Adaptive algorithms for identifying large flows in IP traffic

Abstract : We develop in this paper an adaptive algorithm based on Bloom filters in order to identify large flows. While most algorithms proposed so far in the technical literature rely on a periodic erasure of the Bloom filter, we propose in this paper to progressively decrement the various counters of the filter according to some overload criteria. When tested against real traffic traces, the proposed algorithm performs well in the sense that a high percentage of large flows in traffic are detected by the algorithm. In order to improve the accuracy of the algorithm, we introduce a shadow Bloom filter, which is less frequently decremented so that elephants have more chance of being identified. Since elephant detection issue is very close to flood attack detection, we adapt the proposed algorithm in order to detect SYN and volume flood attack in Internet traffic. The attack detection algorithm is tested against traffic traces from France Telecom collect and transit networks. Some performance issues are finally discussed.
Document type :
Preprints, Working Papers, ...
Complete list of metadatas

https://hal.inria.fr/inria-00357343
Contributor : Philippe Robert <>
Submitted on : Friday, January 30, 2009 - 10:32:02 AM
Last modification on : Friday, May 25, 2018 - 12:02:06 PM
Long-term archiving on : Thursday, June 30, 2011 - 10:45:13 AM

Files

Hal.pdf
Files produced by the author(s)

Identifiers

  • HAL Id : inria-00357343, version 1
  • ARXIV : 0901.4846

Citation

Yousra Chabchoub, Christine Fricker, Fabrice Guillemin, Philippe Robert. Adaptive algorithms for identifying large flows in IP traffic. 2009. ⟨inria-00357343v1⟩

Share

Metrics

Record views

8

Files downloads

45