Active flows in diagnostic of troubleshooting on backbone links

Article type: Research Article

Authors: Sukhov, A.M.^; | Sidelnikov, D.I. | Platonov, A.P. | Strizhov, M.V.^; | Galtsev, A.A.

Affiliations: Samara State Aerospace University, Samara, Russia. E-mails: amskh@yandex.ru, strizhov@cs.colostate.edu, galaleksey@gmail.com | Institute of Organic Chemistry of RAS, Moscow, Russia. E-mail: sid@free.net | Russian Institute for Public Networks, Moscow, Russia. E-mail: plat@ripn.net

Note: [] Corresponding author: A.M. Sukhov, Samara State Aerospace University, Moskovskoe sh., 34, Samara, 443086, Russia. E-mail: amskh@yandex.ru.

Note: [] M. Strizhov is a PhD Student at the Computer Science Department, Colorado State University since May 2009.

Abstract: In this paper, we propose a novel approach to finding and predicting anomalous network states based on a flow monitoring mechanism. We assume that number of active flows can show a real network state. Moreover, the dependence between flow number and link utilisation allows us to derive an equation for the confidence interval on high-loaded network links. Experiments have been conducted that confirmed the basic position of the model and identified the anomaly network states. A software package based on this model has been created that allows the prevention of DDoS attacks. For successful operation of this software the number of active flows that single IP address can generate has been analysed.

Keywords: Flow traffic model, anomaly and attack detection, traffic analysis, network flows, network monitoring, traffic measurement, Cisco NetFlow

DOI: 10.3233/JHS-2011-0447

Journal: Journal of High Speed Networks, vol. 18, no. 1, pp. 69-81, 2011