An active IP host number statistics method based on a binary hash table

Abstract

The invention discloses an active IP host number statistical method based on a binary hash table, which belongs to the field of network security monitoring, and solves the defects of an active detection method and a passive detection method in the prior art. The method comprises the steps of establishing a data structure required by the quantity statistics of the active IP hosts, setting an initial value, wherein the data structure comprises a binary hash table, an IP host counter, a start timestamp and a time period; analyzing the network flow, namely, operating the source IP address of eachIP packet by using a hash function to obtain a hash value; updating the hash value in the binary hash table, and modifying an IP host counter at the same time; and judging whether the difference between the current timestamp and the starting timestamp is greater than or equal to the time period, outputting the value of the counter of the IP host if the difference is greater than or equal to the time period, and carrying out a new round of statistics, otherwise, circularly analyzing the network flow and counting the active IP host. The method is used for counting the number of the active IP hosts.

Description

technical field [0001] The invention discloses a method for counting the number of active IP hosts based on a binary hash table, which is used for counting the number of active IP hosts in network traffic, and belongs to the field of network security monitoring. Background technique [0002] With the continuous development of the Internet, the scale of the network is expanding day by day, and the number of network services carried by it is gradually increasing. Network security has become an issue of increasing concern to people. Network attacks represented by DDoS attacks have caused many security incidents. A large number of existing studies start with network communication traffic analysis to carry out network security detection. One of the important basic capabilities is to quickly count the number of active IP hosts in the current network. . [0003] According to the search, the current statistical methods for network active hosts are as follows: [0004] 1. The paten...

AI Technical Summary

Problems solved by technology

[0008] For the problems of above-mentioned research, the object of the present invention is to provide a kind of active IP host quantity statistics method based on binary hash table, solve in the prior art: (1) active detection method needs to send detection message to each IP address, It is easy to cause additional network load, and it is also easy to be intercepted by security protection devices such as firewalls, resulting in the failure of sending detection messages, so that accurate statistics cannot be obtained

Images