International Business Machines Corporation
Characterizing unique network flow sessions for network security

Abstract:

A technique to identify and distinguish flow sessions begins by capturing a flow record indicating an initiation of a network flow. A unique session identifier associated with the captured flow record is computed by applying a given function over data comprising a set of information (e.g., a tuple) captured in the flow record, together with a time value associated with collection interval having a start time. The given function may be a hash function. The unique session identifier is associated with one or more additional network flows captured during the collection interval, e.g., from another network flow device that computes the same identifier for at least a second flow record captured during the collection interval. In one embodiment, the flow records are captured by distinct data collectors and comprise portions of a same flow session. The distinct data collectors may utilize the same or different flow record types or protocols.