An Experimental Approach to Integrating NetFlow Flow-level Records and NLANR Packet-level Traces

摘要

In this paper, we investigate the integration of flow-level records (exemplified by Cisco NetFlow) and packet-level traces (exemplified by NLANR PMA), in order to facilitate cross-validation and complementary utility. However, identifying the correspondences between the two is non-trivial, due to the heterogeneity in data collection. We have adopted a top-down approach to limit the search space, and reduce the matching errors step by step.