本文選題：流量識別 + 流量測量　； 參考：《解放軍信息工程大學(xué)》2015年博士論文

【摘要】：網(wǎng)絡(luò)流量測量與識別,是網(wǎng)絡(luò)管理、網(wǎng)絡(luò)運營、網(wǎng)絡(luò)優(yōu)化和網(wǎng)絡(luò)安全的重要基礎(chǔ),是掌握網(wǎng)絡(luò)運行規(guī)律和理解網(wǎng)絡(luò)行為的支撐技術(shù)。隨著網(wǎng)絡(luò)技術(shù)的不斷發(fā)展,用戶數(shù)量大幅膨脹,鏈路速率快速增長,承載業(yè)務(wù)更加多樣化,信息隱匿技術(shù)廣泛應(yīng)用,導(dǎo)致傳統(tǒng)的基于知名端口號或基于報文載荷的流量識別方法無法滿足高速網(wǎng)絡(luò)流量識別的需求,迫切需要研究有效的網(wǎng)絡(luò)流量測量與識別技術(shù)及策略以應(yīng)對目前及未來網(wǎng)絡(luò)管理面臨的挑戰(zhàn)。高速網(wǎng)絡(luò)中,并發(fā)流數(shù)量巨大而且報文速率高,雖然使用簡單的流量特征與快速的識別算法能夠?qū)崿F(xiàn)對流量的線速處理,但是難以保證流量識別的準(zhǔn)確率；為此,現(xiàn)有的技術(shù)通常采用多特征及構(gòu)建復(fù)雜分類模型的思路,處理復(fù)雜度高,難以滿足實時性的要求；并且當(dāng)前的流量識別技術(shù)沒有考慮各種業(yè)務(wù)的差異化管理要求,不能實現(xiàn)有約束條件的業(yè)務(wù)識別。因此如何處理準(zhǔn)確性與實時性的矛盾是網(wǎng)絡(luò)業(yè)務(wù)在線識別的關(guān)鍵與難點,對不同網(wǎng)絡(luò)業(yè)務(wù)按級別召回是網(wǎng)絡(luò)管理的現(xiàn)實需求。本文依托于國家863計劃重大項目課題“面向三網(wǎng)融合的統(tǒng)一安全管控網(wǎng)絡(luò)”和863計劃主題項目課題“跨網(wǎng)絡(luò)信息安全防護”,針對課題中的網(wǎng)絡(luò)實時識別和控制需求,面向網(wǎng)絡(luò)業(yè)務(wù)識別中流量測量和識別算法兩個核心環(huán)節(jié),從四個方面開展研究,主要工作如下：1.針對高速網(wǎng)絡(luò)流量識別時獲取全部報文代價過大的問題,從報文約減的角度出發(fā),提出基于同源組合布魯姆過濾器的早期流量抽樣算法。該算法利用并發(fā)流量中已結(jié)束抽樣流數(shù)目遠大于正在抽樣流數(shù)目的特點,設(shè)計寬度不同的兩個計數(shù)布魯姆過濾器組合,分別實現(xiàn)“報文計數(shù)”與“抽樣判斷”功能。算法的理論分析表明,調(diào)節(jié)兩個計數(shù)布魯姆過濾器計數(shù)器的寬度比,可使誤判率達到最低。根據(jù)真實流量進行的空間復(fù)雜度與誤判率的實驗證明了算法的有效性。實驗結(jié)果表明：在相同內(nèi)存資源限制條件下,該算法的誤判率顯著低于同類算法；在同樣誤判率指標(biāo)下,與其他算法相比,其內(nèi)存占用至少減少33%。2.針對采用傳統(tǒng)計數(shù)布魯姆過濾器算法檢測大流時,無結(jié)束標(biāo)識的流量導(dǎo)致的空間擁塞問題,提出了基于自適應(yīng)超時計數(shù)布魯姆過濾器的大流檢測算法。該算法設(shè)計了計數(shù)布魯姆過濾器與計時布魯姆過濾器結(jié)合的大流檢測結(jié)構(gòu)。一方面通過計數(shù)器向量記錄流的報文數(shù)量,并判斷大流；另一方面通過計時器向量記錄流最近報文的到達時刻,以便及時將已經(jīng)結(jié)束流占用的計數(shù)器自動清除,從而解決無結(jié)束標(biāo)識的流量導(dǎo)致的空間擁塞問題。在對該結(jié)構(gòu)檢測誤差理論分析的基礎(chǔ)上,提出自適應(yīng)超時機制,根據(jù)鏈路流到達強度與布魯姆過濾器向量空間長度,自適應(yīng)調(diào)整超時時間,使得算法整體錯誤率始終保持在最低范圍。實驗結(jié)果表明：該算法的錯誤率優(yōu)于固定超時算法的最優(yōu)值,并且在占用相同內(nèi)存空間條件下,與其它參考算法相比,該算法準(zhǔn)確率最高。3.傳統(tǒng)流量識別算法無法滿足網(wǎng)絡(luò)業(yè)務(wù)差異化分類精度要求,針對該問題,提出基于優(yōu)先級分類約束的流量識別算法。該算法設(shè)計了基于分類信息熵的決策樹,并提出加權(quán)的悲觀錯誤剪枝,使最終決策樹在進行分類時側(cè)重于優(yōu)先級高的業(yè)務(wù)類別,提高了優(yōu)先級高的業(yè)務(wù)類別的召回率。實驗結(jié)果表明,算法識別結(jié)果與優(yōu)先級約束一致,并且取得建模時間和準(zhǔn)確率的相對平衡。與標(biāo)準(zhǔn)C4.5決策樹算法相比,雖然分類的整體準(zhǔn)確率略低,但是算法對于高優(yōu)先級的業(yè)務(wù)類別召回率明顯高于C4.5算法,能夠滿足差異化分類約束條件,而且F-measure結(jié)果與C4.5算法相當(dāng)。4.針對如何提高在線流量識別的處理速度問題,從流量約減這一新的角度出發(fā),提出一種基于流集的在線流量識別方法。該方法利用相同三元組的流集合具有相同應(yīng)用類別的特點,對流量集合進行在線約減,即只對具有相同三元組流集合中的部分流進行識別,根據(jù)識別的結(jié)果投票得出流集對應(yīng)的業(yè)務(wù)類別。通過理論分析得出分類錯誤率與檢測的流數(shù)量之間的關(guān)系。對算法的分類性能和處理速度進行了實驗驗證,結(jié)果表明：該方法可以與多種算法結(jié)合使用,并且通過選擇合理的分類錯誤率估計閾值,分類準(zhǔn)確率與處理速度方面比參考算法均有大幅提高。
[Abstract]:Network traffic measurement and recognition is the important foundation of network management, network operation, network optimization and network security. It is the support technology to master the law of network operation and understand the behavior of network. With the continuous development of network technology, the number of users is expanding greatly, the link rate is increasing rapidly, the carrying service is more diversified and the information hiding technology is wide. In general, the traditional traffic recognition method based on well-known port number or message based load can not meet the requirement of high speed network traffic recognition. It is urgent to study effective network traffic measurement and recognition techniques and strategies to cope with the challenges facing network management at present and in the future. Although the rate of message is high, it is difficult to ensure the accuracy of traffic identification by using simple traffic characteristics and fast recognition algorithm, but it is difficult to ensure the accuracy of flow recognition. The flow recognition technology does not take into account the differential management requirements of various services and can not realize the business identification with constraints. Therefore, how to deal with the contradiction between accuracy and real-time is the key and difficult point of network business online recognition. The recall of different network services according to the level is the actual requirement of network management. This paper is based on the country 863. The major project, "unified security management network for the integration of three networks" and "cross network information security protection" of the 863 project theme project, aims at the real-time recognition and control requirements of the network and two core links of traffic measurement and recognition algorithms in network business recognition, mainly from four aspects. The following work is as follows: 1. the early traffic sampling algorithm based on the homologous combination Bloom filter is proposed in view of the problem that the high speed network traffic recognition is too expensive to obtain all the cost of the message. The algorithm uses the homologous combination Bloom filter for the early flow sampling algorithm. Different two counting Bloom filters are combined to realize the function of "message counting" and "sampling judgment" respectively. The theoretical analysis of the algorithm shows that the error rate can be lowest by adjusting the width ratio of the two counting Bloom filter counters. The experiment of the space complexity and the error rate of real traffic proves the algorithm. The experimental results show that the error rate of the algorithm is significantly lower than that of the same algorithm under the same memory resource constraints. Under the same error rate index, the memory occupancy of the algorithm is less than 33%.2., which is at least reduced by the traffic caused by the flow without the end mark when the traditional counting Bloom filter algorithm is used to detect the large flow. A large flow detection algorithm based on adaptive timeout counting Bloom filter is proposed. The algorithm designs a large flow detection structure combining counting Bloom filter and time Bloom filter. On the one hand, it records the number of messages through the counter vector and determines the large flow rate; on the other hand, the timer vector is recorded. The arrival time of the latest message is recorded in order to automatically remove the counter that has been occupied by the end stream in time, so as to solve the problem of space congestion caused by the flow without the end mark. Based on the theoretical analysis of the detection error of the structure, an adaptive timeout mechanism is proposed, based on the arrival intensity of link flow and the vector space of Bloom filter. The result of the experiment shows that the error rate of the algorithm is better than that of the fixed timeout algorithm, and in the same memory space, the accuracy of the algorithm is the highest.3. traditional flow recognition algorithm, compared with other reference algorithms. In order to meet the precision requirement of network service differentiation classification, a traffic recognition algorithm based on priority classification constraints is proposed. This algorithm designs a decision tree based on classified information entropy, and puts forward a weighted pessimistic pruning error, so that the final decision tree is classified as a business class with high priority at the time of classification and improves the priority. The experimental results show that the algorithm recognition results are consistent with the priority constraints, and the relative balance between the modeling time and accuracy is achieved. Compared with the standard C4.5 decision tree algorithm, although the overall accuracy of the classification is slightly lower, the recall rate of the high priority service category is obviously higher than that of the C4.5 algorithm. Enough to satisfy the differential classification constraints, and the F-measure results are equivalent to the C4.5 algorithm for how to improve the processing speed of online traffic recognition. From the new point of view of traffic reduction, an online flow recognition method based on flow set is proposed. This method uses the same application category with the stream set of the same three tuples. Characteristics, the flow set is reduced online, that is, only the partial flow in the same three tuple stream set is identified, and the traffic category corresponding to the flow set is obtained according to the identified results. The relationship between the classification error rate and the quantity of the detected flow is obtained by theoretical analysis. The classification performance and processing speed of the algorithm are tested. The results show that the method can be used in combination with various algorithms, and the classification accuracy and processing speed are greatly improved by choosing a reasonable classification error rate to estimate the threshold.

【學(xué)位授予單位】：解放軍信息工程大學(xué)
【學(xué)位級別】：博士
【學(xué)位授予年份】：2015
【分類號】：TP393.06

【相似文獻】

相關(guān)期刊論文 前10條

1 楊錚;李國元;左敏;;一個嵌入式網(wǎng)絡(luò)流量識別系統(tǒng)的設(shè)計與實現(xiàn)[J];計算機系統(tǒng)應(yīng)用;2008年06期

2 辛峰;於建華;;互聯(lián)網(wǎng)流量識別技術(shù)的研究及實現(xiàn)[J];廣東通信技術(shù);2008年03期

3 李晗;劉瀧;;應(yīng)用層流量識別方法的研究[J];廣東通信技術(shù);2008年04期

4 梁偉;李晗;;網(wǎng)絡(luò)流量識別方法研究[J];通信技術(shù);2008年11期

5 張玲;李君;孫雁飛;;快速應(yīng)用層流量識別方法的研究與實現(xiàn)[J];電信快報;2009年10期

6 葛體富;;網(wǎng)絡(luò)流量識別技術(shù)以及實現(xiàn)方案淺議[J];電腦知識與技術(shù);2011年22期

7 侯艷;;基于深度包和流的流量識別系統(tǒng)設(shè)計[J];電子設(shè)計工程;2013年22期

8 馬保雷;宋穎慧;劉亞維;;基于概念漂移檢測的自適應(yīng)流量識別的研究[J];智能計算機與應(yīng)用;2013年06期

9 張眾;楊建華;謝高崗;;高效可擴展的應(yīng)用層流量識別架構(gòu)[J];通信學(xué)報;2008年12期

10 吳震;劉興彬;童曉民;;基于信息熵的流量識別方法[J];計算機工程;2009年20期

相關(guān)會議論文 前7條

1 馬永立;壽國礎(chǔ);胡怡紅;錢宗玨;區(qū)海平;;新型網(wǎng)絡(luò)流量識別分析系統(tǒng)及其性能評估[A];第六屆全國信息獲取與處理學(xué)術(shù)會議論文集（2）[C];2008年

2 張娜娜;;P2P流量識別方法研究[A];江蘇省電子學(xué)會2010年學(xué)術(shù)年會論文集[C];2010年

3 高長喜;辛陽;鈕心忻;楊義先;;基于行為特征分析的P2P流量識別技術(shù)的研究[A];第一屆中國高校通信類院系學(xué)術(shù)研討會論文集[C];2007年

4 許劉兵;;基于人工神經(jīng)網(wǎng)絡(luò)的P2P流量識別模型的研究[A];中國電子學(xué)會第十五屆信息論學(xué)術(shù)年會暨第一屆全國網(wǎng)絡(luò)編碼學(xué)術(shù)年會論文集（上冊）[C];2008年

5 賈波;鄒園萍;;基于無監(jiān)督學(xué)習(xí)的P2P流量識別[A];浙江省信號處理學(xué)會2011學(xué)術(shù)年會論文集[C];2011年

6 王波;周曉光;蘇志遠;;基于節(jié)點狀態(tài)的P2P流量識別系統(tǒng)[A];中國電子學(xué)會第十五屆信息論學(xué)術(shù)年會暨第一屆全國網(wǎng)絡(luò)編碼學(xué)術(shù)年會論文集（下冊）[C];2008年

7 王波;周曉光;蘇志遠;;基于節(jié)點狀態(tài)的P2P流量識別系統(tǒng)[A];2008通信理論與技術(shù)新發(fā)展——第十三屆全國青年通信學(xué)術(shù)會議論文集（下）[C];2008年

相關(guān)博士學(xué)位論文 前7條

1 侯穎;網(wǎng)絡(luò)流量測量與識別關(guān)鍵技術(shù)研究[D];解放軍信息工程大學(xué);2015年

2 林冠洲;網(wǎng)絡(luò)流量識別關(guān)鍵技術(shù)研究[D];北京郵電大學(xué);2011年

3 田旭;互聯(lián)網(wǎng)流量識別技術(shù)研究[D];北京郵電大學(xué);2012年

4 彭建芬;P2P流量識別關(guān)鍵技術(shù)研究[D];北京郵電大學(xué);2011年

5 張劍;寬帶接入網(wǎng)流量識別關(guān)鍵技術(shù)研究[D];北京郵電大學(xué);2011年

6 李冰;VoIP和P2P IPTV流量的識別與測量研究[D];天津大學(xué);2010年

7 郭振濱;互聯(lián)網(wǎng)測量與建模研究[D];北京交通大學(xué);2012年

相關(guān)碩士學(xué)位論文 前10條

1 龔雪梅;基于用戶感知的無線網(wǎng)絡(luò)流量識別與控制的設(shè)計與實現(xiàn)[D];電子科技大學(xué);2015年

2 練琪;基于聚類分析的應(yīng)用層流量識別研究[D];湖南大學(xué);2010年

3 朱欣;基于數(shù)據(jù)流挖掘技術(shù)的流量識別[D];蘇州大學(xué);2011年

4 張波;基于流特征的加密流量識別技術(shù)研究[D];哈爾濱工業(yè)大學(xué);2012年

5 孫海霞;基于關(guān)聯(lián)規(guī)則的流量識別方法研究[D];合肥工業(yè)大學(xué);2009年

6 左建勛;網(wǎng)絡(luò)流量識別技術(shù)研究及其應(yīng)用[D];重慶大學(xué);2007年

7 馬保雷;基于概念漂移檢測的自適應(yīng)流量識別研究[D];哈爾濱工業(yè)大學(xué);2013年

8 羅平;網(wǎng)絡(luò)層流量識別與關(guān)鍵內(nèi)容提取系統(tǒng)設(shè)計與實現(xiàn)[D];電子科技大學(xué);2014年

9 崔月婷;基于分類算法與聚類算法流量識別系統(tǒng)的研究[D];北京郵電大學(xué);2010年

10 郭明亮;高速網(wǎng)絡(luò)中實時流量識別系統(tǒng)的研究與設(shè)計[D];北京郵電大學(xué);2010年

，

本文編號：1856809