Linguistic summarization of network traffic flows

Abstract

Trabajo presentado al "FUZZ-IEEE 2008" celebrado en Hong Kong del 1 al 6 de Junio de 2008. ; We address, by means of fuzzy linguistic summaries, two related problems: summarizing network flow statistics and making these statistics human-readable. Two complementary summarization methods are developed. First, a fixed set of protoforms of interest is defined, and the ones with a higher truth value are shown to the user as simple on-line summaries. This first method is suitable for real-time monitoring. Then, an association rules mining process is carried out in order to find hidden relations in flow records. Both approaches are implemented in a tool capable of real-time and off-line processing of network flow records. Experimental results for a number of heterogeneous NetFlow records show the usefulness of linguistic summaries to both network practitioners and users. ; This work has been supported in part by projects TEC2005-04359/MIC from the Spanish Ministry of Education and Science and project TIC2006-635 from the Andalusian regional Government. ; Peer Reviewed