Abstract

The rapid growth of network traffic and available bandwidth forced additional research in the area of network monitoring for network security solutions as well as for accounting and traffic engineering applications. Autonomic networking solutions are considered to counteract identified scalability issues. In this paper, we focus on the amount of measurement data obtained by a monitoring probe that has to be transmitted to and analyzed by an analyzer, e.g. an attack detection system. We question the possibility of re-configuring the monitoring part in order to adapt to the computational resources of the analyzer as well as to the current network behavior. We propose an adaptive mechanism for preventing single systems from being overloaded while providing as much monitoring information as possible for post-processing. Using two simulation models, we verified the applicability of our approach and show the speedup gained by adapting the parameters of the monitoring solution.

Citations