Robust network monitoring in the presence of non-cooperative traffic queries

Barlet‐Ros, Pere; Iannaccone, Gianluca; Sanjuís-Cuxart, Josep; Solé-Pareta, Josep

doi:10.1016/j.comnet.2008.10.007

Cited by 3 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…In Chapter 5, we extend our load shedding scheme to handle non-cooperative monitoring applications and model our system using game theory. Large portions of this chapter are based on [16].…”

Section: Thesis Outlinementioning

confidence: 99%

Load shedding in network monitoring applications

Barlet Ros

View full text Add to dashboard Cite

Monitoring and mining real-time network data streams are crucial operations for managing and operating data networks. The information that network operators desire to extract from the network traffic is of different size, granularity and accuracy depending on the measurement task (e.g., relevant data for capacity planning and intrusion detection are very different). To satisfy these different demands, a new class of monitoring systems is emerging to handle multiple and arbitrary monitoring applications. Such systems must inevitably cope with the effects of continuous overload situations due to the large volumes, high data rates and bursty nature of the network traffic. These overload situations can severely compromise the accuracy and effectiveness of monitoring systems, when their results are most valuable to network operators. In this thesis, we propose a technique called load shedding as an effective and low-cost alternative to over-provisioning in network monitoring systems. It allows these systems to handle efficiently overload situations in the presence of multiple, arbitrary and competing monitoring applications. We present the design and evaluation of a predictive load shedding scheme that can shed excess load in front of extreme traffic conditions and maintain the accuracy of the monitoring applications within bounds defined by end users, while assuring a fair allocation of computing resources to non-cooperative applications. The main novelty of our scheme is that it considers monitoring applications as black boxes, with arbitrary (and highly variable) input traffic and processing cost. Without any explicit knowledge of the application internals, the proposed scheme extracts a set of features from the traffic streams to build an on-line prediction model of the resource requirements of each monitoring application, which is used to anticipate overload situations and control the overall resource usage by sampling the input packet streams. This way, the monitoring system preserves a high degree of flexibility, increasing the range of applications and network scenarios where it can be used. Since not all monitoring applications are robust against sampling, we then extend our load shedding scheme to support custom load shedding methods defined by end users, in order to provide a generic solution for arbitrary monitoring applications. Our scheme allows the monitoring system to safely delegate the task of shedding excess load to the applications and still guarantee fairness of service with non-cooperative users. We implemented our load shedding scheme in an existing network monitoring system and deployed it in a research ISP network. We present experimental evidence of the performance and robustness of our system with several concurrent monitoring applications during long-lived executions and using real-world traffic traces.

show abstract

Section: Thesis Outlinementioning

confidence: 99%

Load shedding in network monitoring applications

Barlet Ros

View full text Add to dashboard Cite

show abstract

Predictive Resource Management of Multiple Monitoring Applications

Barlet‐Ros

Iannaccone

Sanjuàs-Cuxart

et al. 2011

IEEE/ACM Trans. Networking

View full text Add to dashboard Cite

Abnormal Network Behavior Analysis System Based on Traffic Monitoring

Wang

2014

AMM

View full text Add to dashboard Cite

This study based on characteristics of network traffic is significant, it can improve network design, improve network performance, is often used in the abnormal traffic detection and so on. In this paper, the significance of abnormal flow monitoring is design based on an analysis of network behavior anomaly traffic monitoring system, the system for use of the network traffic characteristics of network attacks detected has a good prospect.

show abstract

Robust network monitoring in the presence of non-cooperative traffic queries

Cited by 3 publications

References 22 publications

Load shedding in network monitoring applications

Load shedding in network monitoring applications

Predictive Resource Management of Multiple Monitoring Applications

Abnormal Network Behavior Analysis System Based on Traffic Monitoring

Contact Info

Product

Resources

About