This Article 
   
 Share 
   
 Bibliographic References 
   
 Add to: 
 
Digg
Furl
Spurl
Blink
Simpy
Google
Del.icio.us
Y!MyWeb
 
 Search 
   
37th Annual IEEE Conference on Local Computer Networks
Monitoring Traffic Activity Graphs with low-rank matrix approximation
Clearwater Beach, FL, USA USA
October 22-October 25
ISBN: 978-1-4673-1565-4
Yang Liu, Department of Electrical and Computer Engineering, Iowa State University, Ames, 50011, USA
Wenji Chen, Department of Electrical and Computer Engineering, Iowa State University, Ames, 50011, USA
Yong Guan, Department of Electrical and Computer Engineering, Iowa State University, Ames, 50011, USA
Recently, Traffic Activity Graphs (TAGs) have been proposed to understand, analyze, and model network-wide communication patterns. The topological properties of the TAGs have been shown to be very helpful for malware analysis, anomaly detection, and attack attribution. In a TAG, nodes represent hosts in the network and edges are observed flows that indicate certain communication relations or interactions of interest among the hosts. The challenge is how to capture and analyze TAGs which are usually large, sparse and complex and often have overly-large space and computation requirements. In this paper, we present a new sampling-based low-rank approximation method for monitoring TAGs. The resulted solution can reduce the computation complexity for the communication pattern analysis from O(mn) to O(m+n), where m and n denote the number of sources and destinations, respectively. The experimental results with real-world traffic traces show that our method outperform existing solutions in terms of efficiency and the capability of processing and identifying unknown TAGs.
Index Terms:
Approximation methods,Matrix decomposition,Communities,Sampling methods,Monitoring,Ports (Computers),Electronic mail,Low-rank Matrix Approximation,Packet Sampling,Traffic Measurement
Citation:
Yang Liu, Wenji Chen, Yong Guan, "Monitoring Traffic Activity Graphs with low-rank matrix approximation," lcn, pp.59-67, 37th Annual IEEE Conference on Local Computer Networks, 2012
Usage of this product signifies your acceptance of the Terms of Use.