高速网络访问超点实时检测算法精度分析

doi:10.11959/j.issn.1000-0801.2020117

电信科学 ›› 2020, Vol. 36 ›› Issue (4): 74-82.doi: 10.11959/j.issn.1000-0801.2020117

高速网络访问超点实时检测算法精度分析

于海青,丁伟,徐杰

东南大学网络空间安全学院，江苏南京 211189

修回日期:2020-03-18 出版日期:2020-04-20 发布日期:2020-04-24
作者简介:于海青（1996- ），男，东南大学网络空间安全学院硕士生，主要研究方向为网络空间安全、网络测量、网络管理等|丁伟（1962- ），女，博士，东南大学网络空间安全学院教授，主要研究方向为网络测量与行为学、网络管理及网络安全等|徐杰（1989- ），男，东南大学网络空间安全学院博士生，主要研究方向为网络安全、并行计算和分布式计算等
基金资助:
国家重点研发计划基金资助项目(2018YFB1800200)

Accuracy analysis on access hyper-point real-time detection algorithms in high-speed network

Haiqing YU,Wei DING,Jie XU

School of Cyber Science and Engineering,Southeast University,Nanjing 211189,China

Revised:2020-03-18 Online:2020-04-20 Published:2020-04-24
Supported by:
The National Key Research and Development Project(2018YFB1800200)

摘要/Abstract

摘要：

访问超点的实时获取有利于管理者更好地掌控网络。在高速网络条件下，访问超点检测的难点在于大流量给计算带来的压力。基于40 Gbit/s带宽的网络环境，从精度分析角度对比了流记录统计算法和基于估值原理的估算类超点检测算法。流记录统计算法采用基于重尾分布的阈值模型加以改进，估算类超点检测算法采用SRLA在GPU环境下实现，研究结果表明，估算类超点检测算法明显具有更高的检测精度和更大的改进空间，比流记录统计算法更适合被用于高速网络超点实时检测。

关键词: 访问超点, 网络管理, 估算精度, 高速网络

Abstract:

Real-time access hyper-point helps managers better control the network.Under high-speed network conditions,the difficulty in accessing hyper-point detection lies in the pressure exerted by large traffic on computing.Based on the 40 Gbit/s bandwidth network environment,from the perspective of accuracy analysis,the flow record statistics algorithm and the estimation-based superpoint detection algorithm were compared.The flow record statistical algorithm was improved by the threshold model based on heavy-tailed distribution.The estimation-based superpoint detection algorithm was implemented in the GPU environment by SRLA.The research results show that the estimation-based hyper-point detection algorithm which has obviously higher accuracy and more room for improvement is more suitable for real-time detection of hyper-point in high-speed network than the flow record statistical algorithm.

Key words: access hyper-point, network management, estimation accuracy, high speed network

中图分类号:

TP302

于海青,丁伟,徐杰. 高速网络访问超点实时检测算法精度分析[J]. 电信科学, 2020, 36(4): 74-82.

Haiqing YU,Wei DING,Jie XU. Accuracy analysis on access hyper-point real-time detection algorithms in high-speed network[J]. Telecommunications Science, 2020, 36(4): 74-82.

图/表 7

图1

图2

图3

图4

图5

图6

表1

参考文献 18

[1]	CHOI S , CHOI Y , LEE J ,et al. Network abnormal behaviour analysis system[C]// Proceeding of 2017 19th International Conference on Advanced Communication Technology (ICACT).[S.l.:s.n]. 2017: 49-52.
[2]	周爱平 . 高速网络流量测量关键问题研究[D]. 南京:东南大学, 2015.
	ZHOU A P . Research on key issues of high-speed network traf-fic measurement[D]. Nanjing:Southeast University, 2015.
[3]	KUCERA J , KEKELY L , PIECEK A ,et al. General IDS acceleration for high-speed networks[C]// Proceeding of 2018 IEEE 36th International Conference on Computer Design (ICCD).[S.l.:s.n. ], 2018: 366-373.
[4]	VENKATARAMAN S , SONG D , GIBBONS P B ,et al. New streaming algorithms for fast detection of superspreaders[R]. 2004.
[5]	MODI C , PATEL D , BORISANIYA B ,et al. A survey of intrusion detection techniques in cloud[J]. Journal of Network and Computer Applications, 2013,36(1): 42-57.
[6]	KAMIYAMA N , MORI T , KAWAHARE R . Simple and adaptive identification of superspreaders by flow sampling[C]// Proceeding of IEEE INFOCOM 2007-26th IEEE International Conference on Computer Communications. Piscataway:IEEE Press, 2007: 2481-2485.
[7]	YOON M K , LI T , CHEN S ,et al. Fit a compact spread estimator in small high-speed memory[J]. IEEE/ACM Transactions on Networking, 2011,19(5): 1253-1264.
[8]	CHENG G , TANG Y . Line speed accurate superspreader identification using dynamic error compensation[J]. Computer Communications, 2013,36(13): 1460-1470.
[9]	LIU W , QU W , GONG J ,et al. Detection of sauperpoints using a vector bloom filter[J]. IEEE Transactions on Information Forensics and Security, 2015,11(3):1.
[10]	WANG P , GUAN X , TAO Q ,et al. A data streaming method for monitoring host connection degrees of high-speed links[J]. IEEE Transactions on Information Forensics ＆ Security, 2011,6(3): 1086-1098.
[11]	XU J , DING W , GONG Q ,et al. A super point detection algorithm under sliding time windows based on rough and linear estimators[J]. IEEE Access, 2019(7): 43414-43427.
[12]	白磊, 陈超, 田立勤 . 基于TCBF_LRU的高速网络大流检测算法[J]. 计算机研究与发展, 2014(S2): 122-128.
	BAI L , CHEN C , TIAN L Q . High-speed network large flow detection algorithm based on TCBF_LRU[J]. Journal of Com-puter Research and Development, 2014(S2): 122-128.
[13]	陈楚, 许勇, 张凌 . 重尾分布对网络流量性质的影响[J]. 计算机应用, 2009,29(6): 1520-1522.
	CHEN C , XU Y , ZHANG L . Effects of heavy-tailed distribution on the nature of network traffic[J]. Journal of Computer Applications, 2009,29(6): 1520-1522.
[14]	丁伟, 洪沿, 夏震 . 基于流记录的 HTTP 80 端口服务检测和分析[J]. 华中科技大学学报(自然科学版), 2016,44(11): 34-38.
	DING W , HONG Y , XIA Z . Detection and analysis of HTTP 80 port service based on stream recording[J]. Journal of Huazhong University of Science and Technology(Natural Science), 2016,44(11): 34-38.
[15]	程光, 唐永宁 . 基于近似方法的抽样报文流数估计算法[J]. 软件学报, 2013(2): 255-265.
	CHENG G , TANG Y N . Sampling message flow estimation al-gorithm based on approximation method[J]. Journal of Software, 2013(2): 255-265.
[16]	WHANG K Y , VANDERZANDEN B T , TAYLOR H M . A linear-time probabilistic counting algorithm for database applications[J]. ACM Transactions on Database Systems, 1990,15(2): 208-229.
[17]	XIAO Q , CHEN S , YOU Z ,et al. Cardinality estimation for elephant flows:a compact solution based on virtual register sharing[J]. IEEE/ACM Transactions on Networking, 2017(99): 1-15.
[18]	杨永愉 . Pareto 分布参数的统计推断及其应用[J]. 北京化工大学学报(自然科学版), 1992(1): 89-97.
	YANG Y Y . Statistical inference of pareto distribution parame-ters and Its application[J]. Journal of Beijing University of Chemical Technology (Natural Science Edition), 1992(1): 89-97.

对比项	FPR				FNR
对比项	最大值	最小值	均值	方差	最大值	最小值	均值	方差
流记录统计算法	0.663	0.470	0.564	0.035	0.690	0.481	0.594	0.043
SRLA	0.155	0.000	0.023	0.021	0.289	0.074	0.144	0.040

高速网络访问超点实时检测算法精度分析

Accuracy analysis on access hyper-point real-time detection algorithms in high-speed network

在线阅读

PDF下载

可视化

摘要/Abstract

引用本文

使用本文

图/表 7

参考文献 18

相关文章 15

Metrics

推荐阅读 0

[1]	胡骞, 赵国永, 霍晓莉, 李俊杰, 荆瑞泉, 闫飞, 武晓锋. 灰盒光传输设备的SDN管控技术研究及应用[J]. 电信科学, 2021, 37(12): 93-100.
[2]	徐明,杨雪,章坚武. 移动设备网络流量分析技术综述[J]. 电信科学, 2018, 34(4): 98-108.
[3]	赵晋明. 一种基于随机映射的网络状态评估方法[J]. 电信科学, 2016, 32(8): 164-168.
[4]	赵晋明. 一种基于投影寻踪的电信网络数据处理方法[J]. 电信科学, 2016, 32(12): 144-148.
[5]	宋阿芳,林联,王发光. 通信网管系统云化部署及迁移问题研究[J]. 电信科学, 2015, 31(6): 103-108.
[6]	柴智. 一种基于最优控制的网络管理整体策略[J]. 电信科学, 2015, 31(11): 189-192.
[7]	曹旭,曹瑞彤. 基于大数据分析的网络异常检测方法[J]. 电信科学, 2014, 30(6): 152-156.
[8]	马学刚. 一种WLAN拓扑管理系统[J]. 电信科学, 2014, 30(12): 153-159.
[9]	余颖. 发电企业信息安全保障体系建设[J]. 电信科学, 2014, 30(1): 148-152.
[10]	马迪,沈烁. 基于本地信任锚点管理的RPKI安全运行机制研究[J]. 电信科学, 2013, 29(9): 55-59.
[11]	梁颐涵,周　函,王井龙,李　飞. 统一接口平台在中国电信WDM综合网络管理系统中的应用[J]. 电信科学, 2013, 29(7): 148-152.
[12]	王相林,沈清姿,朱晨,刘立朋. IPv6高速网络环境下数据分组捕获技术的研究 ^*[J]. 电信科学, 2012, 28(6): 54-62.
[13]	宋阿芳,徐伟. IMS网络管理系统特点及部署问题研究[J]. 电信科学, 2011, 27(9): 6-10.
[14]	谢明,侯象飞,刘文超,李士龙. 光进铜退下家庭网络管理体系架构研究[J]. 电信科学, 2011, 27(5): 29-32.
[15]	黄挺,谢文旭,王燕川. 云计算在电信网络管理系统中的应用与实践[J]. 电信科学, 2011, 27(4): 119-122.