Abstract:Due to the massive amount of data in high-speed network traffic and the limit on processing capability, it is a great challenge to accurately measure and monitor network traffic over high-speed links online. A new data structure is presented in this paper for locating the hosts associated with large connection degrees or significant changes in connection degrees based on the reversible connection degree sketch to monitor anomalous network traffic. The reversible connection degree sketch builds a compact summary of host connection degrees efficiently and accurately. For each packet coming, it only needs to set several bits selected in a bit array by a group of hash functions. These hash functions are designed based on the Chinese Remainder Theorem so that the in-degree or out-degree associated with a given host can be accurately estimated. With this new data structure, we develop a new reverse sketch method for locating abnormal hosts. Although the reversible connection degree sketch does not preserve any host address information, we can analytically reconstruct the host addresses associated with large connection degrees or significant changes in connection degrees by a simple calculation purely based on the characteristics of the hash functions. Furthermore, a reinforced reversible connection degree sketch, the double connection degree sketch, is developed to reduce false positives which are commonly encountered in the sketch-based methods. A traffic monitoring system based on this double connection degree is developed to detect and classify the abnormal hosts associated with large connection degrees or significant changes in connection degrees. The experiments are conducted based on the actual network traffic and the testing results show that our method is accurate and efficient.

Study On User'S Multi-Email Addresses Extraction And Association For Large Scale Network Monitoring

Research on Association Analysis Technology of Network User Accounts

A New Way for User'S Web Communication Visualization and Measurement: Modeling, Experiment and Application

Towards Multi-Account Users Detection and Connection Based on Telecom Data

Mapping different online behaviors to physical user for comprehensive knowledge-pushing services

A new connection degree calculation and measurement method for large scale network monitoring.

Automatic Fingerprint Extraction of Mobile APP Users in Network Traffic

Empirical Analysis of an Email Network in a Chinese University

Detecting Compromised Email Accounts from the Perspective of Graph Topology.

A Network Datagram and Big Data Based Research on Method of User Profile

Analysis of E-mail Account Probing Attack Based on Graph Mining

An anomaly detection method of E-mail account based on client behaviors

An Effective Method Of Monitoring The Large-Scale Traffic Pattern Based On Rmt And Pca

Analyze Large-Scale Communication Network Behavior Through Mining TCP Control Segment Information

User Identity Resolution Across Multi-Social Media

Alias Detection Across Multi-online Applications Based on User's Behavior Characteristics

MUCM: Multilevel User Cluster Mining Based on Behavior Profiles for Network Monitoring.

A Data Streaming Method for Monitoring Host Connection Degrees of High-Speed Links

Research on method for extracting large-scale social network based on Mapreduce

Understanding online user behavior in internet sphere

Key Technology Research on User Identity Resolution Across Multi-social Media