App Byte Ratio question...

[Craig Merchant]

Hey, Carter.

 

I've been playing around with the app byte ratio in our environment.  I've had some success feeding it to a machine learning application (Prelert).

 

One thing that occurred to me was if you saw any value in using a weighted version of ABR, such as ABR * total bytes in the flow or ABR * duration of the flow.  I'm wondering if lots of small flows or short flows might distort the average ABR for a given host/protocol/port when compared to a long running or high volume flow.

 

Just curious what your thoughts are on the matter.  I'm not a quant.

 

C
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://pairlist1.pair.net/pipermail/argus/attachments/20140926/d53e6081/attachment.html>