高速网络访问超点实时检测算法精度分析

于海青; 丁伟; 徐杰

doi:10.11959/j.issn.1000-0801.2020117

您当前的位置：

首页 >

文章列表页 >

高速网络访问超点实时检测算法精度分析

研究与开发 | 更新时间：2024-06-05

- 高速网络访问超点实时检测算法精度分析
- Accuracy analysis on access hyper-point real-time detection algorithms in high-speed network
- 电信科学 2020年36卷第4期页码：74-82
- 作者机构：
- 作者简介：
  
  [ "于海青（1996- ），男，东南大学网络空间安全学院硕士生，主要研究方向为网络空间安全、网络测量、网络管理等" ]
  [ "丁伟（1962- ），女，博士，东南大学网络空间安全学院教授，主要研究方向为网络测量与行为学、网络管理及网络安全等" ]
  [ "徐杰（1989- ），男，东南大学网络空间安全学院博士生，主要研究方向为网络安全、并行计算和分布式计算等" ]
- 基金信息：
  
  国家重点研发计划基金资助项目;The National Key Research and Development Project(2018YFB1800200)
- DOI：10.11959/j.issn.1000-0801.2020117
  中图分类号： TP302
- 网络出版日期：2020-04，
  
  纸质出版日期：2020-04-20
- 稿件说明：
移动端阅览
于海青, 丁伟, 徐杰. 高速网络访问超点实时检测算法精度分析[J]. 电信科学, 2020,36(4):74-82.

Haiqing YU, Wei DING, Jie XU. Accuracy analysis on access hyper-point real-time detection algorithms in high-speed network[J]. Telecommunications science, 2020, 36(4): 74-82.
于海青, 丁伟, 徐杰. 高速网络访问超点实时检测算法精度分析[J]. 电信科学, 2020,36(4):74-82. DOI： 10.11959/j.issn.1000-0801.2020117.

Haiqing YU, Wei DING, Jie XU. Accuracy analysis on access hyper-point real-time detection algorithms in high-speed network[J]. Telecommunications science, 2020, 36(4): 74-82. DOI： 10.11959/j.issn.1000-0801.2020117.

摘要

访问超点的实时获取有利于管理者更好地掌控网络。在高速网络条件下，访问超点检测的难点在于大流量给计算带来的压力。基于40 Gbit/s带宽的网络环境，从精度分析角度对比了流记录统计算法和基于估值原理的估算类超点检测算法。流记录统计算法采用基于重尾分布的阈值模型加以改进，估算类超点检测算法采用SRLA在GPU环境下实现，研究结果表明，估算类超点检测算法明显具有更高的检测精度和更大的改进空间，比流记录统计算法更适合被用于高速网络超点实时检测。

Abstract

Real-time access hyper-point helps managers better control the network.Under high-speed network conditions

the difficulty in accessing hyper-point detection lies in the pressure exerted by large traffic on computing.Based on the 40 Gbit/s bandwidth network environment

from the perspective of accuracy analysis

the flow record statistics algorithm and the estimation-based superpoint detection algorithm were compared.The flow record statistical algorithm was improved by the threshold model based on heavy-tailed distribution.The estimation-based superpoint detection algorithm was implemented in the GPU environment by SRLA.The research results show that the estimation-based hyper-point detection algorithm which has obviously higher accuracy and more room for improvement is more suitable for real-time detection of hyper-point in high-speed network than the flow record statistical algorithm.

关键词

Keywords

references

CHOI S , CHOI Y , LEE J , et al . Network abnormal behaviour analysis system [C ] // Proceeding of 2017 19th International Conference on Advanced Communication Technology (ICACT).[S.l.:s.n] . 2017 : 49 - 52 .

周爱平 . 高速网络流量测量关键问题研究 [D ] . 南京:东南大学 , 2015 .

ZHOU A P . Research on key issues of high-speed network traf-fic measurement [D ] . Nanjing:Southeast University , 2015 .

KUCERA J , KEKELY L , PIECEK A , et al . General IDS acceleration for high-speed networks [C ] // Proceeding of 2018 IEEE 36th International Conference on Computer Design (ICCD).[S.l.:s.n . ] , 2018 : 366 - 373 .

VENKATARAMAN S , SONG D , GIBBONS P B , et al . New streaming algorithms for fast detection of superspreaders [R ] . 2004 .

MODI C , PATEL D , BORISANIYA B , et al . A survey of intrusion detection techniques in cloud [J ] . Journal of Network and Computer Applications , 2013 , 36 ( 1 ): 42 - 57 .

KAMIYAMA N , MORI T , KAWAHARE R . Simple and adaptive identification of superspreaders by flow sampling [C ] // Proceeding of IEEE INFOCOM 2007-26th IEEE International Conference on Computer Communications . Piscataway:IEEE Press , 2007 : 2481 - 2485 .

YOON M K , LI T , CHEN S , et al . Fit a compact spread estimator in small high-speed memory [J ] . IEEE/ACM Transactions on Networking , 2011 , 19 ( 5 ): 1253 - 1264 .

CHENG G , TANG Y . Line speed accurate superspreader identification using dynamic error compensation [J ] . Computer Communications , 2013 , 36 ( 13 ): 1460 - 1470 .

LIU W , QU W , GONG J , et al . Detection of sauperpoints using a vector bloom filter [J ] . IEEE Transactions on Information Forensics and Security , 2015 , 11 ( 3 ):1.

WANG P , GUAN X , TAO Q , et al . A data streaming method for monitoring host connection degrees of high-speed links [J ] . IEEE Transactions on Information Forensics ＆ Security , 2011 , 6 ( 3 ): 1086 - 1098 .

XU J , DING W , GONG Q , et al . A super point detection algorithm under sliding time windows based on rough and linear estimators [J ] . IEEE Access , 2019 ( 7 ): 43414 - 43427 .

白磊 , 陈超 , 田立勤 . 基于TCBF_LRU的高速网络大流检测算法 [J ] . 计算机研究与发展 , 2014 ( S2 ): 122 - 128 .

BAI L , CHEN C , TIAN L Q . High-speed network large flow detection algorithm based on TCBF_LRU [J ] . Journal of Com-puter Research and Development , 2014 ( S2 ): 122 - 128 .

陈楚 , 许勇 , 张凌 . 重尾分布对网络流量性质的影响 [J ] . 计算机应用 , 2009 , 29 ( 6 ): 1520 - 1522 .

CHEN C , XU Y , ZHANG L . Effects of heavy-tailed distribution on the nature of network traffic [J ] . Journal of Computer Applications , 2009 , 29 ( 6 ): 1520 - 1522 .

丁伟 , 洪沿 , 夏震 . 基于流记录的 HTTP 80 端口服务检测和分析 [J ] . 华中科技大学学报(自然科学版) , 2016 , 44 ( 11 ): 34 - 38 .

DING W , HONG Y , XIA Z . Detection and analysis of HTTP 80 port service based on stream recording [J ] . Journal of Huazhong University of Science and Technology(Natural Science) , 2016 , 44 ( 11 ): 34 - 38 .

程光 , 唐永宁 . 基于近似方法的抽样报文流数估计算法 [J ] . 软件学报 , 2013 ( 2 ): 255 - 265 .

CHENG G , TANG Y N . Sampling message flow estimation al-gorithm based on approximation method [J ] . Journal of Software , 2013 ( 2 ): 255 - 265 .

WHANG K Y , VANDERZANDEN B T , TAYLOR H M . A linear-time probabilistic counting algorithm for database applications [J ] . ACM Transactions on Database Systems , 1990 , 15 ( 2 ): 208 - 229 .

XIAO Q , CHEN S , YOU Z , et al . Cardinality estimation for elephant flows:a compact solution based on virtual register sharing [J ] . IEEE/ACM Transactions on Networking , 2017 ( 99 ): 1 - 15 .

杨永愉 . Pareto 分布参数的统计推断及其应用 [J ] . 北京化工大学学报(自然科学版) , 1992 ( 1 ): 89 - 97 .

YANG Y Y . Statistical inference of pareto distribution parame-ters and Its application [J ] . Journal of Beijing University of Chemical Technology (Natural Science Edition) , 1992 ( 1 ): 89 - 97 .

浏览量

522

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

基于SDWAN承载技术的生态环境厅业务专网升级

灰盒光传输设备的SDN管控技术研究及应用

移动设备网络流量分析技术综述

一种基于投影寻踪的电信网络数据处理方法

一种基于随机映射的网络状态评估方法