Joint pdf Plots: Telling Beetles from Ants in Network Traffic Measurement by Cross-Domain Analysis

In this paper we propose a method for traffic analysis based on plots of joint probability density function. While still referring to traffic flow, we do not focus the attention on the behavior of packets or bytes within a single flow, but rather we collect global statistics about the amount of packets, bytes and flows during non-overlapping observation windows. Then the joint pdf between these traffic statistics is calculated and plotted in order to provide a very simple method of analysis. Considering the jpdf we illustrate how beetles (large flows with a low occurrence) can be easily separated from ants (small flows with a high rate of occurrence). This helps the development of accurate and parsimoniuos traffic models and can also directly identify some kind of network impairments such as port scans.