RBFRadar:基于可编程数据平面检测价值突发流  

RBFRadar:Detecting Remarkable Burst Flows with Programmable Data Plane

作　　者：吴艳妮 周政演 陈翰泽 张栋 WU Yanni;ZHOU Zhengyan;CHEN Hanze;ZHANG Dong(College of Computer and Data Science,Fuzhou University,Fuzhou 350108,China;Quan Cheng Laboratory,Jinan 250100,China;College of Computer Science and Technology,Zhejiang University,Hangzhou 310013,China;Zhicheng College,Fuzhou University,Fuzhou 350002,China)

机构地区：[1]福州大学计算机与大数据学院,福州350108 [2]泉城省实验室,济南250100 [3]浙江大学计算机科学与技术学院,杭州310013 [4]福州大学至诚学院,福州350002

出　　处：《计算机科学》2024年第4期48-55,共8页Computer Science

基　　金：国家重点研发计划专项(2023YFB2904000,2023YFB2904005);泉城省实验室(QCLZD202304);山东省实验室项目(SYS202201)。

摘　　要：在各种网络流量中,突发是一种常见且重要的流量模式。突发会增大网络时延并影响应用性能,因此对突发流的检测、分析和缓解对于提升网络性能和鲁棒性是有意义的。然而,当前基于逐次突发的检测方案存在显著的带宽开销和高用户负担问题。文中通过观察并分析多个场景下的突发流量特征,提出了价值突发流(Remarkable Burst Flow,RBF)检测,在降低带宽开销的同时,减少了传统突发检测中的密集手工劳动和专家经验要求,减轻了网络管理者的负担。RBFRadar是基于Sketch数据结构的框架,支持可编程数据平面上的RBF检测,在一段时间内观察流级别的突发性。该框架仅产生有限的内存占用和低时间复杂性,其原型可在PISA架构上实现。实验结果表明,在检测RBF的准确性方面,RBFRadar的F1分数是现有方案的5.6~23.4倍;在带宽开销方面,与基于逐次突发的检测方案相比,RBFRadar可降低84.62%~98.84%的带宽开销。Burst is a common and important traffic pattern in diverse network traffics.Since bursts may increase network latency and have a non-trivial impact on application performance,the efforts to detect,analyze and mitigate burst flows are meaningful for improving the performance and robustness of network.However,existing per-burst-based detection schemes face the limitations of significant bandwidth overheads and high user burdens.This paper proposes the detection of remarkable burst flows(RBFs)via observing and analyzing the characteristics of burst flows in various scenarios.The detection of RBFs reduces the bandwidth overheads.At the same time,such detection process avoids the requirements of intensive manual labor and expert experience,and mitigate the burdens of network operators.We propose RBFRadar,a Sketch-based RBF detection framework that supports RBF detection on programmable data plane,observing flow-level burstiness in a period.We prototype RBFRadar in PISA architecture with limited memory footprints and low time complexity.Experiments demonstrate that the F1-score of RBFRadar in RBF detection is 5.6 times to 23.4 times higher than that of existing schemes.Compared with per-burst detection,the bandwidth overhead could be reduced by 84.62%to 98.84%.

关 键 词：突发流检测 SKETCH 网络测量 可编程数据平面 数据中心网络 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]