| Load Transformations and their Usage for Traffic Prediction and Understanding in Networks with Security Requirements |
| |
Team Leader | |
Scientists | |
Students | Daniel Mentz, Nico Weber |
Partners | Telecommunications And Computer Networks, University of Hamburg |
Funding | Deutsche Forschungsgemeinschaft (German Research Foundation) |
Project Time | 01.11.2007 - |
Description | Realistic modeling and prediction of traffic in complex networking environments, as well as network monitoring and traffic analysis for traffic characterization and network security are two research areas with many unsolved problems. The LUPUS research project is to find novel modeling and analysis solutions by combining know-how and expertise of both areas. Work on new traffic models concentrates on the load transformation approach which allows translating arrival sequences at the application layer into arrival sequences at the network layer. With respect to traffic analysis, one research goal is to find ways to invert the load transformation in order to infer application layer loads from monitored traffic. Further traffic analysis methods to be considered are network data mining and payload-based traffic identification. Traffic analysis relies on monitoring data collected with help of adaptive passive and active network monitoring techniques. The scientific outcome of the project is to enable improved security management and performance monitoring in communication networks. |
Related Publications:
| [1] | Lothar Braun, Gerhard Münz, and Georg Carle. Packet sampling for worm and botnet detection in TCP connections. In Proceedings of IEEE/IFIP Network Operations and Management Symposium (NOMS2010), Osaka, Japan, April 2010. |
| [2] | Benoit Claise, Paul Aitken, Andrew Johnson, and Gerhard Münz. IPFIX export per SCTP stream. Internet-Draft (work in progress), draft-ietf-ipfix-export-per-sctp-stream-04, October 2009. [ http ] |
| [3] | Thomas Dietz, Atsushi Kobayashi, Benoit Claise, and Gerhard Münz. Definitions of managed objects for IP flow information export. Internet-Draft (work in progress), draft-ietf-ipfix-mib-08, October 2009. [ http ] |
| [4] | Gerhard Münz, Benoit Claise, and Paul Aitken. Configuration data model for IPFIX and PSAMP. Internet-Draft (work in progress), draft-ietf-ipfix-configuration-model-04, October 2009. [ http ] |
| [5] | Hui Dai, Gerhard Münz, Lothar Braun, and Georg Carle. TCP-Verkehrsklassifizierung mit Markov-Modellen. In Leistungs-, Zuverlässigkeits- und Verlässlichkeitsbewertung von Kommunikationsnetzen und Verteilten Systemen, 5. GI/ITG-Workshop MMBnet 2009, Hamburg, Germany, September 2009. |
| [6] | Stephan Heckmüller, Gerhard Münz, Lothar Braun, Aaron Kunde, Bernd E. Wolfinger, and Georg Carle. Lasttransformation durch Rekonstruktion von Auftragslängen anhand von Paketdaten. In Leistungs-, Zuverlässigkeits- und Verlässlichkeitsbewertung von Kommunikationsnetzen und Verteilten Systemen, 5. GI/ITG-Workshop MMBnet 2009, Hamburg, Germany, September 2009. |
| [7] | Daniel Mentz, Gerhard Münz, and Lothar Braun. Recommendations for implementing IPFIX over DTLS. Internet-Draft (work in progress), draft-mentz-ipfix-dtls-recommendations-00, July 2009. [ .txt ] |
| [8] | Gerhard Münz and Georg Carle. Application of forecasting techniques and control charts for traffic anomaly detection. In Proceedings of the 19th ITC Specialist Seminar on Network Usage and Traffic, Berlin, Germany, October 2008. [ .pdf ] |
| [9] | Gerhard Münz and Lothar Braun. Lossless compression for IP flow information export (IPFIX). Internet-Draft (work in progress), draft-muenz-ipfix-compression-00, July 2008. [ .txt ] |
| [10] | Gerhard Münz and Georg Carle. Distributed network analysis using TOPAS and Wireshark. In Proceedings of IEEE Workshop on End-to-End Monitoring Techniques and Services (E2EMon 2008), Salvador-Bahia, Brazil, April 2008. [ .pdf ] |
| [11] | Gerhard Münz, Nico Weber, and Georg Carle. Signature detection in sampled packets. In Proceedings of Workshop on Monitoring, Attack Detection and Mitigation (MonAM 2007), Toulouse, France, November 2007. [ .pdf ] |
| [12] | Gerhard Münz, Sa Li, and Georg Carle. Traffic anomaly detection using k-means clustering. In Proc. of Leistungs-, Zuverlässigkeits- und Verlässlichkeitsbewertung von Kommunikationsnetzen und Verteilten Systemen, 4. GI/ITG-Workshop MMBnet 2007, Hamburg, Germany, September 2007. [ .pdf ] |