Adaptive algorithms for identifying large flows in IP traffic - Archive ouverte HAL Accéder directement au contenu
Pré-Publication, Document De Travail Année : 2009

Adaptive algorithms for identifying large flows in IP traffic

Résumé

We propose in this paper an on-line algorithm based on Bloom filters for identifying large flows in IP traffic (a.k.a. elephants). Because of the large number of small flows, hash tables of these algorithms have to be regularly refreshed. Recognizing that the periodic erasure scheme usually used in the technical literature turns out to be quite inefficient when using real traffic traces over a long period of time, we introduce a simple adaptive scheme that closely follows the variations of traffic. When tested against real traffic traces, the proposed on-line algorithm performs well in the sense that the detection ratio of long flows by the algorithm over a long time period is quite high. Beyond the identification of elephants, this same class of algorithms is applied to the closely related problem of detection of anomalies in IP traffic, e.g., SYN flood due for instance to attacks. An algorithm for detecting SYN and volume flood anomalies in Internet traffic is designed. Experiments show that an anomaly is detected in less than one minute and the targeted destinations are identified at the same time.
Fichier principal
Vignette du fichier
Hal.pdf (229.9 Ko) Télécharger le fichier
Origine : Fichiers produits par l'(les) auteur(s)
Loading...

Dates et versions

inria-00357343 , version 1 (30-01-2009)
inria-00357343 , version 2 (20-06-2009)

Identifiants

  • HAL Id : inria-00357343 , version 2
  • ARXIV : 0901.4846

Citer

Youssef Azzana, Yousra Chabchoub, Christine Fricker, Fabrice Guillemin, Philippe Robert. Adaptive algorithms for identifying large flows in IP traffic. 2009. ⟨inria-00357343v2⟩
73 Consultations
658 Téléchargements

Altmetric

Partager

Gmail Facebook X LinkedIn More