Dictyogram: A statistical approach for the definition and visualization of network flow categories

Network managers have to deal with tons of measurement data provided by monitoring systems. Such data is difficult to both process and translate into concrete management actions. As an attempt to make managerial work easier, we propose a novel statistical approach that summarizes the behavior of network flow characteristics - e.g., flow sizes or durations. Bearing in mind that losses in the summarized information can lead to restricted or even erroneous conclusions, our approach solves this by exploiting the probability integral transform theorem. This theorem allows the definition of a set of intervals, mapped into concrete categories, where the number of flows according to a given characteristic would be uniformly distributed among categories. This eases the use of both statistical tests and simple visual inspection to detect changes in the behavior of the characteristic under analysis, as typically abrupt changes are understood as signs of intrusion, malfunction or other types of anomalies. This proposal gave rise to the visualization and analytical framework Dictyogram, which has been applied to monitor the Spanish Academic Network - more than one million users. Its results are shown as a case study assessing the usefulness of our proposal.