Adaptive Flow Aggregation - A New Solution for Robust Flow Monitoring under Security Attacks

— Flow-level traffic measurement is required for a wide range of applications including accounting, network planning and security management. A key design challenge is how to gracefully deal with traffic surges that exhaust the resources (memory, export bandwidth or CPU) of the flow monitor. A standard solution is to do sampling (look at one out of every n packets). This is implemented in Cisco’s Netflow, a popular platform. Setting the sampling rate according to the normal traffic, however, cannot avoid overrunning available memory for flow records during abnormal situations, such as when there is a DoS attack or other security breaches. Currently available countermeasures have their own problems: (1) reject new flows when the cache is full - some legitimate new flows will not be counted; (2) export not-terminated flows to make room for new ones - this will exhaust the export bandwidth; (3) adapt the sampling rate to traffic rate - this will reduce the overall accuracy o...

• Type: Conference
• Year: 2006
• Where: NOMS
• Authors: Yan Hu, Dah-Ming Chiu, John C. S. Lui
• Keywords: Abnormal Traffic Conditions, Export Bandwidth, NOMS 2006, Sampling Rate