高速网络超点检测的并行数据流方法  

Parallel Data Streaming Method for Detection of Super Points in High-Speed Networks

作　　者：周爱平[1,2,3] 程光[1,3] 郭晓军[1,3] 梁一鑫[1,3] 

机构地区：[1]东南大学计算机科学与工程学院,江苏南京211189 [2]泰州学院计算机科学与技术学院,江苏泰州225300 [3]计算机网络和信息集成教育部重点实验室(东南大学),江苏南京211189

出　　处：《软件学报》2016年第7期1841-1860,共20页Journal of Software

基　　金：国家高技术研究发展计划(863)(2015AA015603);江苏省未来网络创新研究院未来网络前瞻性研究项目(BY2013 095-5-03);江苏省"六大人才高峰"高层次人才项目(2011-DZ024);江苏省普通高校研究生科研创新计划(KYLX_0141)~~

摘　　要：超点检测对于网络安全、网络管理等应用具有重要意义.由于存在着高速网络环境下海量网络流量与有限系统资源之间的矛盾,在线准确地监测网络流量是一个极大的挑战.随着多核处理器的发展,多核处理器的并行性成为算法性能提高的一种有效途径.目前,针对基于流抽样的超点检测方法存在计算负荷重、检测精度低、实时性差等问题,提出了一种并行数据流方法(parallel data streaming,简称PDS).该方法构造并行的可逆Sketch数据结构,建立紧凑的节点链接度概要,在未存储节点地址信息的情况下,通过简单地计算重构超点的地址,获得了良好的效率和精度.实验结果表明:与CSE(compact spread estimator),JM(joint data streaming and sampling method)方法相比,该方法具有较好的性能,能够满足高速网络流量监测的应用需求.Detection of super points is very important for some network applications such as network security and network management. Due to the imbalance between the massive amount of traffic data in high-speed networks and the limited system resource, it is a great challenge to accurately monitor traffic in high-speed networks online. With the development of multi-core processers, the parallelism of multi-core processers becomes an effective method of improving performance. Consider that the existing method based on flow sampling has heavy computing load, low detection accuracy and poor timeliness, this article presents a new approach, PDS（parallel data streaming）. This method constructs parallel reversible sketch and builds a compact summary of node connection degrees. Addresses of super points are reconstructed by a simple calculation without address information of nodes. This makes PDS efficient and precise. The experimental results show that PDS is superior to the CSE（compact spread estimator） and JM（joint data streaming and sampling method） methods. Consequently, the proposed method satisfies application requirement of traffic monitoring in high-speed networks.

关 键 词：网络测量 网络安全 超点检测 数据流 并行方法 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]