一种基于分组抽样的TRW改进算法

端口扫描是最常见的网络异常流量,TRW是端口扫描检测中最有代表性的算法之一。在高速网络环境下,网络测量通常采用分组抽样技术。已有的研究表明,分组抽样对原始流的流大小分布有细化和扭曲的作用,使得TRW检测算法随着抽样率的增加,成功检测率和误检率呈现出先增加后减少的趋势。本文提出了一种TRW的改进算法,原理是利用抽样后样本流中包含的TCP协议信息改善分组抽样下的流大小分布估计,从而提高TRW检测算法的有效性。实验证明,新算法与原算法相比,在成功检测率差不多的情况下,误检率明显降低了。     

无线自组网络中TCP流公平性的分析与改进

研究了TCP(transmission control protocol)流在多跳无线自组网络中的公平性问题,发现IEEE802.11DCF协议在此环境下会导致严重的不公平性,即部分节点垄断了网络带宽而其他节点被饿死.首先,通过仿真分析了产生TCP流不公平性的原因,指出其根源在于MAC(media access and control)协议的不公平性,同时,TCP的超时机制加剧了不公平性的产生;然后,利用概率模型定量分析了TCP不公平性与MAC协议参数之间的关系,发现TCP流的公平性与TCP报文长度直接相关,并且增加MAC协议初始竞争窗口的大小能够有效提高公平性.据此,提出了一种根据TCP报文长度动态调节初始回退窗口大小的自适应回退MAC协议改进算法.理论分析和仿真表明,该算法在很大程度上可以有效缓解不公平性问题的产生,并且不会引起网络吞吐量的严重降低.     

基于近似方法的抽样报文流数估计算法

维护每个报文的流记录需要占用大量测量资源.目前已有多种抽样技术估计网络流统计信息,然而精确地估计出流数统计信息是目前的研究难点.提出了Integral和Iteration 两种基于报文抽样样本估计网络流数的算法.Integral算法只需使用抽样流长为1的流数信息就可以近似推导出未抽样的流数.Iteration算法通过建立迭代函数估计未抽样流数,然后根据未抽样流数和已抽样的流数推断出原始流量的流数.采用CERNET(China education andresearch network)骨干网络链路数据将这两种算法与EM(expectation maximization)算法进行对比,表明Iteration算法具有较好的精度和性能.     

TCP友好的多媒体通信流控制机制

该文给出了一个端到端的适应性多媒体流控制策略,称为基于丢失延时的算法LDA(loss-delaybasedalgo-rithm),它调整多媒体流的发送行为,以符合网络的当前拥塞状况。LDA算法利用实时传输协议RTP(real-timetransportprotocol)来收集分组丢失和延时统计信息,并用来调整发送端的发送行为,使它和TCP的拥塞控制有类似的统计特性,是TCP友好的。仿真的结果显示LDA算法对于网络资源的利用、拥塞避免和TCP流的公平性都是比较好的。     

基于掩码匹配的校园网出口流量抽样测量研究

针对校园网出口流量抽样测量问题，给出了测量点的选择及测量环境的设计方案,实施了特定掩码与IP报文标识字段进行匹配的抽样测量。提出了从抽样后的报文中估计一定时间刻度原始流量的大小、估计原始报文长度与协议分布的方法。通过对防火墙流量信息的观测和对校园网流量信息的分析表明，抽样测量结果与实际情况相符。     

区分服务网络中带宽利用的公平性

为了解决DiffServ网络中带宽利用的不公平性 ,该文提出了一种自适应的数据包标记算法AFM(AdaptiveFairMarker) .与现有的标记算法相比 ,它有两个显著的不同 :( 1)增加了一种带宽估计机制 ,对网络中可使用的带宽进行动态估计 ,并将所估计的带宽以按比例的方式公平地分配给各个汇聚流 ;( 2 )对TCP协议作了一个微小而又非常有效的改进 ,在控制TCP拥塞窗口的同时尽量避免TCP协议的AIMD机制 .该文通过仿真试验对算法进行了验证 ,结果证实AFM算法比其它几种算法具有更好的公平性     

网络自适应公平分组抽样算法研究

针对SGS(sketch guided sampling)的缺陷,提出了一种网络自适应公平抽样算法.根据抽样分组估计出值流量大小,并依据该值调整抽样比,使之适应于流量变化,从而达到对各种流的公平抽样的效果.对算法的相关性质进行了证明与分析,基于实际互联网数据进行了实验比较,实验结果表明,该算法具有准确性、自适应性、易于工程实现等优点.     

TCP与UDP网络流量对比分析研究*

网络带宽不断增长,越来越多的音/视频、在线游戏等应用成为网络空间的主体。基于实时性考虑,这些新兴应用协议多选择UDP作为其底层的传输协议,使得UDP流量呈上升趋势,而以往的流量测量工作一般基于TCP进行,忽略了UDP协议。对国内某骨干网流量进行了连续12 h的在线测量,在传输层和应用层分别对TCP和UDP及其应用层协议的流的总数、长度分布、持续时间分布、流的速度分布等进行了详尽的分析,并对TCP和UDP的应用层协议流的大小、长短、快慢作了详细的分类。为网络流的分类技术、网络行为发现、网络设计等提供了数据支持。     

用于多维数据实视图选择的分布估计算法

在数据仓库中,为选择合适的视图加以实体化,提出一种新的分布估计算法。在解空间随机产生初始群体,根据适应值选择部分好的解集,利用这些优势群体建立概率模型并估计联合概率分布,再从新的概率分布中抽样得到下一代。实验结果表明,该算法能减少查询响应时间和视图维护代价,并且其寻优性能优于经典遗传算法。     

无线接入网络中TCP流的上下行信道公平算法

在无线接入网络中,上行TCP流会极大地压制下行TCP流,导致严重的上下行信道TCP流不公平问题.本文指出TCP流的ACK包在接入节点下行缓存中的侵占性是上下行TCP不公平问题的直接原因,从限制缓存大小的新角度提出了MBA(Maximum Buffer for ACKs)算法.MBA算法基于上下行TCP流的不公平比例和缓存大小的关系,自适应地调节ACK包的最大缓存空间.理论分析和仿真实验结果表明MBA算法不但能通过限制ACK包的缓存空间实现上下行TCP流公平,还能通过减少无线信道ACK包传输概率提高网络总有效吞吐率.     

空间高效的数据包公平抽样算法

数据包公平抽样通过牺牲长流的包抽样率以换取更高的短流包抽样率,因而比均匀随机包抽样更能保证数据流之间的公平性.现有的公平抽样算法SGS(sketch guided sampling)存在空间效率低、短流估计误差大的问题.提出了一种空间高效的数据包公平抽样算法SEFS(space-efficient fair sampling).SEFS算法的新颖之处在于采用多解析度抽样统计器对数据流流量作近似估计,各个统计器由d-left哈希表实现.采用在OC-48和OC-192骨干网采集的真实流量数据,在数据流流量测量以及长流检测的应用背景下,对SEFS算法和SGS算法的性能进行了比较.实验结果表明,与SGS算法相比,SEFS算法在空间复杂度降低65%的前提下,仍具有更高的估计精度.特别是对于占网络数据流绝大多数的短流而言,SEFS算法估计精度高的优势更为明显.     

CLAMP: Efficient class-based sampling for flexible flow monitoring

With an increasing requirement to classify traffic and track security threats, newer flexible and efficient ways are needed for collecting traffic statistics and monitoring network flows. However, traditional solutions based on packet sampling do not provide the flexibility required for these applications. For example, operators are often interested in observing as many unique flows as possible; however, random packet sampling is inherently biased towards large flows. Operators may also be interested in increasing the fidelity of flow measurements for a certain class of flows; such flexibility is lacking in today’s packet sampling frameworks. In this paper, we propose a novel architecture called CLAMP that provides an efficient framework to implement class-based sampling. At the heart of CLAMP is a novel data structure we propose called composite Bloom filter (CBF) that consists of a set of Bloom filters working together to encapsulate various class definitions. In particular, we show the flexibility and efficacy of CLAMP by implementing a simple two-class size-based sampling. We also consider different objectives such as maximizing flow coverage and improving the accuracy of certain class of flows. In comparison to previous approaches that implement simple size-based sampling, our architecture requires substantially lower amounts of memory (up to 80×) and achieves higher flow coverage (up to 8× more flows) under specific configurations.     

Fast Filtered Sampling

Traffic sampled from the network backbone using uniform packet sampling is commonly utilized to detect heavy hitters, estimate flow level statistics, as well as identify anomalies like DDoS attacks and worm scans. Previous work has shown however that this technique introduces flow bias and truncation which yields inaccurate flow statistics and “drowns out” information from small flows, leading to large false positives in anomaly detection.In this paper, we present a new sampling design: Fast Filtered Sampling (FFS), which is comprised of an independent low-complexity filter, concatenated with any sampling scheme at choice. FFS ensures the integrity of small flows for anomaly detection, while still providing acceptable identification of heavy hitters. This is achieved through a filter design which suppresses packets from flows as a function of their size, “boosting” small flows relative to medium and large flows. FFS design requires only one update operation per packet, has two simple control parameters and can work in conjunction with existing sampling mechanisms without any additional changes. Therefore, it accomplishes a lightweight online implementation of the “flow-size dependent” sampling method. Through extensive evaluation on traffic traces, we show the efficacy of FFS for applications such as portscan detection and traffic estimation.     

Double sampling for flow measurement on high speed links

Traffic measurement and monitoring are an important component of network QoS management and traffic engineering. With high speed Internet links, efficient and effective packet sampling techniques for traffic measurement are not only desirable, but increasingly becoming a necessity. Packet sampling has become an attractive and scalable means to measure flow data on high speed links. Passive traffic measurement increasingly employs sampling at the packet level and makes inferences from sampled network traffic. However, it meets difficulty in estimating the original flow distribution. To circumvent the problem, we propose and analyze a double sampling technique for flow measurement. In particular, we rewrite the expectation maximization (EM) algorithm that estimates flow distribution for double sampling. Using real network traffic traces, we show that the proposed double sampling technique indeed produces the desired accuracy in estimating the flow distribution.     

基于语义的访问控制模型及其推理机制

针对高速链路中流量测量缺乏可扩展性的问题,提出一种在线挖掘频繁流的算法。通过采用“滑动窗口”机制,构造流抽样函数,自适应地设置抽样门限的方法,实现流大小的无偏估计。基于实际的互联网数据进行仿真实验,结果表明,该算法在保证准确性的同时,具有自适应性和资源可控性。     

基于滑动窗口的资源可控流量测量算法

针对高速链路中流量测量缺乏可扩展性的问题,提出一种在线挖掘频繁流的算法。通过采用“滑动窗口”机制,构造流抽样函数,自适应地设置抽样门限的方法,实现流大小的无偏估计。基于实际的互联网数据进行仿真实验,结果表明,该算法在保证准确性的同时,具有自适应性和资源可控性。     

Scalable algorithms for estimating flow length distributions from sampled data

With the rapid growth of link speed, obtaining detailed traffic statistics becomes much more difficult. In order to reduce the resource consumption of measurement systems, more and more passive traffic measurement employs sampling at the packet level. Packet sampling has become an attractive and scalable method to measure flow data on high-speed links. However, knowing the length distributions of traffic flows passing through a network link is very useful for network operation and management. In this paper, we consider the problem of estimating flow length distributions based on sampled flow data. This paper introduces two algorithms for estimating flow length distributions, fitting estimation and factoring estimation. The fitting estimation uses piecewise Pareto distribution to fit the original traffic for a small sampling period. The factoring estimation is used for a large sampling period. It first factorizes the large sampling period into a product of some smaller integer factors, then iteratively invokes fitting estimation or other algorithms such as ${\textit{EM}}$ in the arranged order of the factors. Evaluations of the proposed algorithms on large Internet traces obtained from several sources demonstrate that they have high measurement accuracy with low computation overhead. The algorithms allow us to recover the complete flow length distributions.     

基于业务流数量自适应的资源限制分组抽样

高速网络中,流量抽样测量技术是一种重要可扩展的解决方案,其中NetFlow在流量测量中有着广泛的应用。针对NetFlow的缺陷提出了一种基于业务流数量自适应的资源限制分组抽样算法,该算法结合 “分层抽样”的思想,把 “累积业务流数量”作为重要的参数,来自适应地调节抽样概率,该抽样方法简单、易于实现,平衡了资源的消耗量和准确性。并基于实际互联网数据进行了实验比较,结果显示：该方法具有简单性、自适应性、资源可控性的同时不会失去准确性。     

改进型分层抽样技术及性能研究

报文抽样技术是高速网络流量测量和管理中使用的一项关键技术。本文通过引进分层特征、层数L、分层边界、各层样本量分配、层内抽样策略5个分层抽样参数,并对其进行重新配置和简单理论探讨,实现对分层抽样技术的改进。同时文章使用简单线性估计推断原始流数据,并借助于Φ偏差检验方法,对改进的分层抽样技术和其它抽样技术在测量网络报文长度分布方面进行准确性性能比较。结果表明,改进的分层抽样技术在测量报文长度分布方面的准确性性能远高于其它抽样方式,提高了测量的精度。