METHOD AND SYSTEM FOR MONITORING AND ANALYSIS OF NETWORK TRAFFIC FLOWS

摘要

Network traffic flow records received from a network probe are filtered and short traffic flows are selected so that the total number of short traffic flows is high but the number of bytes in the short traffic flows is negligible, followed by discarding of the short traffic flows. Traffic flow data is recorded in multiple sets of buckets of different granularity, optimized for the purpose of almost instant analysis and display as well as for longer term report generation. The traffic flow data is pre-processed and stored redundantly in parallel in multiple bucketized data base tables of different time window sizes. A corresponding method and system are provided.

主权项

1. A method for processing traffic flow data received from a network probe device, comprising:
(a) determining a statistical traffic flow profile of traffic flow data, comprising a distribution of number of traffic flows according to respective byte sizes; (b) selecting, from said distribution, a given byte size so that an aggregate of bytes in traffic flows having a size below the given byte size represents a predetermined small percentage of aggregate bytes in all traffic flows in said distribution; and (c) retaining flow records of those traffic flows whose byte size is above the given byte size, and discarding flow records for other traffic flows.