37th Annual IEEE Conference on Local Computer Networks (2012)
Clearwater Beach, FL, USA USA
Oct. 22, 2012 to Oct. 25, 2012
Yang Liu , Department of Electrical and Computer Engineering, Iowa State University, Ames, 50011, USA
Wenji Chen , Department of Electrical and Computer Engineering, Iowa State University, Ames, 50011, USA
Yong Guan , Department of Electrical and Computer Engineering, Iowa State University, Ames, 50011, USA
Recently, Traffic Activity Graphs (TAGs) have been proposed to understand, analyze, and model network-wide communication patterns. The topological properties of the TAGs have been shown to be very helpful for malware analysis, anomaly detection, and attack attribution. In a TAG, nodes represent hosts in the network and edges are observed flows that indicate certain communication relations or interactions of interest among the hosts. The challenge is how to capture and analyze TAGs which are usually large, sparse and complex and often have overly-large space and computation requirements. In this paper, we present a new sampling-based low-rank approximation method for monitoring TAGs. The resulted solution can reduce the computation complexity for the communication pattern analysis from O(mn) to O(m+n), where m and n denote the number of sources and destinations, respectively. The experimental results with real-world traffic traces show that our method outperform existing solutions in terms of efficiency and the capability of processing and identifying unknown TAGs.
Approximation methods, Matrix decomposition, Communities, Sampling methods, Monitoring, Ports (Computers), Electronic mail, Low-rank Matrix Approximation, Packet Sampling, Traffic Measurement
Y. Liu, W. Chen and Y. Guan, "Monitoring Traffic Activity Graphs with low-rank matrix approximation," 37th Annual IEEE Conference on Local Computer Networks(LCN), Clearwater Beach, FL, USA USA, 2012, pp. 59-67.