Supported by the National Grand Fundamental Research 973 Program of China under Grant No.2003CB314804(国家重点基础研究发展规划(973));the National High-Tech Research and Development Plan of China under Grant No.2005AA103011-1(国家高技术研究发展计划(863));the Key Project of Chinese Ministry of Education under Grant No.105084(国家教育部科学技术重点研究项目);the Jiangsu Province Key Laboratory of Network and Information Security under Grant No.BM2003201(江苏省网络与信息安全重点实验室)
基于流特性的测量在网络行为分析中发挥着越来越重要的作用.超时策略作为流识别的主要标志之一,对流特性测量的正确性和性能具有重要的影响.通过对现有流超时策略进行比较和分析,指出这些超时策略的适用范围和存在的问题.在详细分析网络中流长分布和速度测度各项指标的基础上,针对短流占总体流量很大比例的特点,提出了一种动态超时策略(dynamical timeout strategy,简称DToS).该策略通过实时综合分析网络使用状况,针对不同特性的流采用不同的超时方式,从而增加网络测量性能,提高测量系统的资源利用率;并可以有效地感知可能存在的网络异常,启动应急措施,保证测量系统的安全;然后通过理论分析的方法验证该策略的可行性和鲁棒性;最后通过实验论证该超时策略在实际测量中的性能,并进一步分析其适用范围.
The measurements based on flow characteristics have been playing more and more important roles in the analysis of Network Behavior. As a main method of flow recognition, the timeout strategies have a very important impact on the correctness and performance of flow measurement. This paper firstly discusses the state-of-art of flow timeout strategies, and points out where they are applicable and their shortcomings. To deal with the short flows that take a large part of the total flows in the networks, the paper presentes a Dynamical Timeout Strategy (DToS) based on the analysis of flows’ length distribution and flows’ rate metrics in detail. This method could improve the performances of network measurement and the efficiency of the resource usage in measurement systems by using different timeout strategies dealing with flows that have different rate features based on analyzing the usage of target network. It could also apperceive network abnormal behavior efficiently, and trigger emergent methods to ensure the safety of measurement system. After that the feasibility and robustness of this method are analyzed. At last, some experiments are employed to show the rationality of DToS strategy. The fitness area of strategy is also anatomized in the paper.