Advanced Indexing Techniques for Wide-Area Network Monitoring

Detecting and unraveling incipient coordinated attacks on Internet resources requires a distributed network monitoring infrastructure. Such an infrastructure will have two logically distinct elements: distributed monitors that continuously collect packet and flow-level information, and a distributed query system that allows network operators to effi- ciently and rapidly access this information. We argue that, in addition to supporting other types of queries, the network monitoring query system must support multi-dimensional range queries on traffic records (flows, or aggregated flow records). We discuss the design of MIND, a distributed indexing system which supports the creation of multiple distributed indices that use proximal hashing to scalably respond to range queries.