An adaptive flow counting method for anomaly detection in SDN

CoNEXT 2013 - Proceedings of the 2013 ACM International Conference on Emerging Networking Experiments and Technologies

Volumn , Issue , 2013, Pages 25-30

  Zhang, Ying ^a  

^a ERICSSON RESEARCH   (United States)

Author keywords

Network measurement; Software defined networking

Indexed keywords

IMPORTANCE SAMPLING; SOFTWARE DEFINED NETWORKING;

ADAPTIVE FLOW-COUNTING; ADAPTIVE ZOOMING; AGGREGATED INFORMATION; ANOMALY DETECTION; NETWORK MEASUREMENT; TEMPORAL DIMENSIONS; TRAFFIC ANOMALY DETECTIONS; TRAFFIC MONITORING;

FLOW MEASUREMENT;

EID: 84893368816     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/2535372.2535411     Document Type: Conference Paper

References (27)

1. T. ZSEBY, "Netflow."
2. M. WANG, B. LI, and Z. LI, "sflow: Towards resource-efficient and agile service federation in service overlay networks," in Prvc. ACM SIGCOMM, 2004.
3. B.-Y. CHOI, J. PARK, and Z.-L. ZHANG, "Adaptive random sampling for total load estimation," in In IEEE International Conference on Communications, 2003.
4. J. Mai, C.-N. Chuah, A. Sridharan, T. Ye, and H. Zang, "Is sampled data sufficient for anomaly detection?," in Proc. ACM SIGCOMM IMC, pp. 165-176, 2006.
5. C. ESTAN, K. KEYS, D. MOORE, and G. VARGH-ESE, "Building a better netflow," in Proc. ACM SIGCOMM, 2004.
6. N. McKeown, T. Anderson, H. Balakrishnan, G. Parulkar, L. Peterson, J. Rexford, S. Shenker, and J. Turner, "Openflow: enabling innovation in campus networks," SIGCOMM Comput. Commun. Rev., Vol. 38, pp. 69-74, March 2008.
7. "OpenFlow 1.1." http://www.openflow.org/wk/index.php/OpenFlow- v1.1.
8. A. R. Curtis, J. C. Mogul, J. Tourrilhes, P. Yalagandula, P. Sharma, and S. Banerjee, "Devoflow: scaling flow management for high-performance networks," SIGCOMM Comput. Commun. Rev., Vol. 41, pp. 254-265, August 2011.
9. M. Yu, L. Jose, and R. Miao, "Software defined traffic measurement with opensketch," in Proc. Symposium on Networked Systems Design and Implementation, 2013.
10. M. Moshref, M. Yu, and R. Govindan, "Resource/Accuracy Tradeoffs in Software-Defined Measurement," in Proceedings of HotSDN, August 2013.
11. L. Jose, M. Yu, and J. Rexford, "Online measurement of large traffic aggregates on commodity switches," in Proceedings of HotCloud, pp. 13-13, 2011.
12. M. Yu, J. Rexford, M. J. Freedman, and J. Wang, "Scalable flow-based networking with difane," in Proceedings of the ACM SIGCOMM 2010 conference, SIGCOMM '10, pp. 351-362, 2010.
13. P. Barford, J. Kline, D. Plonka, and A. Ron, "A signal analysis of network traffic anomalies," in Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment, IMW '02, pp. 71-82, 2002.
14. http://www.internet2.edu/network/.
15. L. Yuan, C.-N. Chuah, and P. Mohapatra, "Progme: towards programmable network measurement," in Proc. ACM SIGCOMM, pp. 97-108, 2007.
16. F. Khan, N. Hosein, C.-N. Chuah, and S. Ghiasi, "Streaming solutions for fine-grained network traffic measurements and analysis.," in ANCS, 2011.
17. V. Sekar, M. K. Reiter, W Willinger, H. Zhang, R. R. Kompella, and D. G. Andersen, "Csamp: a system for network-wide flow monitoring," in Proceedings of the 5th USENIX Symposium on Networked Systems Design and Implementation, NSDI'08, 2008.
18. C.-W Chang, G. Huang, B. Lin, and C.-N. Chuah, "Leisure: A framework for load-balanced network-wide traffic measurement.," in ANCS, 2011.
19. A. Lakhina, M. Crovella, and C. Diot, "Mining anomalies using traffic feature distributions," in Proc. ACM SIGCOMM, pp. 217-228, 2005.
20. J. D. Brutlag, "Aberrant behavior detection in time series for network monitoring," in Proceedings of the 14th USENIX conference on System administration, LISA '00, pp. 139-146, 2000.
21. D. Brauckhoff, B. Tellenbach, A. Wagner, M. May, and A. Lakhina, "Impact of packet sampling on anomaly detection metrics," in Proc. ACM SIGCOMM IMC, pp. 159-164, 2006.
22. A. Greenberg, G. Hjalmtysson, D. A. Maltz, A. Myers, J. Rexford, G. Xie, H. Yan, J. Zhan, and H. Zhang, "A clean slate 4d approach to network control and management," SIGCOMM Comput. Commun. Rev., Vol. 35, October 2005.
23. R. Sherwood, G. Gibb, K.-K. Yap, G. Appenzeller, M. Casado, N. McKeown, and G. Parulkar, "Can the production network be the testbed?," in Proceedings of the 9th USENIX conference on Operating systems design and implementation, OSDI'10, 2010.
24. R. Wang, D. Butnariu, and J. Rexford, "Openflow-based server load balancing gone wild," in Proceedings of the 11th USENIX conference on Hot topics in management of internet, cloud, and enterprise networks and services, Hot-ICE'11, 2011.
25. N. Foster, R. Harrison, M. J. Freedman, C. Monsanto, J. Rexford, A. Story, and D. Walker, "Frenetic: a network programming language," in Proceedings of the 16th ACM SIGPLAN international conference on Functional programming, ICFP '11, 2011.
26. M. Reitblatt, N. Foster, J. Rexford, and D. Walker, "Consistent updates for software-defined networks: change you can believe in!," in Proceedings of the 10th ACM Workshop on Hot Topics in Networks, HotNets-X, 2011.
27. F Huici, A. di Pietro, B. Trammell, J. M. Gomez Hidalgo, D. Martinez Ruiz, and N. d'Heureuse, "Blockmon: a high-performance composable network traffic measurement system," in Proc. ACM SIGCOMM, 2012.