On the Economic Placement of Monitors in Router Level Network Topologies

Network monitoring systems are very important components for protecting networks. Due to economical and technical constraints, it is necessary to provide a proper monitor placement strategy. In this paper, we discuss how to place monitors for a given router level topology to maximize the observation of attack events. We set up a network model including routing strategies and a threat model for general network topology and then define the monitor placement problem. We give a simple proof to show that our problem is NP-complete and provide heuristic solutions with experimental results. Due to routing asymmetry, upstream traffic and downstream traffic often traverse different paths. We also extend the monitor placement problem to the asymmetric routing scenario and discuss how to optimize monitor placement to observe bi-directional data.