A Continuous Virtual Vector-Based Algorithm for Measuring Cardinality Distribution

摘要

The host cardinality is the number of distinct destinations that a host communicates with. Host cardinality is an important metric for high-speed network profiling. With the development of internet, network attacks occur frequently such as worm spreading, DDoS attack and port scanning and so on. One common characteristic of these attacks is that they usually generate a lot of traffic connections in a short time which will lead the host cardinality distribution to change. Hence we can detect these attacks according to the host cardinality distribution. In this paper, we present an algorithm based on continuous virtual vector to estimate the host cardinality distribution. Through experiments using real internet traces, we demonstrate that our algorithm can estimate the host cardinality distribution accurately while using little storage.