Sciweavers

INFOCOM
2009
IEEE

Identifying High Cardinality Internet Hosts

13 years 10 months ago
Identifying High Cardinality Internet Hosts
—The Internet host cardinality, defined as the number of distinct peers that an Internet host communicates with, is an important metric for profiling Internet hosts. Some example applications include behavior based network intrusion detection, p2p hosts identification, and server identification. However, due to the tremendous number of hosts in the Internet and high speed links, tracking the exact cardinality of each host is not feasible due to the limited memory and computation resource. Existing approaches on host cardinality counting have primarily focused on hosts of extremely high cardinalities. These methods do not work well with hosts of moderately large cardinalities that are needed for certain host behavior profiling such as detection of p2p hosts or port scanners. In this paper, we propose an online sampling approach for identifying hosts whose cardinality exceeds some moderate prescribed threshold, e.g. 50, or within specific ranges. The main advantage of our approac...
Jing Cao, Yu Jin, Aiyou Chen, Tian Bu, Zhi-Li Zhan
Added 24 May 2010
Updated 24 May 2010
Type Conference
Year 2009
Where INFOCOM
Authors Jing Cao, Yu Jin, Aiyou Chen, Tian Bu, Zhi-Li Zhang
Comments (0)