网络测量中的抽样技术研究

发布时间：2018-03-26 00:45

本文选题：流量测量　切入点：抽样　出处：《曲阜师范大学》2014年硕士论文

【摘要】：随着新一代互联网的建设和发展，网络行为变得十分复杂，针对网络的异常攻击也变得更加严重，这些现状在很大程度上威胁着网络的管理和安全。网络测量是对网络性能进行分析和建模的基础，在网络管理中扮演着越来越重要的角色。然而，由于高速网络中数据量较大，获取每个报文信息或者流信息进行存储和测量已变的不可能，且流量存在很大的突变性，给系统资源带来过多的消耗，抽样技术的引入成功的解决了该性能瓶颈问题，成为网络流量工程研究的重点之一。本文首先介绍了网络测量与流量分析技术，阐述高速网络测量中遇到的困难，指出抽样技术在网络测量中的重要作用。接着对抽样技术的详细内容进行概述，讨论了几种常用的抽样方法，系统全面地分析了与抽样测量相关的关键技术和重要算法，如Bloom filter算法和超时策略等。最后，通过研究目前网络特性，本文将抽样技术与Bloom filter算法和动态的超时策略相结合，提出了新的抽样测量算法应用于流量测量中，其中，Bloom filter实现简单，能快速进行资源查找和匹配；超时策略作为判断流输出的标志之一，对流特性的测量精度和流cache的利用率有很大的影响。经性能分析和实验仿真证明，本论文提出的算法能够在提高测量准确性的同时，，提高系统的资源利用率。具体研究内容如下：（1）本文对Bloom filter算法和改进的CBF算法进行了深入研究，针对目前CBF算法在流量过大时会造成计数器溢出的缺陷，设计了一种动态计数型布鲁姆过滤器（DCBF）算法。该算法使用了多层CBF，可在流量较大时自适应增加新的CBF，防止CBF溢出造成测量误差。将DCBF与基于报文的流抽样算法相结合，可以在减少测量个数的同时提高测量精度。通过实验仿真对该算法与基于CBF和FCBF的抽样算法进行了测量误差方面的比较，分析可知，本文提出的算法提高了抽样的准确性，降低了空间利用率。（2）随着网络规模的不断扩张，网络流量的特征变得异常复杂且难以预测，静态的抽样方法已不能满足高速网络测量的要求。本文提出了一种自适应流抽样算法，该算法利用时间对报文进行分层，在层内使用固定的最大数量的抽样，这样可以在网络流量较小时保持测量准确性，而在流量剧增时保证资源的可控性。然后，针对固定超时策略在网络测量应用中存在的缺陷，采用了两层自适应超时（TSAT）策略来控制流的输出。TSAT策略采用了两层流空间，为系统中广泛存在的单包流维护独立的流空间，并对其使用较小超时。通过对该算法与基于NetFlow的抽样算法进行仿真比较，验证了算法具有自适应性、较高的准确性和资源可控性。
[Abstract]:With the construction and development of the new generation of Internet, the network behavior becomes very complex, and the abnormal attacks against the network become more serious. Network measurement is the basis of network performance analysis and modeling, and plays an increasingly important role in network management. However, because of the large amount of data in high-speed network, network measurement plays a more and more important role in network management. It is impossible to obtain every message information or stream information to store and measure, and there is a great mutation of traffic, which brings excessive consumption to system resources. The introduction of sampling technology successfully solves the performance bottleneck problem. It has become one of the emphases of network traffic engineering. This paper first introduces the network measurement and flow analysis technology, expounds the difficulties encountered in high-speed network measurement, points out the important role of sampling technology in network measurement, and then summarizes the detailed contents of sampling technology. Several common sampling methods are discussed, and the key technologies and important algorithms related to sampling measurement, such as Bloom filter algorithm and timeout strategy, are systematically analyzed. In this paper, we combine sampling technique with Bloom filter algorithm and dynamic timeout strategy, and propose a new sampling measurement algorithm for traffic measurement, in which Bloom filter is easy to implement and can find and match resources quickly. As one of the criteria for judging the flow output, the measurement accuracy of convection characteristics and the utilization rate of flow cache are greatly affected by the time-out strategy. The performance analysis and experimental simulation show that the proposed algorithm can improve the accuracy of the measurement at the same time. The specific research contents are as follows:. 1) in this paper, the Bloom filter algorithm and the improved CBF algorithm are studied in depth. Aiming at the defects of the current CBF algorithm, when the flow is too large, the counter overflow will be caused. In this paper, a dynamic counting Bloom filter (DCBF) algorithm is designed. The algorithm uses multi-layer CBFs, which can adaptively add new CBFs when the flow is large, and prevent CBF overflow from causing measurement error. DCBF is combined with the packet-based stream sampling algorithm. It can reduce the number of measurements and improve the accuracy of measurement. The comparison between this algorithm and the sampling algorithm based on CBF and FCBF is carried out through experimental simulation. The analysis shows that the algorithm proposed in this paper improves the accuracy of sampling. Reduced space utilization. 2) with the continuous expansion of network scale, the characteristics of network traffic become extremely complex and difficult to predict. The static sampling method can no longer meet the requirements of high-speed network measurement. In this paper, an adaptive flow sampling algorithm is proposed. The algorithm uses time to stratify packets, uses a fixed maximum number of samples in the layer, so that the measurement accuracy can be maintained when the network traffic is small, and the controllability of the resource can be guaranteed when the traffic increases sharply. In view of the defects of fixed timeout policy in network measurement, a two-layer adaptive time-out (TSAT) strategy is adopted to control the output of flow. TSAT strategy adopts two-layer flow space to maintain the independent flow space for the widely existing single-envelope flow in the system. By comparing the algorithm with the sampling algorithm based on NetFlow, it is proved that the algorithm is adaptive, accurate and resource controllable.
【学位授予单位】：曲阜师范大学
【学位级别】：硕士
【学位授予年份】：2014
【分类号】：TP393.06

【参考文献】