho, "An information-theoretic approach to traffic matrix estimation," in Proc. ACM SIGCOMM'03, Karlsruhe, Germany, 2003.
15. W. Lee and D. Xiang, "Information-theoretic measures for anomaly detection," in Proc. IEEE Symp. Security and Privacy, Oakland, CA, 2001.
16. K. Xu, Z. L. Zhang, and S. Bhattacharyya, "Profiling internet backbone traffic: Behavior models and applications," in Proc. ACM SIGCOMM'05 Philadelphia, PA, 2005.
17. Y. Gu, A. McCallum, and D. Towsley, "Detecting anomalies in network traffic using maximum entropy estimation," in Proc. ACM Internet Measurement Conf. (IMC'05), Berkeley, CA, 2005.
18. Y. Liu, D. Towsley, and T. Ye, "An information-theoretic approach to network monitoring and measurement," in Proc. ACM Internet Measurement Conf. (IMC'05), Berkeley, CA, 2005.
19. CERT Advisory CA-1998-01 Smurf IP Denial-of-Service Attacks. CERT Coordination Center. [Online]. Available: http://www.cert.org/advisories/ CA-1998-01.html
20. CERT Advisory CA-2003-04 MS-SQL Server Worm. CERT Coordination Center. [Online].Available: http://www.cert.org/advisories/CA-2003-04.html
21. CERT Advisory CA-2003-20 W32/Blaster Worm. CERT Coordination Center. [Online]. Available: http://www.cert.org/advisories/CA-2003-20.html
22. CERT Advisory CA-1996-21 TCP SYN Flooding and IP Spoofing Attacks. CERT Coordination Center. [Online]. Available: http://www.cert.org/advisories/ CA-1996-21.html
23. N. Duffield, C. Lund, and M. Thorup, "Charging from sampled network usage," in Proc. ACM SIGCOMM Internet Measurement Workshop, San Francisco, CA, 2001.
24. [Online]. Available: http://sourceforge.net/projects/fprobe
25. Y. Hu, D. M. Chiu, and J. Lui, "Adaptive flow aggregation - a new solution for robust flow monitoring under security attacks," in Proc. IEEE/IFIP Network Operations and Management Symp. (NOMS), Vancouver, Canada, 2006.
26. T. M. Cover and J. A. Thomas, Elements of Information Theory. New York: Wiley, 1991.
27. C. Estan, G. Varghese, and M. Fisk, "Bitmap algorithms for counting active flows on high speed links," in Proc. ACM Internet Measurement Conf. (IMC'03), Miami, FL, 2003.