Automatic Profiling of Network Event Sequences: Algorithm and Applications Export

@inproceedings{meng:profiling, abstract = {The behavior of network entities, such as flows, sessions, hosts, and users, can often be described by communication event sequences in the time domain. For the purpose of many network measurement and monitoring tasks, it is desirable to have an accurate yet information-compact profiling of the behavior of massive event sequences. This paper proposes a new method to achieve this goal. On a given set of event sequences, the proposed method automatically learns a mixture model which fully captures the sequence behavior including both event pattern and duration between events. The learned mixture model is information-compact as it classifies sequences into a set of behavior templates, each of which is described by a Markov Chain. The model parameters are estimated in an iterative procedure which is developed from the Expectation Maximization algorithm. Two network management applications are proposed based on the method: a visualization tool for network administrators to conduct exploratory traffic analysis, and an efficient anomaly detection mechanism. In the evaluation, we validate the method accuracy as well as the usefulness of the two applications by using three networking datasets with different types: TCP packet traces, VoIP calls, and syslog traces in wireless networks.}, author = {Meng, Xiaoqiao and Jiang, Guofei and Zhang, Hui and Chen, Haifeng and Yoshihira, K.}, booktitle = {INFOCOM 2008. The 27th Conference on Computer Communications. IEEE}, citeulike-article-id = {5248722}, citeulike-linkout-0 = {http://dx.doi.org/10.1109/INFOCOM.2008.62}, citeulike-linkout-1 = {http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=4509657}, doi = {10.1109/INFOCOM.2008.62}, journal = {INFOCOM 2008. The 27th Conference on Computer Communications. IEEE}, keywords = {analysis, crawdad, dartmouth\_campus, modelling, syslog}, pages = {266--270}, posted-at = {2009-07-24 09:15:35}, priority = {2}, title = {Automatic Profiling of Network Event Sequences: Algorithm and Applications}, url = {http://dx.doi.org/10.1109/INFOCOM.2008.62}, year = {2008} }

TY - CONF ID - meng:profiling L3 - citeulike-article-id:5248722 N2 - The behavior of network entities, such as flows, sessions, hosts, and users, can often be described by communication event sequences in the time domain. For the purpose of many network measurement and monitoring tasks, it is desirable to have an accurate yet information-compact profiling of the behavior of massive event sequences. This paper proposes a new method to achieve this goal. On a given set of event sequences, the proposed method automatically learns a mixture model which fully captures the sequence behavior including both event pattern and duration between events. The learned mixture model is information-compact as it classifies sequences into a set of behavior templates, each of which is described by a Markov Chain. The model parameters are estimated in an iterative procedure which is developed from the Expectation Maximization algorithm. Two network management applications are proposed based on the method: a visualization tool for network administrators to conduct exploratory traffic analysis, and an efficient anomaly detection mechanism. In the evaluation, we validate the method accuracy as well as the usefulness of the two applications by using three networking datasets with different types: TCP packet traces, VoIP calls, and syslog traces in wireless networks. JF - INFOCOM 2008. The 27th Conference on Computer Communications. IEEE EP - 270 TI - Automatic Profiling of Network Event Sequences: Algorithm and Applications T2 - INFOCOM 2008. The 27th Conference on Computer Communications. IEEE SP - 266 KW - analysis KW - crawdad KW - dartmouth_campus KW - modelling KW - syslog AU - Meng, Xiaoqiao AU - Jiang, Guofei AU - Zhang, Hui AU - Chen, Haifeng AU - Yoshihira, K PY - 2008/// UR - http://dx.doi.org/10.1109/INFOCOM.2008.62 ER -