Traffic Summary Analysis for Network Abuse Detection in High Date-Rate ISP Networks
P. Sandford, David J. Parish, J.M. Sandford · 2007
The recent explosion in bandwidth available to home users has caused traffic rates for commercial national networks to increasing rapidly. This presents a problem for any core network monitoring tool as the traffic rate it is expected to monitor is rising on a monthly basis. Security within these networks is paramount as they are now a stable home of trade and commerce. This paper suggests that the use of summary statistics, gathered over a number of packets, is a sensible way of coping with high data rates. We further present a methodology for discovering which metrics are appropriate for classifying significant network events and demonstrate this in a test environment. Finally we show how the statistical variance found in the test environment matches to those found in a National network core.