App Byte Ratio question...
craig.merchant at oracle.com
Fri Sep 26 16:44:43 EDT 2014
I've been playing around with the app byte ratio in our environment. I've had some success feeding it to a machine learning application (Prelert).
One thing that occurred to me was if you saw any value in using a weighted version of ABR, such as ABR * total bytes in the flow or ABR * duration of the flow. I'm wondering if lots of small flows or short flows might distort the average ABR for a given host/protocol/port when compared to a long running or high volume flow.
Just curious what your thoughts are on the matter. I'm not a quant.
-------------- next part --------------
An HTML attachment was scrubbed...
More information about the argus