Network Traffic Monitoring Research Articles

Identifying P2P traffic: A survey

Peer-to-Peer (P2P) traffic is widely used for the purpose of streaming media, file-sharing, instant messaging, games, software etc., which often involves copyrighted data. From the past decade, P2P traffic has been contributing to major portion of Internet traffic which is still rising and hence is consuming a lot of network traffic bandwidth. It also worsens congestion of network traffic significantly and degrades the performance of traditional client–server applications. Popularity of various P2P applications has led Internet Service Providers (ISPs) to face various challenges regarding efficiently and fairly utilizing network resources. The traditional methods of identifying P2P traffic such as port-based and payload-based are proving ineffective due to their significant limitations and can be bypassed. Hence, new approaches based on statistics or behaviour of network traffic needs to be developed and adopted in order to accurately identify existing and new P2P traffic which emerge over the time. This article presents a survey regarding various strategies involved in identifying P2P traffic. Furthermore, conceptual analysis of network traffic measurement and monitoring is also presented.

DBStream: A holistic approach to large-scale network traffic monitoring and analysis

In the last decade, many systems for the extraction of operational statistics from computer network interconnects have been designed and implemented. Those systems generate huge amounts of data of various formats and in various granularities, from packet level to statistics about whole flows. In addition, the complexity of Internet services has increased drastically with the introduction of cloud infrastructures, Content Delivery Networks (CDNs) and mobile Internet usage, and complexity will continue to increase in the future with the rise of Machine-to-Machine communication and ubiquitous wearable devices. Therefore, current and future network monitoring frameworks cannot rely only on information gathered at a single network interconnect, but must consolidate information from various vantage points distributed across the network.In this paper, we present DBStream, a holistic approach to large-scale network monitoring and analysis applications. After a precise system introduction, we show how its Continuous Execution Language (CEL) can be used to automate several data processing and analysis tasks typical for monitoring operational ISP networks. We discuss the performance of DBStream as compared to MapReduce processing engines and show how intelligent job scheduling can increase its performance even further. Furthermore, we show the versatility of DBStream by explaining how it has been integrated to import and process data from two passive network monitoring systems, namely METAWIN and Tstat. Finally, multiple examples of network monitoring applications are given, ranging from simple statistical analysis to more complex traffic classification tasks applying machine learning techniques using the Weka toolkit.

CVS: Fast cardinality estimation for large-scale data streams over sliding windows

Estimating the cardinality of data streams over a sliding window is an important problem in many applications, such as network traffic monitoring, web access log analysis and database. The problem becomes more difficult in large-scale data streams when time and space complexity is taken into account. In this paper, we present a novel randomized data structure to address the problem. The significant contributions are as follows: (1) A space-efficient counter vector sketch (CVS) are proposed, which extends the well-known bitmap sketch to sliding window settings. (2) Based on the CVS, a random update mechanism is introduced, whereby a small fixed number of entries are randomly chosen from CVS in a step and then updated. This means that the update procedure just costs constant time. (3) Furthermore, estimating cardinality by CVS just needs one-pass scan of the data. (4) Finally, a theoretical analysis is given to show the accuracy of CVS-based estimators. Our comprehensive experiments confirm that the CVS-based schema attains high accuracy, and demonstate its time efficiency in comparison with the Timestamp Vector (TSV) and the auxiliary indexing method.

DDoS Attack Analyzer: Using JPCAP and WinCap

Nowadays, Computers and their Networks leads to being complex and diverse systems that communicate with speed and flexible. There is always room for sophisticated and highly specific network/Packet analyzing tool. Network traffic monitoring is not as straight as they written in theory but also leads to many trends changing changes. Tools are also able to provide the statics and graphic representation of risk and reports. While developing the tools, it is highly important to understand the intrusion attacks conditions, network protocols and systems behavior, the intension of user and user conformability. We are proposing the network traffic detection and analyzing tools that mainly focus on the DDoS attack. We are using JPCAP packet capturing library with WinCap for Detection and analysis of network traffic on a prime target of DDoS Attack.

Combat-Sniff: A Comprehensive Countermeasure to Resist Data Plane Eavesdropping in Software-Defined Networks

Software-defined networking (SDN), on account of its unprecedented capability of network traffic monitoring and data resource transferring, has been deployed into a wide range of application scenarios. However, typical cyber-attacks which prevail in traditional IP networks, have also mutated their implementation models adjusting to SDN environment. Eavesdropping is one of such attacks and causes severe information disclosure to different degree. In this paper, we focus on data plane eavesdropping in SDN and treat it on two levels according to the extent an adversarial sniffer can exploit a SDN switch. Then we introduce Combat-Sniff, a comprehensive countermeasure which includes two methods to deal with the two-level sniffing respectively. And later, we both theoretically and experimentally demonstrate their reliability and performance. Results represent that we can exert Combat-Sniff in SDN to satisfy different security requirements with an acceptable overhead.

メタデータ照合型ネットワーク解析システム‘MANACO’を用いた医療情報通信観測に関する提案

メタデータ照合型ネットワーク解析システム‘MANACO’を用いた医療情報通信観測に関する提案

Simulation of the Subject-Object Interaction in Network Infrastructures

The problem of identification of the different aspects of the interacting objects in-formation and telecommunication networks (ITN) on the results of network traffic monitoring is analyzed. As a solution to this problem in terms of identifying the types of network facilities and operations interaction graph model of behavior is proposed, in terms of relations disclosure of anonymity interacting objects predicate state model objects ITN based on the relationship between instances is offered.

Study of Data Stream Clustering Based on MSF

Nowadays with the rapid development of wireless sensor networks, and network traffic monitoring, stream data gradually becomes one of the most popular data models. Stream data is different from the traditional static data. Clustering analysis is an important technology for data mining, so that many researchers pay their attention to the clustering of stream data. In this paper, MSFS algorithm is proposed. By means of the experimental verification analysis, based on biologically inspired computational model, higher clustering purity on both the real dataset and the simulation datasets existence is demonstrated for the proposed algorithm. In other words, the cluster result of MSFS algorithm is advantageous over previous method.

Multilevel Bloom Filters for P2P Flows Identification Based on Cluster Analysis in Wireless Mesh Network

With the development of wireless mesh networks and distributed computing, lots of new P2P services have been deployed and enrich the Internet contents and applications. The rapid growth of P2P flows brings great pressure to the regular network operation. So the effective flow identification and management of P2P applications become increasingly urgent. In this paper, we build a multilevel bloom filters data structure to identify the P2P flows through researches on the locality characteristics of P2P flows. Different level structure stores different numbers of P2P flow rules. According to the characteristics values of the P2P flows, we adjust the parameters of the data structure of bloom filters. The searching steps of the scheme traverse from the first level to the last level. Compared with the traditional algorithms, our method solves the drawbacks of previous schemes. The simulation results demonstrate that our algorithm effectively enhances the performance of P2P flows identification. Then we deploy our flow identification algorithm in the traffic monitoring sensors which belong to the network traffic monitoring system at the export link in the campus network. In the real environment, the experiment results demonstrate that our algorithm has a fast speed and high accuracy to identify the P2P flows; therefore, it is suitable for actual deployment.

The Design of Computer Network Traffic Monitoring System

With the rapid development of Internet and the growing, today's network structure complexity is increasing day by day, network scale, network security has gradually become the focus of attention. To build a stable and secure network management system naturally become the focus of attention, one of network traffic monitoring system is one of the important means. The network traffic load monitoring system from the perspective of packet traffic analysis, through real-time information collection and monitor network packets, to check the network performance. It is help to monitor and analysis the network running status, improve the efficiency of network management and network security status, having a basic and decisive significance.

Research on P2P Traffic Monitoring System Based on DPI Technology

This paper focuses on the key technologies of P2P technology and network traffic monitoring, which focuses on AC automaton and bypass interference control technology, and on based of it, we design a new P2P traffic monitoring system. The system uses DPI and DFI recognition technology, as well as straight loss and bypass interference control technology, basically meet the recognition and control of P2P traffic. Finally, the test results show that this system recognition accuracy of P2P traffic is high, good control effect, function and performance meet the design requirements.

Stream-Oriented Network Traffic Capture and Analysis for High-Speed Networks

Intrusion detection, traffic classification, and other network monitoring applications need to analyze the captured traffic beyond the network layer to allow for connection-oriented analysis, and achieve resilience to evasion attempts based on TCP segmentation. Existing network traffic capture frameworks, however, provide applications with raw packets and leave complex operations like flow tracking and TCP stream reassembly to application developers. This gap, between what applications need and what systems provide, leads to increased application complexity, longer development time, and most importantly, reduced performance due to excessive data copies between the packet capture subsystem and the stream processing module. This paper presents the Stream capture library (Scap), a network monitoring framework built from the ground up for stream-oriented traffic processing. Based on a kernel module that directly handles flow tracking and TCP stream reassembly, Scap delivers to user-level applications flow-level statistics and reassembled streams by minimizing data movement operations and discarding uninteresting traffic at early stages, while it inherently supports parallel processing on multi-core architectures, and uses advanced capabilities of modern network cards. Our experimental evaluation shows that Scap can capture all streams for traffic rates two times higher than other stream reassembly libraries. Finally, we present the implementation and performance evaluation of four popular network traffic monitoring applications built on top of Scap.

Efficient Flow Sampling With Back-Annotated Cuckoo Hashing

One of the applications of network traffic monitoring is to detect anomalies and security threats. Due to the huge number of packets that traverse networks, monitoring is typically implemented by sampling the traffic. Sampling can be done per packet or per flow. For flow sampling, the decision to select a flow can be purely random or based on some properties of the flows. In this later case, each incoming packet has to be compared against the set of flows being monitored to determine if the packet belongs to any of those flows. This matching can be implemented using a content addressable memory (CAM) or hash based data structures. Among those, one option is Cuckoo hashing that provides good memory utilization and a deterministic worst number of memory accesses. However, in the case of flow sampling, most packets will not belong to any of the flows being monitored. Therefore, all tables will be accessed and the worst case number of accesses will be required thus reducing throughput. In this letter, a technique to reduce the average number of accesses to search for items that are not stored in the Cuckoo hash is proposed and evaluated. The results show that the proposed scheme can significantly reduce the average number of accesses in a flow sampling application. This means that the technique can be used to increase the throughput substantially.

Monitoring and analyzing big traffic data of a large-scale cellular network with Hadoop

Network traffic monitoring and analysis is of theoretical and practical significance for optimizing network resource and improving user experience. However, existing solutions, which usually rely on a high-performance server with large storage capacity, are not scalable for detailed analysis of a large volume of traffic data. In this article, we present a traffic monitoring and analysis system for large-scale networks based on Hadoop, an open-source distributed computing platform for big data processing on commodity hardware. This system has been deployed in the core network of a large cellular network and extensively evaluated. The results demonstrate that the system can efficiently processes 4.2 Tbytes of traffic data from 123 Gb/s links with high performance and low cost every day.

Flow Measurement and Control System in the Campus Network

A campus network traffic monitoring and control systems, the use of P2P software as an application in the form of a new campus network, to break the existing information services on the Internet is mainly used in the client / server model, P2P applications can accurately identify the flow control device, on the campus network bandwidth rational planning and adjustment of P2P traffic bandwidth limitations and management, improve the quality of Internet users.

Design and Realization of the Computer Network Traffic Monitoring

This paper studies the computer network traffic related subjects background first, and analyzes the research status quo of network traffic monitoring, putting forward the main content and the research target. This paper introduces the key technology, network traffic monitoring system for the topological design and analysis of computer network traffic monitoring system, computer network traffic monitoring system for the overall design, network traffic monitoring has been basically achieved demand. From the point of view of network users and network operators, network traffic monitoring can improve the scientific and rationality of network management having important research value.

The Analysis and Design of the Computer Network Traffic Monitor

The important work of the network management in real-time network monitoring, network monitoring network traffic, the state, the collection of behavioral information, the information will be collected for statistical analysis, network traffic status data, and network traffic information collected includes dynamic information and static information, on this basis, conducted a study of network traffic monitoring and management system.

A Study on the WAN Network Traffic Monitoring

Network traffic monitoring, analysis, and anomaly detection have become a very active research area in the networking community over the past few years. Traffic monitoring and analysis is essential in order to more effectively troubleshoot and resolve issues when they occur, so as to not bring network services to a stand still for extended periods of time. This paper discusses router based monitoring techniques in the WAN traffic monitoring. It gives an overview of the two most widely used router based network monitoring tools available (SNMP, cisco netflow), and provides an example about the netflow technology.

Big Data Analytics framework for Peer-to-Peer Botnet detection using Random Forests

Network traffic monitoring and analysis-related research has struggled to scale for massive amounts of data in real time. Some of the vertical scaling solutions provide good implementation of signature based detection. Unfortunately these approaches treat network flows across different subnets and cannot apply anomaly-based classification if attacks originate from multiple machines at a lower speed, like the scenario of Peer-to-Peer Botnets.In this paper the authors build up on the progress of open source tools like Hadoop, Hive and Mahout to provide a scalable implementation of quasi-real-time intrusion detection system. The implementation is used to detect Peer-to-Peer Botnet attacks using machine learning approach. The contributions of this paper are as follows: (1) Building a distributed framework using Hive for sniffing and processing network traces enabling extraction of dynamic network features; (2) Using the parallel processing power of Mahout to build Random Forest based Decision Tree model which is applied to the problem of Peer-to-Peer Botnet detection in quasi-real-time. The implementation setup and performance metrics are presented as initial observations and future extensions are proposed.

On monitoring and predicting mobile network traffic abnormality

Traffic analysis and traffic abnormality detection are emerged as an efficient way of detecting network attacks in recent years. The existing approaches can be improved by introducing a new model and a new analysis method of network user’s traffic behaviors. The description dimensions to network user’s traffic behaviors in the current approaches are high, resulting in high processing complexity, high delay in differentiating an individual user’s abnormal traffic behavior from massive network data, and low detection rate. To improve the detection rate and efficiency, we develop a new method of establishing user’s traffic behavior analysis system based on a new model of network traffic monitoring. First, we establish a more complete feature set based on the characteristics of network traffic to describe massive network user’s behaviors. Then, we define a feature selection rule based on the relative deviation distance to select the optimized feature set. We use the selected feature set to locate the abnormality moment and the users who produce the abnormal traffic behavior. Finally, a traffic behavior analysis method based on prediction is developed to improve efficiency of the system. This new method is applied to evaluate the mobile users on mobile cloud. The experimental results show that the proposed method has a higher detection rate and lower delay in the analysis of abnormal user’s traffic behavior than that of the existing approaches.