Improving Network Monitoring through Aggregation of HTTP/1.1 Dialogs in IPFIX

Network monitoring is the basis to analyze communications for preventing network attacks and misuse. Common practice for today's high throughput networks are flow-based network monitoring techniques like IPFIX. However, these solutions do not support the observation of HTTP/1.1 request/response dialogs. At the same time, we observe an increasing trend to use HTTP pipelining in the Internet as well as the use of HTTP as a generic transport protocol. IPFIX-based network monitoring and attack detection is no longer able to identify misbehavior in the complex and often interlaced HTTP dialogs. This work presents a new monitoring concept, which is able to aggregate HTTP/1.1 dialog information into bidirectional IPFIX flows. It is thereby laying the foundation for network security tools like IDS to process the resulting flows faster and more efficiently. The evaluation shows that the implemented parsing mechanism can even deal with complex HTTP traffic and clearly outperforms existing solutions.