A Framework for Detection of Traffic Anomalies Based on IP Aggregation

Marat ZHANIKEEV  Yoshiaki TANAKA 

Publication
IEICE TRANSACTIONS on Information and Systems  Vol.E92-D  No.1  pp.16-23
Publication Date: 2009/01/01
Online ISSN: 1745-1361
Print ISSN: 0916-8532
Type of Manuscript: PAPER
Category: Networks
Keyword: 
traffic analysis,  IP aggregation,  anomaly detection,  performance monitoring,  network management, 

Full Text: PDF(734.9KB)

Summary: 
Traditional traffic analysis is can be performed online only when detection targets are well specified and are fairly primitive. Local processing at measurement point is discouraged as it would considerably affect major functionality of a network device. When traffic is analyzed at flow level, the notion of flow timeout generates differences in flow lifespan and impedes unbiased monitoring, where only n-top flows ordered by a certain metric are considered. This paper proposes an alternative manner of traffic analysis based on source IP aggregation. The method uses flows as basic building blocks but ignores timeouts, using short monitoring intervals instead. Multidimensional space of metrics obtained through IP aggregation, however, enhances capabilities of traffic analysis by facilitating detection of various anomalous conditions in traffic simultaneously.