An Efficient Approach for Analyzing Multidimensional Network Traffic

摘要：

Identifying dominant network flows is important for network anomaly detection.Estan et al.proposed an algorithm that effectively detects dominant network flows by constructing multidimensional clusters based on a natural hierarchy existing in the five-tuple information of network flows.Wang et al.improved this algorithm by significantly reducing its computational complexity.In practice,however,the algorithms execution time may be relatively long when handling large volumes of traffic with a low threshold.In this paper,we introduce a practical technique that further improves the time efficiency of Wang et al.s algorithm.Our approach simplifies network traffics hierarchical structure by utilizing local IP subnet information.The comparative performance of our approach and Wang et al.s algorithm is evaluated using real NetFlow data collected at a large campus network.The experimental results demonstrate that our algorithm is much more time efficient than Wang et al.s algorithm.

作者: Jia Yang Hao Ma Bei Zhang Ping Chen

作者单位: Peking University,Beijing 100871,P.R.China

会议类型: 国际会议

会议名称: 11th Asia-Pacific Network Operations and Management Symposium(APNOMS 2008)(第十一届亚太网络运行和管理国际研讨会)

会议地点: 北京

会议语种:英文

页码: 227-235

在线出版日期: 2008-10-22（万方平台首次上网日期，不代表论文的发表时间）