Aggregated representations and metrics for scalable flow analysis

While monitoring network traffic at the operator level allows to collect highly valuable data for monitoring large scale distributed attacks, scalability remains a major challenge due to the large data volumes to handle. In particular, collecting and storing NetFlow data is feasible but accurate analysis is still a challenging topic. Hence, this paper leverages an aggregated representation of the network traffic which is further analyzed using dedicated entropic based metrics and machine learning techniques. The main advantage is a reduction of the computational complexity while the accuracy still remains acceptable as highlighted by evaluation on real datasets.