An Efficient Representation of Network Flow Record

Complexity and diversity of traffic are constantly increasing, and the demand for continuous detailed network traffic monitoring is growing. The NetFlow method has its characteristics of low efficient data representation, which causes large transmission bandwidth consuming and storage explosion. And aggregated NetFlow records lose lots of information, which result in being unable to do traffic analysis refinedly. To find an efficient network traffic information representation method is of important significance to satisfy the new demand for network monitor. This paper proposes a new flow of information representation—TABSI(target-and-application-based statistical interpretation). This method cycles per unit time monitoring of the objects in various different applications, using the flow statistics, flow number statistics and the distribution as the number of the basic description for the traffic information unit, and periodically exports the information to describe the flow characteristics of the link. Theoretical analysis shows that the TABSI can give a good description of network behavior, and the TABSI contain more information content compared with the polymer-based NetFlow, and the effectiveness of historical data is better. The results of running on real network show that the TABSI method has low data transmission, more efficient analysis performance, and large reduction in storage space.