Digging into IP Flow Records with a Visual Kernel Method

  • Cynthia Wagner
  • Gerard Wagener
  • Radu State
  • Thomas Engel
Part of the Lecture Notes in Computer Science book series (LNCS, volume 6694)


This paper presents a network monitoring framework with an intuitive visualization engine. The framework leverages a kernel method with spatial and temporal aggregated IP flows for the off/online processing of Netflow records and full packet captures from ISP and honeypot input data and is operating on aggregated Netflow records and is supporting network management activities related to the anomaly and attack detection.


Netflow records Visualization Kernel Function Honeypot 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    Cifarelli, C., Nieddu, L., Seref, O., Pardalos, P.M.: K.-T.R.A.C.E.: A kernel k-means procedure for classification. Computers and Operations Research 34(10), 3154–3161 (2007)MathSciNetCrossRefzbMATHGoogle Scholar
  2. 2.
    Cho, K., Kaizaki, R., Kato, A.: Aguri: An aggregation-based traffic profiler. In: Smirnov, M., Crowcroft, J., Roberts, J., Boavida, F. (eds.) QofIS 2001. LNCS, vol. 2156, pp. 222–242. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  3. 3.
    Cowlishaw, M.F.: Fundamental Requirements for Picture Presentation. Proceedings of the Society for Picture Presentation 26(2), 101–107 (1985)Google Scholar
  4. 4.
    Glanfield, J., Brooks, S., Taylor, T., Paterson, D., Smith, C., Gates, C., McHugh, J.: OverFlow: An Overview Visualization for Network Analysis. In: 6th International Workshop on Visualization for Cyber Security, Atlantic City, NJ (2009)Google Scholar
  5. 5.
    Goodall, J.R., Tesone, D.R.: Visual Analytics for Network Flow Analysis. In: Conference for Homeland Security, Cybersecurity Applications & Technology, pp. 199–204. IEEE, Los Alamitos (2009)CrossRefGoogle Scholar
  6. 6.
    Mansmann, F., Fischer, F., Keim, D.A., North, S.C.: Visual Support for Analyzing Network Traffic and Intrusion Detection Events using TreeMap and Graph Representations. In: Proceeding of ACM CHiMitiT 2009, Balitmore, Maryland, pp. 19–28 (2009)Google Scholar
  7. 7.
    Paredes-Oliva, I.: Portscan Detection with Sampled NetFlow. In: Papadopouli, M., Owezarski, P., Pras, A. (eds.) TMA 2009. LNCS, vol. 5537, pp. 26–33. Springer, Heidelberg (2009)CrossRefGoogle Scholar
  8. 8.
    Patole, V.A., Pachghare, V.K., Kulkarni, P.: Self Organizing Maps to build Intrusion Detection Systems. Journal of Computer Applications 1(8) (2010)Google Scholar
  9. 9.
    Rieck, K.: Machine Learning for Application-layer Intrusion Detection. In: Fraunhofer Institute FIRST and Berlin Institute of Technology, Berlin, Germany (2009)Google Scholar
  10. 10.
    Spitzner, L.: Honeypots: Tracking Hackers. Addison-Wesley Professional, Reading (2002)Google Scholar
  11. 11.
    Vapnik, V.: Statistical Learning Theory. Wiley, Chichester (1998)zbMATHGoogle Scholar
  12. 12.
    Wagner, C., Wagener, G., State, R., Dulaunoy, A., Engel, T.: Game Theory Driven Monitoring of Spatial-Aggregated IP-Flow Records. In: 6th International Conference on Network and Services Management, Niagara Falls, Canada (2010)Google Scholar

Copyright information

© Springer-Verlag Berlin Heidelberg 2011

Authors and Affiliations

  • Cynthia Wagner
    • 1
  • Gerard Wagener
    • 1
  • Radu State
    • 1
  • Thomas Engel
    • 1
  1. 1.University of Luxembourg - SnTLuxembourgLuxembourg

Personalised recommendations