Abstract:Due to the massive amount of data in high-speed network traffic and the limit on processing capability, it is a great challenge to accurately measure and monitor network traffic over high-speed links online. A new data structure is presented in this paper for locating the hosts associated with large connection degrees or significant changes in connection degrees based on the reversible connection degree sketch to monitor anomalous network traffic. The reversible connection degree sketch builds a compact summary of host connection degrees efficiently and accurately. For each packet coming, it only needs to set several bits selected in a bit array by a group of hash functions. These hash functions are designed based on the Chinese Remainder Theorem so that the in-degree or out-degree associated with a given host can be accurately estimated. With this new data structure, we develop a new reverse sketch method for locating abnormal hosts. Although the reversible connection degree sketch does not preserve any host address information, we can analytically reconstruct the host addresses associated with large connection degrees or significant changes in connection degrees by a simple calculation purely based on the characteristics of the hash functions. Furthermore, a reinforced reversible connection degree sketch, the double connection degree sketch, is developed to reduce false positives which are commonly encountered in the sketch-based methods. A traffic monitoring system based on this double connection degree is developed to detect and classify the abnormal hosts associated with large connection degrees or significant changes in connection degrees. The experiments are conducted based on the actual network traffic and the testing results show that our method is accurate and efficient.

An Unknown Link Protocol Bit Stream Segmentation Algorithm Based on Frequent Statistics and Association Rules

Data Link Bit Stream Oriented Association Analysis On Unknown Frame

Bitstream-oriented Frequent Pattern Sequence Mining Algorithm

A Novel Trie and Sequential Feature Analysis-Based Algorithm for Unknown Frame Structure Recognition

A Preamble Mining Algorithm Oriented to Binary Protocol Using Random Probes

Frame Synchronization Word Identification of Link Layer Protocol Based on Multi-fractal Spectrum

A Data Streaming Method for Monitoring Host Connection Degrees of High-Speed Links

Bit Stream Oriented Enumeration Tree Pruning Algorithm

Analyze Large-Scale Communication Network Behavior Through Mining TCP Control Segment Information

Network Message Field Type Classification and Recognition for Unknown Binary Protocols

Internet Anomaly Detection with Weighted Fuzzy Matching over Frequent Episode Rules

LinkScope: Toward Detecting Target Link Flooding Attacks

Topology Analysis Non-cooperative Path Measurement Localization Selected Paths Selected Paths Feature Vectors Detection Algorithm Detection Engine Measurement Schedule Measurement Schedule Feature Extraction 3

Abnormal Event Correlation and Detection Based on Network Big Data Analysis

Study on Frame Structure Detection in Physical Layer Based on Multi-fractal Spectrum

Explore Utilizing Network Traffic Distribution to Detect Stepping-Stone Intrusion

Frequent Attack Sequences-based Network log Mining

Low-bit-rate Speech Coding and Transmission Algorithm for Defending the Wideband Rejective Interference

Covert timing channel detection method based on time interval and payload length analysis

Protocol Reverse Engineering Using LDA and Association Analysis.

Mining Network Traffic with the k -Means Clustering Algorithm for Stepping-Stone Intrusion Detection