Behavioral analysis of network flow traffic
Heller, Mark D.
Xie, Geoffrey G.
MetadataShow full item record
Network Behavior Analysis (NBA) is a technique to enhance network security by passively monitoring aggregate traffic patterns and noting unusual action or departures from normal operations. The analysis is typically performed offline, due to the huge volume of input data, in contrast to conventional intrusion prevention solutions based on deep packet inspection, signature detection, and real-time blocking. After establishing a benchmark for normal traffic, an NBA program monitors network activity and flags unknown, new, or unusual patterns that might indicate the presence of a potential threat. NBA also monitors and records trends in bandwidth and protocol use. Computer users in the Department of Defense (DoD) operational networks may use Hypertext Transport Protocol (HTTP) to stream video from multimedia sites like youtube.com, myspace.com, mtv.com, and blackplanet.com. Such streaming may hog bandwidth, a grave concern, given that increasing amounts of operational data are exchanged over the Global Information Grid, and introduce malicious viruses inadvertently. This thesis develops an NBA solution to identify and estimate the bandwidth usage of HTTP streaming video traffic entirely from flow records such as Cisco's NetFlow data.
RightsThis publication is a work of the U.S. Government as defined in Title 17, United States Code, Section 101. Copyright protection is not available for this work in the United States.
Showing items related by title, author, creator and subject.
Konukbay, Atakan. (Monterey, California. Naval Postgraduate School, 2002-06);The purpose of this thesis is to design a quantum well infrared detector with tunable spectral bandwidth. The tunability of the bandwidth is achieved by using the linear Stark effect for the ground to first excited state ...
Babcock, Bruce Kevin (Monterey, California: Naval Postgraduate School, 1990-06);This thesis is a tutorial for Command, Control, and Communications (C3) students and synthesizes the essence of electronic communications systems and related frequency spectrums into an integrated set of illustrations. The ...
An analysis of the effects of energy spreading loss and transmission loss on low frequency active sonar operations in shallow water Adams, Brian S. (Monterey, California. Naval Postgraduate School, 1997-09);Energy Spreading Loss (ESL) is qualitatively defined as the reduction in peak power level due to energy spreading of a transmitted acoustic pulse in tune. An analysis of the impact of bathymetric geometry and sediment type ...