基于掩码匹配的IP网络抽样测量系统的设计和实现

随着高速网络技术的发展和普及,面向高速网络的流量抽样测量技术成为研究热点之一。文章首先归纳和比较了网络抽样测量技术的各种类别;然后系统介绍了基于掩码匹配的网络抽样测量技术;并详细阐述了基于掩码匹配的网络抽样测量系统的设计和实现方法。     

IP网络抽样测量技术及其应用

随着高速网络技术的发展和普及,传统的网络被动测量方式不再可行,使得面向高速网络的流量抽样测量技术成为研究热点之一.文章首先归纳和比较了网络抽样测量技术的各种类别.然后,详细论述了基于掩码匹配的网络抽样测量技术.最后,介绍了IP网络抽样技术的主要应用并给出了结论.     

基于抽样流长与完全抽样阈值的异常流自适应抽样算法

高速IP网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计精度偏低,对异常流量筛选能力较差的缺陷,该文提出一种基于业务流已抽样长度与完全抽样阈值S的自适应流抽样算法(AFPT)。AFPT算法根据完全抽样阈值S筛选对异常流量敏感相关的小流,同时根据业务流已抽样长度自适应调整抽样概率。仿真和实验结果表明,AFPT算法的估计误差与理论上界相符,具有较强的异常流量筛选能力,能够有效提高异常检测算法的准确率。     

基于抽样和哈希技术的长流测量算法研究

在互联网中理解网络行为最高效的途径即是对网络数据流量进行检测与分析,它是对已有互联网的组建、规范化和改造的依据,同时也是对Internet进行检测的重要环节.为了解决网络中的资源和高速IP流量之间的冲突问题,需要对网络流进行多种方式的处理与算法研究.本文首先提出了改进的数据抽样技术并综合论述了现阶段基于抽样技术的数据测量算法的研究.同时通过对重要数据参数的重新设置和分析,并结合使用多种数据取样的方法,探讨改进的数据空间映射技术与现阶段的各种取样方式在测量网络长流算法中的综合应用.     

生物序列模体的混合Gibbs抽样识别算法

针对生物序列模体的识别问题,提出了一个新的混合Gibbs抽样识别算法.算法基于混合模体模型学习,采用贪心策略,通过似然度最大化,逐次将新的模体加入到混合模型中.算法中设计了位点抽样和模体抽样两种抽样方法,这两种抽样方法交替进行.为了加速搜索过程,对输入数据集采用了基于kd-trees的分层划分策略.实验结果表明,该算法对序列家族大量模体特征的识别具有显著优势,并且可建立更具统计特征的模体模型,从而提高序列分类的准确性.     

基于实时分析的网络测量抽样统计模型

由于网络通信量具有自相似性,传统的网络测量抽样方法如均匀抽样、泊松抽样容易与真实数据产生比较大的误差.本文提出了一种基于实时分析的网络抽样统计模型（NMSM）,在数据采集过程中,实时分析样本的变化特征,动态调整采集频率,最好程度的完成数据抽样采集.实验证明,NMSM模型在网络变化比较平稳时,对网络的影响程度最低,在网络变化比较大时,对真实数据的拟合程度最好.     

一种面向流量异常检测的概率流抽样方法

针对基于概率抽样的网络流量异常检测数据集构造过程中无法同时兼顾大、小流抽样需求及未区分flash crowd与流量攻击等问题,该文提出一种面向流量异常检测的概率流抽样方法。在对数据流按目的、源IP地址进行分类的基础上,将每类数据流抽样率定义为其目的、源IP地址抽样率的最大值,并在抽样过程中对数据流抽样数目向上取整,保证每类数据流至少被抽样一次,使抽样得到的数据集可有效反映原始流量在大、小流和源、目的IP地址方面的分布性。采用源IP地址熵刻画异常流源IP地址分散度,并基于源IP地址熵阈值设计攻击流抽样算法,降低由flash crowd引起的非攻击异常流抽样概率。仿真结果表明,该方法能同时满足大、小流抽样需求,具有较强的异常流抽样能力,可抽样到所有与异常流相关的可疑源、目的IP地址,并能在抽样过程中过滤非攻击异常流。     

基于马氏抽样的SVM非平衡数据分类算法的泛化性能研究

本文将样本为独立同分布的情形减弱为一致遍历马氏链的情形去研究了非平衡数据分类算法的泛化性能,提出了基于马氏抽样的SVM非平衡数据分类算法、基于马氏抽样的EDSVM非平衡数据分类算法和基于马氏抽样的SVM-WKNN非平衡数据分类算法.并用UCI数据库中的10个实际不平衡数据集进行数值实验,实验结果表明基于马氏抽样的上述三种算法的错分率均比基于随机抽样的对应算法的错分率要低,且上述三种算法中,基于马氏抽样的SVM-WKNN非平衡数据分类算法的泛化性能最好.     

无线传感器网络中基于双阈值的分布式监测算法

基于单阈值的监测算法降低了警报的准确率,因此研究基于双阈值的监测方法,即带有概率保证的约束违反的监测具有重要意义.首先,基于监测结果的概率阈值语义,研究了节点的双阈值监测问题.其次,给出了感知数据大于监测阈值的概率的紧上界,提出了基于双阈值的分布式监测算法.第三,给出了根据精度要求确定优化样本容量的数学方法,提出了基于抽样的近似簇监测算法.理论分析和实验结果验证了提出的监测算法的高效性.     

一种基于大小流区分计数的公平抽样算法

针对一种草图指导公平抽样(SGS)算法对小流估计误差大的问题,该文提出一种基于大小流区分计数的包公平抽样算法(DCMFS),并给出哈希冲突对SGS算法估计误差影响的定量分析结果。DCMFS采用大小流区分计数器,对小流采用逐流精确计数,对大流采用哈希计数。理论分析及实际的数据仿真结果均表明,DCMFS算法对小流能够实现逐流精确统计,对大流的估计标准差接近公平抽样估计标准差理论值上限。算法采用不等长位宽计数器结构,保证其空间复杂度较SGS和自适应非线性抽样方法(ANLS)没有增加;引入计数器置换使得算法时间复杂度略有提高,但仍能满足10 Gbps线速处理要求。     

SEAL2: An SDN‐enabled all‐Layer2 packet forwarding network architecture for multitenant datacenter networks

This paper presents the design and development of a new network virtualization scheme to support multitenant datacenter networking (MT‐DCN) based on software‐defined networking (SDN) technologies. Effective multitenancy supports are essential and challenging for datacenter networking designs. In this study, we propose a new network virtualization architecture framework for efficient packet forwarding in MT‐DCN. Traditionally, an internet host uses IP addresses for both host identification and location information, which causes mobile IP problems whenever the host is moved from one IP subnet to another. Unfortunately, virtual machine (VM) mobility is inevitable for cloud computing in datacenters for reasons such as server consolidation and network traffic flow optimization. To solve the problems, we decouple VM identification and location information with two independent values neither by IP addresses. We redefine the semantics of Ethernet MAC address to embed tenant ID information to the MAC address field without violating its original functionality. We also replace traditional Layer2/Layer3 two‐stage routing schemes (MAC/IP) with an all‐Layer2 packet forwarding mechanism that combines MAC addresses (for VM identification and forwarding in local server groups under an edge switch gateway) and multiprotocol label switching (MPLS) labels (for packet transportation between edge switch gateways across the core label switching network connecting all the edge gateways). To accommodate conventional IP packet architecture in a multitenant environment, SDN (OpenFlow) technology is used to handle all this complex network traffics. We verified the design concepts by a simple system prototype in which all the major system components were implemented. Based on the prototype system, we evaluated packet forwarding efficiency under the proposed network architecture and compared it with conventional IP subnet routing approaches. We also evaluated the incurred packet processing overhead caused by each of the packet routing components.     

Demonstration of 100 Gbps optical packet switching using header processor based on 48-bit longest prefix matching

Wire-rate packet processing and its energy saving for over 100 Gbps speed of line are major issues to be resolved in optical packet switching (OPS) networks. For that purpose, we newly develop a high-speed, deterministic-latency electronic header processor based on longest prefix matching (LPM) for searching optical packet destination addresses (OP-DAs). This paper reports the successful experimental results of electronic header processing based on LPM search of up to 48 bits and optical switching of 100 Gbps optical packets by the use of the header processor. We demonstrate 48-bit LPM-capable optical packet switching. We also demonstrate IP packet transfer and 32-bit LPM-capable optical packet switching. In the latter demonstration, the 32-bit OP-DA of optical packets is directly copied from the 32-bit destination address of Internet Protocol version 4 (IPv4) packets. This result indicates that OPS networks can be deployed with electronic IP networks by the use of integrated network operation between OPS and IP networks.     

一种新的端到端采样网络流量测量方法

本文主要对端到端采样测量方法进行了研究,在大量实验的基础上提出了IP包头标识字段取模采样方法,并利用该采样方法进行了模拟实验,结果证明该方法具有效率高,采样比率易控制等特点。     

Learn more, sample less: control of volume and variance in network measurement

This paper deals with sampling objects from a large stream. Each object possesses a size, and the aim is to be able to estimate the total size of an arbitrary subset of objects whose composition is not known at the time of sampling. This problem is motivated from network measurements in which the objects are flow records exported by routers and the sizes are the number of packet or bytes reported in the record. Subsets of interest could be flows from a certain customer or flows from a worm attack. This paper introduces threshold sampling as a sampling scheme that optimally controls the expected volume of samples and the variance of estimators over any classification of flows. It provides algorithms for dynamic control of sample volumes and evaluates them on flow data gathered from a commercial Internet Protocol (IP) network. The algorithms are simple to implement and robust to variation in network conditions. The work reported here has been applied in the measurement infrastructure of the commercial IP network. To not have employed sampling would have entailed an order of magnitude greater capital expenditure to accommodate the measurement traffic and its processing.     

报文抽样测量技术及应用

报文抽样技术是高速网络流量测量和网络QoS管理中使用的一项关键技术。本文从报文抽样的数学理论出发,对数学推导的重要结论进行了讨论和分析;然后在研究了当前各种报文抽样策略、机制及简单性能衡量之后,分析了当前的报文抽样技术发展现状;随后对报文抽样的新进展进行了讨论;最后阐述了报文抽样技术的发展趋势及其在现代网络测量、管理中的应用情况。     

基于SIP协议的VoIP网关的设计和实现

在传统方式下,话音业务和数据业务是由两个互相独立的网络———公共电话交换网(PSTN)和数据通信网分别提供的。公共电话交换网基于电路交换的结构,这种技术保证语音有优良的品质,但同时也给PSTN带来线路资源分配方案的效率低和通话传真成本高的局限性。数据通信网则是基于包交换,由于采用了简单健壮的IP协议,使得其在这几年发展迅速。分析了目前在IP通信领域的两大主流协议H.323和SIP的特点和差异,给出了对支持SIP协议的VOIP网关的软硬件设计方案。     

软件定义网络中基于密码标识的报文转发验证机制

针对软件定义网络(SDN)中缺乏安全高效的数据来源验证机制问题,该文提出基于密码标识的报文转发验证机制。首先,建立基于密码标识的报文转发验证模型,将密码标识作为IP报文进出网络的通行证。其次,设计SDN批量匿名认证协议,将SDN控制器的验证功能下放给SDN交换机,由SDN交换机进行用户身份验证和密码标识验证,快速过滤伪造、篡改等非法报文,提高SDN控制器统一认证与管理效率,同时可为用户提供条件隐私保护。提出基于密码标识的任意节点报文抽样验证方案,任何攻击者无法通过推断采样来绕过报文检测,确保报文的真实性的同时降低其处理延迟。最后,进行安全性分析和性能评估。结果表明该机制能快速检测报文伪造和篡改及抵抗ID分析攻击,但同时引入了大约9.6%的转发延迟和低于10%的通信开销。     

TCP-friendly flow control of wireless multimedia using ECN marking

In a wireless network packet losses can be caused not only by network congestion but also by unreliable error-prone wireless links. Therefore, flow control schemes which use packet loss as a congestion measure cannot be directly applicable to a wireless network because there is no way to distinguish congestion losses from wireless losses. In this paper, we extend the so-called TCP-friendly flow control scheme, which was originally developed for the flow control of multimedia flows in a wired IP network environment, to a wireless environment. The main idea behind our scheme is that by using explicit congestion notification (ECN) marking in conjunction with random early detection (RED) queue management scheme intelligently, it is possible that not only the degree of network congestion is notified to multimedia sources explicitly in the form of ECN-marked packet probability but also wireless losses are hidden from multimedia sources. We calculate TCP-friendly rate based on ECN-marked packet probability instead of packet loss probability, thereby effectively eliminating the effect of wireless losses in flow control and thus preventing throughput degradation of multimedia flows travelling through wireless links. In addition, we refine the well-known TCP throughput model which establishes TCP-friendliness of multimedia flows in a way that the refined model provides more accurate throughput estimate of a TCP flow particularly when the number of TCP flows sharing a bottleneck link increases. Through extensive simulations, we show that the proposed scheme indeed improves the quality of the delivered video significantly while maintaining TCP-friendliness in a wireless environment for the case of wireless MPEG-4 video.     

基于交互式抗误码技术的H.263编解码器

目前，在IP分组网中进行视频图像的传输正被日益广泛地应用。但是，由于IP分组网固有的特点，IP分组包丢失的现象不可避免并极大地影响了视频传输的服务质量。本文通过对一种使用连续更新来阻止差错传播（RESCU）的交互式抗误码技术进行改进，实现了一种新的交互式抗误码方法。同时，我们根据这种方法实现了一种具有良好差错恢复能力的H．263编解码器，从而改善了因分组包丢失对视频传输质量带来的影响。     

基于信任管理系统的可信路由器的设计与实现(英文)

This paper presents a scheme to perform QoS management and assure network security by using the trusted-router based on the Trust Management System.In this trusted-router,every IP packet is forwarded and queued by its trust value,which is the quantification of the network's expectation for this packet's and its owner's behavior in the network.We outline the algorithms to calculate the trust value of the trusted-router and the IP packet.We also introduce the trust-based QoS management algorithm and the deplo...