Finding Persistent Elements of Anomalous Flows in Distributed Monitoring Systems

A novel data streaming method for detecting abnormal flows in distributed monitoring systems

“…If the ratio of the value of the counter B[i][j] to the value of the counter B[i][0] is larger than the threshold α, the value of the counter B(j) is the value of the counter B[i][j]. Otherwise, the value of the counter B(j) is the value of the counter B[i][0] subtracted by the value of the counter B[i][j] (lines [3][4][5][6][7][8][9][10][11]. If the estimated value is more than the threshold θ 1 L, the candidates are considered to be abnormal flows with high traffic volume (lines [12][13][14][15].…”

“…This paper focuses on the problem of finding abnormal flows in the distributed monitoring system consisting of the controller and multiple monitors. 3 For a flow, its traffic volume denotes the number of packets or bytes occurring in one measurement period. Therefore, the problem of detecting abnormal flows is converted to find flows with high traffic volume in one measurement period or significant change in traffic volume between two consecutive measurement periods.…”

“…By identifying abnormal flows, network operators can timely response to potential network attacks in order to keep the network running smoothly. This paper focuses on the problem of finding abnormal flows in the distributed monitoring system consisting of the controller and multiple monitors 3 . For a flow, its traffic volume denotes the number of packets or bytes occurring in one measurement period.…”

“…The controller aggregates the generated summary data structures from each monitor at the end of one measurement period. Updating and aggregating summary data structure is shown in Algorithm 1.When packet stream arrives, each monitor extracts flow labels f from packets and maps them to the corresponding counters in B k using hash function h(f ), where k = 1, 2, …, r. The counter B k [h(f )][0] in B k is increased by v f , which is expressed as(3), where k = 1, 2, …, r (lines 2-10).…”

Privacy-friendly wi-fi-based crowd monitoring for pedestrian dynamics analytics

“…We build upon the notion of t-persistence [23] and we call nonstationary and stationary devices the devices whose probe requests reach a certain scanner in less than t, respectively at least t out of a total of c e epochs (i.e. predefined fixed-length time intervals) preceding the concerned moment of counting.…”