基于散列表的防冲突网络流量监测器设计  

Design ofanti-collision network flow monitor based on hash table

作　　者：李玥[1] 武凌[2] 

机构地区：[1]甘肃农业大学信息科学技术学院,兰州730070 [2]兰州交通大学现代信息技术与教育中心,兰州730070

出　　处：《自动化与仪器仪表》2014年第6期74-76,79,共4页Automation & Instrumentation

基　　金：国家自然科学基金(31360315)资助

摘　　要：为了有效监测网络流量,及时发现网络流量的应用、攻击等异常情况,基于流的高速网络流量监测器采用散列表处理分组,利用散列函数将流量关键字映射为散列值。使用散列表的优势是其恒定的查找时间O(1)。本文在分析了基于散列的网络流量监测机制的基础上提出两种简单散列方法,通过设置网络攻击实验,证实攻击者可利用散列函数创建散列冲突攻击,从而造成大量数据包丢失。最后,在此基础上提出一个改进的散列函数,研究表明该方法具有较好的执行效率和极快的监测速度,能够达到对网络流量的有效监控。Hash table was used for processing pocket in order to monitoring network flow effectively, and discovering application and attack without delay in high rate network flow monitor based on flow. Constant lookup time of O（1） was the advantage of hash table, hash function was used to mapping flow key to hash val-ue. This study presented two methods, addition of flow key and CRC32 method based on hash table, it is showed that attacker can create hash collision attacking using hash function through the setting of network at-tacking experiment, so that account of pockets were dropped. Thus, an optimal hash function was presented with disadvantage of before-mentioned methods, the research indicated that the improved hash function offer-ing preferable performance efficiency and fast monitoring speed, and detecting network flow effectively.

关 键 词：流量监测 散列冲突 DDOS攻击 CRC32 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]