arXivDaily arXiv每日学术速递 周一至周五更新
arXiv 0901.4846cs.NI
收藏

识别IP业务中大流的自适应算法

Adaptive algorithms for identifying large flows in IP traffic

Youssef Azzana, Yousra Chabchoub, Christine Fricker, Fabrice Guillemin, Philippe Robert

摘要:

本文提出了一种基于Bloom过滤器的在线算法,用于识别IP流量中的大流量(a.k.a.大象)。由于大量的小流,这些算法的哈希表必须定期刷新。认识到技术文献中通常使用的周期性擦除方案在很长一段时间内使用真实的流量跟踪时是相当低效的,我们引入了一个简单的自适应方案,密切关注流量的变化。当测试对真实的交通痕迹,建议的在线算法表现良好的意义上说,在很长一段时间内的算法的检测率长流量是相当高的。除了大象的识别之外,这类算法还应用于IP流量中异常检测的密切相关问题,例如,例如,由于攻击而导致的SYN洪水。设计了一种检测网络流量中SYN和流量泛滥异常的算法。实验表明,在不到一分钟的时间内检测到异常,同时识别出目标目的地。

英文摘要:

We propose in this paper an on-line algorithm based on Bloom filters for identifying large flows in IP traffic (a.k.a. elephants). Because of the large number of small flows, hash tables of these algorithms have to be regularly refreshed. Recognizing that the periodic erasure scheme usually used in the technical literature turns out to be quite inefficient when using real traffic traces over a long period of time, we introduce a simple adaptive scheme that closely follows the variations of traffic. When tested against real traffic traces, the proposed on-line algorithm performs well in the sense that the detection ratio of long flows by the algorithm over a long time period is quite high. Beyond the identification of elephants, this same class of algorithms is applied to the closely related problem of detection of anomalies in IP traffic, e.g., SYN flood due for instance to attacks. An algorithm for detecting SYN and volume flood anomalies in Internet traffic is designed. Experiments show that an anomaly is detected in less than one minute and the targeted destinations are identified at the same time.

机构、总结、中文摘要均由AI分析而来,可能存在错误,请以论文正文为准。

↑