大流识别是网络测量中的一项关键基础性工作, 目前主流的方法是采用概要型数据结构Sketch快速统计网络流量, 进而高效筛选大流. 然而, 当网络流量发生抖动时, 大量分组的急速涌入将导致大流识别精度显著下降. 对此, 提出一种支持流量抖动的网络大流弹性识别方法RobustSketch. 所提方法首先设计基于Sketch循环链的可伸缩小流过滤器, 根据实时分组到达速率适应性扩增与缩减其中的Sketch数量, 以始终完整记录当前时间周期内所有到达的网络分组, 从而确保网络流量抖动出现时仍能精确过滤小流. 然后设计基于动态分段哈希的可拓展大流记录表, 根据小流过滤器筛选后的候选大流数量适应性增加与减少分段, 以完整记录所有候选大流, 并保持较高的存储空间利用率. 进一步, 通过理论分析给出了所提小流过滤器和大流记录表的误差界限. 最后, 借助真实网络流量样本, 对所提大流识别方法RobustSketch进行实验评估. 实验结果表明: 所提方法的大流识别精确率明显高于现有方法, 即使在网络流量抖动时仍能稳定保持在99%以上, 而平均相对误差减少了2.7倍以上, 有效提升了大流识别的精确性和鲁棒性.

Elephant flow identification is a fundamental task in network measurements. Currently, the mainstream methods generally employ sketch data structure Sketch to quickly count network traffic and efficiently find elephant flows. However, the rapid influx of numerous packets will significantly decrease the identification accuracy of elephant flows under network traffic jitters. To this end, this study proposes an elastic identification method for elephant flows supporting network traffic jitters, which is named RobustSketch. This method first designs a stretchable mice flow filter based on the cyclic Sketch chain, and adaptively increases and reduces the number of Sketch in real-time packet arrival rates. As a result, it always completely records all arrived packets within the current period to ensure accurate mice flow filtering even under network traffic jitters. Subsequently, this study designs a scalable elephant flow record table based on dynamic segmented hashing, which adaptively increases and reduces segments according to the number of candidate elephant flows filtered out by the mice flow filter. Finally, this can fully record all candidate elephant flows and keep high storage space utilization. Furthermore, the error bounds of the proposed mice flow filter and elephant flow recording table are provided by theoretical analysis. Finally, experimental evaluation is conducted on the proposed elephant flow identification method RobustSketch with real network traffic samples. Experimental results indicate that the identification accuracy of elephant flows of the proposed method is significantly higher than that of the existing methods, and can stably keep high accuracy of over 99% even under network traffic jitters. Meanwhile, its average relative error is reduced by more than 2.7 times, which enhances the accuracy and robustness of elephant flow identification.

TP393

国家自然科学基金(62272062, U22B2005, 61972412); 湖南省自然科学基金(2023JJ30053, 2021JJ30456); 湖南省教育厅资助科研项目(22A0232, 22B0300); 国防科技计划(2021-KJWPDL-17); 中央军委装发预研项目(31511010402); 湖南省研究生科研创新资助项目(CX20230913)