基于分组标识的网络流量抽样测量模型

PSAMP建议流量抽样测量模型应该简单且能够满足各种测量应用要求,为此,文章提出基于报文标识的流量抽样测量模型.对CERNET主干网络流量IP报头各字段的进行随机性分析,结果表明标识字段16比特统计上满足抽样掩码匹配字段的随机性要求.并提出基于标识字段的多掩码抽样测量算法及其修正算法,实验验证其抽样样本既能满足流量统计行为研究,又能进行网络行为研究.     

基于掩码匹配的IP网络抽样测量系统的设计和实现

随着高速网络技术的发展和普及,面向高速网络的流量抽样测量技术成为研究热点之一。文章首先归纳和比较了网络抽样测量技术的各种类别;然后系统介绍了基于掩码匹配的网络抽样测量技术;并详细阐述了基于掩码匹配的网络抽样测量系统的设计和实现方法。     

IP网络抽样测量技术及其应用

随着高速网络技术的发展和普及,传统的网络被动测量方式不再可行,使得面向高速网络的流量抽样测量技术成为研究热点之一.文章首先归纳和比较了网络抽样测量技术的各种类别.然后,详细论述了基于掩码匹配的网络抽样测量技术.最后,介绍了IP网络抽样技术的主要应用并给出了结论.     

基于抽样和哈希技术的长流测量算法研究

在互联网中理解网络行为最高效的途径即是对网络数据流量进行检测与分析,它是对已有互联网的组建、规范化和改造的依据,同时也是对Internet进行检测的重要环节.为了解决网络中的资源和高速IP流量之间的冲突问题,需要对网络流进行多种方式的处理与算法研究.本文首先提出了改进的数据抽样技术并综合论述了现阶段基于抽样技术的数据测量算法的研究.同时通过对重要数据参数的重新设置和分析,并结合使用多种数据取样的方法,探讨改进的数据空间映射技术与现阶段的各种取样方式在测量网络长流算法中的综合应用.     

高速网络中入侵检测的抽样方法

提出了一个面向主干网入侵检测,以内存瓶颈消耗量为测度的动态自适应抽样方法IDSampling.通过分析攻击流量的流长和熵聚类信息特征指导抽样,过滤掉攻击可疑性低的报文,采取"节流"方法解决万兆网络入侵检测存在的性能和精度不平衡问题.在大规模异常发生时采用基于单报文属性熵的单一抽样策略,其他情况下采用带反馈指导的混合抽样策略,试图用尽可能小的检测代价来取得同样的检测效果.实验结果表明①IDSampling可以大幅减低IDS处理输入,同时保证对主干网人规模攻击趋势性信息的检测精度;②相较于随机报文抽样和随机流抽样方法,IDSampling凭借流长、熵聚类信息和后期检测结果等启发式信息的指导,其抽取攻击报文的准确性高于前2种方法,尤其是在大规模、高强度攻击情况下IDSampling抽中攻击报文的数目甚至高于其他2种方法一个数量级.     

基于实时分析的网络测量抽样统计模型

由于网络通信量具有自相似性,传统的网络测量抽样方法如均匀抽样、泊松抽样容易与真实数据产生比较大的误差.本文提出了一种基于实时分析的网络抽样统计模型（NMSM）,在数据采集过程中,实时分析样本的变化特征,动态调整采集频率,最好程度的完成数据抽样采集.实验证明,NMSM模型在网络变化比较平稳时,对网络的影响程度最低,在网络变化比较大时,对真实数据的拟合程度最好.     

抽样对复合傅里叶变换轮廓术的影响

为了研究抽样对复合傅里叶变换轮廓术测量精度的影响,避免因抽样造成的频谱混叠,采用梳状函数对连续变形条纹进行抽样的方法,并结合卷积性质,在相位方向和其垂直方向上分别进行了讨论,从而得到了在实际测量中两个方向上抽样频率的选择依据.结果表明,在相位方向上,抽样频率应至少为基频的倍;在垂直方向上,抽样频率必须至少为两个载频中较大频率的3倍.计算机模拟和实验验证了理论分析的正确性.     

校园网网络测量方法应用与分析

目前,随着高校信息化和数字化水平的不断提高,利用网络测量技术、网络仿真建模等方法对网络关键部件进行测量和数据分析,是当前网络研究热点。随着互联网应用规模和业务的丰富多样,校园网网络流量急剧增加,网络的可预测性、可靠性和安全性存在诸多潜在风险。文章在对当下主流的网络测量方法进行研究的基础上,对比分析了主动式测量、被动式测量和探针式测量方法在不同场合应用测试优缺点,研究了基于SNMP协议进行的网络拓扑发现和数据采集方法,并结合Wireshark和Sniffer pro等专业抓包工具,以多层次不同网络报文颗粒的分布式测量为辅助方法,开展校园网测量和性能分析工作。     

基于流量负载的改进型几何抽样算法

为了解决在流量高峰时期网络节点由于超负荷工作导致报文丢失的问题,在几何抽样的基础上,设计了一种能自动适应流量负载变化的抽样算法.该算法在流量高峰时会根据负载情况动态地计算最佳的抽样概率来匹配节点的处理能力从而降低节点丢失的报文数,在流量负载轻时会自动地提高抽样概率以充分利用节点的处理性能.通过真实网络流量数据的实验分析表明,改进后的几何抽样算法不仅能有效降低节点丢弃的报文数,同时还提高了网络测量的精度,证明了该改进算法对流量负载具有良好的适应性.     

基于抽样流长与完全抽样阈值的异常流自适应抽样算法

高速IP网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计精度偏低,对异常流量筛选能力较差的缺陷,该文提出一种基于业务流已抽样长度与完全抽样阈值S的自适应流抽样算法(AFPT)。AFPT算法根据完全抽样阈值S筛选对异常流量敏感相关的小流,同时根据业务流已抽样长度自适应调整抽样概率。仿真和实验结果表明,AFPT算法的估计误差与理论上界相符,具有较强的异常流量筛选能力,能够有效提高异常检测算法的准确率。     

Adaptive random sampling for traffic volume measurement

Traffic measurement and monitoring are an important component of network management and traffic engineering. With high-speed Internet backbone links, efficient and effective packet sampling techniques for traffic measurement and monitoring are not only desirable, but also increasingly becoming a necessity. Since the utility of sampling depends on the accuracy and economy of measurement, it is important to control sampling error. In this paper, we propose an adaptive packet sampling technique for flow-level traffic measurement with stratification approach. We employ and advance sampling theory in order to ensure the accurate estimation of large flows. With real network traces, we demonstrate that the proposed sampling technique provides unbiased estimation of flow size with controllable error bound, in terms of both packet and byte counts for elephant flows, while avoiding excessive oversampling. Baek-Young Choi received her Ph.D. in 2003 in Computer Science and Engineering from the University of Minnesota, Twin Cities. She received her B.S. degree in 1993 from Pusan National University, Korea and M.S. degree in 1995 from Pohang University of Science and Technology, Korea. After her Ph.D. she was a post-doctoral researcher at Sprint Advanced Technology Labs, and a 3M McKnight Distinguished Visiting Assistant Professor at the University of Minnesota, Duluth. From 2005, Dr. Choi is an assistant professor at the University of Missouri, Kansas City. Zhi-Li Zhang received a B.S. degree in computer science from Nanjing University, China, in 1986 and his M.S. and Ph.D. degrees in computer science from the University of Massachusetts in 1992 and 1997. In 1997 he joined the Computer Science and Engineering faculty at the University of Minnesota, where he is currently a professor. From 1987 to 1990, he conducted research in Computer Science Department at rhus University, Denmark, under a fellowship from the Chinese National Committee for Education. He has held visiting positions at Sprint Advanced Technology Labs; IBM T.J. Watson Research Center; Fujitsu Labs of America, Microsoft Research China, and INRIA, Sophia-Antipolis, France.     

Inside packet sampling techniques: exploring modularity to enhance network measurements

Traffic sampling is viewed as a prominent strategy contributing to lightweight and scalable network measurements. Although multiple sampling techniques have been proposed and used to assist network engineering tasks, these techniques tend to address a single measurement purpose, without detailing the network overhead and computational costs involved. The lack of a modular approach when defining the components of traffic sampling techniques also makes difficult their analysis. Providing a modular view of sampling techniques and classifying their characteristics is, therefore, an important step to enlarge the sampling scope, improve the efficiency of measurement systems, and sustain forthcoming research in the area. Thus, this paper defines a taxonomy of traffic sampling techniques resorting to a comprehensive analysis of the inner components of existing proposals. After identifying granularity , selection scheme , and selection trigger as the main components differentiating sampling proposals, the study goes deeper on characterizing these components, including insights into their computational weight. Following this taxonomy, a general‐purpose architecture is established to sustain the development of flexible sampling‐based measurement systems. Traveling inside packet sampling techniques, this paper contributes to a clearer positioning and comparison of existing proposals, providing a road map to assist further research and deployments in the area. Copyright © 2016 John Wiley & Sons, Ltd.     

光网络性能监测技术

光网络性能监测(OPM)已成为下一代光网络发展的关键技术,构建满足光网络发展需求的OPM系统也已成为物理层技术的发展重点。本文在介绍光网络性能监测主要内容、关键技术、光采样技术的基础上,总结了目前光网络发展对光性能监测技术的主要要求,同时分析了目前应用的部分技术难点和后续发展趋势。     

Detection accuracy of network anomalies using sampled flow statistics

We investigated the detection accuracy of network anomalies when using flow statistics obtained through packet sampling. Through a case study based on measurement data, we showed that network anomalies generating a large number of small flows, such as network scans or SYN flooding, become difficult to detect during packet sampling. We then developed an analytical model that enables us to quantitatively evaluate the effect of packet sampling and traffic conditions, such as anomalous traffic volume, on detection accuracy. We also investigated how the detection accuracy worsens when the packet sampling rate decreases. In addition, we show that, even with a low sampling rate, spatially partitioning monitored traffic into groups makes it possible to increase detection accuracy. We also developed a method of determining an appropriate number of partitioned groups, and we show its effectiveness. Copyright © 2011 John Wiley & Sons, Ltd.     

Exploiting packet‐sampling measurements for traffic characterization and classification

The use of packet sampling for traffic measurement has become mandatory for network operators to cope with the huge amount of data transmitted in today's networks, powered by increasingly faster transmission technologies. Therefore, many networking tasks must already deal with such reduced data, more available but less rich in information. In this work we assess the impact of packet sampling on various network monitoring‐activities, with a particular focus on traffic characterization and classification. We process an extremely heterogeneous dataset composed of four packet‐level traces (representative of different access technologies and operational environments) with a traffic monitor able to apply different sampling policies and rates to the traffic and extract several features both in aggregated and per‐flow fashion, providing empirical evidences of the impact of packet sampling on both traffic measurement and traffic classification. First, we analyze feature distortion, quantified by means of two statistical metrics: most features appear already deteriorated under low sampling step, no matter the sampling policy, while only a few remain consistent under harsh sampling conditions, which may even cause some artifacts, undermining the correctness of measurements. Second, we evaluate the performance of traffic classification under sampling. The information content of features, even though deteriorated, still allows a good classification accuracy, provided that the classifier is trained with data obtained at the same sampling rate of the target data. The accuracy is also due to a thoughtful choice of a smart sampling policy which biases the sampling towards packets carrying the most useful information. Copyright © 2012 John Wiley & Sons, Ltd.     

Trajectory Sampling With Unreliable Reporting

We define and evaluate methods to perform robust network monitoring using trajectory sampling in the presence of report loss. The first challenge is to reconstruct an unambiguous set of packet trajectories from the reports on sampled packets received at a collector. In this paper we extend the reporting paradigm of trajectory sampling to enable the elimination of ambiguous groups of reports, but without introducing bias into any characterization of traffic based on the surviving reports. Even after the elimination, a proportion of trajectories are incomplete due to report loss. A second challenge is to adapt measurement based applications (including network engineering, path tracing, and passive performance measurement) to incomplete trajectories. To achieve this, we propose a method to join multiple incomplete trajectories for inference, and analyze its performance. We also show how applications can distinguish between packet and report loss at the statistical level.     

Online end‐to‐end quality of service monitoring for service level agreement management

A major challenge in network and service level agreement (SLA) management is to provide Quality of Service (QoS) demanded by heterogeneous network applications. Online QoS monitoring plays an important role in the process by providing objective measurements that can be used for improving network design, troubleshooting and management. Online QoS monitoring becomes increasingly difficult and complex due to the rapid expansion of the Internet and the dramatic increase in the speed of network. Sampling techniques have been explored as a means to reduce the difficulty and complexity of measurement. In this paper, we investigate several major sampling techniques, i.e. systematic sampling, simple random sampling and stratified sampling. Performance analysis is conducted on these techniques. It is shown that stratified sampling with optimum allocation has the best performance. However, stratified sampling with optimum allocation requires additional statistics usually not available for real‐time applications. An adaptive stratified sampling algorithm is proposed to solve the problem. Both theoretical analysis and simulation show that the proposed adaptive stratified sampling algorithm outperforms other sampling techniques and achieves a performance comparable to stratified sampling with optimum allocation. A QoS monitoring software using the aforementioned sampling techniques is designed and tested in various real networks. Copyright © 2007 John Wiley & Sons, Ltd.     

Scheduling strategy for networked control system based on variable sampling period and deadband feedback

A scheduling strategy of variable sampling period combined with deadband feedback for networked control system is proposed. Variable sampling period algorithm can allocate a reasonable sampling period to each controlled loop according to the network utilization and packet transmission time. Deadband feedback algorithm can alleviate network congestion by appropriately adjusting the packets in the network when the networked control system cannot be scheduled. According to the actual overload and utilization of the network, the designed scheduling strategy dynamically adjusts the sampling period and priority, and improves the performance of the system combined with deadband feedback. Based on the TrueTime platform, the proposed scheduling strategy is verified on a three controlled loops networked control system with interference nodes and limited network resources. The simulation results demonstrate that the designed scheduling strategy can overcome the uncertainty of the upper bound of network resources, improve output control performance, reduce integral absolute error value of the controlled loop, and shorten the packet transmission time. The overall control performance of the system is improved. The designed scheduling strategy is effective.     

基于WCDMA分组网络的VPDN应用

WCDMA网络以其技术优势、产业规模、价值链成熟度以及全球应用经验等其它3G标准所无法比拟的优势,自2009年正式商用后,用户规模迅速增长,企业基于WCDMA网络的VPN/VPDN应用也如火如荼的发展壮大。文中根据WCDMA分组数据网络VPN/VPDN组网及应用实例,探讨了VPDN应用方面的技术及组网技巧。