面向SDN网络的分布式轻量级大流检测算法  

A distributed and lightweight elephant ow detection algorithm for software-de ned networks

作　　者：周京晶 黄河[1] 孙玉娥 杜扬[1] 张博宇 Jingjing ZHOU;He HUANG;Yu-E SUN;Yang DU;Boyu ZHANG(School of Computer Science and Technology,Soochow University,Suzhou 215006,China;School of Rail Transportation,Soochow University,Suzhou 215131,China;Key Laboratory of Embedded System and Service Computing(Tongji University),Ministry of Education,Shanghai 201804,China)

机构地区：[1]苏州大学计算机科学与技术学院,苏州215006 [2]苏州大学轨道交通学院,苏州215131 [3]嵌入式系统与服务计算教育部重点实验室(同济大学),上海201804

出　　处：《中国科学：信息科学》2023年第10期1924-1944,共21页Scientia Sinica(Informationis)

基　　金：国家自然科学基金(批准号:62332013,62072322,62202322,U20A20182);同济大学嵌入式系统与服务计算教育部重点实验室开放课题(批准号:ESSCKF 2022-05);江苏省自然科学基金(批准号:BK20210706);江苏省博士后科研资助(批准号:2021K165B)项目。

摘　　要：在SDN (software-defined networks)网络中检测大流对负载均衡、异常检测、流量工程等网络应用的实施及网络服务质量的提升至关重要. SDN网络通常使用流表统计流量数据,但由于存储流表的三态内容寻址寄存器(ternary content addressable memory, TCAM)资源有限,仅凭流表无法从海量网络数据中识别出所有大流,需要使用紧凑数据结构作为额外的测量模块来辅助检测.现有的研究多考虑将测量模块部署在单台或边缘交换机上,但交换机中的高速存储资源和计算资源极度紧缺,处于高流量链路上的交换机会因执行测量任务承受过高的负载,甚至影响交换机核心功能的执行.为此,本文提出了一种面向SDN网络的分布式轻量级大流检测方案.该方案将网络流量测量任务分摊至全网交换机,进而实现测量负载的均衡,并结合所设计的轻量级测量模块,有效降低了每台交换机执行测量任务所需的计算和存储开销.实验结果证明该方案较已有最新研究成果具有更高的测量精度及更低的计算和存储开销.Detecting elephant flows in software-defined networking(SDN)has broad applications in areas such as load balancing,anomaly detection,traffic engineering,and service quality management.In SDN,network traffic is usually measured by flow tables based on ternary content addressable memory(TCAM).However,using the flow table alone to measure network traffic can only store a small number of flows since TCAM is typically small and cannot identify all elephant flows from massive network streams.Therefore,to tackle this challenge,existing work uses an additional measurement module to support elephant flow detection,i.e.,deploying a compact data structure(called a Sketch)on a single switch or a set of edge switches to measure traffic.However,running a Sketch on a switch will consume its scarce high-speed memory and computing resources.The tremendous measurement overhead caused by heavy network traffic may affect the performance of other network functions.To address this issue,this paper proposes a novel distributed lightweight elephant flow detection solution.The proposed solution allocates the measurement task to the switches and uses a lightweight Sketch to perform the measurement task,thereby balancing the network-wide measurement overhead and reducing each switch’s computing overhead and memory usage effectively.Experimental results on real Internet traces demonstrate that the proposed solution has higher accuracy,lower computing overhead,and smaller memory usage compared to the state-of-the-art techniques.

关 键 词：SDN网络 网络流量测量 大流检测 分布式测量 SKETCH 

分 类 号：TP393.06[自动化与计算机技术—计算机应用技术]