An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Elich, Martin; Velan, Petr; Jirsík, Tomáš; Čeleda, Pavel

doi:10.1109/lcnw.2013.6758546

Cited by 10 publications

(6 citation statements)

References 13 publications

(11 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In recent years, we have seen methods that use not only standard flow records, but also additional features from packet payload to capture the behavior of application protocols such as DNS or HTTP. The prevalent use of web applications and new phenomena such as Bring Your Own Device (BYOD) or Internet of Things (IoT) show the limitation of flow monitoring based on Layer 3 and 4 packet features.…”

Section: History Of Flow‐based Anomaly Detectionmentioning

confidence: 99%

Similarity as a central approach to flow‐based anomaly detection

2014

View full text Add to dashboard Cite

SUMMARY Network flow monitoring is currently a common practice in mid‐ and large‐size networks. Methods of flow‐based anomaly detection are subject to ongoing extensive research, because detection methods based on deep packets have reached their limits. However, there is a lack of comprehensive studies mapping the state of the art in this area. For this reason, we have conducted a thorough survey of flow‐based anomaly detection methods published on academic conferences and used by the industry. We have analyzed these methods using the perspective of similarity which is inherent to any anomaly detection method. Based on this analysis, we have proposed a new taxonomy of network anomalies and a similarity‐oriented classification of flow‐based detection methods. We have also identified four issues requiring further research: the lack of flow‐based evaluation datasets, infeasible benchmarking of proposed methods, excessive false positive rate and limited coverage of certain anomaly classes. Copyright © 2014 John Wiley & Sons, Ltd.

show abstract

Section: History Of Flow‐based Anomaly Detectionmentioning

confidence: 99%

Similarity as a central approach to flow‐based anomaly detection

2014

View full text Add to dashboard Cite

show abstract

“…Little research has explored the possibilities of using the application information to improve the measurement itself. In [10] we have shown that the information from IPv6 tunnels can be used to create flows with finer granularity. We expect that the information from application protocols can be utilized in a similar manner to create more detailed flow records.…”

Section: Motivationmentioning

confidence: 99%

Next Generation Application-Aware Flow Monitoring

Velan

Čeleda

2014

Monitoring and Securing Virtualized Networks and Services

Self Cite

View full text Add to dashboard Cite

Abstract. Deep packet inspection (DPI) and IP flow monitoring are frequently used network monitoring approaches. Although the DPI provides application visibility, detailed examination of every packet is computationally intensive. The IP flow monitoring achieves high performance by processing only packet headers, but provides less details about the traffic itself. Application-aware flow monitoring is proposed as an attempt to combine DPI accuracy and IP flow monitoring performance. However, the impacts, benefits and disadvantages of application flow monitoring have not been studied in detail yet. The work proposed in this paper attempts to rectify this lack of research. We also propose a next generation flow measurement for application monitoring. The flows will represent events within the application protocol, e.g., web page download, instead of packet stream. Finally, we will investigate the performance of different approaches to application classification and application parsing with a computational complexity in mind.

show abstract

“…The ongoing trend in the field of application layer monitoring is towards creation of richer flow records [3], [4], [5], carrying some extra information in addition to the basic flow size and timing statistics. The added information often include values from the application layer protocol headers, such as HTTP, DNS etc.…”

Section: Introductionmentioning

confidence: 99%

Software Defined Monitoring of Application Protocols

Kekely

Kučera

Pus

et al. 2016

IEEE Trans. Comput.

View full text Add to dashboard Cite

With the ongoing shift of network services to the application layer also the monitoring systems focus more on the data from the application layer. The increasing speed of the network links, together with the increased complexity of application protocol processing, require a new way of hardware acceleration. We propose a new concept of hardware acceleration for flexible flow-based application level traffic monitoring which we call Software Defined Monitoring. Application layer processing is performed by monitoring tasks implemented in the software in conjunction with a configurable hardware accelerator. The accelerator is a high-speed application-specific processor tailored to stateful flow processing. The software monitoring tasks control the level of detail retained by the hardware for each flow in such a way that the usable information is always retained, while the remaining data is processed by simpler methods. Flexibility of the concept is provided by a plugin-based design of both hardware and software, which ensures adaptability in the evolving world of network monitoring. Our high-speed implementation using FPGA acceleration board in a commodity server is able to perform a 100 Gb/s flow traffic measurement augmented by a selected application-level protocol analysis.

show abstract

An investigation into teredo and 6to4 transition mechanisms: Traffic analysis

Cited by 10 publications

References 13 publications

Similarity as a central approach to flow‐based anomaly detection

Similarity as a central approach to flow‐based anomaly detection

Next Generation Application-Aware Flow Monitoring

Software Defined Monitoring of Application Protocols

Contact Info

Product

Resources

About