Situational Awareness and Network Traffic Analysis

Abstract

As network traffic increases, the problems associated with monitoring and analyzing the traffic on high speed networks become increasingly difficult. In this paper, we consider a variety of techniques for analyzing such data and using it to develop a variety of network views that reflect the status of the monitored environment. The powers of the monitoring approach and the analysis techniques is such that it is possible, on one hand, to identify network wide phenomena, and, on the other, to look at the behavior of individual network hosts.

This material is based upon work partially supported by the National Science Foundation under Grant No. 0326472. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of the National Science Foundation. This work is also supported by the Army Research Office through grant number DAAD190210389 (“Perpetually Available and Secure Information Systems”) to CyLab at Carnegie Mellon University. The first author's participation in the workshop where the material on which this paper is based was presented was partially supported by NATO.