网络扫描发包速率学习算法  

A Packet-Sending Rate Learning Algorithm for Web Scanning

作　　者：黄伟武[1,2] 闫兆腾 朱红松[1] 孙利民[1] 

机构地区：[1]物联网信息安全技术北京市重点实验室中国科学院信息工程研究所,北京100093 [2]中国科学院大学,北京100049

出　　处：《信息安全与通信保密》2016年第3期110-114,117,共6页Information Security and Communications Privacy

基　　金：国家自然科学基金(No.U1536107)

摘　　要：不同网络环境中,主机对外网进行的扫描受多种因素影响,如上行带宽、路由器转发能力等,这些因素决定了主机的发包速率不能任意指定,其值过高会引起丢包问题,过低则导致扫描过程十分漫长。如何确定不同网络环境中主机的扫描发包速率,使得在上行带宽等资源受限时能达到最佳的扫描效果是一个极大的挑战,为此本文提出了一种网络扫描发包速率学习算法。我们首先从实验数据中获取先验知识,确定算法一些重要参数的初始值,然后在实际探测过程中对特定IP段重复扫描行为,根据实时存活主机数更新优化发包速率,并最终得到最佳速率值。实验结果表明,本算法能在不同网络环境中,通过较短的时间确定主机对外网进行扫描的最佳发包速率,从而在保证扫描效果的同时提高了扫描效率。Various interference factors would badly affect the scanning under different network environments, such as upstream band- width and transmit ability of routers. One of the most important factors is packet-sending rate. A packet-sending rate learning algo- rithm is necessary, since an over-high packet sending rate would result in packet loss while a too-slow scanning would cost plenty of time. The detection of best packet-sending rate under different network environments is a great challenge, and thus the emphasis should be put on the promotion of packet-sending efficiency in face of problems such as resource limit. To achieve this, a packet- sending rate learning algorithm is proposed. Firstly, the priori knowledge is obtained from a number of experiments so as to determine the initial value of the important parameters, and then repeated scanning behaviors are done on specific IP range, and based on this, the sending rate is updated and optimized in ligbt of the real-time number of living hosts. And finally, the best packet sending rate is achieved. The experiment results show that the described algorithm could fairly detect the best packet sending rate in a relatively short time under different network environments, and thus is able to maximize the scanning rate while maintaining a good performance.

关 键 词：网络扫描 发包速率 上行带宽 丢包 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术]