CDF-based Flow Detection for Network Flow Sampling and Packet Capturing
Aris Cahyadi Risdianto (1), Nuryani - (2*) (1) School of Electrical Engineering and Computer Science, Gwangju Institute of Science and Technology - Korea, Republic of
(2) Research Center for Informatics, Indonesian Institute of Sciences (LIPI) - Indonesia
(*) Corresponding Author
Received: February 20, 2019; Revised: June 25, 2019
Accepted: August 01, 2019; Published: August 31, 2019
Abstract
Providing an appropriate level of flow collection, relying on packet capturing or flow sampling method, is extremely hard due to various practical limitations and resources requirements. To address this challenge, this paper investigated a CDF (Cumulative Distribution Function)-based flow detection to decide between “known” and “unknown” flows. Therefore, a combined flow collection can be achieved to improve the collection’s efficiency by sampling only the known flows and capturing the remaining unknown flows. As a preliminary experiment, detecting known and unknown flows was conducted over a long period by calculating the empirical CDF distance between each flow’s rate and overall packet’s rate distribution, called as FPR (Flow-to-Packet Ratio), with a threshold (FPRmin) based on a significant level of observed data. The result shows that unknown flow is detected for most of the recommended significant level values.
http://dx.doi.org/10.14203/jet.v19.26-31 Keywords
References
A. C. Risdianto, J. W. Kim, "A balanced collection of flow visibility for effective SDN-coordinated flow clustering and tagging," in Proc. Korea Inst. Commun. Inform. Sci. Winter Conf. 2017, Jeongseon, Korea, 2017.
S. Panchen, P. Phaal, N. McKee (2001). InMon corporation's sFlow: A method for monitoring traffic in switched and routed networks.
Y. Afek, A. B. Barr, S. L. Feibish, L. Schiff, “Sampling and large flow detection in SDN”, in Proc. 2015 ACM Special Interest Group Data Commun., London, UK, 2015, pp. 345-346. Crossref
G. Cheng, Y. Tang, W. Ding, “A double-sampling and hold based approach for accurate and efficient network flow monitoring,” in Proc. Int. Conf. Computational Sci., China, 2007, pp. 857-864. Crossref
J. M. C. Silva, P. Carvalho, S. R. Lima, “A modular architecture for deploying self-adaptive traffic sampling,” in Proc. Int. Federation Inform. Process. Int. Conf. Autonomous Infrastructure Manage. Security, 2014, pp. 179-183. Crossref
R. Hofstede, P. Čeleda, B. Trammell, I. Drago, R. Sadre, A. Sperotto, and A. Pras, “Flow monitoring explained: From packet capture to data analysis with netflow and ipfix, ” IEEE Commun. Surveys Tutorials, vol. 16, no. 4, pp. 2037-2064, May, 2014. Crossref
P. Phaal and S. Panchen. (2017, June). Packet sampling basics. [Online]. Available: http://www.sflow.org/packetSamplingBasics/index.htm.
A. W. V. Vaart, Asymptotic Statistics. Cambridge: Cambridge University Press, 1998, p. 265.
H. W. Lilliefors, "On the Kolmogorov-Smirnov test for normality with mean and variance unknown," J. American Statistical Assoc., vol. 62, no. 318, pp. 399-402, Jun. 1967. Crossref
Wireshark. (2017, June). Wireshark [Online]. Available: https://www.wireshark.org/.
Dipartimento di Ingegneria Elettrica e delle Tecnologie dell'Informazione (2017, June). D-ITG: Distributed Internet Traffic Generator [Online]. Available: http://www.grid.unina.it/software/ITG/.
G. Lyon (2017, June). Nmap: the Network Mapper – Free Security Scanner [Online]. Available: https://nmap.org/.
University de Montreal. (2017, June). Critical Values for two-sample Kolmogorov-Smirnov test (2-sided) [Online]. Available: https://www.webdepot.umontreal.ca/Usagers/angers/MonDepotPublic/STT3500H10/Critical_KS.pdf.
D. M. Lane. (2017, June). Significance Testing and Confidence Intervals [Online]. Available: http://onlinestatbook.com/2/logic_of_hypothesis_testing/sign_conf.html.
Article Metrics
Metrics powered by PLOS ALM
Refbacks
- There are currently no refbacks.
Copyright (c) 2019 National Research and Innovation Agency
This work is licensed under a Creative Commons Attribution-NonCommercial-ShareAlike 4.0 International License.
Email this article 
