Cost-Effective IP Trace Publishing Using Data Sketch

Abstract

IP Traces are sets of IP packets (or packet headers) captured at the measuring point. Their publishing, which is most challenged by massive size concern, is crucial for network research. In this paper, we propose a new scheme for IP Trace publishing which offers much smaller transportation quantity than the traditional methods. Based on Cisco's Net flow technique, the data provider first summarizes an original IP Trace to a sketch. During the summarizing process, extra statistics of certain fields in the original IP Trace are obtained. The sketch and the statistics, which are much smaller in size, are then published instead of the original IP Trace. Based on the Monte Carlo simulation technique, the data down loader can generate a synthetic IP Trace from the sketch and the statistics which preserves most of the statistical properties of the original IP Trace. According to our experiments, the transportation quantity of our scheme is only 3% of that in the traditional methods and meanwhile privacy is better protected. In the end, the utility of the synthetic IP Trace and that of the original IP Trace are compared using two network performance metrics (throughput and RTT). The result shows that this scheme is feasible.