Abstract:The technique of traffic sampling measurement is an important scalable solution in high-speed network.NetFlow is one of the applications which is widely deployed for traffic measurement.However,the sampling method of NetFlow has shortcomings.In order to overcome those deficiencies,a novel sketch called time stratified adaptive packet sampling was proposed based on traffic load.The proposed sketch adopts the following methods:bounding sampling error within a pre-specified tolerance level,time stratified sampling and predicting traffic load adaptively.The easily-implemented packet sampling method presented can not only automatically adapt the sampling rate to traffic variety,but also give the right tradeoff between resource consumption and accuracy for all traffic mixes.Experiments were conducted based on real network traces.Results demonstrate that the proposed method can achieve simplicity,adaptability and controllability of resource consumption without sacrificing accuracy compared with other sampling methods.

An Improved TRW Algorithm Based on Packet Sampling

Packet Payload Based Anomalous Network Intrusion Detection

Research of Improved Probabilistic Packet Marking Algorithms

Port Scanning Techniques and Analysis of Attack and Defense

Detecting Randomly Scanning Worms Based on Heavy-Tailed Property

Analysis and Improvement on Packet Index Maintenance Algorithm of SRTP

An Analysis of Packet Sampling Strategy of Network-based Intrusion Detection System

A novel mechanism to defend against low-rate denial-of-service attacks

An Adaptive Algorithm to Detect Port Scans

Time Stratified Adaptive Packet Sampling Based on Traffic Load

Port Scan Detection Algorithms Based on Statistical Traffic Features

Improved Algorithms Tracing Back To Attacking Sources

Time-Driven vs packet-driven: a deep study on traffic sampling

Anomaly Detection of Network Traffic Based on Wavelet Packet

Self-adaptive distributed detection method of port scan

A Defense Strategy Against RoQ Attacks Based on Dynamic Packets Filtering

Traffic analyzer for differentiating BitTorrent handshake failures from port-scans

IP Traceback Scheme Based on Reverse Node Sampling

WiTracer: A Novel Solution to Improve TCP Performance over Wireless Network

Port Scan Behavior Diagnosis by Clustering

A Hypothesis Testing Based Scalable TCP Scan Detection.