Application-Aware Flow Monitoring

Network flow monitoring has been a part of network security for the last dozen years. It is constantly evolving to keep pace with changes in network operation and innovative network attacks. This thesis contributes to the continuous efforts by exploring the possibilities unlocked by extending the flow data with application-specific information. We show how the construction of flows is affected by the addition, present the benefits to traffic analysis and assess the inevitable performance loss. To compensate for the lost performance, several novel optimisation techniques are proposed for the flow monitoring process. Recognizing that the increasing deployment of encryption is going to limit the benefits of application flow monitoring, we perform a survey of methods for measurement of encrypted traffic. The thesis is concluded by an outlook towards future possibilities for flow monitoring advancement.