An Improved TCP Protocol Machine for Flow Analysis and Network Monitoring
スポンサーリンク
概要
- 論文の詳細を見る
In the Internet, flow analysis and network monitoring have been studied by various methods. Some methods try to make TCP (Transport Control Protocol) traces more readable by showing them graphically. Others such as MRTG, NetScope, and NetFlow read the traffic counters of the routers and record the data for traffic engineering. Even if all of the above methods are useful, they are made only to perform a single task. This paper describes an improved TCP Protocol Machine, a multipurpose tool that can be used for flow analysis, intrusion detection and link congestion monitoring. It is developed based on a finite state machine (automaton). The machine separates the flows into two main groups. If a flow can be mapped to a set of input symbols of the automaton, it is valid, otherwise it is invalid. It can be observed that intruders' attacks are easily detected by the use of the protocol machine. Also link congestion can be monitored, by measuring the percentage of valid flows to the total number of flows. We demonstrate the capability of this tool through measurement and working examples.
- 社団法人電子情報通信学会の論文
- 2003-02-01
著者
-
FUKUSHIMA Masaki
KDDI R & D Laboratories Inc.
-
Fukushima Masaki
Kddi R&d Laboratories Inc.
-
KHOSRAVI Heshmatollah
Department of Information and Computer Science,Waseda University
-
GOTO Shigeki
Department of Information and Computer Science,Waseda University
-
Goto Shigeki
Department Of Information And Computer Science Waseda University
-
Khosravi Heshmatollah
Department Of Information And Computer Science Waseda University
関連論文
- Modeling of Seamless Interworking Environments for Heterogeneous Mobile Systems(Terrestrial Radio Communications)
- Modeling of Aggregated TCP/IP Traffic on a Bottleneck Link Based on Scaling Behavior
- An Improved TCP Protocol Machine for Flow Analysis and Network Monitoring
- Efficient Lookup Scheme for Non-aggregatable Name Prefixes and Its Evaluation