Abstract
Flow-based monitoring has become a popular approach
in many areas of network management. However, flow
monitoring is, by design, susceptible to anomalies that generate a large number of flows, such as Distributed Denial-Of-Service attacks. This paper aims at getting a better understanding on how a flow monitoring application reacts to the presence of massive attacks.We analyze the performance of a flow monitoring application from the perspective of the flow data it has to process. We first identify the changes in the flow data caused by a massive
attack and propose a simple queueing model that describes
the behavior of the flow monitoring application. Secondly, we present a case study based on a real attack trace collected at the University of Twente and we analyze the performance of the flow monitoring application by means of simulation experiments. We conclude that the observed changes in the flow data might cause unwanted effects in monitoring applications. Furthermore, our results show that our model can help to parametrize and dimension flow-based monitoring systems.
Original language | Undefined |
---|---|
Title of host publication | Proceedings of the 2012 IEEE Network Operations and Management Symposium (NOMS 2012) |
Place of Publication | USA |
Publisher | IEEE Computer Society |
Pages | 269-277 |
Number of pages | 9 |
ISBN (Print) | 978-1-4673-0267-8 |
DOIs | |
Publication status | Published - Apr 2012 |
Event | 13th IEEE/IFIP Network Operations and Management Symposium, NOMS 2012 - Maui, United States Duration: 16 Apr 2012 → 20 Apr 2012 Conference number: 13 http://noms2012.ieee-noms.org/ |
Publication series
Name | |
---|---|
Publisher | IEEE Computer Society |
ISSN (Print) | 1542-1201 |
Conference
Conference | 13th IEEE/IFIP Network Operations and Management Symposium, NOMS 2012 |
---|---|
Abbreviated title | NOMS 2012 |
Country | United States |
City | Maui |
Period | 16/04/12 → 20/04/12 |
Internet address |
Keywords
- METIS-289689
- IR-81678
- CR-C.2.3
- EWI-22240
- EC Grant Agreement nr.: FP7/257513