EventFlow: Network Flow Aggregation Based on User Actions

Kód výsledku v IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F63839172%3A_____%2F16%3A10130712" target="_blank" >RIV/63839172:_____/16:10130712 - isvavai.cz</a>

Výsledek na webu

<a href="http://dx.doi.org/10.1109/NOMS.2016.7502895" target="_blank" >http://dx.doi.org/10.1109/NOMS.2016.7502895</a>

DOI - Digital Object Identifier

<a href="http://dx.doi.org/10.1109/NOMS.2016.7502895" target="_blank" >10.1109/NOMS.2016.7502895</a>

Jazyk výsledku

angličtina

Název v původním jazyce

EventFlow: Network Flow Aggregation Based on User Actions

Popis výsledku v původním jazyce

Network flow monitoring is being supplemented with an application flow visibility to provide more detailed information about network traffic. However, the current concept of flows does not provide a mechanism to keep track of semantic relations between individual flows that are created as a part of a single user action. We propose an extension to the flow measurement, called EventFlow, which allows to preserve relations between HTTP and DNS application flows that are a part of single user action, most typically browsing a web page. We describe an architecture of the EventFlow extension and its limitations. A prototype implementation of the EventFlow is introduced and evaluated on a packet trace from an ISP network. We show that a significant number of flow records can be recognised as a part of a single user action.

Název v anglickém jazyce

EventFlow: Network Flow Aggregation Based on User Actions

Popis výsledku anglicky

Network flow monitoring is being supplemented with an application flow visibility to provide more detailed information about network traffic. However, the current concept of flows does not provide a mechanism to keep track of semantic relations between individual flows that are created as a part of a single user action. We propose an extension to the flow measurement, called EventFlow, which allows to preserve relations between HTTP and DNS application flows that are a part of single user action, most typically browsing a web page. We describe an architecture of the EventFlow extension and its limitations. A prototype implementation of the EventFlow is introduced and evaluated on a packet trace from an ISP network. We show that a significant number of flow records can be recognised as a part of a single user action.

Druh

D - Stať ve sborníku

CEP obor

IN - Informatika

OECD FORD obor

—

Projekt

<a href="/cs/project/LM2015042" target="_blank" >LM2015042: E-infrastruktura CESNET</a><br>

Návaznosti

P - Projekt vyzkumu a vyvoje financovany z verejnych zdroju (s odkazem do CEP)

Rok uplatnění

2016

Kód důvěrnosti údajů

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Název statě ve sborníku

Proceedings of the IEEE/IFIP Network Operations and Management Symposium 2016

ISBN

978-1-5090-0223-8

ISSN

2374-9709

e-ISSN

—

Počet stran výsledku

5

Strana od-do

767-771

Název nakladatele

IEEE Xplore Digital Library

Místo vydání

Istanbul, Turkey

Místo konání akce

Istanbul, Turkey

Datum konání akce

25. 4. 2016

Typ akce podle státní příslušnosti

WRD - Celosvětová akce

Kód UT WoS článku

000389830100106