基于自动机的TCP流识别算法

发布时间：2018-03-01 12:04

本文关键词： 流识别 TCP 自动机属性识别度流超时　出处：《电子学报》2017年06期 　论文类型：期刊论文

【摘要】：为提升网络流识别性能,本文提出了一种TCP流识别算法.该算法基于传输控制协议(Transmission Control Protocol,TCP)下网络通信双方的交互过程构建双向流自动机,由该自动机根据TCP协议规则和网络流当前状态判断TCP流终止,同时以基于规则的过滤机制和超时策略为辅助措施,快速识别单包流和异常中断流.该算法内存开销、计算和内存总开销均低于经典算法固定超时策略(Fixed Timeout strategy,FT)和同类代表性算法两层自适应超时策略(Two-level Self-Adaptive Timeout,TSAT),同时该算法精度高于TSAT,且仅比默认精度标准略有下降.该算法基于协议规则识别TCP流,既保证了流的准确性,又节省了流的超时等待时间,而且算法尤其适合中流、小流和不规则TCP流比重较大的情况,使得识别系统在面临DDo S攻击、蠕虫爆发等网络异常时仍能正常运行.
[Abstract]:In order to improve the recognition performance of the network flow, this paper proposes a TCP flow identification algorithm. This algorithm is based on the transmission control protocol (Transmission Control Protocol, TCP) the interaction process of network communication on both sides of the construction of a two-way flow by the automaton, automaton according to the rules of TCP agreement and the current state of network flow TCP flow at the same time to judge the termination of rule filtering mechanism the timeout strategy based on auxiliary measures. The rapid identification of single packet flow and abnormal flow interruption. The algorithm memory overhead, computation and memory overhead are lower than the classical algorithm (Fixed Timeout fixed timeout strategy strategy, FT) and similar representative algorithm of two layer adaptive timeout strategy (Two-level Self-Adaptive Timeout, TSAT), and at the same time the accuracy is higher than TSAT, and only slightly lower than the default accuracy standard. This algorithm based on TCP protocol rule recognition flow, both to ensure the accuracy of the flow, and save the current super When waiting time, and the algorithm is especially suitable for intermediate flow, the larger proportion of small flow and irregular TCP flow makes the recognition system still run normally when facing network anomalies such as DDo S attack and worm outbreak.

【作者单位】：东南大学计算机科学与工程学院;河南科技大学信息工程学院;
【基金】：国家重点基础研究发展规划(973计划)项目(No.2009CB320505) 国家科技攻关计划基金资助项目(No.2008BAH37B04)
【分类号】：TP301.1;TP393.06

【相似文献】