一种新的可变采样率的网络流量抽样测量方法  

IP flow-based variable sampling method for network traffic measurement

作　　者：潘乔[1,2] 裴昌幸[1] 

机构地区：[1]西安电子科技大学综合业务网理论及关键技术国家重点实验室,陕西西安710071 [2]东华大学计算机科学与技术学院,上海210051

出　　处：《西安电子科技大学学报》2008年第6期968-972,共5页Journal of Xidian University

基　　金：国家自然科学基金资助(60572147,60132030)

摘　　要：随机报文抽样方法是目前常用的流量抽样测量方法,但是它倾向于采集长流,影响了异常检测的正确性.提出了一种新的基于IP流可变采样率的网络流量抽样测量方法,将到达的数据报文按照流标识分类,并以每一个报文在所属流中的位置和流的大小为参数设置可变采样率进行抽样测量.实验表明,该方法提高了短流中报文的采样率,减少了随机报文抽样方法对异常检测的影响,检测结果能正确地反映原始数据的异常情况.The random packet sampling method is usually employed by traffic sampling measurement. But the accuracy of anomaly detection is affected by the fact that it biases a large IP flow. Based on the IP flow arrival process, a variable sampling method is proposed. According to the attribute of the IP flow, the incoming packets are classified by their flow identifiers and sampling rates are set by their positions in the IP flow. Experimental results show that sampled traffic data improve the accuracy of anomaly detection because the variable sampling method increases the sampling rate of packets in a small IP flow.

关 键 词：抽样测量 可变采样率抽样 IP流 端口扫描 INTERNET 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]