The Architecture of NG-MON: A Passive Network Monitoring System for High-Speed IP Networks1

Han, Se-Hee; Kim, Myung-Sup; Ju, Hongtaek; Hong, James Won‐Ki

doi:10.1007/3-540-36110-3_5

Cited by 31 publications

(34 citation statements)

References 5 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Two critical problems exist in today's Internet traffic monitoring and analysis. The first problem is how to handle an increased and massive amount of traffic data generated from high-speed network links, such as 2.5 Gbps and higher, in a real-time manner [1]- [5]. The other problem is how to analyze sophisticated traffic data generated from various newly emerging network-based applications such as streaming media, peer-topeer (P2P), and game applications [6]- [8].…”

Section: Introductionmentioning

confidence: 99%

“…The third step is the flow relationship map (FRM), which aggregates flows according to their inter-dependency and decides a corresponding application name to each flow. To validate the proposed algorithm, we have designed and implemented a traffic analysis system, called NG-MON [1]. NG-MON is currently deployed at the Internet junction of POSTECH and provides us with important characteristics of Internet traffic captured between our campus and the Internet.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Application-Level Traffic Monitoring and an Analysis on IP Networks

Kim¹,

Won²,

Hong³

2005

ETRI J

Self Cite

View full text Add to dashboard Cite

Traditional traffic identification methods based on wellknown port numbers are not appropriate for the identification of new types of Internet applications. This paper proposes a new method to identify current Internet traffic, which is a preliminary but essential step toward traffic characterization. We categorized most current network-based applications into several classes according to their traffic patterns. Then, using this categorization, we developed a flow grouping method that determines the application name of traffic flows. We have incorporated our method into NG-MON, a traffic analysis system, to analyze Internet traffic between our enterprise network and the Internet, and characterized all the traffic according to their application types.Keywords: Passive traffic monitoring and analysis, application-level traffic identification, application-level traffic characterization, Internet traffic, streaming traffic, peer-to-peer traffic. Manuscript received Apr. 8, 2004; revised Aug. 10, 2004. This work was in part supported by the Electrical and Computer Engineering Division at POSTECH under the BK21 program of Ministry of Education, and the Program for the Training of Graduate Students in Regional Innovation of Ministry of Commerce, Industry and Energy of the Korean Government.Myung-Sup Kim (phone: +82 54 279 5654, email: mount@postech.ac.kr), Young J. Won (email: yjwon@postech.ac.kr) and James Won-Ki Hong (email: jwkhong@postech.ac.kr) are with the DPNM Laboratory, POSTECH, Pohang, Korea. I. IntroductionIn addition to the fundamental and traditional purposes of traffic analysis such as network planning, network problem detection, and network usage reporting, traffic monitoring and analysis is required in many areas to improve network service quality such as in abnormal traffic detection and usage-based accounting. However, to come up with an evolution of the Internet in terms of underlying technologies and user services, network traffic monitoring and analysis techniques should be improved in terms of system architecture and analysis methodology. Two critical problems exist in today's Internet traffic monitoring and analysis. The first problem is how to handle an increased and massive amount of traffic data generated from high-speed network links, such as 2.5 Gbps and higher, in a real-time manner [1]- [5]. The other problem is how to analyze sophisticated traffic data generated from various newly emerging network-based applications such as streaming media, peer-topeer (P2P), and game applications [6]-[8].Regarding the second problem, the types and patterns of current network traffic are more complex than they were in the past. In the past network environment, most Internet traffic was occupied by HTTP, FTP, TELNET, SMTP, and NNTP. Today, the proportion of these well-known port-based traffic types is decreasing. Instead, P2P, streaming media, and game traffic are increasing. Internet2 administrators report that about 4% of the traffic carried by their network is P2P traffic, while a further 54% of unident...

show abstract

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Application-Level Traffic Monitoring and an Analysis on IP Networks

Kim¹,

Won²,

Hong³

2005

ETRI J

Self Cite

View full text Add to dashboard Cite

show abstract

“…Experimental systems therefore observe and analyse network traffic at a fixed location such as entry point, or gateway, to a Local Area Network (LAN) (Ranum et al, 1997;Snort, http://www.snort.org, ;Han et al, 2002). This choice is based on several assumptions: that anomalies represent threats to the system and that threats to the network come from outside the network rather than within.…”

Section: Introductionmentioning

confidence: 99%

Principle Components and Importance Ranking of Distributed Anomalies

Begnum

Burgess

2005

Mach Learn

View full text Add to dashboard Cite

Abstract.Correlations between locally averaged host observations, at different times and places, hint at information about the associations between the hosts in a network. These smoothed, pseudo-continuous time-series imply relationships with entities in the wider environment. For anomaly detection, mining this information might provide a valuable source of observational experience for determining comparative anomalies or rejecting false anomalies. The difficulties with distributed analysis lie in collating the distributed data and in comparing observables on different hosts, in different frames of reference. In the present work, we examine two methods (Principle Component Analysis and Eigenvector Centrality) that shed light on the usefulness of comparing data destined for different locations in a network.

show abstract

“…Web Services technologies [10] consists of certain functional areas, XML messaging (e.g., SOAP), transport (e.g., HTTP, FTP and SMTP) and description of application interactions (e.g., WSDL) and discovery (e.g., UDDI). XML describes a class of data objects called XML documents.…”

Section: Web Services Technologiesmentioning

confidence: 99%

Web Services Based Configuration Management for IP Network Devices

Yoo

Hong

2005

Management of Multimedia Networks and Services

Self Cite

View full text Add to dashboard Cite

Abstract. As the Internet continues to grow, current networks are composed of a large number network devices from diverse vendors. The tasks of operating and managing these devices are getting more difficult and complicated. For that reason, IETF Netconf Working Group has an ongoing effort to standardize network configuration management. The Netconf protocol helps to exchange configuration information between a manager and agent. The protocol is able to effectively manage various devices on a network. However, it is still problematic for the manager to discover and manage configurable parameters in all the agents. A configuration task should follow a pre-defined process that is only obtained through hands-on experience. Because there is no formal methodology to describe such configuration processes, a series of configuration tasks becomes very inefficient when using the Netconf protocol only. This paper proposes a mechanism that can quickly discover devices and their parameters and easily recognize methods to manipulate the configuration information on them. We present the architecture for XCMS-WS which meets this mechanism. Web Services technologies, such as SOAP, WSDL, and UDDI, support discovery agents and recognize agent services. Using these Web Services technologies, we have designed a more powerful and flexible system than the existing XCMS. For validation, we have applied XCMS-WS for the configuration management of NG-MON, a distributed, real-time Internet traffic monitoring and analysis system.

show abstract

The Architecture of NG-MON: A Passive Network Monitoring System for High-Speed IP Networks1

Cited by 31 publications

References 5 publications

Application-Level Traffic Monitoring and an Analysis on IP Networks

Application-Level Traffic Monitoring and an Analysis on IP Networks

Principle Components and Importance Ranking of Distributed Anomalies

Web Services Based Configuration Management for IP Network Devices

Contact Info

Product

Resources

About