Application of sampling methodologies to network traffic characterization
SIGCOMM '93 Conference proceedings on Communications architectures, protocols and applications
Empirically derived analytic models of wide-area TCP connections
IEEE/ACM Transactions on Networking (TON)
Efficient policies for carrying Web traffic over flow-switched networks
IEEE/ACM Transactions on Networking (TON)
Charging from sampled network usage
IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
Internetworking with TCP/IP, Volume 1: Principles, Protocols, and Architectures, Fourth Edition
Internetworking with TCP/IP, Volume 1: Principles, Protocols, and Architectures, Fourth Edition
New directions in traffic measurement and accounting
Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
Properties and prediction of flow statistics from sampled packet streams
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
Estimating flow distributions from sampled flow statistics
Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
Proceedings of the 2004 conference on Applications, technologies, architectures, and protocols for computer communications
A parameterizable methodology for Internet traffic flow profiling
IEEE Journal on Selected Areas in Communications
Fisher information of sampled packets: an application to flow size estimation
Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Confident estimation for multistage measurement sampling and aggregation
SIGMETRICS '08 Proceedings of the 2008 ACM SIGMETRICS international conference on Measurement and modeling of computer systems
A stratified traffic sampling methodology for seeing the big picture
Computer Networks: The International Journal of Computer and Telecommunications Networking
Estimating Flow Length Distributions Using Least Square Method and Maximum Likelihood Estimation
ICCS '07 Proceedings of the 7th international conference on Computational Science, Part IV: ICCS 2007
Towards optimal sampling for flow size estimation
Proceedings of the 8th ACM SIGCOMM conference on Internet measurement
A resource-minimalist flow size histogram estimator
Proceedings of the 8th ACM SIGCOMM conference on Internet measurement
On the statistical characterization of flows in Internet traffic with application to sampling
Computer Communications
Network anomaly detection and classification via opportunistic sampling
IEEE Network: The Magazine of Global Internetworking - Special issue title on recent developments in network intrusion detection
Estimating flow distribution by using difference information of multiple packet samplings
ICOIN'09 Proceedings of the 23rd international conference on Information Networking
Fast and scalable classification of structured data in the network
NETWORKING'07 Proceedings of the 6th international IFIP-TC6 conference on Ad Hoc and sensor networks, wireless networks, next generation internet
A novel algorithm for estimating flow length distributions-LSM
NPC'07 Proceedings of the 2007 IFIP international conference on Network and parallel computing
An online framework for catching top spreaders and scanners
Computer Networks: The International Journal of Computer and Telecommunications Networking
Forecasting-based sampling decision for accurate and scalable anomaly detection
GLOBECOM'09 Proceedings of the 28th IEEE conference on Global telecommunications
On accurate and scalable anomaly detection in next generation mobile network
ICC'09 Proceedings of the 2009 IEEE international conference on Communications
A signal processing view on packet sampling and anomaly detection
INFOCOM'10 Proceedings of the 29th conference on Information communications
High-speed per-flow traffic measurement with probabilistic multiplicity counting
INFOCOM'10 Proceedings of the 29th conference on Information communications
Flowroute: inferring forwarding table updates using passive flow-level measurements
IMC '10 Proceedings of the 10th ACM SIGCOMM conference on Internet measurement
Understanding and evaluating the impact of sampling on anomaly detection techniques
MILCOM'06 Proceedings of the 2006 IEEE conference on Military communications
Investigating self-similarity and heavy-tailed distributions on a large-scale experimental facility
IEEE/ACM Transactions on Networking (TON)
Estimating original flow length from sampled flow statistics
ICCS'06 Proceedings of the 6th international conference on Computational Science - Volume Part IV
An algorithm for estimation of flow length distributions using heavy-tailed feature
ICCS'06 Proceedings of the 6th international conference on Computational Science - Volume Part IV
Towards efficient flow sampling technique for anomaly detection
TMA'12 Proceedings of the 4th international conference on Traffic Monitoring and Analysis
Inverting flow durations from sampled traffic
Proceedings of the 24th International Teletraffic Congress
Detection and classification of peer-to-peer traffic: A survey
ACM Computing Surveys (CSUR)
Measurement artifacts in netflow data
PAM'13 Proceedings of the 14th international conference on Passive and Active Measurement
| Hi-index | 0.00 |
Passive traffic measurement increasingly employs sampling at the packet level. Many high-end routers form flow statistics from a sampled substream of packets. Sampling controls the consumption of resources by the measurement operations. However, knowledge of the statistics of flows in the unsampled stream remains useful, for understanding both characteristics of source traffic, and consumption of resources in the network. This paper provides methods that use flow statistics formed from sampled packet stream to infer the frequencies of the number of packets per flow in the unsampled stream. A key task is to infer the properties of flows of original traffic that evaded sampling altogether. We achieve this through statistical inference, and by exploiting protocol level detail reported in flow records. We investigate the impact on our results of different versions of packet sampling.