Multiple-category large-flow parallel measuring method under high speed network environment

Abstract

The invention relates to a multiple-category large-flow parallel measuring method under high speed network environment. The method comprises the following steps: 1) port mirror is set on a network device so that all the network messages passing through the device are copied and sent to a network monitoring front-end processor; 2) the front-end processor adopts TS-LRU algorithm and 1 hierarchical structure, each hierarchy contains constant storage units; the first hierarchy is used to store fine grain steam, when the storage units are not enough, one fine grain steam is selected through LRU strategy to eliminate; the other n-numbered hierarchies are used to store steam types to be measured, each hierarchy stores one kind of steams, the fine grain steams eliminated by the first hierarchy can be separately classified in the corresponding steams of the n-numbered hierarchies, when the storage units are not enough, one steam is selected through LRU-Size strategy to eliminate; and 3) when each measurement period ends, TS-LRU reports the large-flow passing through the node and the number of messages thereof or the number of bytes thereof to the network monitoring equipment.

Description

technical field [0001] The invention relates to a multi-type large flow parallel measurement method in a high-speed network environment. Background technique [0002] With the rapid development of Internet technology, various network applications have brought great convenience to our life. With the increasing dependence of human beings on the Internet, it is particularly important to ensure a smooth and safe network environment. However, the frequent occurrence of basic operation network congestion incidents caused by the outbreak of large-scale network security incidents has caused a wide range of network operations to be affected, making it difficult for information systems to provide normal external services, resulting in significant economic losses and social impacts. In order to provide stable Internet services, it is necessary to gain an in-depth understanding of network load conditions through network traffic monitoring, and timely discover and control the spread of...

AI Technical Summary

Problems solved by technology

These algorithms can effectively reduce storage space requirements and improve measurement efficiency, but there is a certain gap with the requirements of network monitoring: on the one hand, the sampling strategy or multi-resolution strategy adopted will inevitably introduce large errors. The research results show that, The deviation caused by the sampling method will obviously affect the accuracy of attack detection; on the other hand, network monitoring usually requires large flow information of multiple modes at the same time, and the above measurement algorithm needs to run different algorithm instances for measuring different modes of large flow, which seriously weakens the Algorithm scalability

Images