skip to main content

DOE PAGESDOE PAGES

This content will become publicly available on April 28, 2019

Title: Multivariate network traffic analysis using clustered patterns

Traffic analysis is a core element in network operations and management for various purposes including change detection, traffic prediction, and anomaly detection. In this paper, we introduce a new approach to online traffic analysis based on a pattern-based representation for high-level summarization of the traffic measurement data. Unlike the past online analysis techniques limited to a single variable to summarize (e.g., sketch), the focus of this study is on capturing the network state from the multivariate attributes under consideration. To this end, we employ clustering with its benefit of the aggregation of multidimensional variables. The clustered result represents the state of the network with regard to the monitored variables, which can also be compared with the observed patterns from previous time windows enabling intuitive analysis. Finally, we demonstrate the proposed method with two popular use cases, one for estimating state changes and the other for identifying anomalous states, to confirm its feasibility. Our extensive experimental results with public traces and collected monitoring measurements from ESnet traffic traces show that our pattern-based approach is effective for multivariate analysis of online network traffic with visual and quantitative tools.
Authors:
ORCiD logo [1] ;  [2] ;  [3] ;  [1] ;  [4]
  1. Texas A & M Univ., Commerce, TX (United States)
  2. Lawrence Berkeley National Lab. (LBNL), Berkeley, CA (United States)
  3. Energy Sciences Network, Berkeley, CA (United States)
  4. Electronics and Telecommunications Research Inst., Daejon (Korea, Republic of)
Publication Date:
Grant/Contract Number:
AC02-05CH11231
Type:
Accepted Manuscript
Journal Name:
Computing: Archiv fuer Informatik und Numerik
Additional Journal Information:
Journal Volume: 101; Journal Issue: 4; Journal ID: ISSN 0010-485X
Publisher:
Springer Nature
Research Org:
Lawrence Berkeley National Lab. (LBNL), Berkeley, CA (United States)
Sponsoring Org:
USDOE Office of Science (SC), Advanced Scientific Computing Research (ASCR) (SC-21)
Country of Publication:
United States
Language:
English
Subject:
97 MATHEMATICS AND COMPUTING; Network traffic analysis; Clustered patterns; Change detection; Anomaly detection; Multivariate analysis
OSTI Identifier:
1498687

Kim, Jinoh, Sim, Alex, Tierney, Brian, Suh, Sang, and Kim, Ikkyun. Multivariate network traffic analysis using clustered patterns. United States: N. p., Web. doi:10.1007/s00607-018-0619-4.
Kim, Jinoh, Sim, Alex, Tierney, Brian, Suh, Sang, & Kim, Ikkyun. Multivariate network traffic analysis using clustered patterns. United States. doi:10.1007/s00607-018-0619-4.
Kim, Jinoh, Sim, Alex, Tierney, Brian, Suh, Sang, and Kim, Ikkyun. 2018. "Multivariate network traffic analysis using clustered patterns". United States. doi:10.1007/s00607-018-0619-4.
@article{osti_1498687,
title = {Multivariate network traffic analysis using clustered patterns},
author = {Kim, Jinoh and Sim, Alex and Tierney, Brian and Suh, Sang and Kim, Ikkyun},
abstractNote = {Traffic analysis is a core element in network operations and management for various purposes including change detection, traffic prediction, and anomaly detection. In this paper, we introduce a new approach to online traffic analysis based on a pattern-based representation for high-level summarization of the traffic measurement data. Unlike the past online analysis techniques limited to a single variable to summarize (e.g., sketch), the focus of this study is on capturing the network state from the multivariate attributes under consideration. To this end, we employ clustering with its benefit of the aggregation of multidimensional variables. The clustered result represents the state of the network with regard to the monitored variables, which can also be compared with the observed patterns from previous time windows enabling intuitive analysis. Finally, we demonstrate the proposed method with two popular use cases, one for estimating state changes and the other for identifying anomalous states, to confirm its feasibility. Our extensive experimental results with public traces and collected monitoring measurements from ESnet traffic traces show that our pattern-based approach is effective for multivariate analysis of online network traffic with visual and quantitative tools.},
doi = {10.1007/s00607-018-0619-4},
journal = {Computing: Archiv fuer Informatik und Numerik},
number = 4,
volume = 101,
place = {United States},
year = {2018},
month = {4}
}