Monitoring Engine. The Monitoring Engine is the component of the Provider layer of the Monitoring Architecture responsible for filtering, aggregating and correlating events collected by the WISER Agents and for the generation of alarms based on a predefined set of correlation rules or security directives. Deliverable D4.1, Section 6 gives details about the internal operation of the Monitoring Engine. A summary can be found below:
Monitoring Engine. (ME) The monitoring engine runs in each router and aims at sampling and capturing packets at the interfaces of the router. It then exports them in the form of NetFlow records to the central collector. As depicted in Figure 1, one can observe four main modules: • Packet capturing: this module listens to the network interface and sample data at a given sampling rate. This sampling rate is configured each time by the Cognitive Engine (CE) next to the optimization it carries out after correlating measurements from all routers. • Classifier: Once a packet is sampled by the Packet capturing module, the classifier identifies flows by a key (in our case this key corresponds to the 5-tuple consisting of source and destination addresses, source and destination port numbers, and protocol number). The Classifier then determines if a flow is active or if it is a new flow. If the flow is active, it updates real-time statistics on that flow such as the number of packets and bytes. If it is a newly observed flow, it inserts a new flow record for this new packet’s key. The ME maintains the keys of flows forwarded by the router together with the collected statistics on those flows. A flow is declared terminated by the Classifier in one of three cases: (i) when observing a FIN or a RST packet (TCP control), (ii) when a timeout expires after the record for that flow was created, and finally (iii) when the number of records exceeds a given threshold in order to release memory. • Reporting: Once collected, flow records are exported using UDP messages to the central Unit (Cognitive Engine) through the CM (Cognitive-Monitoring) interface. • Controller: Based on the collected data and machine learning methods, the cognitive component takes a decision on how to tune the sampling rates and sends the decision back to the ME. The controller in each router receives the decision and updates the sampling rate in the ME accordingly.
