Count Me In: Viable Distributed Summary Statistics for Securing High-Speed Networks

摘要: Summary statistics represent a key primitive for profiling and protecting operational networks. Many network operators routinely measure properties such as throughput, traffic mix, heavy hitters. Likewise, security monitoring often deploys statistical anomaly detectors that trigger, e.g., when source scans the local IP address range, or exceeds threshold of failed login attempts. Traditionally, diverse set tools is used computations, each typically hard-coding either features it operates on specific calculations performs, both. In this work we present novel framework calculating wide array summary in real-time, independent underlying data, potentially aggregated from points. We focus providing transparent, extensible, easy-to-use interface implement our design top an open-source system. demonstrate example applications detection would traditionally require significant effort different to compute. have released implementation under BSD license report experiences real-world deployments large-scale environments.