对数无限可分级串框架下的异常网络流量分析

湍流尺度分析中的对数无限可分级串方法具有描述数据流全范围下的多尺度行为的优点,可用于对网络流量的多尺度行为的分析。在对几组正常流量和含蠕虫的异常流量分析讨论的基础上,发现受数据流内含协议数据的成分变化的影响,正常流量的多尺度分段点具有不确定性;而受W32／Blaster蠕虫影响的数据流的尺度特性符合幂律关系,即尺度不变性;W32／Nachi蠕虫不影响TCP数据流的尺度特性。     

检测使用Web反射器的攻击

攻击者在大规模DDoS网络攻击中使用反射器向受害者发送洪水包,Web服务器被攻击者利用为TCP反射器不仅加剧了网络攻击的程度,也消耗了正常Web服务资源。分析了Web反射器所在网络的入出口流量特点,以及攻击者利用Web反射器发起攻击时的数据包特性,利用流入和流出反射器网络TCP数据包的特性,通过对网络流量的异常统计检测和实时在线分析来检测Web反射器。模拟实验表明,可以检测出利用Web服务器进行的大规模DRDoS攻击。     

基于小波变换的实际网络流量刻画

大量研究结果表明实际网络流量具有明显的尺度特性,在大尺度上表现出自相似,在小尺度上表现出多重分形.多重分形为刻画流量在小尺度上的奇异性提供了良好的数学框架,而小波变换对具有长程依赖性的流量起到了去相关的作用,因此有必要利用小波技术来研究多重分形.同时网络流量的多尺度特性也为研究人员提供了新的方法来探讨流量本质特征.本文基于小波技术研究实际网络流量,首先从全局尺度和局部尺度上分析流量特征,确定产生分形的时间.然后比较多媒体流量和数据型流量在不同尺度下所表现出的性能,并且给出了产生这种现象的原因.     

尺度变换下Internet流量的Gamma特征

网络流量特征分析与研究对流量产生和流量工程具有重要意义.现有工作集中在特定尺度下考察分析.基于不同地点采集得到的流量集合,采用尺度变换的方法,以时间间隔与数据包个数作为尺度变换的对象,分析不同粒度下流量特征,发现网络流量在特定尺度范围之上满足Gamma分布的特征.且在传输层上表现有所不同,TCP流量在特定尺度范围之上满足Gamma分布,UDP流量则在任何尺度都无明确的统计分布特征.     

基于收发平衡判定的TCP流量回放方法

基于真实网络流量的互动式回放测试是当前针对防火墙、IPS等串接型安全设备进行测评的最新方法.文中在分析现有基于状态判定的TCP流量互动式回放方法基础之上,引入收发平衡机制,提出了一种基于收发平衡和状态判定相结合的新的TCP流量回放方法.通过在发送TCP数据包前优先进行收发平衡判定将数据包发送出去,提出的方法能够有效减少TCP流量在发送过程中的状态判定开销,提高回放性能.对引入收发平衡机制前后的TCP流量回放方法的差异进行了分析比较.从单个TCP会话特性、并发会话流量特性、网络传输延迟与丢包等角度分析验证了影响引入收发平衡机制后的算法有效性的因素.实际流量实验表明,文中所提方法在回放TCP流量时性能有显著提升,适用于在更大规模的流量环境下对防火墙、IPS等串接型网络安全设备进行测评.     

Netfilter/Iptables框架下基于TCP滑动窗口的串行流量控制算法

传统的基于流量整形的流量控制算法通常需要建立对应的队列模型,实施起来极为复杂,而且所有数据包都要进入整形队列,加大了网络延时。本文从TCP协议拥塞控制和数据包组包机制出发,提出了基于TCP滑动窗口的串行流量控制算法,通过改变TCP发送端窗口的大小来达到流量控制的目的。本文在Linux内核Netfilter/iptables框架中实现了该流量控制方法,在部署的网络环境中,比较了不同参数设置下的算法效果。与CBQ算法相比,该方法降低了数据包在队列中排队整形的延时。     

不同背景流量下TCP吞吐量的主动测量及分析

为了进行网络性能评估，在专用网络实验平台上开发了主动测量TCP吞吐量的工具NetThruput，并利用此工具在不同背景流量下测量端到端的TCP吞吐量；分析了TCP和UDP背景流量以及TCP连接的个数等因素对TCP吞吐量测量的影响；区分了TCP吞吐量和可用带宽。     

基于MVC设计模式的电子商务Web应用框架

在介绍Web应用关键技术的基础上,引入了基于MVC设计模式的电子商务应用框架,并对该应用框架的可重用性、安全性及支持多类型用户界面等特性进行了分析。     

多跳Ad Hoc网络TCP拥塞控制改进方案

为改进传输控制协议TCP在无线移动网络环境下的通信性能,减少网络拥塞,分析了Ad Hoc网络Web通信时数据丢失的主要原因,提出了利用探测包探测网络传输性能重新划分网络状态的方法来改进TCP拥塞控制.仿真结果表明,改进后的TCP拥塞控制机制能够明显提高无线多跳Ad Hoc网络环境下Web通信的性能,避免拥塞.     

支持Web服务组合与验证的形式化模型

针对Web服务的组合与验证问题,在范畴理论描述框架的基础上,引入进程代数描述服务组件的外部行为,为Web服务系统的架构描述建立了一种形式化的语义模型。Web服务作为范畴理论中的对象节点,服务间的交互和组合关系作为态射,从而以范畴图表的形式来描述服务网络。在形式化定义服务接口、Web服务、服务组合等概念的基础上,进一步分析讨论了服务组合和交互过程中的语义特性,给出了Web服务可替代性和服务请求可满足性的形式化定义。实例研究表明,该框架增强了Web服务架构的语义描述能力。     

TCP流量的多尺度分析

基于小波技术对多组局域网和广域网流量的实测数据进行了全局缩放性质和局部缩放性质的研究。讨论了分形高斯噪声模型和多分形小波模型。在全局缩放性质的研究中，讨论了一类Hurst参数估计器．并将实际数据与分形高斯噪声模型相比较，发现大时间尺度上的网络流量可以用分形高斯噪声来近似。在局部缩放性质的研究中，分析了局部缩放指数及相应的结构函数．并将实际数据与多分形小波模型相比较，发现在小时间尺度上，无论是分形高斯噪声还是多分形小波模型都不能很好地近似网络流量，大小时间尺度的划分在典型的往返时间附近。     

Analysis and modeling of a campus wireless network TCP/IP traffic

In this paper we analyzed and modeled wireless TCP/IP traffic. Specifically, we focused on the interarrival times of TCP flows and the number of packets within a flow. We show that the marginal distribution of the flow interarrival times is piecewise Weibull distributed. Second and higher order statistics show that the flow interarrival times are long-range dependent and exhibit multifractal scaling. Taking these higher order properties into consideration, we proposed a multinomial canonical cascade with 3 stages to model the flow interarrival times. Looking at the IP layer, we find that the number of packets in a flow is heavy-tailed distributed. Especially interesting is that in 2 of our data sets, the number of packets in a flow possesses infinite mean. The interarrival time of packets within a flow is highly correlated, bursty, and its statistical characteristics vary from flow to flow.     

Passive analysis of TCP anomalies

In this paper, we focus on passive measurements of TCP traffic. We propose a heuristic technique to classify TCP anomalies, i.e., segments that have a sequence number different from the expected one, such as out-of-sequence and duplicate segments. Since TCP is a closed-loop protocol that infers network conditions from packet losses and reacts accordingly, the possibility of carefully distinguishing the causes of anomalies in TCP traffic is very appealing and may be instrumental to understand TCP behavior in real environments. We apply the proposed heuristic to traffic traces collected at both network edges and backbone links. By comparing results obtained from traces collected over several years, we observe some phenomena such as the impact of the introduction of TCP SACK which reduces the unnecessary retransmissions, the large percentage of network reordering, etc. By further studying the statistical properties of TCP anomalies, we find that, while their aggregate exhibits long-range dependence, anomalies suffered by individual long-lived flows are on the contrary uncorrelated. Interestingly, no dependence on the actual link load is observed.     

TCP flow control technique for an interworking interface: hardware implementation

Current TCP flow control depends on packet losses to find the workload that a network can support. A variety of situations, including lossy wireless networks, asymmetric networks and web traffic workload, violates many of the assumptions made by TCP, causing degraded end-to-end performances. To improve the performance of TCP over heterogeneous networks (Ethernet and ATM interconnection), we propose a new technique, which we call Vegas–Snoop+, based on Vegas and Snoop protocols. Two modified service elements take part on the Vegas–Snoop+ technique. First, Vegas service element manages the connection parameters to achieve better throughput. Second, Snoop service element isolates the Ethernet senders from the characteristics of the ATM link. The objective in this paper is to win from advantages of Vegas and Snoop protocols, as well as to search an interconnection interface for networks interoperability. Actually, the development of two new integrated circuits (the BCM5680 (switch) and the BCM5401 (PHY)) orientate researchers to implement, at higher layer of the OSI model, flow control mechanisms to ensure reliability. Vegas–Snoop+ is an implementation of TCP, which gives in this way a solution for traffic management and congestion control improving good throughput with more reliability.     

Utility function of TCP

Understanding the TCP congestion control mechanism from a global optimization point of view is not only important in its own right, but also crucial to the design of other transport layer traffic control protocols with provable properties. In this paper, we derive a global utility function and the corresponding optimal control law, known as TCP control law, which maximizes the global utility. The TCP control law captures the essential behaviors of TCP, including slow start, congestion avoidance, and the binary nature of congestion feedback in TCP. We find that the utility function of TCP is linear in the slow start phase and is proportional to the additive increase rate and approaches the well-known logarithm function as the data rate becomes large in the congestion avoidance phase. We also find that understanding the slow start phase with a fixed threshold is critical to the design of new transport layer control protocols to enable quality of service features. Finally, as an application, we design a Minimum Rate Guaranteed (MRG) traffic control law that shares the same utility function as the TCP control law. Our simulation study of the MRG control law indicates that it is indeed TCP friendly and can provide minimum rate guarantee as long as the percentage of network resource consumed by the MRG flows is moderately small.     

TCP with gateway adaptive pacing for multihop wireless networks with Internet connectivity

This paper introduces an effective congestion control pacing scheme for TCP over multihop wireless networks with Internet connectivity. The pacing scheme is implemented at the wireless TCP sender as well as at the Internet gateway, and reacts according to the direction of TCP flows running across the wireless network and the Internet. Moreover, we analyze the causes for the unfairness of oncoming TCP flows and propose a scheme to throttle aggressive wired-to-wireless TCP flows at the Internet gateway to achieve nearly optimal fairness. The proposed scheme, which we denote as TCP with Gateway Adaptive Pacing (TCP-GAP), does not impose any control traffic overhead for achieving fairness among active TCP flows and can be incrementally deployed since it does not require any modifications of TCP in the wired part of the network. In an extensive set of experiments using ns-2 we show that TCP-GAP is highly responsive to varying traffic conditions, provides nearly optimal fairness in all scenarios and achieves up to 42% more goodput for FTP-like traffic as well as up to 70% more goodput for HTTP-like traffic than TCP NewReno. We also investigate the sensitivity of the considered TCP variants to different bandwidths of the wired and wireless links with respect to both aggregate goodput and fairness.     

Stochastic TCP friendliness: Expanding the design space of TCP-friendly traffic control protocols

While the current definition of TCP friendliness has enabled a wide variety of traffic control protocols other than TCP, it still considerably restricts the design space of TCP-friendly traffic control protocols. For example, some multimedia streaming applications prefer a smooth sending rate on a time scale of tens of seconds, however, a UDP flow maintaining such a long smoothness time scale is naturally not TCP friendly by the current definition. In this paper, we propose an innovative method to relatively compare the degrees of TCP friendliness of different traffic control protocols, and use it to define a new class of TCP friendliness definitions, called stochastic TCP friendliness (STF). STF greatly expands the design space of TCP-friendly traffic control protocols, while still effectively maintaining the desired fairness of the Internet. To demonstrate the expanded design space, we also develop a new congestion control protocol, called TCP-friendly CBR-Like Rate Control (TFCBR), for multimedia streaming applications which do not require a high sending rate but prefer a smooth sending rate on a time scale of tens of seconds. TFCBR is stochastically TCP friendly, however, it is not TCP friendly by the current definition.     

A three-dimensional probabilistic fuzzy control system for network queue management

A novel probabilistic fuzzy control system is proposed to treat the congestion avoidance problem in transmission control protocol （TCP） networks. Studies on traffic measurement of TCP networks have shown that the packet traffic exhibits long range dependent properties called self-similarity, which degrades the network performance greatly. The probabilistic fuzzy control （PFC） system is used to handle the complex stochastic features of self-similar traffic and the modeling uncertainties in the network system. A three-dimensional （3-D） membership function （MF） is embedded in the PFC to express and describe the stochastic feature of network traffic. The 3-D MF has extended the traditional fuzzy planar mapping and further provides a spatial mapping among ＂fuzziness-randomness-state＂. The additional stochastic expression of 3-D MF provides the PFC an additional freedom to handle the stochastic features of self-similar traffic. Simulation experiments show that the proposed control method achieves superior performance compared to traditional control schemes in a stochastic environment.     

Weblins: A scalable WWW cluster-based server

With the ever-growing web traffic, cluster-based web servers have become very important to the Internet infrastructure. Thus, making the best use of all available resources in the cluster to achieve high performance is a significant research issue. In this paper, we present Weblins, a cluster-based web server that can achieve good throughput. Weblins has Gobelins operating system as platform. Gobelins is an efficient single system image operating system that transparently makes use of the resources available in the cluster. The architecture of Weblins is fully distributed. Weblins implements a content-aware request distribution policy via a new interface on top of Gobelins. Popular web files are dynamically replicated on all nodes via a cooperative caching mechanism. For the non-popular files, the requests are handed-off to the corresponding nodes via the TCP Handoff protocol. Simulation results show that the strategy used by Weblins is more suitable for cluster-based Web severs in comparison with pure content-aware strategy and pure cooperative caching strategy.