高速网络监控中大流量对象的提取  

Identifying Heavy Hitters in High-Speed Network Monitoring

作　　者：王风宇[1] 云晓春[1] 王晓峰[2] 王勇[1] 

机构地区：[1]中国科学院计算技术研究所信息智能与信息安全研究中心 [2]哈尔滨工业大学计算机网络与信息安全技术研究中心,黑龙江哈尔滨150001

出　　处：《软件学报》2007年第12期3060-3070,共11页Journal of Software

基　　金：Supported by the National Natural Science Foundation of China under Grant No.60573134(国家自然科学基金);the Program for New Century Excellent Talents in University of China(新世纪优秀人才支持计划)

摘　　要：在高速网络环境下,由于受计算及存储资源的限制,及时、准确地提取大流量对象对于检测大规模网络安全事件具有重要意义.结合LRU淘汰机制和LEAST淘汰机制,建立了基于二级淘汰机制的网络大流量对象提取算法(LRU&LEAST replacement,简称LLR),两种淘汰机制相互弥补不足,较大地提高了算法的准确性.由于算法占用存储空间较少,从而可以在有限的SRAM空间中更快地处理流量信息.该算法在网络数据量增加的情况下不必增加存储空间.具有很好的可扩展性.Due to the deficiency of traffic measurement capability in high-speed network, it＇s valuable for detecting large-scale network security incident to identify heavy hitters precisely in time. An algorithm of identifying heavy hitters based on two-level replacement mechanism is proposed in this paper. In this algorithm, LRU replacement and LEAST replacement are combined together to improve its accuracy. The heavy hitters can be identified accurately in small constant memory space, so the data can be treated more rapidly in limited space of SRAM. It＇s unecessary to provide more memory space for more network data, so the algorithm is scalable.

关 键 词：网络测量 大流量对象 淘汰机制 异常检测 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]