基于TCBF算法的TCP流长度分布统计  

Statistics of distribution of TCP flow length based on TCBF algorithm

作　　者：刘卫江[1] 白磊[2] 杨望[3] 

机构地区：[1]大连海事大学计算机科学与技术学院,大连116026 [2]华北科技学院计算机系,廊坊101601 [3]东南大学计算机科学与工程学院,南京210096

出　　处：《东南大学学报（自然科学版）》2007年第5期787-792,共6页Journal of Southeast University：Natural Science Edition

基　　金：国家重点基础研究发展计划(973计划)资助项目(2003CB314804);教育部科学技术研究重点资助项目(105084);江苏省网络与信息安全重点实验室资助项目(BM2003201);江苏省博士后科研资助计划资助项目

摘　　要：为提高流测量系统的运行效率,减少其所需资源的消耗,在分析了TCP连接的释放以发送FIN报文或RST报文作为结束标志的基础上,提出一种新的报文过滤算法TCBF(time-outcounting bloom filter),用于统计TCP流长度分布.通过对有结束标志的流、没有结束标志的中长流和没有结束标志的中短流分别采用不同的统计处理方式,增加了网络测量性能,提高了测量系统的资源利用率.该算法不需要收集所有报文,而是只需要抽样少量报文即可对流长度做出统计.理论分析和仿真结果表明,TCBF算法在使用较少的存储空间的条件下,可以及时准确地对TCP流长度分布做出统计,满足实际测量需要.In order to improve the performance and reduce the resource usage of flow-based measurement systems, a novel packet filtering algorithm for generating the statistics of the distribution of transmission control protocol （TCP） flow length, time-out counting bloom filter （TCBF）, is presented based on the characteristics analysis of that sending a FIN or RST segment is the termination flag of closing a TCP connection in the Internet. This algorithm can improve the performance of network measurement and the efficiency of the resource usage of measurement system by handling flows with termination flag, large flows without termination and middle-short flows without termination with different strategy. Instead of collecting all packets this algorithm may make statistics of flow length with only a few packets. The theoretical analysis and the simulation results indicate that the TCBF algorithm can generate the statistics of the distribution of TCP flow length timely and accurately under the condition of using less storage space, and satisfy the need of practical measurement.

关 键 词：报文抽样 报文过滤 TCP流 重尾分布 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]