VBF超点检测算法的改进研究

发布时间：2018-04-03 23:19

本文选题：超点　切入点：网络测量　出处：《大连海事大学》2017年硕士论文

【摘要】：互联网的应用越来越广泛,可随之而来的网络攻击也日益严重,例如分布式拒绝服务攻击和蠕虫病毒攻击。因此,对于网络管理员来说,能够实时地识别出网络攻击是一个重要而且具有挑战性的任务。一个被感染的主机可能会在短时间内向不同的目的主机发送大量的连接请求,这样的主机被称为超点。超点检测可以应用到流量工程和异常检测中。本文总结了几个现有的超点检测算法,并特别分析了 VBF的性能,而且改进了 VBF超点检测算法。本文提出了三种改进算法,第一种改进将IP捣碎技术加入VBF算法,该算法在准确性上得到了提高;第二种改进是对VBF中哈希函数进行改进的算法,该算法在时间效率上得到了提高;第三种改进是对VBF中过滤函数进行改变的算法,该算法使空间占用得到了减少。三种改进算法均包含两个主要的模块,即在线更新模块和离线统计模块。在线更新模块中,加入了 IP捣碎技术,可以使IP分布均匀,减少哈希冲突。三种算法使用不同个数的二维比特数组来记录经过的流,在离线统计阶段,利用更新过后的二维数组来提取具有原主机信息的比特串,通过合并重叠位的算法来还原IP地址信息,再通过IP捣碎技术将还原的源IP进行可逆变换。本文对还原过程中会产生的噪音值δ进行了推导,因此在估计主机基数时,进行了去噪处理,最后得到估计值,并将估计值大于阈值的主机认定为超点。本文使用不同地区采集到的真实的网络Trace进行实验,实验结果表明了提出的算法可以准确地检测出超点,而且不需要占用很大的存储空间,处理每个报文的时间效率也很高。
[Abstract]:The application of the Internet is becoming more and more extensive, but the following network attacks, such as distributed denial of service attacks and worm attacks, are becoming more and more serious.Therefore, it is an important and challenging task for network administrators to identify network attacks in real time.An infected host may send a large number of connection requests to different destination hosts in a short period of time.Super point detection can be applied to traffic engineering and anomaly detection.This paper summarizes several existing super-point detection algorithms, especially analyzes the performance of VBF, and improves the VBF super-point detection algorithm.In this paper, three improved algorithms are proposed, the first is to add IP mashing technology to VBF algorithm, the other is to improve the accuracy of the algorithm, and the second is to improve the hashing function in VBF.The time efficiency of the algorithm is improved, and the third is the algorithm to change the filter function in VBF, which reduces the space consumption.The three improved algorithms include two main modules: online update module and off-line statistical module.In the online update module, IP mashing technology is added, which can make IP distributed evenly and reduce hash conflicts.The three algorithms use different numbers of two-dimensional bit arrays to record the passing stream. In the off-line statistical stage, the updated two-dimensional array is used to extract the bits string with the original host information.The algorithm of merging overlapped bits is used to restore the IP address information, and the reversibility of the restored source IP is realized by IP tamping technology.In this paper, the noise value 未 produced during the reduction process is deduced, so the noise value 未 is removed when estimating the base number of the host, and the estimated value is finally obtained, and the host computer whose estimated value is greater than the threshold value is considered as a super point.In this paper, the real network Trace collected from different regions is used to carry out experiments. The experimental results show that the proposed algorithm can accurately detect excess points, and it does not need to take up a lot of storage space, and the time efficiency of processing each packet is also very high.
【学位授予单位】：大连海事大学
【学位级别】：硕士
【学位授予年份】：2017
【分类号】：TP393.08

【相似文献】