基于聚合流缓存的高性能网络应用识别
Towards High-Performance Network Application Identification With Aggregate-Flow Cache
摘要：
根据应用层协议对网络流量进行分类是现代网络中流量管理和网络安全的重要任务。现有的基于有效载荷或统计的应用识别方法不能同时满足高性能和准确识别的需求。我们提出了一个应用程序识别框架，利用聚合流缓存在聚合流级别对流量进行分类。基于该框架设计了一个详细的流量分类器，以提高基于有效载荷的识别方法的吞吐量。我们进一步优化分类器，提出了一个有效的设计聚合流缓存。缓存设计采用了基于频率的，最近意识到更换算法的聚合流缓存的时间局部性分析的基础上。实验表明，我们的流量分类器与聚合流缓存可以减少高达95%的后端识别引擎的工作量。所提出的缓存替换算法优于已知的替换算法，并实现了90%的最佳性能，仅使用15%的内存。通过使用我们的流量分类器设计，基于有效载荷的识别系统L7-filter [1]的吞吐量增加了5.1倍。
英文摘要：
Classifying network traffic according to their application-layer protocols is an important task in modern networks for traffic management and network security. Existing payload-based or statistical methods of application identification cannot meet the demand of both high performance and accurate identification at the same time. We propose an application identification framework that classifies traffic at aggregate-flow level leveraging aggregate-flow cache. A detailed traffic classifier designed based on this framework is illustrated to improve the throughput of payload-based identification methods. We further optimize the classifier by proposing an efficient design of aggregate-flow cache. The cache design employs a frequency-based, recency-aware replacement algorithm based on the analysis of temporal locality of aggregate-flow cache. Experiments on real-world traces show that our traffic classifier with aggregate-flow cache can reduce up to 95% workload of backend identification engine. The proposed cache replacement algorithm outperforms well-known replacement algorithms, and achieves 90% of the optimal performance using only 15% of memory. The throughput of a payload-based identification system, L7-filter [1], is increased by up to 5.1 times by using our traffic classifier design.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
