Network Monitoring Framework Research Articles

Co-Simulation Framework for Network Attack Generation and Monitoring

Co-Simulation Framework for Network Attack Generation and Monitoring

Optimizing in-band network telemetry problem

In-band network telemetry is a powerful framework for network monitoring. It allows the collection of telemetry data in real-time and provides network-wide visibility. However, depending on the routing of network flows and which telemetry data are collected, the network-wide visibility and the performance of monitoring applications may decrease. In this paper, we present the in-band network telemetry problem and extend the existing mathematical optimization models of the problem by proposing a new model that computes the routing of network flows. Results show that the new model outperforms existing models in term of network coverage and monitoring applications performance. The results of this work can be useful for network managers and enterprises to gain real-time insights into network performance.

Security and risk analysis in the cloud with software defined networking architecture

Cloud computing has emerged as the actual trend in business information technology service models, since it provides processing that is both cost-effective and scalable. Enterprise networks are adopting software-defined networking (SDN) for network management flexibility and lower operating costs. Information technology (IT) services for enterprises tend to use both technologies. Yet, the effects of cloud computing and software defined networking on business network security are unclear. This study addresses this crucial issue. In a business network that uses both technologies, we start by looking at security, namely distributed denial-of-service (DDoS) attack defensive methods. SDN technology may help organizations protect against DDoS assaults provided the defensive architecture is structured appropriately. To mitigate DDoS attacks, we offer a highly configurable network monitoring and flexible control framework. We present a dataset shift-resistant graphic model-based attack detection system for the new architecture. The simulation findings demonstrate that our architecture can efficiently meet the security concerns of the new network paradigm and that our attack detection system can report numerous threats using real-world network data.

Accurate and Efficient Monitoring for Virtualized SDN in Clouds

This paper presents V-Sight, a network monitoring framework for programmable virtual networks in clouds. Network virtualization based on software-defined networking (SDN-NV) in clouds makes it possible to realize programmable virtual networks; consequently, this technology offers many benefits to cloud services for tenants. However, to the best of our knowledge, network monitoring, which is a prerequisite for managing and optimizing virtual networks, has not been investigated in the context of SDN-NV systems. As the first framework for network monitoring in SDN-NV, we identify three challenges: non-isolated and inaccurate statistics, high monitoring delay, and excessive control channel consumption for gathering statistics. To address these challenges, V-Sight introduces three key mechanisms: 1) statistics virtualization for isolated statistics, 2) transmission disaggregation for reduced transmission delay, and 3) pCollector aggregation for efficient control channel consumption. The evaluation results reveal that V-Sight successfully provides accurate and isolated statistics while reducing the monitoring delay and control channel consumption in orders of magnitude. We also show that V-Sight can achieve a data plane throughput close to that of non-virtualized SDN.

Leveraging a Probabilistic PCA Model to Understand the Multivariate Statistical Network Monitoring Framework for Network Security Anomaly Detection

Network anomaly detection is a very relevant research area nowadays, especially due to its multiple applications in the field of network security. The boost of new models based on variational autoencoders and generative adversarial networks has motivated a reevaluation of traditional techniques for anomaly detection. It is, however, essential to be able to understand these new models from the perspective of the experience attained from years of evaluating network security data for anomaly detection. In this paper, we revisit anomaly detection techniques based on PCA from a probabilistic generative model point of view, and contribute a mathematical model that relates them. Specifically, we start with the probabilistic PCA model and explain its connection to the Multivariate Statistical Network Monitoring (MSNM) framework. MSNM was recently successfully proposed as a means of incorporating industrial process anomaly detection experience into the field of networking. We have evaluated the mathematical model using two different datasets. The first, a synthetic dataset created to better understand the analysis proposed, and the second, UGR'16, is a specifically designed real-traffic dataset for network security anomaly detection. We have drawn conclusions that we consider to be useful when applying generative models to network security detection.

Forest path condition monitoring based on crowd-based trajectory data analysis

The development of Road Information Acquisition Systems (RIASs) based on the Mobile Crowdsensing (MCS) paradigm has been widely studied for the last years. In that sense, most of the existing MCS-based RIASs focus on urban road networks and assume a car-based scenario. However, there exist a scarcity of approaches that pay attention to rural and country road networks. In that sense, forest paths are used for a wide range of recreational and sport activities by many different people and they can be also affected by different problems or obstacles blocking them. As a result, this work introduces SAMARITAN, a framework for rural-road network monitoring based on MCS. SAMARITAN analyzes the spatio-temporal trajectories from cyclists extracted from the fitness application Strava so as to uncover potential obstacles in a target road network. The framework has been evaluated in a real-world network of forest paths in the city of Cieza (Spain) showing quite promising results.

A Theoretical Framework for Network Monitoring Exploiting Segment Routing Counters

Self-driving networks represent the next step of network management techniques in the close future. A fundamental point for such an evolution is the use of Machine Learning based solutions to extract information from data coming from network devices during their activity. In this work we focus on a new type of data, available thanks to the definition of the novel SRv6 paradigm, referred to as SRv6 Traffic Counters ( SRTCs ). SRTCs provide aggregated measurements related to forwarding operations performed by SRv6 routers. In this work a detailed description of different SRTCs types (SR.INT, PISD, PSID.TM and POL) is provided and their relationships is formalized. The theoretical framework deployed is used to identify, on the basis of network configuration parameters of both SRv6 and IGP protocols, the minimum set of independent SRTCs to characterize the Network Status : we show that about the 80% of counters can be neglected with no information loss. We also apply our framework to two use cases: i) Traffic Matrix (TM) Assessment and ii) Traffic Anomaly Detection. For the TM assessment, we show that in a partially deployed SRv6 scenario a specific type of SRTCs , i.e., PSID, is more reliable than other ones; on the contrary, in a fully deployed scenario POL and PSID.TM counters provide the full TM knowledge. For the Traffic Anomaly Detection case, we show that known solutions based on link load measurements can be improved when integrating SRTCs information.

Network modeling and Internet of things for smart and connected health systems—a case study for smart heart health monitoring and management

Heart disease is a leading cause of death in the US. Recent advances in the Internet of Things (IoT) provide a great opportunity to realize smart and connected health systems through IoT monitoring and sensor-based data analytics of cardiac disorders. However, big data arising from the large-scale IoT system pose a significant challenge for efficient and effective sensory information processing and decision making. Very little has been done to glean pertinent information about the disease-altered cardiac activity in the context of large-scale IoT network. In this study, we propose a parallel computing framework for multi-level network modeling and monitoring of cardiac dynamics to realize the potential of IoT-enabled smart health management. Specifically, dissimilarities among cardiac signals are firstly characterized among heartbeats for an individual patient, as well as among representative heartbeats for different patients. Then, a stochastic learning approach is developed to optimize the embedding of cardiac signals into a beat-to-beat network model, as well as a patient-to-patient network model. Further, we develop a parallel computing algorithm to improve the computational efficiency. Finally, a statistical process monitoring scheme is designed to harness network features for real-time monitoring and anomaly detection of cardiac activities. Experimental results show the proposed methodology has strong potential to realize a smart and interconnected system for cardiac health management in the context of large-scale IoT network.

Real‐time and fine‐grained network monitoring using in‐band network telemetry

SummaryIn the modern era of software‐defined networking (SDN), network monitoring is becoming more important for providing information about a network and helping SDN controllers to make decisions about the network. In‐band Network Telemetry (INT) is a new network monitoring framework that collects packet‐level network information to provide real‐time and fine‐grained network monitoring. In this paper, we present the design of the overall INT management architecture and its two main components: the INT management system and INTCollector. The INT management system controls heterogeneous INT‐capable devices through a common interface. INTCollector is a high‐performance collector for INT data, which uses eXpress Data Path and an event detection mechanism. The evaluation result shows that INTCollector processes telemetry reports 27 times faster than other packet‐level telemetry collectors. We made the implementation as open source, to make researchers who are interested in INT implement their own ideas on top of our work.

Flexible sampling-based in-band network telemetry in programmable data plane

Abstract In-band network telemetry (INT) is an emerging network monitoring framework based on a protocol-independent packet processor (P4). Network devices can be programmed with a domain-specific language to embed switch-internal states into data packets as they traverse through networks. However, the current P4-based INT does not support a sampling; thus, INT headers should be augmented for all incoming packets, which will incur high overhead in a large-scale network. In this paper, we propose a flexible sampling-based INT (FS-INT) scheme to address the aforementioned issues. Simulation results show that FS-INT can reduce the protocol overhead in a controlled manner while providing sufficiently high accuracy.

Stream-Oriented Network Traffic Capture and Analysis for High-Speed Networks

Intrusion detection, traffic classification, and other network monitoring applications need to analyze the captured traffic beyond the network layer to allow for connection-oriented analysis, and achieve resilience to evasion attempts based on TCP segmentation. Existing network traffic capture frameworks, however, provide applications with raw packets and leave complex operations like flow tracking and TCP stream reassembly to application developers. This gap, between what applications need and what systems provide, leads to increased application complexity, longer development time, and most importantly, reduced performance due to excessive data copies between the packet capture subsystem and the stream processing module. This paper presents the Stream capture library (Scap), a network monitoring framework built from the ground up for stream-oriented traffic processing. Based on a kernel module that directly handles flow tracking and TCP stream reassembly, Scap delivers to user-level applications flow-level statistics and reassembled streams by minimizing data movement operations and discarding uninteresting traffic at early stages, while it inherently supports parallel processing on multi-core architectures, and uses advanced capabilities of modern network cards. Our experimental evaluation shows that Scap can capture all streams for traffic rates two times higher than other stream reassembly libraries. Finally, we present the implementation and performance evaluation of four popular network traffic monitoring applications built on top of Scap.

Network monitoring in the Tier2 site in Prague

Network monitoring provides different types of view on the network traffic. It's output enables computing centre staff to make qualified decisions about changes in the organization of computing centre network and to spot possible problems. In this paper we present network monitoring framework used at Tier-2 in Prague in Institute of Physics (FZU). The framework consists of standard software and custom tools. We discuss our system for hardware failures detection using syslog logging and Nagios active checks, bandwidth monitoring of physical links and analysis of NetFlow exports from Cisco routers. We present tool for automatic detection of network layout based on SNMP. This tool also records topology changes into SVN repository. Adapted weathermap4rrd is used to visualize recorded data to get fast overview showing current bandwidth usage of links in network.

MeshMon: a multi‐tiered framework for wireless mesh network monitoring

AbstractMonitoring and troubleshooting a large wireless mesh network (WMN) presents several challenges. Diagnosis of problems related to wireless access in these networks requires a comprehensive set of metrics and network monitoring data. Collection and offloading of a large amount of data are infeasible in a bandwidth constrained mesh network. Additionally, the processing required to analyze data from the entire network restricts the scalability of the system and impacts the ability to perform real‐time fault diagnosis. To this end, we propose MeshMon, a network monitoring framework that includes a multi‐tiered method of data collection. MeshMon, dynamically controls the granularity of data collection based on observed events in the network, thereby achieving significant bandwidth savings and enabling real‐time automated management. Our evaluation of MeshMon on a real testbed shows that we can diagnose a majority (87%) of network faults with a 66% savings in bandwidth required for network monitoring. Copyright © 2010 John Wiley & Sons, Ltd.

A flow-based network monitoring framework for wireless mesh networks

As an extension of wireless ad hoc and sensor networks, wireless mesh networks recently were developed as a key solution to provide high-quality multimedia services and applications, such as voice, data, and video, over wireless personal area networks, wireless local area networks, and wireless metropolitan area networks. A WMN has a hybrid network infrastructure with a backbone and an access network and usually is operated in both ad hoc and infrastructure modes with self-configuration and self-organization capabilities. In this article, we review security challenges, attacks, and countermeasures in the physical, medium access control (MAC), and network layers of wireless mesh backbone and access networks. We then extend the concept of traffic flow from IP networks and define meshflow in wireless mesh networks. Based on this new concept, we propose a comprehensive framework to realize network monitoring, user and router profiling, application and service balancing, and security protection in wireless mesh backbone networks. Practical issues and design trade-offs for implementing the proposed framework in real systems also are discussed.

Packet filter optimization techniques for high-speed network monitoring

Effective network monitoring is vital for a growing number of control and management applications typically found in present-day networks. The ever-increasing link speeds and the complexity of monitoring applications’ needs have exposed severe limitations of existing monitoring techniques. A majority of the current monitoring tasks require only a small subset of all observed packets, which share some common properties such as identical header fields or similar patterns in their data. In order to capture only these useful packets, a large set of expressions needs to be evaluated. This evaluation should be done as efficiently as possible when monitoring multi-gigabit networks. To speed up this packet classification process, this article presents different packet filter optimization techniques. Complementary to existing approaches, we propose an adaptive optimization algorithm which dynamically reconfigures the filter expressions based on the currently observed traffic pattern. The performance of the algorithms is validated both analytically and by means of the implementation in a network monitoring framework. The various characteristics of the algorithms are investigated, including their performance in an operational network intrusion detection system.