On the self-similar nature of Ethernet traffic (extended version)
IEEE/ACM Transactions on Networking (TON)
On the constancy of internet path properties
IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
A method to compress and anonymize packet traces
IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
Monitoring very high speed links
IMW '01 Proceedings of the 1st ACM SIGCOMM Workshop on Internet Measurement
Properties and prediction of flow statistics from sampled packet streams
Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
The Entropy of Cell Streams as a Traffic Descriptor in ATM Networks
Proceedings of the Sixth IFIP WG6.3 Conference on Performance of Computer Networks: Data Communications and their Performance
Estimation of entropy and mutual information
Neural Computation
M|G|Infinity Input Processes: A Versatile Class of Models for Network Traffic
INFOCOM '97 Proceedings of the INFOCOM '97. Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Driving the Information Revolution
An information-theoretic approach to traffic matrix estimation
Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
Information-Theoretic Measures for Anomaly Detection
SP '01 Proceedings of the 2001 IEEE Symposium on Security and Privacy
Proceedings of the 3rd ACM SIGCOMM conference on Internet measurement
The impact of spatial correlation on routing with compression in wireless sensor networks
Proceedings of the 3rd international symposium on Information processing in sensor networks
Bridging router performance and queuing theory
Proceedings of the joint international conference on Measurement and modeling of computer systems
Cluster processes: a natural language for network traffic
IEEE Transactions on Signal Processing
Entropy of ATM traffic streams: a tool for estimating QoS parameters
IEEE Journal on Selected Areas in Communications
Packet-level traffic measurements from the Sprint IP backbone
IEEE Network: The Magazine of Global Internetworking
Entropy based adaptive flow aggregation
IEEE/ACM Transactions on Networking (TON)
Traffic monitor deployment in IP networks
Computer Networks: The International Journal of Computer and Telecommunications Networking
Dynamic feature analysis and measurement for large-scale network traffic monitoring
IEEE Transactions on Information Forensics and Security
Monitoring abnormal network traffic based on blind source separation approach
Journal of Network and Computer Applications
| Hi-index | 0.00 |
Network engineers and operators are faced with a number of challenges that arise in the context of network monitoring and measurement. These include: i) how much information is included in measurement traces and by how much can we compress those traces?, ii) how much information is captured by different monitoring paradigms and tools ranging from full packet header captures to flow-level captures (such as with NetFlow) to packet and byte counts (such as with SNMP)? and iii) how much joint information is included in traces collected at different points and can we take advantage of this joint information? In this paper we develop a network model and an information theoretic framework within which to address these questions. We use the model and the framework to first determine the benefits of compressing traces captured at a single monitoring point, and we outline approaches to achieve those benefits. We next consider the benefits of joint coding, or equivalently of joint compression of traces captured a different monitoring points. Finally, we examine the difference in information content when measurements are made at either the flow level or the packet/byte count level. In all of these cases, the effect of temporal and spatial correlation on the answers to the above questions is examined. Both our model and its predictions are validated against measurements taken from a large operational network.