基于数据到达间隔的网络大流检测方法  

Elephant flow detection method based on data arrival interval

作　　者：赵亮[1] 林栎 Zhao Liang;Lin Li(School of Information Engineering,Southwest University of Science&Technology,Mianyang 621010,China;Xinjiang Electronics Research Institute Company,Urumqi 830010,China)

机构地区：[1]西南科技大学信息工程学院,四川绵阳621010 [2]新疆电子研究所股份有限公司,新疆乌鲁木齐830010

出　　处：《网络安全与数据治理》2024年第8期40-43,共4页CYBER SECURITY AND DATA GOVERNANCE

基　　金：四川省产教融合示范项目(23cjkc24);中国科技城网络应急管理研究中心项目(WLYJGL2023YB07);自治区科技支疆项目(2022E02080)。

摘　　要：大流检测是网络监管中的重要任务。现有的检测方法主要围绕流的大小来进行筛选评判。然而,真实的大流往往与数量众多的老鼠流混合在一起,尤其是当路由器存储空间有限时,依靠所能记录下来的流大小信息通常不能准确实现大流检测。为此提出一种新的大流检测方法,该方法根据流的新旧及数据到达间隔来滤除老鼠流。实验显示该方法在有限的存储空间条件下,表现出良好的检测准确性。Detecting elephant flows is a critical task in network monitoring and management.The existing detection methods mainly focus on the size of the flows,where they filter the elephant flows by size.However,the real elephant flows in high-speed network tend to be swamped by a large number of mouse flows,especially under limited memory size,resulting in the algorithm not being able to correctly detect elephant flows by size.In this paper,we propose a novel method which separates the elephant flows from the mouse flows by expelling the oldest flow which also takes on big arrival interval of data.Experimental results show that the new method achieves good precision with limited memory size.

关 键 词：网络监管 大流检测 存储空间 数据到达间隔 

分 类 号：TP393[自动化与计算机技术—计算机应用技术]