Real-time inferring network traffic patterns

It is vitally important for applications in detecting DoS attacks, traffic management, and network security to real-time automatically identify traffic patterns in backbone networks with high speed links carrying large numbers of flows. Our objective is to determine traffic patterns that use up a disproportionate fraction of network resources. This paper first analyzes the major time and space cost in computing high volume clusters under different hierarchical structures, and then proposes a variable hierarchical structure to identify net work traffic patterns in a top-down fashion. We evaluate our model using real trace files from the CERNET backbone link an d demonstrate the improved efficiency of our approach in comparison to previous work on clustering traffic patterns.