TRAMS allows you to analyze the composition of the information flowing through an IP network based on a SCATI classification technology.
SCATI is the result of the METRA project (efficient measurement of the traffic in advanced networks), funded by the Ministry of science and innovation of the Ministry of economy and competitiveness through the program INNPACTO 2011 and carried out in cooperation with the Center for advanced communications of wide band of the Polytechnic University of Catalonia under the leadership of Tecsidel.
The classification of traffic carrying TRAMS is based on two principles that SCATI implements:
- Sampled NetFlow as origin of routers from network traffic data.
- Machine learning algorithms that classify the application associated with each connection from flows Sampled NetFlow.
- Processing of a small sample of the traffic via DPI.
- Learning and building a model of the traffic.
- The NetFlow Traffic classification:
- determining which application/service corresponds each flow without capturing or inspect the contents of packets (much less intrusive/expensive than DPI)
- Re-evaluation of the accuracy of classification
- Mitigation of the impact of sampling.
Operation of SCATI system comprises the following phase:
This gets the same information as DPI, with lower computational cost and a more scalable way.
{slider Arquitecture|closed}
In its architecture, TRAMS presents the following layers:
1. collection: Sampled Netflow
2 characterization and classification based on Sampling and Machine Learning
3 aggregation and storage
4 interfaces
a. with the user
b. with other systems
{slider caracteristicas|closed}
Traffic data obtained from NetFlow (also of Flow, sFlow, IPFIX)
Sorting technology "machine learning with DPI automatic training", highly accurate and scalable
Traffic aggregation using views and customizable filters dynamically defined using combinations of attributes NetFlow
Automatic detection of anomalies "Frequent Itemset Mining"
Ranking in groups and applications
Breakdown of traffic in greater volume of traffic "Autozoom" groups
Support for IP V6
Web console
Export of data and events to external systems
Import of external data support (Data Source Importer)
{/sliders}