本文選題：流量識(shí)別 + 流量測量��； 參考：《解放軍信息工程大學(xué)》2015年博士論文

【摘要】：網(wǎng)絡(luò)流量測量與識(shí)別,是網(wǎng)絡(luò)管理、網(wǎng)絡(luò)運(yùn)營、網(wǎng)絡(luò)優(yōu)化和網(wǎng)絡(luò)安全的重要基礎(chǔ),是掌握網(wǎng)絡(luò)運(yùn)行規(guī)律和理解網(wǎng)絡(luò)行為的支撐技術(shù)。隨著網(wǎng)絡(luò)技術(shù)的不斷發(fā)展,用戶數(shù)量大幅膨脹,鏈路速率快速增長,承載業(yè)務(wù)更加多樣化,信息隱匿技術(shù)廣泛應(yīng)用,導(dǎo)致傳統(tǒng)的基于知名端口號或基于報(bào)文載荷的流量識(shí)別方法無法滿足高速網(wǎng)絡(luò)流量識(shí)別的需求,迫切需要研究有效的網(wǎng)絡(luò)流量測量與識(shí)別技術(shù)及策略以應(yīng)對目前及未來網(wǎng)絡(luò)管理面臨的挑戰(zhàn)。高速網(wǎng)絡(luò)中,并發(fā)流數(shù)量巨大而且報(bào)文速率高,雖然使用簡單的流量特征與快速的識(shí)別算法能夠?qū)崿F(xiàn)對流量的線速處理,但是難以保證流量識(shí)別的準(zhǔn)確率；為此,現(xiàn)有的技術(shù)通常采用多特征及構(gòu)建復(fù)雜分類模型的思路,處理復(fù)雜度高,難以滿足實(shí)時(shí)性的要求；并且當(dāng)前的流量識(shí)別技術(shù)沒有考慮各種業(yè)務(wù)的差異化管理要求,不能實(shí)現(xiàn)有約束條件的業(yè)務(wù)識(shí)別。因此如何處理準(zhǔn)確性與實(shí)時(shí)性的矛盾是網(wǎng)絡(luò)業(yè)務(wù)在線識(shí)別的關(guān)鍵與難點(diǎn),對不同網(wǎng)絡(luò)業(yè)務(wù)按級別召回是網(wǎng)絡(luò)管理的現(xiàn)實(shí)需求。本文依托于國家863計(jì)劃重大項(xiàng)目課題“面向三網(wǎng)融合的統(tǒng)一安全管控網(wǎng)絡(luò)”和863計(jì)劃主題項(xiàng)目課題“跨網(wǎng)絡(luò)信息安全防護(hù)”,針對課題中的網(wǎng)絡(luò)實(shí)時(shí)識(shí)別和控制需求,面向網(wǎng)絡(luò)業(yè)務(wù)識(shí)別中流量測量和識(shí)別算法兩個(gè)核心環(huán)節(jié),從四個(gè)方面開展研究,主要工作如下：1.針對高速網(wǎng)絡(luò)流量識(shí)別時(shí)獲取全部報(bào)文代價(jià)過大的問題,從報(bào)文約減的角度出發(fā),提出基于同源組合布魯姆過濾器的早期流量抽樣算法。該算法利用并發(fā)流量中已結(jié)束抽樣流數(shù)目遠(yuǎn)大于正在抽樣流數(shù)目的特點(diǎn),設(shè)計(jì)寬度不同的兩個(gè)計(jì)數(shù)布魯姆過濾器組合,分別實(shí)現(xiàn)“報(bào)文計(jì)數(shù)”與“抽樣判斷”功能。算法的理論分析表明,調(diào)節(jié)兩個(gè)計(jì)數(shù)布魯姆過濾器計(jì)數(shù)器的寬度比,可使誤判率達(dá)到最低。根據(jù)真實(shí)流量進(jìn)行的空間復(fù)雜度與誤判率的實(shí)驗(yàn)證明了算法的有效性。實(shí)驗(yàn)結(jié)果表明：在相同內(nèi)存資源限制條件下,該算法的誤判率顯著低于同類算法；在同樣誤判率指標(biāo)下,與其他算法相比,其內(nèi)存占用至少減少33%。2.針對采用傳統(tǒng)計(jì)數(shù)布魯姆過濾器算法檢測大流時(shí),無結(jié)束標(biāo)識(shí)的流量導(dǎo)致的空間擁塞問題,提出了基于自適應(yīng)超時(shí)計(jì)數(shù)布魯姆過濾器的大流檢測算法。該算法設(shè)計(jì)了計(jì)數(shù)布魯姆過濾器與計(jì)時(shí)布魯姆過濾器結(jié)合的大流檢測結(jié)構(gòu)。一方面通過計(jì)數(shù)器向量記錄流的報(bào)文數(shù)量,并判斷大流；另一方面通過計(jì)時(shí)器向量記錄流最近報(bào)文的到達(dá)時(shí)刻,以便及時(shí)將已經(jīng)結(jié)束流占用的計(jì)數(shù)器自動(dòng)清除,從而解決無結(jié)束標(biāo)識(shí)的流量導(dǎo)致的空間擁塞問題。在對該結(jié)構(gòu)檢測誤差理論分析的基礎(chǔ)上,提出自適應(yīng)超時(shí)機(jī)制,根據(jù)鏈路流到達(dá)強(qiáng)度與布魯姆過濾器向量空間長度,自適應(yīng)調(diào)整超時(shí)時(shí)間,使得算法整體錯(cuò)誤率始終保持在最低范圍。實(shí)驗(yàn)結(jié)果表明：該算法的錯(cuò)誤率優(yōu)于固定超時(shí)算法的最優(yōu)值,并且在占用相同內(nèi)存空間條件下,與其它參考算法相比,該算法準(zhǔn)確率最高。3.傳統(tǒng)流量識(shí)別算法無法滿足網(wǎng)絡(luò)業(yè)務(wù)差異化分類精度要求,針對該問題,提出基于優(yōu)先級分類約束的流量識(shí)別算法。該算法設(shè)計(jì)了基于分類信息熵的決策樹,并提出加權(quán)的悲觀錯(cuò)誤剪枝,使最終決策樹在進(jìn)行分類時(shí)側(cè)重于優(yōu)先級高的業(yè)務(wù)類別,提高了優(yōu)先級高的業(yè)務(wù)類別的召回率。實(shí)驗(yàn)結(jié)果表明,算法識(shí)別結(jié)果與優(yōu)先級約束一致,并且取得建模時(shí)間和準(zhǔn)確率的相對平衡。與標(biāo)準(zhǔn)C4.5決策樹算法相比,雖然分類的整體準(zhǔn)確率略低,但是算法對于高優(yōu)先級的業(yè)務(wù)類別召回率明顯高于C4.5算法,能夠滿足差異化分類約束條件,而且F-measure結(jié)果與C4.5算法相當(dāng)。4.針對如何提高在線流量識(shí)別的處理速度問題,從流量約減這一新的角度出發(fā),提出一種基于流集的在線流量識(shí)別方法。該方法利用相同三元組的流集合具有相同應(yīng)用類別的特點(diǎn),對流量集合進(jìn)行在線約減,即只對具有相同三元組流集合中的部分流進(jìn)行識(shí)別,根據(jù)識(shí)別的結(jié)果投票得出流集對應(yīng)的業(yè)務(wù)類別。通過理論分析得出分類錯(cuò)誤率與檢測的流數(shù)量之間的關(guān)系。對算法的分類性能和處理速度進(jìn)行了實(shí)驗(yàn)驗(yàn)證,結(jié)果表明：該方法可以與多種算法結(jié)合使用,并且通過選擇合理的分類錯(cuò)誤率估計(jì)閾值,分類準(zhǔn)確率與處理速度方面比參考算法均有大幅提高。
[Abstract]:Network traffic measurement and recognition is the important foundation of network management, network operation, network optimization and network security. It is the support technology to master the law of network operation and understand the behavior of network. With the continuous development of network technology, the number of users is expanding greatly, the link rate is increasing rapidly, the carrying service is more diversified and the information hiding technology is wide. In general, the traditional traffic recognition method based on well-known port number or message based load can not meet the requirement of high speed network traffic recognition. It is urgent to study effective network traffic measurement and recognition techniques and strategies to cope with the challenges facing network management at present and in the future. Although the rate of message is high, it is difficult to ensure the accuracy of traffic identification by using simple traffic characteristics and fast recognition algorithm, but it is difficult to ensure the accuracy of flow recognition. The flow recognition technology does not take into account the differential management requirements of various services and can not realize the business identification with constraints. Therefore, how to deal with the contradiction between accuracy and real-time is the key and difficult point of network business online recognition. The recall of different network services according to the level is the actual requirement of network management. This paper is based on the country 863. The major project, "unified security management network for the integration of three networks" and "cross network information security protection" of the 863 project theme project, aims at the real-time recognition and control requirements of the network and two core links of traffic measurement and recognition algorithms in network business recognition, mainly from four aspects. The following work is as follows: 1. the early traffic sampling algorithm based on the homologous combination Bloom filter is proposed in view of the problem that the high speed network traffic recognition is too expensive to obtain all the cost of the message. The algorithm uses the homologous combination Bloom filter for the early flow sampling algorithm. Different two counting Bloom filters are combined to realize the function of "message counting" and "sampling judgment" respectively. The theoretical analysis of the algorithm shows that the error rate can be lowest by adjusting the width ratio of the two counting Bloom filter counters. The experiment of the space complexity and the error rate of real traffic proves the algorithm. The experimental results show that the error rate of the algorithm is significantly lower than that of the same algorithm under the same memory resource constraints. Under the same error rate index, the memory occupancy of the algorithm is less than 33%.2., which is at least reduced by the traffic caused by the flow without the end mark when the traditional counting Bloom filter algorithm is used to detect the large flow. A large flow detection algorithm based on adaptive timeout counting Bloom filter is proposed. The algorithm designs a large flow detection structure combining counting Bloom filter and time Bloom filter. On the one hand, it records the number of messages through the counter vector and determines the large flow rate; on the other hand, the timer vector is recorded. The arrival time of the latest message is recorded in order to automatically remove the counter that has been occupied by the end stream in time, so as to solve the problem of space congestion caused by the flow without the end mark. Based on the theoretical analysis of the detection error of the structure, an adaptive timeout mechanism is proposed, based on the arrival intensity of link flow and the vector space of Bloom filter. The result of the experiment shows that the error rate of the algorithm is better than that of the fixed timeout algorithm, and in the same memory space, the accuracy of the algorithm is the highest.3. traditional flow recognition algorithm, compared with other reference algorithms. In order to meet the precision requirement of network service differentiation classification, a traffic recognition algorithm based on priority classification constraints is proposed. This algorithm designs a decision tree based on classified information entropy, and puts forward a weighted pessimistic pruning error, so that the final decision tree is classified as a business class with high priority at the time of classification and improves the priority. The experimental results show that the algorithm recognition results are consistent with the priority constraints, and the relative balance between the modeling time and accuracy is achieved. Compared with the standard C4.5 decision tree algorithm, although the overall accuracy of the classification is slightly lower, the recall rate of the high priority service category is obviously higher than that of the C4.5 algorithm. Enough to satisfy the differential classification constraints, and the F-measure results are equivalent to the C4.5 algorithm for how to improve the processing speed of online traffic recognition. From the new point of view of traffic reduction, an online flow recognition method based on flow set is proposed. This method uses the same application category with the stream set of the same three tuples. Characteristics, the flow set is reduced online, that is, only the partial flow in the same three tuple stream set is identified, and the traffic category corresponding to the flow set is obtained according to the identified results. The relationship between the classification error rate and the quantity of the detected flow is obtained by theoretical analysis. The classification performance and processing speed of the algorithm are tested. The results show that the method can be used in combination with various algorithms, and the classification accuracy and processing speed are greatly improved by choosing a reasonable classification error rate to estimate the threshold.

【學(xué)位授予單位】：解放軍信息工程大學(xué)
【學(xué)位級別】：博士
【學(xué)位授予年份】：2015
【分類號】：TP393.06

【相似文獻(xiàn)】

相關(guān)期刊論文 前10條

1 楊錚;李國元;左敏;;一個(gè)嵌入式網(wǎng)絡(luò)流量識(shí)別系統(tǒng)的設(shè)計(jì)與實(shí)現(xiàn)[J];計(jì)算機(jī)系統(tǒng)應(yīng)用;2008年06期

2 辛峰;於建華;;互聯(lián)網(wǎng)流量識(shí)別技術(shù)的研究及實(shí)現(xiàn)[J];廣東通信技術(shù);2008年03期

3 李晗;劉瀧;;應(yīng)用層流量識(shí)別方法的研究[J];廣東通信技術(shù);2008年04期

4 梁偉;李晗;;網(wǎng)絡(luò)流量識(shí)別方法研究[J];通信技術(shù);2008年11期

5 張玲;李君;孫雁飛;;快速應(yīng)用層流量識(shí)別方法的研究與實(shí)現(xiàn)[J];電信快報(bào);2009年10期

6 葛體富;;網(wǎng)絡(luò)流量識(shí)別技術(shù)以及實(shí)現(xiàn)方案淺議[J];電腦知識(shí)與技術(shù);2011年22期

7 侯艷;;基于深度包和流的流量識(shí)別系統(tǒng)設(shè)計(jì)[J];電子設(shè)計(jì)工程;2013年22期

8 馬保雷;宋穎慧;劉亞維;;基于概念漂移檢測的自適應(yīng)流量識(shí)別的研究[J];智能計(jì)算機(jī)與應(yīng)用;2013年06期

9 張眾;楊建華;謝高崗;;高效可擴(kuò)展的應(yīng)用層流量識(shí)別架構(gòu)[J];通信學(xué)報(bào);2008年12期

10 吳震;劉興彬;童曉民;;基于信息熵的流量識(shí)別方法[J];計(jì)算機(jī)工程;2009年20期

相關(guān)會(huì)議論文 前7條

1 馬永立;壽國礎(chǔ);胡怡紅;錢宗玨;區(qū)海平;;新型網(wǎng)絡(luò)流量識(shí)別分析系統(tǒng)及其性能評估[A];第六屆全國信息獲取與處理學(xué)術(shù)會(huì)議論文集（2）[C];2008年

2 張娜娜;;P2P流量識(shí)別方法研究[A];江蘇省電子學(xué)會(huì)2010年學(xué)術(shù)年會(huì)論文集[C];2010年

3 高長喜;辛陽;鈕心忻;楊義先;;基于行為特征分析的P2P流量識(shí)別技術(shù)的研究[A];第一屆中國高校通信類院系學(xué)術(shù)研討會(huì)論文集[C];2007年

4 許劉兵;;基于人工神經(jīng)網(wǎng)絡(luò)的P2P流量識(shí)別模型的研究[A];中國電子學(xué)會(huì)第十五屆信息論學(xué)術(shù)年會(huì)暨第一屆全國網(wǎng)絡(luò)編碼學(xué)術(shù)年會(huì)論文集（上冊）[C];2008年

5 賈波;鄒園萍;;基于無監(jiān)督學(xué)習(xí)的P2P流量識(shí)別[A];浙江省信號處理學(xué)會(huì)2011學(xué)術(shù)年會(huì)論文集[C];2011年

6 王波;周曉光;蘇志遠(yuǎn);;基于節(jié)點(diǎn)狀態(tài)的P2P流量識(shí)別系統(tǒng)[A];中國電子學(xué)會(huì)第十五屆信息論學(xué)術(shù)年會(huì)暨第一屆全國網(wǎng)絡(luò)編碼學(xué)術(shù)年會(huì)論文集（下冊）[C];2008年

7 王波;周曉光;蘇志遠(yuǎn);;基于節(jié)點(diǎn)狀態(tài)的P2P流量識(shí)別系統(tǒng)[A];2008通信理論與技術(shù)新發(fā)展——第十三屆全國青年通信學(xué)術(shù)會(huì)議論文集（下）[C];2008年

相關(guān)博士學(xué)位論文 前7條

1 侯穎;網(wǎng)絡(luò)流量測量與識(shí)別關(guān)鍵技術(shù)研究[D];解放軍信息工程大學(xué);2015年

2 林冠洲;網(wǎng)絡(luò)流量識(shí)別關(guān)鍵技術(shù)研究[D];北京郵電大學(xué);2011年

3 田旭;互聯(lián)網(wǎng)流量識(shí)別技術(shù)研究[D];北京郵電大學(xué);2012年

4 彭建芬;P2P流量識(shí)別關(guān)鍵技術(shù)研究[D];北京郵電大學(xué);2011年

5 張劍;寬帶接入網(wǎng)流量識(shí)別關(guān)鍵技術(shù)研究[D];北京郵電大學(xué);2011年

6 李冰;VoIP和P2P IPTV流量的識(shí)別與測量研究[D];天津大學(xué);2010年

7 郭振濱;互聯(lián)網(wǎng)測量與建模研究[D];北京交通大學(xué);2012年

相關(guān)碩士學(xué)位論文 前10條

1 龔雪梅;基于用戶感知的無線網(wǎng)絡(luò)流量識(shí)別與控制的設(shè)計(jì)與實(shí)現(xiàn)[D];電子科技大學(xué);2015年

2 練琪;基于聚類分析的應(yīng)用層流量識(shí)別研究[D];湖南大學(xué);2010年

3 朱欣;基于數(shù)據(jù)流挖掘技術(shù)的流量識(shí)別[D];蘇州大學(xué);2011年

4 張波;基于流特征的加密流量識(shí)別技術(shù)研究[D];哈爾濱工業(yè)大學(xué);2012年

5 孫海霞;基于關(guān)聯(lián)規(guī)則的流量識(shí)別方法研究[D];合肥工業(yè)大學(xué);2009年

6 左建勛;網(wǎng)絡(luò)流量識(shí)別技術(shù)研究及其應(yīng)用[D];重慶大學(xué);2007年

7 馬保雷;基于概念漂移檢測的自適應(yīng)流量識(shí)別研究[D];哈爾濱工業(yè)大學(xué);2013年

8 羅平;網(wǎng)絡(luò)層流量識(shí)別與關(guān)鍵內(nèi)容提取系統(tǒng)設(shè)計(jì)與實(shí)現(xiàn)[D];電子科技大學(xué);2014年

9 崔月婷;基于分類算法與聚類算法流量識(shí)別系統(tǒng)的研究[D];北京郵電大學(xué);2010年

10 郭明亮;高速網(wǎng)絡(luò)中實(shí)時(shí)流量識(shí)別系統(tǒng)的研究與設(shè)計(jì)[D];北京郵電大學(xué);2010年

，

本文編號：1856809