Abstract
Identifying dominant network flows is important for network anomaly detection. Estan et al. proposed an algorithm that effectively detects dominant network flows by constructing multidimensional clusters based on a “natural hierarchy” existing in the five-tuple information of network flows. Wang et al. improved this algorithm by significantly reducing its computational complexity. In practice, however, the algorithm’s execution time may be relatively long when handling large volumes of traffic with a low threshold. In this paper, we introduce a practical technique that further improves the time efficiency of Wang et al.’s algorithm. Our approach simplifies network traffic’s hierarchical structure by utilizing local IP subnet information. The comparative performance of our approach and Wang et al.’s algorithm is evaluated using real NetFlow data collected at a large campus network. The experimental results demonstrate that our algorithm is much more time efficient than Wang et al.’s algorithm.
Access this chapter
Tax calculation will be finalised at checkout
Purchases are for personal use only
Preview
Unable to display preview. Download preview PDF.
References
Cormode, G., Muthukrishnan, S.: Whats new: Finding significant differences in network data streams. In: Proc. IEEE INFOCOM, pp. 1219–1232 (2004)
Manku, G., Motwani, R.: Approximate frequency counts over data streams. In: Proc. Int. Conf. Very Large Databases, pp. 346–357 (2002)
Estan, C., Savage, S., Varghese, G.: Automatically Inferring Patterns of Resource Consumption in Network Traffic. In: SIGCOMM 2003, pp. 137–148 (2003)
Wang, J., Miller, D.J., Kesidis, G.: Efficient Mining of the Multidimensional Traffic Cluster Hierarchy for Digesting, Visualization, and Anomaly Identification. In: IEEE JSAC, pp. 1929–1941 (2006)
The eMule project, http://www.emule-project.net
PPlive website, http://www.pplive.com
Cisco website, http://www.cisco.com
Definition of DPI from Wikipekia wetsite, http://en.wikipedia.org/wiki/Deep_packet_inspection
Definition of CIDR from Wikipekia wetsite, http://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing
Introduction to the main campus network of Peking University (in Chinese), http://www.pku.edu.cn/network/xyw/jj.htm
Definition of Directed Acyclic Graph from MathWorld website, http://mathworld.wolfram.com/AcyclicDigraph.html
Author information
Authors and Affiliations
Editor information
Editors and Affiliations
Rights and permissions
Copyright information
© 2008 Springer-Verlag Berlin Heidelberg
About this paper
Cite this paper
Yang, J., Ma, H., Zhang, B., Chen, P. (2008). An Efficient Approach for Analyzing Multidimensional Network Traffic. In: Ma, Y., Choi, D., Ata, S. (eds) Challenges for Next Generation Network Operations and Service Management. APNOMS 2008. Lecture Notes in Computer Science, vol 5297. Springer, Berlin, Heidelberg. https://doi.org/10.1007/978-3-540-88623-5_23
Download citation
DOI: https://doi.org/10.1007/978-3-540-88623-5_23
Publisher Name: Springer, Berlin, Heidelberg
Print ISBN: 978-3-540-88622-8
Online ISBN: 978-3-540-88623-5
eBook Packages: Computer ScienceComputer Science (R0)