Special features of toolkit for network traffic analysis

Seminars

Laboratory of Information Technologies

Joint Laboratory Seminar

Date and Time: Thursday, 14 March 2024, at 11:00 AM

Venue: room 310, Meshcheryakov Laboratory of Information Technologies, online on Webinar

Seminar topic: “Special features of the toolkit for network traffic analysis”

Speaker: Ivan Tatarinov

Authors: Ivan Tatarinov, Valery Ivanov

Abstract:

Research on network traffic is an important stage in ensuring the security and optimising the performance of computer networks. Analysing various characteristics of network traffic, including the probability distribution of data transmission speed, understanding the behavioural patterns of network traffic, and detecting anomalies, such as those resulting from DDoS attacks, are key aspects of this type of research. This paper describes the development and utilisation of a toolkit that provides a full range of tasks for analysing network traffic, from collecting data from various types of computer networks to visualising the analysis results.

The massive volumes (in the case of researching network traffic in large backbone channels with millions of network devices) and the diversity of network traffic (in the case of studying network traffic in small computer networks, including home computer networks) require both high performance and flexible management with fine tuning, which are often not satisfied by standard tools. In the context of network traffic research, the necessity arose to develop a custom toolkit that is flexible and powerful enough to effectively analyse large-scale network data.

To carry out tasks related to the study of network traffic, a comprehensive set of tools was developed, covering all stages of network traffic analysis, including data interception, storage, direct analysis of stored data, and visualisation of the results. Each component of the toolkit is optimised to provide high efficiency and accuracy in processing and interpreting network data.

Each stage of network traffic analysis required the application of specific approaches to achieve the goals set. For example, during the data interception and storage stage, post-processing was required to significantly reduce both the volume of stored data and the speed of subsequent data retrieval. During the network traffic analysis stage, algorithms were required for purposes such as rapid calculation of parameters for approximating curves.