一种大象流两级识别方法

基于大象流的识别准确度高且开销低,对于解决SDN流量管理过程中控制器单点故障问题具有重要意义.针对现有大象流识别方法识别开销大的问题,提出一种大象流两级识别方法.该方法在第一阶段提出基于TCP发送队列的可疑大象流识别算法,在第二阶段提出基于流持续时间的真实大象流识别算法;第一阶段是在端系统中识别可疑大象流,用于降低第二阶段真实大象流识别过程中SDN控制器所需监测的网络流数量.实验分析表明,在保证大象流识别的高准确度前提下,大象流两级识别方法较基于采样的大象流识别方法可以降低约85％的控制器识别开销.     

High‐speed flow‐based classification on FPGA

Analyzing the composition of Internet traffic has many applications nowadays, like tracking bandwidth‐consuming applications, QoS‐based traffic engineering and lawful interception of illegal traffic. Even though many flow‐based classification methods, such as support vector machines (SVM), have demonstrated their accuracy, few practical implementations of lightweight classifiers exist. We consider in this paper the design of a real‐time SVM traffic classifier at hundreds of Gb/s to allow online detection of categories of applications. We also implement a high‐speed flow reconstruction algorithm able to handle one million concurrent flows. The solution is based on the massive parallelism and low‐level network interface access of FPGA boards. We find maximum supported bit rates up to 408 Gb/s for classification and up to 20 GB/s for flow reconstruction for the most challenging trace. Results are confirmed using a commercial Combov2 board with a Virtex 5 FPGA. Copyright © 2014 John Wiley & Sons, Ltd.     

Studying cost-sensitive learning for multi-class imbalance in Internet traffic classification

Cost-sensitive learning has been applied to resolve the multi-class imbalance problem in Internet traffic classification and it has achieved considerable results.But the classification performance on the minority classes with a few bytes is still unhopeful because the existing research only focuses on the classes with a large amount of bytes.Therefore,the class-dependent misclassification cost is studied.Firstly,the flow rate based cost matrix(FCM) is investigated.Secondly,a new cost matrix named weighted cost matrix(WCM) is proposed,which calculates a reasonable weight for each cost of FCM by regarding the data imbalance degree and classification accuracy of each class.It is able to further improve the classification performance on the difficult minority class(the class with more flows but worse classification accuracy).Experimental results on twelve real traffic datasets show that FCM and WCM obtain more than 92% flow g-mean and 80% byte g-mean on average;on the test set collected one year later,WCM outperforms FCM in terms of stability.     

Measurement-Based Admission Control at Edge Routers

It is very important to allocate and manage resources for multimedia traffic flows with real-time performance requirements in order to guarantee quality of service (QoS). In this paper, we develop a scalable architecture and an algorithm for admission control of real-time flows. Since individual management of each traffic flow on each transit router can cause a fundamental scalability problem in both data and control planes, we consider that each flow is classified at the ingress router and data traffic is aggregated according to the class inside the core network as in a DiffServ framework. In our approach, admission decision is made for each flow at the edge (ingress) routers, but it is scalable because per-flow states are not maintained and the admission algorithm is simple. In the proposed admission control scheme, an admissible bandwidth, which is defined as the maximum rate of a flow that can be accommodated additionally while satisfying the delay performance requirements for both existing and new flows, is calculated based on the available bandwidth measured by edge routers. The admissible bandwidth is a threshold for admission control, and thus, it is very important to accurately estimate the admissible bandwidth. The performance of the proposed algorithm is evaluated by taking a set of simulation experiments using bursty traffic flows.     

Priority differentiated multicast flow scheduling method in Ceph cloud storage network

In order to solve the problem that existing flow scheduling method is difficult to meet the different multicast scheduling requirements of multi-service flows in the Ceph cloud storage network,a service priority-based multicast flow scheduling method was tailored.First,the network status was obtained via software defined network (SDN) to support flow scheduling.Then,a multicast task was decomposed into multiple attribute decision problems for multiple unicast path selection,and a method of unicast path selection based on technique for order preference by similarity to ideal solution (TOPSIS) was proposed.The unicast path selection method was used to find the optimal unicast path set for the service flow based on the flow’s network performance requirements.Then,the multicast distribution node was determined by the maximum common sub-path among the optimal unicast path sets for construct a multicast transmission path.The experiment results show that the proposed method can reduce the transmission delay of high priority flows while reduce the redundant traffic and better balance the traffic loads compared with the existing methods.     

Identifying online traffic based on property of TCP flow

Classification of network traffic using port-based or payload-based analysis is becoming increasingly difficult when many applications use dynamic port numbers, masquerading techniques, and encryption to avoid detection. In this article, an approach is presented for online traffic classification relying on the observation of the first n packets of a transmission control protocol (TCP) connection. Its key idea is to utilize the properties of the observed first ten packets of a TCP connection and Bayesian network method to build a classifier. This classifier can classify TCP flows dynamically as packets pass through it by deciding whether a TCP flow belongs to a given application. The experimental results show that the proposed approach performs well in online Internet traffic classification and that it is superior to naive Bayesian method.     

基于抽样流长与完全抽样阈值的异常流自适应抽样算法

高速IP网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计精度偏低,对异常流量筛选能力较差的缺陷,该文提出一种基于业务流已抽样长度与完全抽样阈值S的自适应流抽样算法(AFPT)。AFPT算法根据完全抽样阈值S筛选对异常流量敏感相关的小流,同时根据业务流已抽样长度自适应调整抽样概率。仿真和实验结果表明,AFPT算法的估计误差与理论上界相符,具有较强的异常流量筛选能力,能够有效提高异常检测算法的准确率。     

面向带宽碎片最小化和QoS保障的数据中心网络流量调度算法

随着数据中心网络流量的迅速增长,如何提高数据中心网络性能和服务质量成为了研究热点。然而现有的流量调度算法在网络负载加大时,一方面会导致网络带宽碎片化从而使得网络吞吐量降低,另一方面忽视了流量应用需求导致网络服务质量较差。为此,该文提出一种面向带宽碎片最小化和QoS保障的动态流量调度算法,算法综合考虑了带宽敏感的大流、时延与丢包敏感的小流的不同需求,首先根据待调度流的源地址和目的地址建立最短路径集,其次从中筛选出满足待调度流的带宽需求的所有路径,然后根据路径剩余带宽信息和小流应用需求情况为每条路径建立权重函数,最后根据权重函数值利用轮盘赌算法选择转发路径。实验仿真结果显示,与其它算法相比,所提算法降低了小流的丢包率和时延,同时在网络负载较大时提升了网络吞吐量。     

FEBA: A Bandwidth Allocation Algorithm for Service Differentiation in IEEE 802.16 Mesh Networks

In wireless mesh networks, the end-to-end throughput of traffic flows depends on the path length, i.e., the higher the number of hops, the lower becomes the throughput. In this paper, a fair end-to-end bandwidth allocation (FEBA) algorithm is introduced to solve this problem. FEBA is implemented at the medium access control (MAC) layer of single-radio, multiple channels IEEE 802.16 mesh nodes, operated in a distributed coordinated scheduling mode. FEBA negotiates bandwidth among neighbors to assign a fair share proportional to a specified weight to each end-to-end traffic flow. This way traffic flows are served in a differentiated manner, with higher priority traffic flows being allocated more bandwidth on the average than the lower priority traffic flows. In fact, a node requests/grants bandwidth from/to its neighbors in a round-robin fashion where the amount of service depends on both the load on its different links and the priority of currently active traffic flows. If multiple channels are available, they are all shared evenly in order to increase the network capacity due to frequency reuse. The performance of FEBA is evaluated by extensive simulations. It is shown that wireless resources are shared fairly among best-effort traffic flows, while multimedia streams are provided with a differentiated service that enables quality of service.     

TCP-LP: low-priority service via end-point congestion control

Service prioritization among different traffic classes is an important goal for the Internet. Conventional approaches to solving this problem consider the existing best-effort class as the low-priority class, and attempt to develop mechanisms that provide "better-than-best-effort" service. In this paper, we explore the opposite approach, and devise a new distributed algorithm to realize a low-priority service (as compared to the existing best effort) from the network endpoints. To this end, we develop TCP Low Priority (TCP-LP), a distributed algorithm whose goal is to utilize only the excess network bandwidth as compared to the "fair share" of bandwidth as targeted by TCP. The key mechanisms unique to TCP-LP congestion control are the use of one-way packet delays for early congestion indications and a TCP-transparent congestion avoidance policy. The results of our simulation and Internet experiments show that: 1) TCP-LP is largely non-intrusive to TCP traffic; 2) both single and aggregate TCP-LP flows are able to successfully utilize excess network bandwidth; moreover, multiple TCP-LP flows share excess bandwidth fairly; 3) substantial amounts of excess bandwidth are available to the low-priority class, even in the presence of "greedy" TCP flows; 4) the response times of web connections in the best-effort class decrease by up to 90% when long-lived bulk data transfers use TCP-LP rather than TCP; 5) despite their low-priority nature, TCP-LP flows are able to utilize significant amounts of available bandwidth in a wide-area network environment.     

Monitoring and controlling QoS network domains

Increased performance, fairness, and security remain important goals for service providers. In this work, we design an integrated distributed monitoring, traffic conditioning, and flow control system for higher performance and security of network domains. Edge routers monitor (using tomography techniques) a network domain to detect quality of service (QoS) violations—possibly caused by underprovisioning—as well as bandwidth theft attacks. To bound the monitoring overhead, a router only verifies service level agreement (SLA) parameters such as delay, loss, and throughput when anomalies are detected. The marking component of the edge router uses TCP flow characteristics to protect ‘fragile’ flows. Edge routers may also regulate unresponsive flows, and may propagate congestion information to upstream domains. Simulation results indicate that this design increases application‐level throughput of data applications such as large FTP transfers; achieves low packet delays and response times for Telnet and WWW traffic; and detects bandwidth theft attacks and service violations. Copyright © 2004 John Wiley & Sons, Ltd.     

基于最短划分距离的网络流量决策树分类方法

对不同类别的应用数据流,根据其在最初若干分组中进行握手和参数协商的差异性,通过通信模式、载荷长度以及信息熵等特征,采用基于最短划分距离的方法构建决策树模型,对其进行流量分类。经过在4个不同类型的真实网络数据集上的离线分类实验,以及在校园网环境中的在线流量分类实验。结果表明该模型对8种常见协议的网络流量,分析其前4到6个分组的特征,能够在分类准确性和系统开销上取得较好的效果。与其他机器学习算法相比,该模型构建的决策树规模较小,分类时间较短,适合于实时流量分类问题。     

基于深度报文检测和深度流检测的骨干网流量特征分析

Based on the massive data collected with a passive network monitoring equipment placed in China's backbone, we present a deep insight into the network backbone traffic and evaluate various ways for improving traffic classifying efficiency in this paper. In particular, the study has scrutinized the network traffic in terms of protocol types and signatures, flow length, and port distribution, from which meaningful and interesting insights on the current Internet of China from the perspective of both the packet and flow levels are derived. We show that the classification efficiency can be greatly improved by using the information of preferred ports of the network applications. Quantitatively, we find two traffic duration thresholds, with which 40% of TCP flows and 70% of UDP flows can be excluded from classification processing while the impact on classification accuracy is trivial, i.e., the classification accuracy can still reach a high level by saving 85% of the resources.     

An Empirical Investigation of Filter Attribute Selection Techniques for High-Speed Network Traffic Flow Classification

Attribute selection is an important methodology for data mining problems. Removing irrelevant and redundant attributes from original data set can greatly simplify building classifier models. In this paper, we consider applying attribute selection techniques to network traffic flow classification and conduct experiments using the actual network data collected from the Internet of China. The results show that building with an appropriate attribute selection method can simplify the network traffic classifier while achieving satisfactory classification accuracy.     

基于深度特征学习的网络流量异常检测方法

针对网络流量异常检测过程中提取的流量特征准确性低、鲁棒性差导致流量攻击检测率低、误报率高等问题,该文结合堆叠降噪自编码器(SDA)和softmax,提出一种基于深度特征学习的网络流量异常检测方法。首先基于粒子群优化算法设计SDA结构两阶段寻优算法:根据流量检测准确率依次对隐藏层层数及每层节点数进行寻优,确定搜索空间中的最优SDA结构,从而提高SDA提取特征的准确性。然后采用小批量梯度下降算法对优化的SDA进行训练,通过最小化含噪数据重构向量与原始输入向量间的差异,提取具有较强鲁棒性的流量特征。最后基于提取的流量特征对softmax进行训练构建异常检测分类器,从而实现对流量攻击的高性能检测。实验结果表明:该文所提方法可根据实验数据及其分类任务动态调整SDA结构,提取的流量特征具有更高的准确性和鲁棒性,流量攻击检测率高、误报率低。     

Research on traffic identification and scheduling based on optical interconnection architecture in data center

In order to solve the data center link congestion problem,based on the characteristics of the flow distribution and flow types,a flow identification and scheduling scheme based on optical interconnect structure,named HCFD (host-controller flow detection),was proposed to identify the elephant flow which has a large impact on the network performance,and use the SDN controller to make forward strategy,and schedule the network traffic reasonably.The implementation of the scheme was to use the Netfilter framework in Linux kernel protocol on the host side to mark the flow that exceeds the threshold amount.Then,the classification model was used in the controller side to classify the marked flow.Finally,the appropriate forwarding strategy was developed based on the above results.With the advantage of the photoelectric network,mechanisms of flow depth fusion and switching could be realized.The scheme which integrates the advantage of the existing research results,was expected to identify elephant flow more accurately and comprehensively.It can effectively alleviate the network congestion,make full use of network bandwidth,reduce end-to-end delay and packet loss rate.     

Bandwidth sharing and admission control for elastic traffic

We consider the performance of a network like the Internet handling so‐called elastic traffic where the rate of flows adjusts to fill available bandwidth. Realized throughput depends both on the way bandwidth is shared and on the random nature of traffic. We assume traffic consists of point to point transfers of individual documents of finite size arriving according to a Poisson process. Notable results are that weighted sharing has limited impact on perceived quality of service and that discrimination in favour of short documents leads to considerably better performance than fair sharing. In a linear network, max–min fairness is preferable to proportional fairness under random traffic while the converse is true under the assumption of a static configuration of persistent flows. Admission control is advocated as a necessary means to maintain goodput in case of traffic overload. This revised version was published online in June 2006 with corrections to the Cover Date.     

Soft‐State Bandwidth Reservation Mechanism for Slotted Optical Burst Switching Networks

This paper proposes a novel transport network architecture for the next generation network (NGN) based on the optical burst switching technology. The proposed architecture aims to provide efficient delivery of various types of network traffic by satisfying their quality‐of‐service constraints. To this end, we have developed a soft‐state bandwidth reservation mechanism, which enables NGN transport nodes to dynamically reserve bandwidth needed for active data burst flows. The performance of the proposed mechanism is evaluated by means of numerical analysis and NS2 simulation. Our results show that the packet delay is kept within the constraint for each traffic flow and the burst loss rate is remarkably improved.     

Credit-based processor sharing for decoupled delay and bandwidthallocation

We propose a credit-based processor sharing (CPS) approach for decoupled allocation of delay and bandwidth. For bandwidth guarantees, a CPS system serves traffic flows in proportion to their service weights. For delay guarantees, on the other hand, a CPS system allows real-time flows to temporarily borrow bandwidth from nonreal-time flows using service credits. This borrowing mechanism boosts the delay performance of real-time flows without increasing their long-term bandwidth requirements. By systematically regulating service credits of real-time flows, nonreal-time flows are protected for their aggregate long-term bandwidth share     

ATM网中ABR业务及其反馈流量控制

ABR（AvailableBitRate）业务是近年来为了充分利用ATM网络的剩余带宽而提出的一种新型业务类型，自从1993年被ATM论坛正式提出以来得到了很快的发展。文章对该业务的特点和发展过程作了较全面的介绍，对该类型业务的流量控制方法作了比较深入的分析和研究，对流量控制中关键因素的改进提出了自己的见解。