Intentional network monitoring: Finding the needle without capturing the haystack

Sean Donovan, Nick Feamster

Research output: Chapter in Book/Report/Conference proceedingConference contribution

13 Scopus citations

Abstract

Monitoring network traffic serves many purposes, from security to accounting, yet current mechanisms for collecting network traffic are typically based on low-level features of network traffic (e.g., IP addresses, port numbers), rather than characteristics that more closely map to intent (e.g., people, applications, or devices). In this paper, we present the case for intentional network monitoring-the practice of capturing the minimal set of traffic that satisfies the operator's monitoring intent or goal-and a preliminary design and implementation for NetAssay, a system that enables intentional monitoring. A significant challenge in developing NetAssay is developing a runtime that can maintain a mapping between stable abstractions that an operator or programmer might use to express intent (e.g., a username) and the dynamic, heterogeneous data that establishes these associations (e.g., information from a login server or DNS record). We present examples that show how the NetAssay runtime can perform late binding between these mappings and network flow space and discuss the research and technical challenges associated with establishing more general late-binding mechanisms.

Original languageEnglish (US)
Title of host publicationProceedings of the 13th ACM Workshop on Hot Topics in Networks, HotNets 2014
PublisherAssociation for Computing Machinery, Inc
ISBN (Electronic)9781450332569
DOIs
StatePublished - Oct 27 2014
Event13th ACM SIGCOMM Workshop on Hot Topics in Networks, HotNets 2014 - Los Angeles, United States
Duration: Oct 27 2014Oct 28 2014

Publication series

NameProceedings of the 13th ACM Workshop on Hot Topics in Networks, HotNets 2014

Other

Other13th ACM SIGCOMM Workshop on Hot Topics in Networks, HotNets 2014
CountryUnited States
CityLos Angeles
Period10/27/1410/28/14

All Science Journal Classification (ASJC) codes

  • Computer Networks and Communications

Keywords

  • Network Monitoring
  • Software-defined networking (SDN)

Fingerprint Dive into the research topics of 'Intentional network monitoring: Finding the needle without capturing the haystack'. Together they form a unique fingerprint.

  • Cite this

    Donovan, S., & Feamster, N. (2014). Intentional network monitoring: Finding the needle without capturing the haystack. In Proceedings of the 13th ACM Workshop on Hot Topics in Networks, HotNets 2014 [2673872] (Proceedings of the 13th ACM Workshop on Hot Topics in Networks, HotNets 2014). Association for Computing Machinery, Inc. https://doi.org/10.1145/2670518.2673872