SYSTEM AND METHOD FOR NETWORK FLOW TRAFFIC RATE ENCODING

• US 20100054151A1
• Filed: 08/26/2008
• Published: 03/04/2010
• Est. Priority Date: 08/26/2008
• Status: Active Grant

• Current Assignee: International Business Machines Corporation
• Original Assignee: International Business Machines Corporation
• Inventors: Kind, Andreas, Stoecklin, Marc, Droz, Patrick, Hurley, Paul
• Granted Patent: US 7,911,975 B2
• Time in Patent Office: Days
• US Class Current: 370/253
• CPC Class Codes: H04L 43/024 by adaptive sampling
• CPC Class Codes: H04L 43/028 by filtering
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/067 using time frame reporting

Abstract

A system and method for monitoring packetized traffic flow in a network and enabling approximation of the rate information of a network flow. The method for monitoring network traffic flow includes receiving, at a network packet flow collector device, packetized traffic flow signals to be monitored; sampling said received packetized traffic flow signals in time to form an approximation of the packet flow rate in time; generating packet flow activity data comprising data representing the sampled traffic flow signals sampled in time; communicating the packet flow activity data to a network packet flow analyzer device and processing the flow activity data to form signals representing an approximate version of the network traffic flow in the network, the analyzer processing the traffic flow signals for reconstructing the rate of the netflow as a function of time. The flow analyzer then generates a compressed version of the network traffic flow signals in the network, the compressed network traffic flow signals comprising relevant approximation of the packet flow rate in time.

Claims

1. A network traffic flow monitor system comprising:

a network packet flow collector device for receiving packetized traffic flow signals via a network connection to be monitored and generating packet flow activity data, said flow activity data comprising data representing traffic flow signals sampled in time to form an approximation of said packet flow rate in time;

a network packet flow analyzer device for receiving said flow activity data and processing said flow activity data to form signals representing an approximate version of said network traffic flow in said network, said analyzer processing said traffic flow signals for reconstructing the rate of the netflow as a function of time.

2. The network traffic flow monitor system as claimed in claim 1, wherein said approximation of said packet flow rate in time comprises a compressed version of said network traffic flow signals.

3. The network traffic flow monitor system as claimed in claim 1, further comprising:

a filter device, at said flow collector device, for converting said sampled traffic flow signals in time into basis coefficient information based on the configuration of said filter device, said flow activity data including said basis coefficient information;

transmitting device for communicating said flow activity data to said network flow analyzer device;

a synthesis filter device, at said flow analyzer device, responsive to said basis coefficient information received from said flow activity data to configure said synthesis filter device for processing said approximate network traffic flow signals for reconstructing the rate of the netflow as a function of time.

4. The network traffic flow monitor system as claimed in claim 3, further comprising:

a storage device having a fixed amount of storage space at said network packet flow collector device for storing said basis coefficient information prior to said communicating to said network packet flow analyzer device.

5. The network traffic flow monitor system as claimed in claim 3, wherein said filter and synthesis filter devices are configured according to a type of network flow activity data the network packet flow analyzer device is targeting.

6. The network traffic flow monitor system as claimed in claim 5, wherein said filter device adapts the netflow signal according to a received network packet flow length, said network packet flow collector device adapting said basis coefficient data of said filter device according to said network packet flow duration.

7. The network traffic flow monitor system as claimed in claim 6, wherein said filter and synthesis filter device each includes a bank of filters, each filter bank including one or more:

downsampler device for reducing the sampling rate of received packetized netflow traffic signals and,

upsampler device for increasing the sampling rate of said received packetized netflow traffic signals.

8. The network traffic flow monitor system as claimed in claim 7, wherein said downsampler device initiates deleting one or more said basis coefficients to account for the increased packet flow duration lengths.

9. The network traffic flow monitor system as claimed in claim 7, wherein said filter and synthesis filter devices each comprise a perfect reconstruction filter bank.

10. The network traffic flow monitor system as claimed in claim 6, further comprising:

quantizer device for mapping the filter device generated basis coefficients into a predetermined value range, wherein said basis coefficients outputs of said filter devices are pre-processed before being provided to said network packet flow analyzer device.

11. A method for monitoring network traffic flow comprising:

receiving, at a network packet flow collector device, packetized traffic flow signals to be monitored;

sampling said received packetized traffic flow signals in time to form an approximation of said packet flow rate in time;

generating packet flow activity data comprising data representing said sampled traffic flow signals sampled in time;

communicating said packet flow activity data to a network packet flow analyzer device and processing said flow activity data to form signals representing an approximate version of said network traffic flow in said network, said analyzer processing said traffic flow signals for reconstructing the rate of the netflow as a function of time.

12. The method as claimed in claim 11, further comprising:

providing, at said network packet flow collector device, a filter device for converting said sampled traffic flow signals in time into basis coefficient information based on the configuration of said filter device, said flow activity data including said basis coefficient information; and

,

configuring a synthesis filter device, at said flow analyzer device, in response to said basis coefficient information received from said flow activity data, for processing said approximate network traffic flow signals for reconstructing the rate of the netflow as a function of time.

13. The method as claimed in claim 12, wherein said filter device generates a compressed version of said network traffic flow signals in said network, said compressed network traffic flow signals comprising relevant approximation of said packet flow rate in time.

14. The method as claimed in claim 12, further comprising:

providing, at said network packet flow collector device, a storage device having a fixed amount of storage space for storing said basis coefficient information and additional network flow activity data prior to said communicating to said network packet flow analyzer device.

15. The method as claimed in claim 12, further comprising:

configuring said filter and synthesis filter devices according to a type of network flow activity data the network packet flow analyzer device is targeting.

16. The method as claimed in claim 12, further comprising:

adapting the netflow signal according to a received network packet flow length, said network packet flow collector device adapting said basis coefficient data of said filter device according to said network packet flow duration.

17. The method as claimed in claim 14, further comprising, performing one or more or combination of:

reducing, by one or more downsampler devices implemented at each said filter and synthesis filter device, the sampling rate of received packetized netflow traffic signals; and

,

increasing, by one or more upsampler devices implemented at each said filter and synthesis filter device, the sampling rate of said received packetized netflow traffic signals.

18. The method as claimed in claim 17, further comprising:

deleting, by said downsampler device, one or more said basis coefficients to account for the increased packet flow duration lengths.

19. The method as claimed in claim 17, further comprising:

pre-processing said basis coefficients outputs of said filter devices before being provided to said network packet flow analyzer device, said pre-processing comprising mapping the filter device generated basis coefficients into a predetermined value range.

20. A method of deploying a computer program product for monitoring network traffic flow, wherein, when executed, the computer program performs the steps of:

receiving, at a network packet flow collector device, packetized traffic flow signals to be monitored;

sampling said received packetized traffic flow signals in time to form an approximation of said packet flow rate in time;

generating packet flow activity data comprising data representing said sampled traffic flow signals sampled in time;

communicating said packet flow activity data to a network packet flow analyzer device and processing said flow activity data to form signals representing an approximate version of said network traffic flow in said network, said analyzer processing said traffic flow signals for reconstructing the rate of the netflow as a function of time.

21. The method of deploying a computer program product as claimed in claim 20, further comprising:

providing, at said network packet flow collector device, a filter device for converting said sampled traffic flow signals in time into basis coefficient information based on the configuration of said filter device, said flow activity data including said basis coefficient information; and

,

configuring a synthesis filter device, at said flow analyzer device, in response to said basis coefficient information received from said flow activity data, for processing said approximate network traffic flow signals for reconstructing the rate of the netflow as a function of time.