SMARTxAC: a passive monitoring and analysis system for high‐speed networks

Barlet‐Ros, Pere; Sole-Pareta, J.; Barrantes, Javier; Codina, Eva; Domingo‐Pascual, Jordi

doi:10.1108/10650740610704144

Cited by 18 publications

(13 citation statements)

References 10 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We included the resulting decision tree in the SMARTxAC network monitoring system [44] and processed a large set of traces described later in Section 2.5. Although these traces also contain the application label, this information is only relevant to validate the accuracy of our method.…”

Section: Machine Learning and Validation Processmentioning

confidence: 99%

Analysis of the impact of sampling on NetFlow traffic classification

et al. 2011

View full text Add to dashboard Cite

The traffic classification problem has recently attracted the interest of both network operators and researchers. Several machine learning (ML) methods have been proposed in the literature as a promising solution to this problem. Surprisingly, very few works have studied the traffic classification problem with Sampled NetFlow data. However, Sampled NetFlow is a widely extended monitoring solution among network operators. In this paper we aim to fulfill this gap. First, we analyze the performance of current ML methods with NetFlow by adapting a popular ML-based technique. The results show that, although the adapted method is able to obtain similar accuracy than previous packet-based methods (≈90%), its accuracy degrades drastically in the presence of sampling. In order to reduce this impact, we propose a solution to network operators that is able to operate with Sampled NetFlow data and achieve good accuracy in the presence of sampling.

show abstract

Section: Machine Learning and Validation Processmentioning

confidence: 99%

Analysis of the impact of sampling on NetFlow traffic classification

et al. 2011

View full text Add to dashboard Cite

show abstract

“…In our second scenario, we integrated our system into a production monitoring platform, called SMARTxAC [24], and deployed it on the Catalan NREN (Anella Científica) to monitor two peering links to the Spanish NREN (RedIris). In the experiments we describe below, we use our scheme for both anomaly detection and classification.…”

Section: B Deployment In a Production Network Monitoring Platformmentioning

confidence: 99%

Practical anomaly detection based on classifying frequent traffic patterns

Paredes-Oliva

Castell-Uroz

Barlet‐Ros

et al. 2012

2012 Proceedings IEEE INFOCOM Workshops

View full text Add to dashboard Cite

Abstract-Detecting network traffic anomalies is crucial for network operators as it helps to identify security incidents and to monitor the availability of networked services. Although anomaly detection has received significant attention in the literature, the automatic classification of network anomalies still remains an open problem. In this paper, we introduce a novel scheme and build a system to detect and classify anomalies that is based on an elegant combination of frequent item-set mining with decision tree learning. Our approach has two key features: 1) effectiveness, it has a very low false-positive rate; and 2) simplicity, an operator can easily comprehend how our detector and classifier operates. We evaluate our scheme using traffic traces from two real networks, namely from the European-wide backbone network of GÉANT and from a regional peering link in Spain. In both cases, we achieve an overall classification accuracy greater than 98% and a false-positive rate of approximately only 1%. In addition, we show that it is possible to train our classifier with data from one network and use it to effectively classify anomalies in a different network. Finally, we have built a corresponding anomaly detection and classification system and have deployed it as part of an operational platform, where it is successfully used to monitor two 10Gb/s peering links between the Catalan and the Spanish national research and education networks (NREN).

show abstract

“…Real-time statistics about the traffic of this link are available on-line at [11]. We first implemented the portscan detection techniques and the sampling methods described in Section 2 on the SMARTxAC monitoring system [12]. Then, we ran several tests with varying sampling rates, sampling methods and portscan detection algorithms.…”

Section: Portscan Detection Algorithmsmentioning

confidence: 99%

Portscan Detection with Sampled NetFlow

Paredes-Oliva

Barlet‐Ros

Solé-Pareta

2009

Traffic Monitoring and Analysis

View full text Add to dashboard Cite

Abstract. Sampling techniques are often used for traffic monitoring in high-speed links in order to avoid saturation of network resources. Although there is a wide existing research dealing with anomaly detection, few studies analyzed the impact of sampling on the performance of portscan detection algorithms. In this paper, we performed several experiments on two already existing portscan detection mechanisms to test whether they are robust enough to different sampling techniques. Unlike previous works, we found that flow sampling is not always better than packet sampling to continue detecting portscans reliably.

show abstract

SMARTxAC: a passive monitoring and analysis system for high‐speed networks

Cited by 18 publications

References 10 publications

Analysis of the impact of sampling on NetFlow traffic classification

Analysis of the impact of sampling on NetFlow traffic classification

Practical anomaly detection based on classifying frequent traffic patterns

Portscan Detection with Sampled NetFlow

Contact Info

Product

Resources

About