MIND: A Distributed Multi-Dimensional Indexing System for Network Diagnosis

— Detecting coordinated attacks on Internet resources requires a distributed network monitoring infrastructure. Such an infrastructure will have two logically distinct elements: distributed monitors that continuously collect traffic information, and a distributed query system that allows network operators to efficiently correlate information from different monitors in order to detect anomalous traffic patterns. In this paper, we discuss the design and implementation of MIND, a distributed index management system that supports the creation and querying of multiple distributed indices. We validate MIND using traffic traces from two large backbone networks, then examine the performance of a MIND prototype on more than 100 PlanetLab machines. Our experiments show that MIND can detect and report network anomalies in about one second on an inter-continental backbone. We also analyze the efficiency of our load balancing mechanism and evaluate the robustness of MIND to node failure.

• Type: Conference
• Year: 2006
• Where: INFOCOM
• Authors: Xin Li, Fang Bian, Hui Zhang 0002, Christophe Diot, Ramesh Govindan, Wei Hong, Gianluca Iannaccone
• Keywords: Anomalous Traffic Patterns, Communications, Distributed Network, INFOCOM 2006, Multiple Distributed Indices