Please use this identifier to cite or link to this item:
Scopus Web of ScienceĀ® Altmetric
Type: Conference paper
Title: Efficient network-wide flow record generation
Author: Sommers, J.
Bowden, R.
Eriksson, B.
Barford, P.
Roughan, M.
Duffield, N.
Citation: Proceedings of IEEE INFOCOM 2011 Conference, 2011; pp.2363-2371
Publisher: IEEE
Publisher Place: USA
Issue Date: 2011
Series/Report no.: IEEE INFOCOM
ISBN: 9781424499199
ISSN: 0743-166X
Conference Name: IEEE INFOCOM Conference (2011 : Shanghai, China)
Statement of
Joel Sommers, Rhys Bowden, Brian Eriksson, Paul Barford, Matthew Roughan and Nick Duffield
Abstract: Experiments on diverse topics such as network measurement, management and security are routinely conducted using empirical flow export traces. However, the availability of empirical flow traces from operational networks is limited and frequently comes with significant restrictions. Furthermore, empirical traces typically lack critical meta-data (e.g., labeled anomalies) which reduce their utility in certain contexts. In this paper, we describe fs: a first-of-its-kind tool for automatically generating representative flow export records as well as basic SNMP-like router interface counts. fs generates measurements for a target network topology with specified traffic characteristics. The resulting records for each router in the topology have byte, packet and flow characteristics that are representative of what would be seen in a live network. fs also includes the ability to inject different types of anomalous events that have precisely defined characteristics, thereby enabling evaluation of proposed attack and anomaly detection methods. We validate fs by comparing it with the ns-2 simulator, which targets accurate recreation of packet-level dynamics in small network topologies. We show that data generated by fs are virtually identical to what are generated by ns-2, except over small time scales (below 1 second). We also show that fs is highly efficient, thus enabling test sets to be created for large topologies. Finally, we demonstrate the utility of fs through an assessment of anomaly detection algorithms, highlighting the need for flexible, scalable generation of network-wide measurement data with known ground truth.
DOI: 10.1109/INFCOM.2011.5935055
Grant ID:
Published version:
Appears in Collections:Aurora harvest
Mathematical Sciences publications

Files in This Item:
There are no files associated with this item.

Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.