多输出队列网络的轮询权重自适应调度算法

队列调度对于网络QoS至关重要。常见的多队列轮询调度算法对不同的输出队列设置不同的固定权值,这类算法在一定程度上能改善队列调度的公平性,但对于网络数据类型和流量变化较大的场合适应性较差。本文提出一种队列轮询权重自适应的方法,能较好的满足不同类型数据分组的QoS需求。     

基于多维流量特征的IRC僵尸网络频道检测

针对IRC僵尸网络频道的检测问题,提出一种基于流量特征的检测方法。分析了僵尸网络频道数据流在不同周期内流量的聚类性、相似性、平均分组长度、流量高峰和协同流量高峰等特征,并以此作为僵尸网络频道检测的依据。检测过程中,采用改进的最大最小距离和k-means聚类分析算法,改善了数据聚类的效果。最后经过实验测试,验证了方法的有效性。     

基于Command and Control通信信道流量属性聚类的僵尸网络检测方法

僵尸网络(Botnet)是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制信道(Command and Control channel, CC)机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击目的。该文提出一种与僵尸网络结构和CC协议无关,不需要分析数据包的特征负载的僵尸网络检测方法。该方法首先使用预过滤规则对捕获的流量进行过滤,去掉与僵尸网络无关的流量;其次对过滤后的流量属性进行统计;接着使用基于X-means聚类的两步聚类算法对CC信道的流量属性进行分析与聚类,从而达到对僵尸网络检测的目的。实验证明,该方法高效准确地把僵尸网络流量与其他正常网络流量区分,达到从实际网络中检测僵尸网络的要求,并且具有较低的误判率。     

无线传感器网络自适应目标跟踪节点调度算法

在无线传感器网络中,设计合理的节点调度算法是提高网络感知能力、降低系统能耗的关键。在分析节点能耗模型的基础上,针对移动目标跟踪型网络应用,提出一种高能效的无线传感器网络自适应节点调度算法ANSTT。该算法根据节点对移动目标的感知能力,以及节点的相对剩余能量水平,自动调整节点工作模式。仿真实验表明,ANSTT算法在维持低感知延时、高目标感知率的同时,可有效降低系统能耗,延长网络寿命。     

无线传感器网络中基于移动代理的自适应数据融合路由算法

该文提出在无线传感器网络中基于移动代理的自适应数据融合路由(AFMR)算法,解决移动代理如何以能量有效的方式融合、收集相关性数据的问题。该算法综合考虑了移动代理在路由过程中传输能量和融合能量的消耗,并根据数据融合算法的能量开销和节能增益,对移动代理迁移到各节点时是否执行数据融合操作进行自适应调整,以达到在各种不同的应用场景中优化移动代理能量开销的目的。通过仿真验证了在无线传感器网络的各种相关性数据收集的应用环境中,AFMR算法在节省能量方面比现有TSP和FMR的移动代理路由算法更加有效。     

基于量子计算的僵尸网络周期性通信行为检测算法

僵尸网络需要在控制者和受控主机之间维持周期性通信,如果能够有效识别僵尸网络的周期性通信行为,就能够以此为基础实现僵尸网络检测。尽管一些算法提出了基于周期性通信行为的僵尸网络检测方法,但是如何在海量数据中实现僵尸网络的快速检测仍然是一个问题。基于量子计算的僵尸网络周期性通信行为检测算法,是在已有算法的基础上引入量子计算来提高周期性通信检测算法的速度。实验结果表明,改进后的算法与已有算法相比,拥有相同的检测精度,与此同时,能够使用较少的查询次数完成僵尸网络检测,能够有效提高僵尸网络检测的速度。     

互联网电视CDN智能调度技术研究和应用

本文研究了在互联网电视CDN分层级、分区域下沉后产生的节点不均衡问题,以及春晚等大流量场景下区域间负载不均衡问题、直播频道突发流量分布不均导致的CDN节点内设备负载不均衡等问题,并且针对区域间、节点间以及节点内的调度场景,综合考虑各级调度影响因子,研究通过K-Means聚类算法、非线性回归算法、Random Forest算法等AI算法在互联网电视CDN调度中的应用,实现智能调度策略决策及分场景调度实施。通过互联网电视CDN智能调度技术方案的研究,并在江苏移动完成部署,峰值承载流量超20Tbps。智能调度模型有效地均衡了区域、节点及设备的流量,提升了互联网电视CDN的总体利用率,提升了互联网电视系统可靠性和服务质量。     

一种基于最长队列预测的CICQ交换结构调度算法

CICQ(Combined Input Crosspoint Queued)是一种在crossbar交叉点加入少量缓存的交换结构,具有无需内部加速比及分布并行调度的特性。为了自适应网络环境中各种业务流量,提高在非均匀流量下的性能,该文提出了一种基于最长队列预测的高效CICQ交换结构调度算法RR-LQD (Round Robin with Longest Queue Detecting)。RR-LQD算法复杂度为O(1),具有良好的可扩展性;通过预测局部最长队列并尽力为其服务,保持调度中队列长度的均衡,能够适应各种非均匀流量的网络环境。仿真结果表明:在各种均匀和非均匀流量下,RR-LQD算法均能达到100%的吞吐量,并且具有优良的时延性能。该文使用FPGA芯片实现了RR-LQD算法仲裁器,能够满足高速、大容量交换结构的设计需要。     

软件定义UAV网络的自适应QoS机制研究

针对软件定义无人机网络(SUNET)链路状态频繁变化难以保障用户服务质量(Quality of Service, QoS)的问题,本文研究了软件定义UAV网络中包含流量管控与队列调度的自适应QoS机制。首先,利用SUNET能够获取全局链路状态信息的优势,提出一种自适应QoS流量控制机制,其综合考虑链路带宽、不同类别消息的优先级和到期时间(ToE)等QoS要求,自适应调整OpenFlow交换机的数据流表项与计量表;然后,结合Linux流量控制的优先级(PRIO)和分层令牌桶(HTB)算法设计出多级队列调度方案以实现细粒度控制。仿真结果表明,所提自适应QoS机制能够显著降低高优先级消息的传输时延与丢包率,满足不同类型消息的差异化要求。     

基于变长度调度间隔的雷达资源调度算法

在相控阵雷达完成精密跟踪和目标识别等不同任务时,波形、数据率和积累时间等雷达资源需要自适应改变,基于固定长度调度间隔的自适应调度算法较为复杂且不能充分利用雷达资源。提出了一种基于变长度调度间隔的自适应资源调度算法,根据任务请求的重要性函数安排待执行的雷达事件顺序,并根据雷达资源的动态变化情况,自适应地调整调度间隔的时间长度。利用VC语言建模弹道导弹目标和多功能地基相控阵雷达,进行分布式仿真,通过直观观测资源调度的执行过程,以及通过目标跟踪数量和时间利用率两个指标,评价了资源调度算法性能。改进算法的软件实现较为容易,可以增加目标跟踪数量,节约时间资源。     

Adaptive traffic sampling for P2P botnet detection

Peer‐to‐peer (P2P) botnets have become one of the major threats to network security. Most existing botnet detection systems detect bots by examining network traffic. Unfortunately, the traffic volumes typical of current high‐speed Internet Service Provider and enterprise networks are challenging for these network‐based systems, which perform computationally complex analyses. In this paper, we propose an adaptive traffic sampling system that aims to effectively reduce the volume of traffic that P2P botnet detectors need to process while not degrading their detection accuracy. Our system first identifies a small number of potential P2P bots in high‐speed networks as soon as possible, and then samples as many botnet‐related packets as possible with a predefined target sampling rate. The sampled traffic then can be delivered to fine‐grained detectors for further in‐depth analysis. We evaluate our system using traffic datasets of real‐world and popular P2P botnets. The experiments demonstrate that our system can identify potential P2P bots quickly and accurately with few false positives and greatly increase the proportion of botnet‐related packets in the sampled packets while maintain the high detection accuracy of the fine‐grained detectors.     

使用时空相关性分析检测加密僵尸网络流量

In this paper, we propose a novel method to detect encrypted botnet traffic. During the traffic preprocessing stage, the proposed payload extraction method can identify a large amount of encrypted applications traffic. It can filter out a large amount of non-malicious traffic, greatly improving the detection efficiency. A Sequential Probability Ratio Test (SPRT)-based method can find spatial-temporal correlations in suspicious botnet traffic and make an accurate judgment. Experimental results show that the false positive and false negative rates can be controlled within a certain range.     

Performance evaluation of priority based adaptive multiguard channel call admission control for multiclass services in mobile networks

The CAC (call admission control), which can guarantee call services to meet their QoS (Quality of Service) requirements, plays a significant role in providing QoS in wireless mobile networks. In this paper, an adaptive multiguard channel scheme‐based CAC strategy is proposed to prioritize traffic types and handoff calls. The major aim of the study is to develop the analytical model of the priority traffic and handoff calls based adaptive multiguard channel scheme and examining the performance through setting the value of the adaptive ratio parameters. Our proposed scheme tries to mediate the advantages and drawbacks of the static and dynamic CAC schemes. The proposed scheme is quite different from previous studies because multithreshold values have been considered for multiclass traffic by adaption parameters, and a closed form analytical model is developed The numerical results show that this scheme can be used to keep the targeted QoS requirement by suitably setting the adaptive ratio parameters. Copyright © 2011 John Wiley & Sons, Ltd.     

End-to-End Adaptive QoS Provisioning over GPRS Wireless Mobile Network

The General Packet Radio Service (GPRS) offers performance guaranteed packet data services to mobile users over wireless frequency-division duplex links with time division multiple access, and core packet data networks. This paper presents a dynamic adaptive guaranteed Quality-of-Service (QoS) provisioning scheme over GPRS wireless mobile links by proposing a guaranteed QoS media access control (GQ-MAC) protocol and an accompanying adaptive prioritized-handoff call admission control (AP-CAC) protocol to maintain GPRS QoS guarantees under the effect of mobile handoffs. The GQ-MAC protocol supports bounded channel access delay for delay-sensitive traffic, bounded packet loss probability for loss-sensitive traffic, and dynamic adaptive resource allocation for bursty traffic with peak bandwidth allocation adapted to the current queue length. The AP-CAC protocol provides dynamic adaptive prioritized admission by differentiating handoff requests with higher admission priorities over new calls via a dynamic multiple guard channels scheme, which dynamically adapts the capacity reserved for dealing with handoff requests based on the current traffic conditions in the neighboring radio cells. Integrated services (IntServ) QoS provisioning over the IP/ATM-based GPRS core network is realized over a multi-protocol label switching (MPLS) architecture, and mobility is supported over the core network via a novel mobile label-switching tree (MLST) architecture. End-to-end QoS provisioning over the GPRS wireless mobile network is realized by mapping between the IntServ and GPRS QoS requirements, and by extending the AP-CAC protocol from the wireless medium to the core network to provide a unified end-to-end admission control with dynamic adaptive admission priorities.     

僵尸网络研究

僵尸网络是一种从传统恶意代码形态进化而来的新型攻击方式,为攻击者提供了隐匿、灵活且高效的一对多命令与控制机制,可以控制大量僵尸主机实现信息窃取、分布式拒绝服务攻击和垃圾邮件发送等攻击,僵尸网络对因特网安全已造成严重威胁。深入研究分析了僵尸网络的三种模型,并对僵尸网络的发现、追踪进行了探讨。     

基于异常行为特征的僵尸网络检测方法研究

基于僵尸网络通信及网络流量的异常行为,可以有效检测出僵尸频道。介绍了通过对主机响应信息的异常分析,进而判断出当前IRC频道是否为一个僵尸频道的检测算法。由此引入了基于异常行为的僵尸频道检测模型,该模型分类提取IRC频道的主机响应信息,结合检测算法分析得出结论。实验结果验证了该模型的有效性。     

QoS provisioning in micro-cellular networks supporting multiple classes of traffic

We introduce an adaptive call admission control mechanism for wireless/mobile networks supporting multiple classes of traffic, and discuss a number of resource sharing schemes which can be used to allocate wireless bandwidth to different classes of traffic. The adaptive call admission control reacts to changing new call arrival rates, and the resource sharing mechanism reacts to rapidly changing traffic conditions in every radio cell due to mobility of mobile users. In addition, we have provided an analytical methodology which shows that the combination of the call admission control and the resource sharing schemes guarantees a predefined quality-of-service to each class of traffic. One major advantage of our approach is that it can be performed in a distributed fashion removing any bottlenecks that might arise due to frequent invocation of network call control functions.     

An MAC protocol supporting multiple traffic over mobile ad hoc networks

This letter presents the design and performance of a multi-channel MAC protocol that supports multiple traffics for IEEE 802.11 mobile ad-hoc networks.The dynamic channel selection scheme by receiver decision is implemented and the number of the data channel is independent of the network topology.The priority for real-time traffic is assured by the proposed adaptive back off algorithm and different IFS.The protocol is evaluated by simulation and the results have shown that it can support multiple traffics and the performance is better than the performance that IEEE 802.11 standard provides.     

BotCatcher:botnet detection system based on deep learning

Machine learning technology has wide application in botnet detection.However,with the changes of the forms and command and control mechanisms of botnets,selecting features manually becomes increasingly difficult.To solve this problem,a botnet detection system called BotCatcher based on deep learning was proposed.It automatically extracted features from time and space dimension,and established classifier through multiple neural network constructions.BotCatcher does not depend on any prior knowledge which about the protocol and the topology,and works without manually selecting features.The experimental results show that the proposed model has good performance in botnet detection and has ability to accurately identify botnet traffic .