DocumentCode :
3434039
Title :
Sifting through Network Data to Cull Activity Patterns with HEAPs
Author :
Sharafuddin, Esam ; Jin, Yu ; Jiang, Nan ; Zhang, Zhi-Li
Author_Institution :
Dept. of Comput. Sci. & Eng., Univ. of Minnesota, Minneapolis, MN, USA
fYear :
2010
fDate :
21-25 June 2010
Firstpage :
685
Lastpage :
696
Abstract :
Today´s large campus and enterprise networks are characterized by their complexity, i.e. containing thousands of hosts, and diversity, i.e. with various applications and usage patterns. To effectively manage and secure such networks, network operators and system administrators are faced with the challenge of characterizing, profiling and tracking activity patterns passing through their networks. Because of the large number of IP addresses and the prevalence of dynamic IP addresses, profiling and tracking individual hosts may not be effective nor scalable. In this paper, we develop a hierarchical extraction of activity patterns (HEAPs), which is a method for characterizing and profiling activity patterns within subnets. By representing activities within a subnet in a host-port association matrix (HPAM) and applying pLSA, we obtain co-clusters that capture the significant and dominant activity patterns of the subnet. Using these co-clusters, we utilize hierarchical clustering to cluster activity patterns to assist network operators and security analysts gain a ”big-picture” view of the network activity-patterns. We also develop a novel method to track and quantify changes in activity patterns within subnets over time and demonstrate how to utilize this method to identify major changes and anomalies within the network.
Keywords :
IP networks; business communication; data structures; pattern clustering; HEAP; IP addresses; enterprise network; hierarchical clustering; hierarchical extraction of activity pattern; host port association matrix; network operator; pLSA; system administrator; Application software; Computer network management; Computer science; Data engineering; Data mining; Distributed computing; Network servers; Pattern analysis; Secure storage; Telecommunication traffic;
fLanguage :
English
Publisher :
ieee
Conference_Titel :
Distributed Computing Systems (ICDCS), 2010 IEEE 30th International Conference on
Conference_Location :
Genova
ISSN :
1063-6927
Print_ISBN :
978-1-4244-7261-1
Type :
conf
DOI :
10.1109/ICDCS.2010.65
Filename :
5541635
Link To Document :
بازگشت