| 摘要 |
Disclosed is an informed sampling technique for biasing a sample data s et toward network data of interest for a particular application. Network data received at a network node (for example at a rate which is greater than a sampling rate fo r which the network node is configured) is chosen to be included in a sample set based o n one or more predetermined signatures which are chosen to bias the sample set toward network data of interest for a particular application. For example, the samp le set may be biased to include data of interest for fraud detection, spam detection, a nd intrusion detection. The particular signature(s) may be predefined by a user, or may b e automatically generated by another network application. The invention may be implemented at various levels and nodes of a network. For example, the informed sampling may be implemented at a traffic monitoring function of a network router, a flow collector which receives network flow data from the router, or both.
|
