Method and system for profiling network flows at a measurement point within a computer network

• US 6,944,673 B2
• Filed: 05/15/2001
• Issued: 09/13/2005
• Est. Priority Date: 09/08/2000
• Status: Expired due to Fees

• Current Assignee: Board of Regents of the University of Michigan (University of Michigan)
• Original Assignee: Board of Regents of the University of Michigan (University of Michigan)
• Inventors: Malan, Gerald R., Jahanian, Farnam
• Primary Examiner(s): BANANKHAH, MAJID A
• Application Number:
  US09/855,809
• Publication Number:
  US 20020032717A1
• Time in Patent Office: 1,582 Days
• Field of Search: 709/203, 709/220, 709/224, 709/237, 709/248, 710/104, 713/1, 713/100, 703/20, 703/27, 370/379, 370/389, 370/392
• US Class Current: 709/237
• CPC Class Codes: H04L 2463/141 Denial of service attacks against endpoints in a network
• CPC Class Codes: H04L 2463/146 Tracing the source of attacks
• CPC Class Codes: H04L 41/12 Discovery or management of network topologies
• CPC Class Codes: H04L 41/22 comprising specially adapted graphical user interfaces [GUI]
• CPC Class Codes: H04L 41/28 Restricting access to network management systems or functions, e.g. using authorisation function to access network configuration
• CPC Class Codes: H04L 43/00 Arrangements for monitoring or testing data switching networks
• CPC Class Codes: H04L 43/022 by sampling
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/062 related to network traffic
• CPC Class Codes: H04L 43/16 Threshold monitoring
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04L 63/1416 Event detection, e.g. attack signature detection
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1458 Denial of Service
• CPC Class Codes: H04L 67/30 Profiles
• CPC Class Codes: H04L 69/329 in the application layer [OSI layer 7]

Abstract

A method and system for profiling network flows at a measurement point within a computer network is provided. The method includes measuring network flows having invariant features at a measurement point located within routing infrastructure of the computer network to obtain flow statistics. The method also includes aggregating the flow statistics to obtain a traffic profile of the network flows at the measurement point. The method and system utilize the natural hierarchy in the Internet addressing scheme to provide a means for making tractable measurements of network traffic in high-speed networks. Moreover, the method and system adapt dynamically to the changing underlying traffic characteristics to maintain a maximum memory footprint for the profiles. The method and system adapt by adjusting the level of aggregation of the traffic endpoints along a scale from Interface to fully specified network address.

Claims

1. A method for profiling network flows at a measurement point within a computer network, the method comprising:

measuring network flows having invariant features at a measurement point located within routing infrastructure of the computer network to obtain flow statistics; and

aggregating the flow statistics to obtain a traffic profile of the network flows at the measurement point wherein the step of aggregating is based on at least one of the invariant features and wherein the at least one invariant feature is either a source endpoint or a destination endpoint and wherein the step of aggregating is based on distance of the measurement point from the endpoint so that the network flow is profiled at the measurement point within the routing infrastructure in proportion to the distance from the measurement point to the endpoint.

2. The method as claimed in claim 1 wherein the invariant features include source and destination endpoints.

3. The method as claimed in claim 2 further comprising identifying typical traffic source and destination pairs for network flows that transit the measurement point based on the source and destination endpoints.

4. The method as claimed in claim 2 wherein the invariant features include protocol type.

5. The method as claimed in claim 4 wherein the invariant features include port information.

6. The method as claimed in claim 1 wherein the step of aggregating is based on temporal, static network and dynamic routing parameters.

7. The method as claimed in claim 1 further comprising identifying desired network flow characteristics based on dynamic routing and topology information.

8. The method as claimed in claim 1 wherein the computer network is the Internet.

17. The method as claimed in claim 1 wherein level of route aggregation is a measure of the distance.

18. The method as claimed in claim 1 further comprising utilizing physical and logical router interfaces at a highest level of aggregation.

19. The method as claimed in claim 1 wherein the distance is a logical distance with respect to forwarding topology.

9. A system for profiling network flows at a measurement point within a computer network, the system comprising:

means for measuring network flows having invariant features at a measurement point located within routing infrastructure of the computer network to obtain flow statistics; and

means for aggregating the flow statistics to obtain a traffic profile of the network flows at the measurement point wherein the flow statistics are aggregated based on at least one of the invariant features and wherein the at least one invariant feature is either a source endpoint or a destination endpoint and wherein the flow statistics are aggregated based on distance from the measurement point to the endpoint.

10. The system as claimed in claim 9 wherein the invariant features include source and destination endpoints.

11. The system as claimed in claim 10 further comprising means for identifying typical traffic source and destination pairs for network flows that transit the measurement point based on the source and destination endpoints.

12. The system as claimed in claim 10 wherein the invariant features include protocol type.

13. The system as claimed in claim 12 wherein the invariant features include port information.

14. The system as claimed in claim 9 wherein the flow statistics are aggregated based on temporal, static network and dynamic routing parameters.

15. The system as claimed in claim 9 further comprising means for identifying desired network flow characteristics based on dynamic routing and topology information.

16. The system as claimed in claim 9 wherein the computer network is the Internet.

20. The system as claimed in claim 9 wherein the system is capable of adapting to system resources in a dynamic fashion by reassignment of system resources to deal with possible aggregation levels.