Analysing traffic flows through sampling: A comparative study

Silva, João Marco C.; Carvalho, Paulo; Lima, Solange Rito

doi:10.1109/iscc.2015.7405538

Cited by 6 publications

(4 citation statements)

References 16 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…A comprehensive literature exists on sampling methods applied to traffic classification [22]. A thorough comparison is reported by [23]. As noted in [24], sampling techniques can be classified into four categories: packet, flow, smart, and selective sampling.…”

Section: A Literature Reviewmentioning

confidence: 99%

Probabilistic Analysis of Random Check Intrusion Detection System

Kamalov,

Moussa,

Satrya

2024

Int. J. Adv. Sci. Eng. Inf. Technol.

View full text Add to dashboard Cite

The ubiquitous adoption of network-based technologies has left organizations vulnerable to malicious attacks. It has become vital to have effective intrusion detection systems (IDS) that protect the network from attacks. In this paper, we study the intrusion detection problem through the lens of probability theory. We consider a situation where a network receives random malicious signals at discrete time instances, and an IDS attempts to capture these signals via a random check process. We aim to develop a probabilistic framework for intrusion detection under the given scenario. Concretely, we calculate the detection rate of a network attack by an IDS and determine the expected number of detections. We perform extensive theoretical and experimental analyses of the problem. The results presented in this paper would be helpful tools for designing and analyzing intrusion detection systems. We propose a probabilistic framework that could be useful for IDS experts; for a network-based IDS that monitors in real-time, analyzing the entire traffic flow can be computationally expensive. By probabilistically sampling only a fraction of the network traffic, the IDS can still perform its task effectively while reducing the computational cost. However, checking only a fraction of the traffic increases the possibility of missing an attack. This research can help IDS designers achieve appropriate detection rates while maintaining a low false alarm rate. The groundwork laid out in this paper could be used for future research on understanding the probabilities related to intrusion detection.

show abstract

Section: A Literature Reviewmentioning

confidence: 99%

Probabilistic Analysis of Random Check Intrusion Detection System

Kamalov,

Moussa,

Satrya

2024

Int. J. Adv. Sci. Eng. Inf. Technol.

View full text Add to dashboard Cite

show abstract

“…When considering the use of traffic sampling to sustain this task with reduced amount of traffic, the aspects identified in Section 5.2 for Traffic Accounting need to be taken into account once again. According to [29], [30] and Figure 10, comparing the relation between the volume of data acquired and the number of different flows identified in the network, the most suitable sampling techniques for traffic classification are time-based and multiadaptive sampling (i.e., SystT and MuST). As expected, the techniques that sample larger volumes of data, identify a larger percentage of flows.…”

Section: Traffic Classificationmentioning

confidence: 99%

“…10. Flow identification per volume of data acquired [30], for systematic (SystC,SystT), random (RandC) and adaptive (LP, MuST) techniques.…”

Section: Traffic Classificationmentioning

confidence: 99%

Towards a holistic semantic support for context-aware network monitoring

et al. 2020

Self Cite

View full text Add to dashboard Cite

Monitoring current communication networks and services is an increasingly complex task as a result of a growth in the number and variety of components involved. Moreover, different perspectives on network monitoring and optimisation policies must be considered to meet context-dependent monitoring requirements. To face these demanding expectations, this article proposes a semantic-based approach to support the flexible configuration of context-aware network monitoring, where traffic sampling is used to improve efficiency. Thus, a semantic layer is proposed to provide with a standard and interoperable description of the elements, requirements and relevant features in the monitoring domain. On top of this description, semantic rules are applied to make decisions regarding monitoring and auditing policies in a proactive and context-aware manner. Use cases focusing on traffic accounting and traffic classification as monitoring tasks are also provided, demonstrating the expressiveness of the ontology and the contribution of smart SWRL rules for recommending optimised configuration profiles.

show abstract

“…Their results are really generic and do not target the network anomaly detection problem specifically, they thus might not apply in our situation. An extension of this study is presented in [6].…”

Section: Related Workmentioning

confidence: 99%

Evaluating the Impact of Traffic Sampling onAATAC�s DDoS Detection

Roudi�re¹,

Owezarski²

2019

JCSM

View full text Add to dashboard Cite

As Distributed Denial of Service (DDoS) attack are still a severe threat for the Internet stakeholders, they should be detected with efficient tools meeting industrial requirements. We previously introduced the AATAC detector, which showed its ability to accurately detect DDoS attacks in real time on full traffic, while being able to cope with the several constraints due to an industrial operation, as time to detect, limited resources for running detection algorithms, detection autonomy for not wasting uselessly administrators' time. However, in a realistic scenario, network monitoring is done using sampled traffic. Such sampling may impact the detection accuracy or the pertinence of produced results. Consequently, in this paper, we evaluate AATAC over sampled traffic. We use five different count-based or time-based sampling techniques, and show that AATAC's resources consumption is in general greatly reduced with little to no impact on the detection accuracy. Obtained results are succinctly compared with those from FastNetMon, an open-source threshold-based DDoS detector.

show abstract

Analysing traffic flows through sampling: A comparative study

Cited by 6 publications

References 16 publications

Probabilistic Analysis of Random Check Intrusion Detection System

Probabilistic Analysis of Random Check Intrusion Detection System

Towards a holistic semantic support for context-aware network monitoring

Evaluating the Impact of Traffic Sampling onAATAC�s DDoS Detection

Contact Info

Product

Resources

About