HISTORY – High-Speed Network Monitoring and Analysis

Abstract—In this paper we demonstrate the potentials of a new network monitoring architecture named HISTORY (High Speed Network Monitoring and Analysis). The basis of this approach is a high-speed monitoring probe allowing to process up to one gigabit per second on a standard PC. The complete architecture relies on standardized protocols such as IPFIX and PSAMP for transmission of monitoring data between the monitoring elements and successive traffic analysis. Especially the employed statistical methodologies allow the usage of History for various applications in network security such as intrusion detection and traceback. In this paper we introduce two tools developed in History for high-speed network monitoring (Vermont) and analysis (Nasty)