流的大小与传输速率相结合的双门限检测算法  

Dual threshold elephant flow detection algorithm combined flow size with transmission rate

作　　者：李春强[1] 董永强[1,2] 吴国新[1,2] LI Chunqiang;DONG Yongqiang;WU Guoxin(School of Computer Science and Engineering,Southeast University,Nanjing 211189,China;Ministry of Education Key Laboratory of Computer Network and Information Integration,Southeast University,Nanjing 211189,China)

机构地区：[1]东南大学计算机科学与工程学院,江苏南京211189 [2]东南大学计算机网络和信息集成教育部重点实验室,江苏南京211189

出　　处：《国防科技大学学报》2018年第6期75-81,共7页Journal of National University of Defense Technology

基　　金：国家863计划资助项目(2013AA013503);国家自然科学基金资助项目(61272532);赛尔网络下一代互联网技术创新资助项目(NGII20160407)

摘　　要：提出基于流传输速率与数据量的双门限检测算法。为满足高速网络传输的性能要求,使用Hash表存储流检测的数据结构,将Hash表的冲突处理与基于流速率的缓存替换相结合以实现高效的大流检测,通过限制Hash桶的容量,确保报文的处理性能。真实网络数据的仿真测试结果表明:所提算法在相近的存储开销下,保持了较高的处理性能,准确性优于基于最近最少使用算法的大流检测及其派生算法以及基于统计计数的紧凑型空间节省算法。A novel algorithm which is based on both the flows’ size and transmission rate was proposed for elephant flow detection. In order to meet the performance requirement of high speed networks,the data structure of elephant flow detection was indexed by Hash table,which combines the Hash conflict resolution with the eviction of cached flow entry to identify the elephant flow efficiently. A theoretical analysis was conducted to demonstrate the accuracy,performance and memory overhead of the detection algorithm. Experimental results on real data sets show that the proposed algorithm outperforms least recently used detection algorithm,its derivations and compact space saving detection algorithm in terms of accuracy and performance with similar memory overhead.

关 键 词：流检测 HASH表 传输速率 Hash冲突 缓存替换 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]