Tranalyzer: Versatile high performance network traffic analyser

Burschka, Stefan; Dupasquier, Benoit

doi:10.1109/ssci.2016.7849909

Cited by 32 publications

(12 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…Good performances achieved by such flow exporters, e.g. Argus [32] and Tranalyzer [3], were demonstrated in Haddadi et al [13]. Hence in this research, Tranalyzer is employed for exporting the flows from raw network traffic.…”

Section: Network Traffic Flowsmentioning

confidence: 94%

See 1 more Smart Citation

Unsupervised Monitoring of Networkand Service Behaviour Using SelfOrganizing Maps

Zincir-Heywood

Heywood

2018

JCSM

View full text Add to dashboard Cite

Botnets represent one of the most destructive cybersecurity threats. Given the evolution of the structures and protocols botnets use, many machine learning approaches have been proposed for botnet analysis and detection. In the literature, intrusion and anomaly detection systems based on unsupervised learning techniques showed promising performances. This paper investigates the capability of the Self Organizing Map (SOM), an unsupervised learning technique as a data analytics system. In doing so, the aim is to understand how far such an approach could be pushed to analyze the network traffic, and to detect malicious behaviours in the wild. To this end, three different unsupervised SOM training scenarios for different data acquisition conditions are designed, implemented and evaluated. The approach is evaluated on publicly available network traffic (flows) and web server access (web requests) datasets. The results show that the approach has a high potential as a data analytics tool on unknown traffic/web service requests, and unseen attack behaviours. Malicious behaviours both on network and service datasets used

show abstract

Section: Network Traffic Flowsmentioning

confidence: 94%

“…This work employs all 71 numerical features extracted from ISOT dataset using Tranalyzer with default configuration and basic plugins [24]. The basic plugins are: basicFlow, basicStats, tcpFlags, icmpDecode, connStat, descriptiveStats [3].…”

Section: Isotmentioning

confidence: 99%

Unsupervised Monitoring of Networkand Service Behaviour Using SelfOrganizing Maps

Zincir-Heywood

Heywood

2018

JCSM

View full text Add to dashboard Cite

show abstract

“…Anonymous traffic contained in Anon17 is split into different flows (see Sec. 2.2), by means of the flow-exporting tool Tranalyzer2 [29], constituting the TC object here employed. We highlight that the direction of each flow (considered as a feature) is indicated as "A" or "B" for client-to-server and vice versa, respectively.…”

Section: Traffic Object and Feature Setsmentioning

confidence: 99%

“…the TC object could be the single packet 6 ). For each traffic flow, Anon17 provides different sets of features extracted via Tranalyzer2 [29]. In this work, we consider two different feature sets, referred hereinafter to as TC_set and EarlyTC_set.…”

Section: Traffic Object and Feature Setsmentioning

confidence: 99%

A Dive into the Dark Web: Hierarchical Traffic Classification of Anonymity Tools

Montieri

Ciuonzo

Bovenzi

et al. 2020

IEEE Trans. Netw. Sci. Eng.

View full text Add to dashboard Cite

Privacy-preserving protocols and tools are increasingly adopted by Internet users nowadays. These mechanisms are challenged by the process of Traffic Classification (TC) which, other than being an important workhorse for several network management tasks, becomes a key factor in the assessment of their privacy level, both from offensive (malign) and defensive (benign) standpoints. In this paper we propose TC of anonymity tools (and deeper, of their running services and applications) via a truly hierarchical approach. Capitalizing a public dataset released in 2017 containing anonymity traffic, we provide an in-depth analysis of TC and we compare the proposed hierarchical approach with a flat counterpart. The proposed framework is investigated in both the usual TC setup and its "early" variant (i.e. only the first segments of traffic aggregate are used to take a decision). Results highlight a general improvement over the flat approach in terms of all the classification metrics. Further performance gains are also accomplished by tuning the thresholds ensuring progressive censoring. Finally, fine-grain performance investigation allows to (a) demonstrate lower severity of errors incurred by the hierarchical approach (as opposed to the flat case) and (b) highlight poorly-classifiable services/applications of each anonymity tool, gathering useful feedback on their privacy-level.

show abstract

“…Another example of tool that generates enriched records is Tranalyzer . Such tool can generate general statistics per protocol, and it can be used to feed standard tools such as RRD or Splunk, and even yield a PDF report, in the same way we present in our work.…”

Section: Introductionmentioning

confidence: 99%

On the design and performance evaluation of automatic traffic report generation systems with huge data volumes

Vega

Sierra

Moreno³

et al. 2018

Int J Network Mgmt

View full text Add to dashboard Cite

In this paper, we analyze the performance issues involved in the generation of automated traffic reports for large IT infrastructures. Such reports allow the IT manager to proactively detect possible abnormal situations and roll out the corresponding corrective actions. With the ever-increasing bandwidth of current networks, the design of automated traffic report generation systems is very challenging. In a first step, the huge volumes of collected traffic are transformed into enriched flow records obtained from diverse collectors and dissectors. Then, such flow records, along with time series obtained from the raw traffic, are further processed to produce a usable report. As will be shown, the data volume in flow records turns out to be very large as well and requires careful selection of the key performance indicators (KPIs) to be included in the report. In this regard, we discuss the use of high-level languages versus low-level approaches, in terms of speed and versatility. Furthermore, our design approach is targeted for rapid development in commodity hardware, which is essential to cost-effectively tackle demanding traffic analysis scenarios. Actually, the paper shows feasibility of delivering a large number of KPIs, as will be detailed later, for several TBytes of traffic per day using a commodity hardware architecture and high-level languages.

show abstract

Tranalyzer: Versatile high performance network traffic analyser

Cited by 32 publications

References 8 publications

Unsupervised Monitoring of Networkand Service Behaviour Using SelfOrganizing Maps

Unsupervised Monitoring of Networkand Service Behaviour Using SelfOrganizing Maps

A Dive into the Dark Web: Hierarchical Traffic Classification of Anonymity Tools

On the design and performance evaluation of automatic traffic report generation systems with huge data volumes

Contact Info

Product

Resources

About