A hash-based algorithm for measuring cardinality distribution in network traffic
by Weijiang Liu; Chao Liu; Shuming Guo
International Journal of Autonomous and Adaptive Communications Systems (IJAACS), Vol. 9, No. 1/2, 2016

Abstract: The host cardinality, defined as the number of distinct peers that a host communicates with, is an important metric for profiling hosts. Host cardinality distribution is very useful for characterising the communication connectivity patterns between hosts inside a network. With the development of the internet, network intrusion events occur frequently, such as worm propagation, DDoS attacks, port scanning, etc. These attacks generate a lot of traffic connections in a short time, resulting in network block and even paralysis. In the case of DDoS or worm attacks, the infected host usually produces a lot of connections with other hosts in a short period of time, then the host cardinality distribution will be different from normal situations. Hence, this paper proposes a hash-based algorithm for measuring the host cardinality distribution. Combining with hash, Bloom filter, and data stream algorithm, the space and time consumption of the algorithm is very small, so it can be used to estimate the host cardinality distribution in the high-speed network.

Online publication date: Sat, 19-Mar-2016

The full text of this article is only available to individual subscribers or to users at subscribing institutions.

 
Existing subscribers:
Go to Inderscience Online Journals to access the Full Text of this article.

Pay per view:
If you are not a subscriber and you just want to read the full contents of this article, buy online access here.

Complimentary Subscribers, Editors or Members of the Editorial Board of the International Journal of Autonomous and Adaptive Communications Systems (IJAACS):
Login with your Inderscience username and password:

Username:        Password:          Forgotten your password?

Want to subscribe?
A subscription gives you complete access to all articles in the current issue, as well as to all articles in the previous three years (where applicable). See our Orders page to subscribe.

If you still need assistance, please email subs@inderscience.com