Hybrid Network Monitoring Solution with Packet-Level Records

This technical report presents HybridMon, a hybrid network monitoring solution that integrates packet-level monitoring with selective flow-based aggregation. The objective of HybridMon is to address the limitations of traditional monitoring approaches, which often require a compromise between efficiency and accuracy. The report outlines the challenges faced by network operators, including the increasing volume of network traffic and the sophistication of cyberattacks. It details how HybridMon operates on P4-programmable switches to provide fine-grained monitoring at high speeds, enabling timely detection and analysis of security incidents. The solution is designed to export condensed packet-level information while minimizing overhead. Extensive evaluations demonstrate HybridMon's effectiveness in network forensics and intrusion detection, showcasing its ability to reduce output bandwidth significantly compared to full packet monitoring. The report also discusses the deployment flexibility of HybridMon and its compatibility with existing network infrastructures and analysis tools.