Abstract
Information about the network status can be obtained by analyzing the monitored network traffic. Because the network traffic is huge in size and is continuously varying in time, the process of analyzing the monitored traffic is extremely difficult and time and space consuming. To keep the monitoring system running, the administrator has to manage a trade-off between the amount of derived significant information vs. monitoring process complexity vs. time and space availability. This paper proposes a method that can simplify the administrator's work as well as the monitoring process of, without sacrificing significant information about the network. The proposed method presents a mathematical model that decomposes the monitored network traffic into two main parts: significant traffic and non-significant traffic. The decomposition rules are implemented based on experimental observations of the monitored network. Basic experiments show that the proposed mathematical model decomposes the network traffic based on the selected rules, and the model achieves a traffic reduction of approximately 80%.