On the efficiency of using space-filling curves in network traffic representation

Network monitors produce a huge amount of traffic data continuously. This data needs to be stored and communicated for analysis purposes. An efficient traffic representation is needed to ensure that the maximum information is passed using reasonable resources. In this paper, we consider using space-filling curves (SFC) in traffic visualization. SFCs provide many desirable properties that help characterize traffic flows and identify anomalous behavior. First, we propose a methodology for representing traffic using SFCs. The proposed method generates traffic images that is robust against compression. Compressed images provide both storage and bandwidth savings, for example, when the image is transmitted from the monitor to an analyzing engine. Second, the proposed technique is evaluated for different SFCs by comparing original images with compressed images in terms of mapping accuracy and efficiency. Actual traces of DDoS attack and Code Red spread traffic is used in the evaluation. The resulting images are shown to withstand aggressive compression while preserving traffic properties.