Network traffic measurement method and system, computer equipment, storage medium and application

Abstract

The invention belongs to the technical field of network flow measurement, discloses a network flow measurement method and system, computer equipment, a storage medium and application, and adopts a novel extensible reversible data compression fusion model capable of simultaneously realizing efficient and accurate network flow measurement of a memory. The model can dynamically and adaptively expand and compress the size of the memory occupied by the fusion model according to the distribution condition of network traffic information. The core idea of the invention is that counters with different sizes are utilized to monitor a low-cardinal-number host and a high-cardinal-number host respectively, that is, a small-sized counter is utilized to monitor the low-cardinal-number host, and a counter capable of adaptively expanding the size is utilized to monitor the high-cardinal-number host; and efficient memory utilization during low-cardinal-number host monitoring and high accuracy during high-cardinal-number host monitoring are ensured. Based on the model, the invention designs a rapid and efficient network flow measurement method to accurately analyze the cardinal number of the host, rapidly identify the super host and efficiently reconstruct the abnormal address.

Description

technical field [0001] The invention belongs to the technical field of network flow measurement, and in particular relates to a network flow measurement method, system, computer equipment, storage medium and application. Background technique [0002] At present, with the continuous improvement of network data forwarding speed, an online data processing model with fast data collection speed and high memory usage efficiency is urgently needed. The summary data structure belongs to the data structure based on probability and statistics, which has been widely used in many aspects of network traffic analysis, such as traffic size estimation, host cardinality estimation, and network anomaly detection. They use data-oriented hashing methods to compress security parameters in a compact way, and perform probability estimation on data through specific operations. Utilizing the advantages of the summary data structure in efficiently compressing fusion data and accurately estimating, i...

Images