基于SNMP的拓扑增强识别算法  

SNMP-based Topology Enhanced Identification Algorithm

作　　者：曾戈 李银 李睿 ZENG Ge;LI Yin;LI Rui(School of Cyberspace Security,Dongguan University of Technology,Dongguan 523808,China)

机构地区：[1]东莞理工学院网络空间安全学院,东莞523808

出　　处：《计算机系统应用》2023年第2期226-233,共8页Computer Systems & Applications

基　　金：国家重点研发计划(2021YFB3101300);国家自然科学基金面上项目(61972089)。

摘　　要：网络拓扑发现对于许多关键网络管理任务来说至关重要.然而,随着网络规模的不断增大,网络结构的愈发复杂,之前的基于SNMP的网络拓扑发现算法存在难以有效识别子网类型和多IP设备,拓扑效率、准确率低等问题.针对上述问题,本文提出了基于SNMP的拓扑增强识别(SNMP-based topology enhanced identification,SNMPTEI)算法.首先,启发式地确定子网IP地址并对其发送探针,根据探测结果来判断子网类型,在确定子网类型后及时终止探针注入防止网络负载过大;其次通过MIB-II记录的系统信息设置设备指纹,结合设备类型识别算法对终端主机IP进行设备指纹鉴定,以达到识别多IP设备的目的.实验结果表明,此方法在仿真网络中可有效识别子网和多IP设备,同时降低了网络负载,探测准确率达到了96.43%.Network topology discovery is important for many key network management tasks.However,as the network scale expands,the network structure gets complex.The previous SNMP-based network topology discovery algorithms cannot effectively identify subnet types and multi-IP devices,and they have low topology efficiency and accuracy.In view of the above problems,this study proposes an SNMP-based topology enhancement identification(SNMP-TEI)algorithm.Firstly,the subnet IP address is heuristically determined,and probes are sent to it,so as to judge the subnet type according to the detection results.In addition,probe injection is stopped in a timely manner after the subnet type is determined,so as to prevent the network load from being too large.Secondly,the device fingerprint is set through system information recorded by MIB-II,and a device type identification algorithm is used to identify the device fingerprint of the terminal host IP,so as to identify multi-IP devices.The experimental results show that this method can effectively identify subnets and multi-IP devices in simulated networks and reduce the network load,with a detection accuracy of 96.43%.

关 键 词：网络管理 SNMP 网络拓扑发现 子网识别 多IP设备识别 

分 类 号：TP393.02[自动化与计算机技术—计算机应用技术]