Abstract:Due to the massive amount of data in high-speed network traffic and the limit on processing capability, it is a great challenge to accurately measure and monitor network traffic over high-speed links online. A new data structure is presented in this paper for locating the hosts associated with large connection degrees or significant changes in connection degrees based on the reversible connection degree sketch to monitor anomalous network traffic. The reversible connection degree sketch builds a compact summary of host connection degrees efficiently and accurately. For each packet coming, it only needs to set several bits selected in a bit array by a group of hash functions. These hash functions are designed based on the Chinese Remainder Theorem so that the in-degree or out-degree associated with a given host can be accurately estimated. With this new data structure, we develop a new reverse sketch method for locating abnormal hosts. Although the reversible connection degree sketch does not preserve any host address information, we can analytically reconstruct the host addresses associated with large connection degrees or significant changes in connection degrees by a simple calculation purely based on the characteristics of the hash functions. Furthermore, a reinforced reversible connection degree sketch, the double connection degree sketch, is developed to reduce false positives which are commonly encountered in the sketch-based methods. A traffic monitoring system based on this double connection degree is developed to detect and classify the abnormal hosts associated with large connection degrees or significant changes in connection degrees. The experiments are conducted based on the actual network traffic and the testing results show that our method is accurate and efficient.

Detection of Hosts Number in LAN Based on Packets Capture Technique

Cooperation System of Worm Detection and Quarantine in Real Time

Design and Implementation of Hosts Quarantine System with Cooperation Support in LAN

A New Fault Detection Method for Computer Networks

An LAN-Monitor Experiment Based on Winpcap and Visual C++

The Intelligent Long-Range Communication System Based on No-Host Lan

The Detection System for Network Scanning

Misuse Detection in Large-scale Network for Network Security Management Systems

A Novel Method of P2P Hosts Detection Based on Flexible Neural Tree

Network Coordinate Based Geographic Information System

A Data Streaming Method for Monitoring Host Connection Degrees of High-Speed Links

Remote OS Detection Based on TCP/IP Stack Fingerprinting

A Honeypot-Based Degree Statistics Method for Scans Detection

Host identification based on self-similarity of network activity

Study on ARP Spoofing Attack Detection and Defense Technology

A New Data Streaming Method for Locating Hosts with Large Connection Degree

The research of worm distributed detection technology based on network security.

Effectiveness Evaluation of a Scan Detection Platform

A Hybrid Packet Clustering Approach for Nat Host Analysis

Detection method of network scan attack and Dos attack

A Hypothesis Testing Based Scalable TCP Scan Detection.