基于近似方法的抽样报文流数估计算法  

Estimation Algorithms of the Flow Number from Sampled Packets on Approximate Approaches

作　　者：程光[1,2] 唐永宁 

机构地区：[1]东南大学计算机科学与工程学院,江苏南京210096 [2]计算机网络和信息集成教育部重点实验(东南大学),江苏南京210096 [3]School of Information Technology,Illinois State University,Normal 61790-5150,USA

出　　处：《软件学报》2013年第2期255-265,共11页Journal of Software

基　　金：国家自然科学基金(60973123);国家重点基础研究发展计划(973)(2009CB320505);江苏省科技计划项目(科技支撑计划--工业部分)(BE2011173)

摘　　要：维护每个报文的流记录需要占用大量测量资源.目前已有多种抽样技术估计网络流统计信息,然而精确地估计出流数统计信息是目前的研究难点.提出了Integral和Iteration两种基于报文抽样样本估计网络流数的算法.Integral算法只需使用抽样流长为1的流数信息就可以近似推导出未抽样的流数.Iteration算法通过建立迭代函数估计未抽样流数,然后根据未抽样流数和已抽样的流数推断出原始流量的流数.采用CERNET(China education andresearch network)骨干网络链路数据将这两种算法与EM(expectation maximization)算法进行对比,表明Iteration算法具有较好的精度和性能.Recording flow statistics for each network packet is resource-intensive. Various sampling techniques are used to estimate flow statistics. However, the estimation accuracy based on the sampling remains a significant challenge. This paper introduces both sampling techniques denoted as Integral and Iteration algorithms, which can accurately infer the number of original flows from the sampled flow records. The Integral algorithm uses only the number of sampled flows with one sampled packet to approximately deduce the number of unsampled flows. The Iteration algorithm can estimate the number of unsampled flows using an iteration method. The number of original flows can be precisely estimated according to both the number of sampled flows and unsampled flows. Both the algorithms are compared to the EM （expectation maximization） algorithm using multiple traffic traces collected from CERNET （Chinaeducation and research network） backbone. The result shows that the Iteration algorithm is superior to the EM algorithm and can provide highly accurate estimation on the number of original flows.

关 键 词：报文抽样 网络测量 流数 二项分布 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]