Download ABSTRACT GOFF, BRIAN DAVID. Distributed

inbound and outbound information on the number of bytes, packets, network and
application flows, and such, transmitted or received for each internal and external host.
A web interface provides persistence graphs and reports that can disclose general and
specific traffic patterns on the network. This information can be used to assess security,
resource usage, and quality of service (QoS) assessment of the monitored network and
hosts. For example, setting flow, load, and other activity thresholds at different levels of
granularity allows for the detection of anomalies throughout the network. Port scans,
Denial of Service (DOS) attacks, and Trojan applications have been detected through
surveillance of simple threshold-based patterns. More complex, possibly multi-probe,
patterns can reveal much more subtle anomalies and side effects.
RUM operates in a statistical mode, rather than continuous mode. It samples the
network every few minutes.
After each sample the collected data is analyzed and
appropriate warnings and interactions with the policy services are effected. Collected
packets are sorted and stored by pre-defined subnets allowing parallelism in the
processing of the data. This also separates datasets for another reason; it enables secure
access to just the network traffic for which an administrator is responsible. Persistence
data is kept in the form of graphs generated using RRDtool, a round robin database
utility, and in logs. The information logged is completely customizable and can even be
offloaded for analysis by other systems. This thesis describes the RUM architecture, data
it collects, analysis modules, user handling, and other features.