Traffic Summary Analysis for Network Abuse Detection in High Date-Rate ISP Networks

The recent explosion in bandwidth available to home users has caused traffic rates for commercial national networks to increasing rapidly. This presents a problem for any core network monitoring tool as the traffic rate it is expected to monitor is rising on a monthly basis. Security within these networks is paramount as they are now a stable home of trade and commerce. This paper suggests that the use of summary statistics, gathered over a number of packets, is a sensible way of coping with high data rates. We further present a methodology for discovering which metrics are appropriate for classifying significant network events and demonstrate this in a test environment. Finally we show how the statistical variance found in the test environment matches to those found in a National network core.