基于DNS日志分析的用户在线检测算法  

User online detection algorithm based on DNS log analysis

作　　者：常得量 张千里[2] 李星[1] Chang Deliang Zhang Qianli Li Xing(Department of Electronic Engineering Information Technology Center, Tsinghua University, Beijing 100084, China)

机构地区：[1]清华大学电子工程系,北京100084 [2]清华大学信息化技术中心,北京100084

出　　处：《华中科技大学学报（自然科学版）》2016年第11期112-116,共5页Journal of Huazhong University of Science and Technology(Natural Science Edition)

基　　金：国家科技支撑计划资助项目(2012BAH01B02)

摘　　要：为解决用户在线检测算法依赖于流量分析,不便于部署在大型网络的问题,提出了一种基于DNS日志分析的用户在线检测算法.这种算法通过使用DNS日志记录避免了复杂的流量分析,利用用户不使用网络时产生的DNS静默期来识别出用户的上下线时刻和在线时间.使用了清华大学校园网的真实数据进行算法验证,达到90.6%的精确率和96.3%的召回率.进一步研究清华大学校园网络用户在线时长和上下线时间等特征的,结果证实了无线网络用户在线时间短、变化快等特点,而且工作日和周末用户特征明显不同,这些结果表明该算法能够实际应用于大型网络的管理中.To solve the problems that many approaches focus on flow analysis,which is unrealistic for a large-scale network,a method of user online detection algorithm was proposed based on passive DNS log analysis.This method avoided the complexity of traffic or raw packet analysis by utilizing DNS（domain name system）logs,and exploited the silence of users′DNS activities when they were offline to identify users′online time length or join/departure time.The method was validated with real-world data from the campus network of Tsinghua University,with a 90.6% precision rate and a recall rate of 96.3%.Further study indicates that the users of wireless network often have shorter online time length and change faster,and the network characteristics in workdays are different from weekends.These results show that this algorithm is capable of being utilized in a real-world large-scale network.

关 键 词：无线网络 网络管理 流量分析 被动测量 侦测和测量 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]