![](bg6.png)
6 CONCLUSIONS
Two models for building Digital Signature of Net-
work Segment were presented using flow analysis
(DSNSF), building two types of signatures, DSNSF-
KM by K-means and DSNSF-ACO clustering opti-
mized by the metaheuristic Ant Colony Optimization
(ACO).
Both DSNSF-KM and DSNSF-ACO showed
good results being possible to generate both a model
which describes in general behavior of the network.
Between the two signatures, DSNSF-ACO had better
results as the proximity of the movement through nor-
malized mean square error; whereas the DSNSF-KM
had better results for correlation to the movement.
Tools that allow network administrators character-
ize network traffic is of vital importance. They make
it possible to identify behaviors for a given time, day
of week or even a particular service, having an impor-
tant role in detecting anomalies.
As future work, the proposed models must be im-
proved in order to increase the accuracy and test algo-
rithms for anomalies detection using signatures gen-
erated DSNSF-KM and DSNSF-ACO.
Also the creation of Digital Signatures of Network
Segments (DSNSF) with information as bits/s, TCP
port, IP source and destination aims to create a cor-
relation matrix DSNSF to assist in the detection of
network problems.
ACKNOWLEDGEMENTS
This work was supported by SETI/Fundac¸˜ao
Arauc´aria and MCT/CNPq by the financial sup-
port for the Rigel Project. Thanks to the Federal
University of Technology – Paran´a – Toledo Campus.
REFERENCES
Chang, S., Qiu, X., Gao, Z., Liu, K., and Qi, F. (2010).
A flow-based anomaly detection method using sketch
and combinations of traffic features. In Network
and Service Management (CNSM), 2010 International
Conference on, pages 302 –305.
Claise, B. (2004). Cisco Systems NetFlow Services Export
Version 9. RFC 3954 (Informational).
Claise, B. (2008). Specification of the IP Flow Information
Export (IPFIX) Protocol for the Exchange of IP Traf-
fic Flow Information. RFC 5101 (Proposed Standard).
Deneubourg, J.-L., Aron, S., and Goss, S. (1990a). The self-
organizing exploratory pattern of the argentine ant.
Journal of Insect Behavior, 3:159–169.
Deneubourg, J. L., Goss, S., Franks, N., Sendova-Franks,
A., Detrain, C., and Chr´etien, L. (1990b). The dynam-
ics of collective sorting robot-like ants and ant-like
robots. In Proceedings of the first international con-
ference on simulation of adaptive behavior on From
animals to animats, pages 356–363, Cambridge, MA,
USA. MIT Press.
Denning, D. (1987). An intrusion-detection model.
Software Engineering, IEEE Transactions on, SE-
13(2):222 – 232.
Dorigo, M., Birattari, M., and Stutzle, T. (2006). Ant colony
optimization. Computational Intelligence Magazine,
IEEE, 1(4):28 –39.
Fatemipour, F. and Yaghmaee, M. (2007). Design and
implementation of a monitoring system based on ip-
fix protocol. In Telecommunications, 2007. AICT
2007. The Third Advanced International Conference
on, page 22.
Fu, H. (2008). A novel clustering algorithm with ant colony
optimization. In Computational Intelligence and In-
dustrial Application, 2008. PACIIA ’08. Pacific-Asia
Workshop on, volume 2, pages 66 –69.
Haag, P. (2004). NFDUMP - NetFlow processing tools.
Haag, P. (2005). NetFlow visualisation and investigation
tool.
Lima, M., Zarpelao, B., Sampaio, L., Rodrigues, J., Abrao,
T., and Proenca, M. (2010). Anomaly detection us-
ing baseline and k-means clustering. In Software,
Telecommunications and Computer Networks (Soft-
COM), 2010 International Conference on, pages 305
–309.
MacQueen, J. B. (1967). Some methods for classification
and analysis of multivariate observations. In Cam, L.
M. L. and Neyman, J., editors, Proc. of the fifth Berke-
ley Symposium on Mathematical Statistics and Prob-
ability, volume 1, pages 281–297. University of Cali-
fornia Press.
Miller, D. (2010). Softflowd - traffic flow monitoring. [On-
line; accessed 28-May-2011].
Patcha, A. and Park, J.-M. (2007). An overview of
anomaly detection techniques: Existing solutions and
latest technological trends. Computer Networks,
51(12):3448 – 3470.
Proenca, M., Coppelmans, C., Bottoli, M., and
Souza Mendes, L. (2006). Baseline to help with
network management. In e-Business and Telecom-
munication Networks, pages 158–166. Springer
Netherlands.
Quittek, J., Zseby, T., Claise, B., and Zander, S. (2004). Re-
quirements for IP Flow Information Export (IPFIX).
RFC 3917 (Informational).
Trammell, B. and Boschi, E. (2011). An introduction to
ip flow information export (ipfix). Communications
Magazine, IEEE, 49(4):89 –95.
DCNET2012-InternationalConferenceonDataCommunicationNetworking
40