Network traffic characterisation using flow-based statistics

Abstract

Abstract-Performing research on live network traffic requires the traffic to be well documented and described. The results of such research are heavily dependent on the particular network. This paper presents a study of network characteristics, which can be used to describe the behaviour of a network. We propose a number of characteristics that can be collected from the networks and evaluate them on five different networks of Masaryk University. The proposed characteristics cover IP, transport and application layers of the network traffic. Moreover, they reflect strong day-night and weekday patterns that are present in most of the networks. Variation in the characteristics between the networks indicates that they can be used for the description and differentiation of the networks. Furthermore, a weak correlation between the chosen characteristics implies their independence and contribution to network description.

SDN enabled flexible optical data center network with dynamic bandwidth allocation based on photonic integrated wavelength selective switch

“…Ethernet frames are generated between 64 and 1518 bytes with an average size of 792 bytes. The realistic DCN traffic volume (Traffic-A: 50% intra-OToR, 37.5% IC and 12.5% EC traffics; Traffic-B: 50% intra-OToR, 12.5% IC and 37.5% EC traffics) are employed in this assessment [32,33]. For the demonstration of the dynamic optical bandwidth allocation for the application with Traffic-A model, in the initial configurations of the TRXs and the PIC-WSS (Case-1), the TRXs with λ 1, 2 (q = 2) and λ 3, 4 (p = 2) are allocated by the SDN control plane to forward the traffic of EC and IC, respectively.…”

Host Behavior in Computer Network: One-Year Study

“…It is a commonly accepted fact that temporal patterns in network traffic can be observed on a network and its subnets [11]. The temporal patterns often follow diurnal patterns, or weekday patterns, for example.…”

“…Measured at both ISP lines, the average connection rate is 6.44 k connections per second with a packet rate of 473.82 k packets per second, and throughput of 3.52 Gbps. For detailed characteristics of the properties of selected university network subnets, refer to [11].…”

“…The methods are compared on the three-month network traffic data containing approximately 300 devices. Velan et al propose characteristics that enable the description of the basic properties of the network segments in [11]. The characteristics also take day-night patterns into account.…”

Evading Stepping-Stone Detection with Enough Chaff

“…We merge the three datasets to create our benign background dataset, with the CAIDA part containing 60.000 connection pairs, while the other two each contain 20.000 connection pairs. The amount of SSH traffic and multimedia streams in this setting is inflated from a realistic setting (up to 0.2% of flows for SSH and up 3% for video streaming [20]) to highlight the strengths and drawbacks of SSD methods, which we consider in the evaluation. In Section A, we analyse false-positives for each dataset individually.…”