基于CBF流抽样的网络安全  

Research on Network Security Based on CBF flow Sampling

作　　者：刘亮亮[1] 桂祚勤[1] 刘渊[2] 

机构地区：[1]江南计算技术研究所,江苏无锡214083 [2]江南大学信息工程学院,江苏无锡214122

出　　处：《江南大学学报（自然科学版）》2008年第1期26-29,共4页Joural of Jiangnan University (Natural Science Edition)　

基　　金：国防基础研究基金项目(A1420061266)

摘　　要：现有网络中常存在DDOS、恶意端口及IP扫描、蠕虫等异常产生大量的只包含1个数据包的流量.针对高速网络流量特点及网络异常导致的流量突然上升,提出了一种改进的基于CBF的流抽样算法.该算法对定长时间内到达的数据包进行固定数量的抽样,使抽样率能适应于流量变化,并可控制资源的消耗,尤其当泛洪攻击、DDOS攻击等导致大规模异常网络流量出现时,能有效保护路由器的处理器和内存资源以及传输流记录所需的带宽资源,同时又不失简单性和准确性.Today＇s traffic mixes often include massive denial of service attacks or aggressive port and IP scans that generate a large number of ＂ flows＂ consisting of a single small packet. Considering the characteristic of high - speed network and the sudden rise of traffic caused by attacks, a novel flow sampling method based on Counting Bloom Filter is devised. It samples a fixed number of packets in a constant period, adapts sampling rate to traffic variety and provides the controllability of resource consumption. Especially, when flooding attacks, distributed denial of service attacks that cause large - scale anomaly traffic, it can efficiently protect router＇ s processor and memory resources, and network bandwidth consumed by flow records, without sacrificing simplicity and accuracy.

关 键 词：网络安全 流量测量 流抽样 

分 类 号：TP309[自动化与计算机技术—计算机系统结构]