A Framework for Detection of Traffic Anomalies Based on IP Aggregation

Yoshiaki TANAKA

IEICE TRANSACTIONS on Information and Systems   Vol.E92-D    No.1    pp.16-23
Publication Date: 2009/01/01
Online ISSN: 1745-1361
DOI: 10.1587/transinf.E92.D.16
Print ISSN: 0916-8532
Type of Manuscript: PAPER
Category: Networks
traffic analysis,  IP aggregation,  anomaly detection,  performance monitoring,  network management,  

Full Text: PDF(735.8KB)>>
Buy this Article

Traditional traffic analysis is can be performed online only when detection targets are well specified and are fairly primitive. Local processing at measurement point is discouraged as it would considerably affect major functionality of a network device. When traffic is analyzed at flow level, the notion of flow timeout generates differences in flow lifespan and impedes unbiased monitoring, where only n-top flows ordered by a certain metric are considered. This paper proposes an alternative manner of traffic analysis based on source IP aggregation. The method uses flows as basic building blocks but ignores timeouts, using short monitoring intervals instead. Multidimensional space of metrics obtained through IP aggregation, however, enhances capabilities of traffic analysis by facilitating detection of various anomalous conditions in traffic simultaneously.

open access publishing via