Detecting coordinated attacks on Internet resources requires a distributed network monitoring infrastructure. Such an infrastructure will have two logically distinct elements: distributed monitors that continuously collect traffic information, and a distributed query system that allows network operators to efficiently correlate information from different monitors in order to detect anomalous traffic patterns. In this paper, we discuss the design and implementation of MIND, a distributed index management system that supports the creation and querying of multiple distributed indices. We validate MIND using traffic traces from two large backbone networks, then examine the performance of a MIND prototype on more than 100 PlanetLab machines. Our experiments show that MIND can detect and report network anomalies in about one second on an inter-continental backbone. We also analyze the efficiency of our load balancing mechanism and evaluate the robustness of MIND to node failure.
MIND REF was introduced as a distributed network monitoring infrastructure for detecting anomalous traffic patterns.
MIND: A Distributed Multi-Dimensional Indexing System for Network Diagnosis
Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications
Proceedings IEEE INFOCOM 2006. 25TH IEEE International Conference on Computer Communications
Computer Science