Traffic flow monitoring with high temporal resolution

• Autor(a) principal: Cunha, Maria Strecht Barros
• Data de Publicação: 2023
• Tipo de documento: Dissertação
• Idioma: eng
• Título da fonte: Repositório Científico de Acesso Aberto de Portugal (Repositórios Cientìficos)
• Texto Completo: http://hdl.handle.net/10773/41039
• topic: Flow monitoring; Libpcap; Network monitoring; Packet analysis

The Internet has grown exponentially, connecting millions of devices for various purposes. However, this growth has led to increased malicious activities that require effective monitoring and security measures. Traditional traffic flow monitoring techniques restrain network performance optimisation and security, making high temporal resolution traffic flow monitoring more crucial for accurate issue identification, troubleshooting, and security breach prevention. To address the need for efficient and scalable monitoring systems, developing a system that can accurately track and measure the transmission of specific traffic flows over time is essential. Traditional monitoring techniques have limited temporal resolution, highlighting the need for high temporal resolution monitoring to provide a comprehensive view of network activity. This dissertation aims to create a monitoring system that can effectively and efficiently track and measure the traffic flow of filtered network data over time. The monitoring framework is divided into three modules: (1) acquiring data through packet filtering and monitoring, (2) processing data through flow identification and activity, and (3) storing the statistical information of the flows in a centralised archive system with high temporal resolution and a sampling interval that the user can customise. This dissertation explores the challenges brought about by the constantly changing and privacy-sensitive nature of the Internet and the advancements in network monitoring and security. This discussion covers the history of network monitoring, various network monitoring and measurement techniques, network flow monitoring, the traditional flow capture protocols and their limitations, and the pros and cons of flow capture with high temporal resolution. The monitoring framework was implemented in Rust, with the help of the Libpcap library, and its implementation is discussed regarding the developed methodologies to identify and quantify traffic flows over time through statistical qualification with high temporal resolution, the deployment of the framework in a network, and an overall performance evaluation.