Advertisement

An Efficient Approach for Analyzing Multidimensional Network Traffic

  • Jia Yang
  • Hao Ma
  • Bei Zhang
  • Ping Chen
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 5297)

Abstract

Identifying dominant network flows is important for network anomaly detection. Estan et al. proposed an algorithm that effectively detects dominant network flows by constructing multidimensional clusters based on a “natural hierarchy” existing in the five-tuple information of network flows. Wang et al. improved this algorithm by significantly reducing its computational complexity. In practice, however, the algorithm’s execution time may be relatively long when handling large volumes of traffic with a low threshold. In this paper, we introduce a practical technique that further improves the time efficiency of Wang et al.’s algorithm. Our approach simplifies network traffic’s hierarchical structure by utilizing local IP subnet information. The comparative performance of our approach and Wang et al.’s algorithm is evaluated using real NetFlow data collected at a large campus network. The experimental results demonstrate that our algorithm is much more time efficient than Wang et al.’s algorithm.

Preview

Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.

References

  1. 1.
    Cormode, G., Muthukrishnan, S.: Whats new: Finding significant differences in network data streams. In: Proc. IEEE INFOCOM, pp. 1219–1232 (2004)Google Scholar
  2. 2.
    Manku, G., Motwani, R.: Approximate frequency counts over data streams. In: Proc. Int. Conf. Very Large Databases, pp. 346–357 (2002)Google Scholar
  3. 3.
    Estan, C., Savage, S., Varghese, G.: Automatically Inferring Patterns of Resource Consumption in Network Traffic. In: SIGCOMM 2003, pp. 137–148 (2003)Google Scholar
  4. 4.
    Wang, J., Miller, D.J., Kesidis, G.: Efficient Mining of the Multidimensional Traffic Cluster Hierarchy for Digesting, Visualization, and Anomaly Identification. In: IEEE JSAC, pp. 1929–1941 (2006)Google Scholar
  5. 5.
    The eMule project, http://www.emule-project.net
  6. 6.
    PPlive website, http://www.pplive.com
  7. 7.
    Cisco website, http://www.cisco.com
  8. 8.
    Definition of DPI from Wikipekia wetsite, http://en.wikipedia.org/wiki/Deep_packet_inspection
  9. 9.
    Definition of CIDR from Wikipekia wetsite, http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing
  10. 10.
    Introduction to the main campus network of Peking University (in Chinese), http://www.pku.edu.cn/network/xyw/jj.htm
  11. 11.
    Definition of Directed Acyclic Graph from MathWorld website, http://mathworld.wolfram.com/AcyclicDigraph.html

Copyright information

© Springer-Verlag Berlin Heidelberg 2008

Authors and Affiliations

  • Jia Yang
    • 1
  • Hao Ma
    • 1
  • Bei Zhang
    • 1
  • Ping Chen
    • 1
  1. 1.Peking UniversityBeijingP.R. China

Personalised recommendations