未知网络应用流量的自动提取方法

提取未知网络应用特征时需要获得其流量数据,但在网络工程中,采集的未知应用流量往往是几种应用流量的混合,如何将未知混合流量进行分离,按照应用进行归类是现有方法没有解决的问题。基于此提出一种基于载荷信息的流量聚类方法,该方法通过对报文载荷的部分字节编码,采用扩展的ROCK算法对未知混合流量进行分离,按照不同应用进行归类。实验结果表明,与基于会话行为特征（一种流量统计特征）的流量聚类方法相比,这种方法具有较高的精确度。     

自适应流量评估方法在IDC网络的应用

为了确保IDC网络的服务质量,往往需要了解IDC网络中各出口、各链路的网络拥塞、大规模网络攻击等流量信息并进行及时全量的数据监测和分析.本文提出了一种自适应流量评估方法,通过测量精度和存储资源两方面的调控,来优化现有的流量测量技术.     

Network services and traffic engineering methods for supporting applications on the VTHD experimental gigabit network

vthd is a high-performanceip experimental network. This network and associated research projects have been partially funded by the French government through the French Research Network for Telecommunications (rnrt) in order to support the development of leading-edge network services on the one hand, and test a wide-scale deployment of advanced Internet applications on the other hand. This paper describes the network services that were deemed necessary to support the deployment of innovative applications, as well as several of the applications that have been experimented on the network. It also presents a selection of the traffic engineering methods and experiments that have been developed in the course of thevthd related research projects. This article describes the collective works of members of the project partners, which are represented by the set of authors for the present paper.     

WPANFIS: combine fuzzy neural network with multiresolution for network traffic prediction

A novel methodology for prediction of network traffic,WPANFIS,which relies on wavelet packet transform(WPT)for multi-resolution analysis and adaptive neuro-fuzzy inference system(ANFIS)is proposed in this article.The widespread existence of self-similarity in network traffic has been demonstrated in earlier studies,which exhibits both long range dependence(LRD)and short range dependence(SRD).Also,it has been shown that wavelet decomposition is an effective tool for LRD decorrelation.The new method uses WPT as extension of wavelet transform which can decoorrelate LRD and make more precisely partition in the high-frequency section of the original traffic.Then ANFIS which can extract useful information from the original traffic is implemented in this study for better prediction performance of each decomposed non-stationary wavelet coefficients.Simulation results show that the proposed WPANFIS can achieve high prediction accuracy in real network traffic environment.     

Cluster processes: a natural language for network traffic

We introduce a new approach to the modeling of network traffic, consisting of a semi-experimental methodology combining models with data and a class of point processes (cluster models) to represent the process of packet arrivals in a physically meaningful way. Wavelets are used to examine second-order statistics, and particular attention is paid to the modeling of long-range dependence and to the question of scale invariance at small scales. We analyze in depth the properties of several large traces of packet data and determine unambiguously the influence of network variables such as arrival patterns, durations, and volumes of transport control protocol (TCP) flows and internal flow structure. We show that session-level modeling is not relevant at the packet level. Our findings naturally suggest the use of cluster models. We define a class where TCP flows are directly modeled, and each model parameter has a direct meaning in network terms, allowing the model to be used to predict traffic properties as networks and traffic evolve. The class has the key advantage of being mathematically tractable, in particular, its spectrum is known and can be readily calculated, its wavelet spectrum deduced, interarrival distributions can be obtained, and it can be simulated in a straightforward way. The model reproduces the main second-order features, and results are compared against a simple black box point process alternative. Discrepancies with the model are discussed and explained, and enhancements are outlined. The elephant and mice view of traffic flows is revisited in the light of our findings.     

Autonomic traffic engineering for network robustness

The continuously increasing complexity of communication networks and the increasing diversity and unpredictability of traffic demand has led to a consensus view that the automation of the management process is inevitable. Currently, network and service management techniques are mostly manual, requiring human intervention, and leading to slow response times, high costs, and customer dissatisfaction. In this paper we present AutoNet, a self-organizing management system for core networks where robustness to environmental changes, namely traffic shifts, topology changes, and community of interest is viewed as critical. A framework to design robust control strategies for autonomic networks is proposed. The requirements of the network are translated to graph-theoretic metrics and the management system attempts to automatically evolve to a stable and robust control point by optimizing these metrics. The management approach is inspired by ideas from evolutionary science where a metric, network criticality, measures the survival value or robustness of a particular network configuration. In our system, network criticality is a measure of the robustness of the network to environmental changes. The control system is designed to direct the evolution of the system state in the direction of increasing robustness. As an application of our framework, we propose a traffic engineering method in which different paths are ranked based on their robustness measure, and the best path is selected to route the flow. The choice of the path is in the direction of preserving the robustness of the network to the unforeseen changes in topology and traffic demands. Furthermore, we develop a method for capacity assignment to optimize the robustness of the network.     

FlowAntEater: network traffic automatic signature generator

In the areas of traffic classification, the payload signature-based classification method–deep packet inspection (DPI) shows the highest performance in terms of preciseness, reliability and practicality. The usual way, however, obtaining signatures for DPI is analyzing network traffic payload and find signatures by hand, which means inefficient and a heavy burden for researchers. Therefore, the research on network traffic automatic signatures generation (NTASG), which helps administrators and researcher find network signatures, becomes important. In this paper, a software framework on NTASG is proposed which uses the K-means cluster algorithm to purity the traffic flow and contains a systematic signatures management algorithm, sig-tree. Also, the feasibility of our design choices was proved via experimental evaluation on the campus traffic trace.     

Advanced traffic control methods for network management

The objectives of network management control are outlined, and two categories of control are defined: network traffic controls and network configuration controls. Network traffic controls are further classified into traffic volume controls and routing controls, and advanced techniques for achieving each of them are examined. Two classes of methods for specifying the amount of traffic to be controlled are described. In proportional control, a certain proportion of the traffic offered by each exchange is admitted; in threshold control, there is a maximum rate at which the traffic offered by each exchange is admitted. The TCS-V2 traffic-control system, an advanced automatic code-blocking system that uses area and subscriber congestion control, is considered, and the simulated performance of proportional control and threshold control is compared for this system. For routing control, an advanced state-dependent dynamic routing scheme is examined, and the results of a comparative evaluation of dynamic routing schemes are presented     

IP network configuration for intradomain traffic engineering

The smooth operation of the Internet depends on the careful configuration of routers in thousands of autonomous systems throughout the world. Configuring routers is extremely complicated because of the diversity of network equipment, the large number of configuration options, and the interaction of configuration parameters across multiple routers. Network operators have limited tools to aid in configuring large backbone networks. Manual configuration of individual routers can introduce errors and inconsistencies with unforeseen consequences for the operational network. In this article we describe how to identify configuration mistakes by parsing and analyzing configuration data extracted from the various routers. We first present an overview of IP networking from the viewpoint of an Internet service provider and describe the kinds of errors that can appear within and across router configuration files. To narrow the scope of the problem, we then focus our attention on the configuration commands that relate to traffic engineering-tuning the intradomain routing protocol to control the flow of traffic through the ISP network. We present a case study of a prototype tool, developed in collaboration with AT&T IP Services, for checking the configuration of the AT&T IP Backbone and providing input to other systems visualization and traffic engineering     

IP骨干网流量的自动化预测

高效、可靠的网络流量预测是网络规划、扩容建设的基础。互联网流量目前缺乏完备的理论模型,行业内大多根据工程实践特点,设计简化可操作的预测模型以满足IP网络规划需求。首先根据中国电信自身IP骨干网流量预测工作的需求及特点,使用时间序列分析的多因子回归模型和函数自适应模型对IP骨干网流量进行分析和预测,基于大量现网实际数据的仿真运算,对比两种模型的特点、优劣和适用场景,提出了一种预测模型选择和参数优化的原则和方法。在此基础上,构建了可以满足百千量级时间序列要求的自动化流量预测系统,极大简化并提升了流量预测工作的效率。最后,展望了未来IP流量预测工作的延展方向和关注重点。     

Java for network management applications

Java preserves much of C++, and offers compelling benefits: it is object-oriented, portable and relatively easy to master and maintain. These, and other benefits, can greatly speed the development cycle for Web-based network management applications. This article discusses these issues, and gives an overview of Java's relevance for network managers. © 1998 John Wiley & Sons, Ltd.     

Research on fuzzy neural network algorithms for nonlinear network traffic predicting

Neural networks provide massive parallelism,robust-ness ,and approxi mate reasoning,which are i mportantfor dealing with uncertain,inexact ,and ambiguous data,withill-defined problems and sparse data sets[1].It hasbeen proved that a neural network system …     

ANEMONA: a programming language for network monitoring applications

This work presents ANEMONA: A language for programming NEtwork MONitoring Applications. The compilation of an ANEMONA program generates code for configuring a policy repository and the corresponding policy deployment and event monitoring. The language allows the definition of expressions of managed objects that are monitored, as well as triggers that when fired may indicate the occurrence of associated events, which are also defined by the language. A translator for the language was implemented that generates code for configuring both the policy repository and deployment. The current implementation of the language employs the Expression MIB and Event MIB. Experimental results are presented, including an ANEMONA program that detects TCP Syn Flooding attacks, and a program for detecting steep variations in the utilization of monitored links. Copyright © 2007 John Wiley & Sons, Ltd.     

Ultrascience net: network testbed for large-scale science applications

UltraScienceNet is an experimental wide area network testbed to enable the development of networking technologies required for next-generation large-scale scientific applications. It provides on-demand dedicated high-bandwidth channels for large data transfers, and also high-resolution high-precision channels for fine control operations. In the initial deployment its data plane consists of several thousand miles of dual 10 Gb/s lambdas. The channels are provisioned on demand using layer 1 and 2 switches in the backbone and multiple service provisioning platforms at the edges in a flexible configuration using a secure control plane. A centralized scheduler is employed to compute future channel allocations, and a signaling daemon is used to generate the configuration signals to switches at appropriate times. The control plane is implemented using an out-of-band virtual private network, which encrypts the switching signals, and also provides authenticated user and application access. Transport experiments are conducted on a smaller test connection that provides us useful information about the basic properties and issues of utilizing dedicated channels in applications.     

Composite lightweight traffic classification system for network management

Accurate and real‐time classification of network traffic is significant to a number of network operation and management tasks such as quality of service differentiation, traffic shaping and security surveillance. However, with emerging P2P applications using dynamic port numbers, IP masquerading techniques and payload encryption, accurate and intelligent traffic classification continues to be a big challenge despite a wide range of research work on the topic. Since each classification method has its disadvantages and hardly could meet the specific requirement of Internet traffic classification, this paper innovatively presents a composite traffic classification system. The proposed lightweight system can accurately and effectively identify Internet traffic with good scalability to accommodate both known and unknown/encrypted applications. Furthermore, It promises to satisfy various Internet uses and is feasible for use in real‐time line speed applications. Our experimental results show the distinct advantages of the proposed classification system. Copyright © 2009 John Wiley & Sons, Ltd.     

Adaptive algorithms for reducing PCS network authentication traffic

Two authentication schemes (ASs) have been proposed in the Electronic Industry Association/Telecommunications Industry Association's (EIA/TIA) Telecommunications Systems Bulletins (TSBs) 51 for incorporation in the cellular industry Interim Standard IS 41 Revision C. In the first scheme, which we refer to as the WS scheme, a unique secret key [also known as shared secret data (SSD)] is shared only between the authentication center (AC) and handset. In the second scheme, referred to as the S scheme, the SSD is also shared with the visited system. The performance of the two schemes can be compared by using the expected number of call originations/terminations between two consecutive registrations or call-to-mobility ratio (CMR). Based on the message flow (accesses to databases), it is apparent that the S scheme outperforms the WS schemes if the CMR ratio is large. The CMRs of users will likely span a wide range and, even for the same user, will perhaps vary from time to time. It is therefore desirable to switch between the ASs based on the users' CMR to reduce the signaling network traffic. We propose two adaptive algorithms to determine how and when to switch between the ASs for a given user. Our performance study indicates that as the CMR of a user changes, the adaptive algorithms automatically select the best AS in real time     

高负荷GSM网络的优化技术

文章给出了现有GSM网络高负荷区域的定义,结合高负荷区域的特点和面临的问题,从网络结构调整、频率规划与载频配置、业务均衡分担、网络参数调整4个方面讨论了相应的优化技术,以期解决网络建设运营中的一些实际问题.     

Method of data cleaning for network traffic classification

Network traffic classification aims at identifying the application types of network packets. It is important for Internet service providers （ISPs） to manage bandwidth resources and ensure the quality of service for different network applications However, most classification techniques using machine learning only focus on high flow accuracy and ignore byte accuracy. The classifier would obtain low classification performance for elephant flows as the imbalance between elephant flows and mice flows on Internet. The elephant flows, however, consume much more bandwidth than mice flows. When the classifier is deployed for traffic policing, the network management system cannot penalize elephant flows and avoid network congestion effectively. This article explores the factors related to low byte accuracy, and secondly, it presents a new traffic classification method to improve byte accuracy at the aid of data cleaning. Experiments are carried out on three groups of real-world traffic datasets, and the method is compared with existing work on the performance of improving byte accuracy. Experiment shows that byte accuracy increased by about 22.31% on average. The method outperforms the existing one in most cases.