US 20020032717A1
(19) United States
(12) Patent Application Publication (io) Pub. No.: US 2002/0032717 Al
Malan et al. (43) Pub. Date: Mar. 14,2002
(54) METHOD AND SYSTEM FOR PROFILING NETWORK FLOWS AT A MEASUREMENT POINT WITHIN A COMPUTER NETWORK
(75) Inventors: Gerald R. Malan, Ann Arbor, MI (US);
Farnam Jahanian, Ann Arbor, MI
(US)
Correspondence Address:
David R. Syrowik
Brooks & Kushman PC
22nd Floor
lOOOTown Center
Southfleld, MI 48075-1351 (US)
(73) Assignee: The Regents of The University of Michigan, 3003 S. State Street, Ann Arbor, MI (US)
(21) Appl. No.: 09/855,809
(22) Filed: May 15, 2001
Related U.S. Application Data
(63) Non-provisional ol provisional application No. 60/231,480, filed on Sep. 8, 2000. Non-provisional of
provisional application No. 60/231,481, filed on Sep. 8, 2000. Non-provisional of provisional application No. 60/231,479, filed on Sep. 8, 2000.
Publication Classification
(51) Int. CI.7 G06F 15/16; G06F 9/00
(52) U.S. CI 709/105; 709/232; 709/234
(57) ABSTRACT
A method and system for profiling network flows at a measurement point within a computer network is provided. The method includes measuring network flows having invariant features at a measurement point located within routing infrastructure of the computer network to obtain flow statistics. The method also includes aggregating the flow statistics to obtain a traffic profile of the network flows at the measurement point. The method and system utilize the natural hierarchy in the Internet addressing scheme to provide a means for making tractable measurements of network traffic in high-speed networks. Moreover, the method and system adapt dynamically to the changing underlying traffic characteristics to maintain a maximum memory footprint for the profiles. The method and system adapt by adjusting the level of aggregation of the traffic endpoints along a scale from Interface to fully specified network address.
