74 results about "Elephant flow" patented technology

Some embodiments provide a forwarding element that detects and handles elephant flows. In detecting, the forwarding element of some embodiments monitors statistics or measurements relating to a data flow. In handling, the forwarding element marks each packet associated with a detected elephant flow in some manner to differentiate it from a packet associated with a mouse flow. Alternatively, the forwarding element of break elephant flows into a number mouse flow by facilitating in sending packets associated with the detected elephant flow along different paths.

Systems and methods are disclosed for classifying traffic flows. A traffic agent operable to collect classification information for one or more traffic flows may be deployed at an end host communicatively coupled to a data-center network. The traffic agent, deployed in a user space independent of the operating system, may compare the classification information for a given traffic flow to a metric value. Where the classification information achieves a certain threshold indicated by the metric value, the traffic agent may classify the traffic flow as an elephant flow. In some examples, a library may be included with the traffic agent that may include a modified send function. The modified send function may provide classification information to the traffic agent indexed to the traffic flow for which it is called so that the traffic agent may analyze the classification information to potentially provide a classification for the traffic flow.

The invention provides a method and a system for distinguishing and transmitting an elephant flow. The method comprises the following steps: S1, setting characteristic flow entry of the elephant flow and an elephant flow recognizer for recognizing the elephant flow to capture a flow belonging to the elephant flow; S2, extracting a keyword combination in the captured flow to be installed in a micro-flow table, and determining an optimal path for transmitting the data flow; and S3, looking up the micro-flow table and transmitting the elephant flow based on the optimal path, and looking up a second layer or a third layer transmitting table to transmit normal flows. According to the method, by capturing the flow belonging to the elephant flow, making a difference to the elephant flow data package and selecting an optimal transmitting path to transmit the elephant flow, as a result, the possibility of 'congestion' is greatly reduced.

The invention discloses an elephant flow detection method based on a three-layer Sketch architecture, and belongs to the technical field of computer networks. The method comprises the following steps:firstly, acquiring network flow data, then analyzing the acquired real-time or offline network flow data, and taking quintuple information of the analyzed network flow data as the input of Sketch; Designing a three-layer Sketch architecture, and carrying out statistics and measurement on input network information through Hash operation and a specific replacement method; And finally, obtaining a measurement result according to the query of the three-layer Sketch architecture, and comparing the result with a preset elephant flow threshold value, thereby realizing an elephant flow detection task. An existing elephant flow detection method is innovated, and the method has the advantage that the accuracy of elephant flow detection can be greatly improved under the condition that memory consumption is not increased.

The invention discloses a data center network dynamic load balancing method based on an SDN, and belongs to the related field of load balancing in the SDN. According to the method, a whole network view is acquired in real time, the influence of mouse flow on switch flow table load and the influence of elephant flow on link load are considered in combination with network flow characteristics of a data center, and an optimal path is selected for flow through an evaluation function. And the network state is periodically monitored, and the routing strategy is adjusted. Therefore, network congestion is relieved, packet loss is reduced, the network utilization rate is improved, and the purpose of optimizing the network performance is achieved. In SDN network transmission, the controller calculates and stores a plurality of alternative paths among the access layer switches, regards a new flow as a mouse flow and selects a path with the highest flow table score for the mouse flow for routing so as to realize flow table equalization. Once the elephant flow is monitored, the elephant flow is rerouted to balance the link load. The network load balancing condition is periodically monitored, and shunting is effectively and quickly achieved by utilizing the group table when the network load is unbalanced. According to the method, the network performance is greatly improved.

The invention relates to a flow scheduling system and method based on accurate elephant flow identification. The system comprises an accurate elephant flow identification module, an elephant flow forwarding path calculation module, and an elephant flow scheduling module, wherein the elephant flow accurate identification module identifies an elephant flow by monitoring a data volume of a TCP queue during a data sending process of a terminal, sets a DSCP field of an IP packet header as an elephant flow identifier, identifies the elephant flow in a network according to the DSCP field of a data packet, calculates the average number of bytes of the flow packet, and deletes the packet from an elephant flow list if the average number of the bytes of the packet is smaller than an elephant flow screening threshold; the elephant flow forwarding path calculation module carries out calculation based on a current routing protocol so as to obtain a path with the maximum available bandwidth, and uses the path with the maximum available bandwidth as the optimum elephant flow forwarding path; and the elephant flow scheduling module sends a flow table to switches on the forwarding path through an SDN controller, so as to achieve elephant flow scheduling. The system and method provided by the invention has the advantage that the elephant flow scheduling efficiency is improved through the accurate elephant flow identification.

Embodiments of the invention provide a detection method for elephant flow, equipment and a system, relate to the technical field of communication and solve a problem that the elephant flow is detected through upgrading a forwarding chip of a switch and storing a flow table to cause high equipment cost in the existing technology. The specific scheme is as follows: a controller receives an SYN message of data flow sent by at least one switch and records parameter information of the data flow, wherein the parameter information includes receiving time of the SYN message, a serial number, a source IP address, a destination IP address, a source port and a destination port which are carried in the SYN message, and a transmission path of the data flow; if an FIN message of the data flow is not received in a preset time threshold, the controller issues a flow strategy to any switch on the data flow transmission path, receives one data message, records the serial number carried by the receiving time of the data message and computes a first average bitrate; and the controller determines the data flow as the elephant flow according to the first average bitrate. The embodiments of the invention are used for detecting the elephant flow.

The invention provides an OpenFlow flow table energy-saving storage architecture supporting QoS (Quality of Service) and application of the OpenFlow flow table energy-saving storage architecture. Thearchitecture comprises three layers, namely a priority flow/elephant flow layer, a mouse flow layer and an active connection cache layer, wherein the priority flow/elephant flow layer adopts a TCAM and a DRAM as storage media, the mouse flow layer adopts an SRAM and a DRAM as storage media, the active connection cache layer adopts an SRAM as a storage medium, and a Cuckoo hash structure is adoptedto cache a mapping relationship between active connection and flow table entries in the TCAM. According to the architecture, the TCAM is adopted to preferentially store the identification fields of the priority flow table entries, and quick flow table lookup of priority data packets is realized, so that the network service quality is guaranteed. Meanwhile, a Cuckoo cache is designed to dynamically store the current active connection and the corresponding TCAM flow entry index value in the elephant flow; the cache is hit by most of the data packets, and the corresponding flow table item is found according to the address of the hit cache item, so that a TCAM flow table lookup process is bypassed, and the flow table lookup energy consumption overhead is greatly reduced.

The invention discloses a dynamic ECMP (Equal-Cost Multi-Path) chip implementation method based on an elephant flow, and the method specifically comprises the steps: detecting the elephant flow and recording the elephant flow in a chip; looking up a route table, and obtaining an ECMP route group; judging whether the ECMP group contains an enabling dynamic ECMP or not: dynamically triggering a chip and automatically selecting a link with the smallest load if the ECMP group contains the dynamic ECMP, or else, selecting one static link according to a Hash value of a message; and finally transmitting the message according to the selected link. The method triggers the chip to automatically select the link at a right moment according to the state of the elephant flow and the current load condition of an ECMP link, selects the link with the smallest load from the ECMP members at each time, and achieves an effect of link load balancing. The method provided by the invention is simple in implementation mode, facilitates the improvement of the utilization rate of network bandwidth, and reduces the impact on the network performance from the elephant flow.

A network element connected to a data network holds a flow of data packets in a queue and periodically determines a metric of the queue. Responsively to a predetermined value of the metric the queue is associated with an elephant flow or a mouse flow. The packets are marked according to the associated flow, and the network element sends the marked packets into the data network. Other network elements process the packets according to the associated flow marked therein.

The invention discloses an elephant flow path monitoring and scheduling method based on an SDN (Software Defined Network) data center network, which specifically comprises the following steps: when aswitch receives a data flow, if the data flow is an elephant flow, the data flow is packaged into a Packet _ in message and reported to a controller; the controller selects a path for the elephant flow for transmission by adopting a path evaluation method, and adds a link on the path through which the elephant flow passes into a link monitoring table; the controller regularly checks the load condition of each link in the link monitoring table, when the load of a certain link exceeds a certain threshold value, an elephant flow is selected to be scheduled to other paths, and the link monitoringtable is updated; and meanwhile, the controller dynamically adjusts the link detection period according to the load condition of each path in the link monitoring table. According to the method, the signaling overhead and the effectiveness of the link state information collected by the controller can be balanced, the problem of link congestion caused by untimely updating of the link state information is reduced, meanwhile, the computing resources of the controller are saved, and the signaling overhead is reduced.

The embodiment of the invention provides a business flow dispatching method and device and belongs to the technical field of communication. The specific realization mode of the method comprises the steps of obtaining a traffic value of each piece of business flow identified as general flow according to set cycle time, and judging each piece of business flow according to an Elephant flow judging condition set by a user; and if the service flow satisfies the judging condition, identifying the service flow as the Elephant flow, and dispatching the Elephant flow according to a set dispatching rule. According to the business flow dispatching method, the Elephant flow can be dispatched to a current optimum exit link timely, the exit bandwidth of a network can be utilized fully, and the transmission efficiency of the business flow can be improved.

The invention discloses a ship-borne network performance self-optimization method based on reinforcement learning, and the method comprises the following steps: 1) monitoring the network state of dataflow in real time, collecting the network state, and obtaining the current network state when an elephant flow arrives; 2) identifying the service type of the data traffic; 3) counting the flow entryAction fields to obtain a service flow source/destination address of the elephant flow, and determining a scheduling path set; 4) training a deep reinforcement learning model by taking the network state of the elephant flow, the service type of the flow and the scheduling path set as input; 4) outputting a globally optimal path solution through the calculation of the deep neural network; 5, afterthe global optimal path is determined, generating a new elephant flow forwarding route, and achieving elephant flow rerouting. According to the invention, the global optimal path is calculated for the elephant flow according to the current state of the network and the service flow information, rerouting of the elephant flow is completed, and the utilization rate of network resources can be effectively increased.

The invention relates to a method for distinguishing a DDoS attack and an elephant flow based on PCA and a random forest, and belongs to the technical field of attack detection in a network. The method comprises the following steps: firstly, selecting a training set and a test set from a DDoS data set, and adding an elephant stream data set into the training set and the test set respectively; performing PCA processing and dimension reduction on the data in the training set to obtain a low-dimensional feature matrix; then putting the low-dimensional feature matrix into a random forest model for training to obtain a random forest classifier; and finally, inputting a test set sample into the trained random forest classifier to obtain a classification result. When a DDoS attack occurs, a legal elephant stream and a DDoS attack stream can be distinguished by using the random forest.

A method and system for processing data packets in a data network have been disclosed. The method comprising: dividing flows containing data packets into elephant flows and mice flows according to a particular division parameter, wherein, an elephant flow contains more data packets than a mice flow; transmitting the divided elephant flows and mice flows to a virtual switch in a server; processing the mice flows at the virtual switch, and transmitting the elephant flows and the processed mice flows to a hardware switch in network; and processing the elephant flows at the hardware switch, and forwarding the received mice flows and the processed elephant flows. With the method and system, network performance may be effectively improved.

The embodiment of the invention provides a data stream processing method and device, electronic equipment and a storage medium. The method comprises the following steps: detecting whether a message flow sent to a central processing unit has a high-rate flow or not; if the large-rate flow exists, calculating the proportion of the message flow corresponding to various message header information in the large-rate flow in the large-rate flow; if the proportion of the message flow corresponding to the first message header information is greater than a first preset threshold, installing a hardware speed limiting entry for the message flow corresponding to the first message header information, and limiting the speed of the message flow. According to the data flow processing method provided by theembodiment of the invention, the generation of the elephant flow in the message flow sent to the CPU is detected, the message header information of the elephant flow is analyzed, the message with more bandwidth occupied by the elephant flow is dynamically suppressed, the elephant flow is prevented from influencing the mouse flow sent to the CPU, and the CPU resources of the switch are reasonablyand fully utilized.

The invention discloses an IPFIX-based elephant flow processing method and device. The method comprises the steps of receiving a message marked as an elephant flow and learning the elephant flow intoan IPFIX flow table through an IPFIX flow table statistical mechanism, wherein the IPFIX flow table performs byte number statistics on each elephant flow; periodically scanning the IPFIX flow table, determining whether the byte number of each elephant flow in the IPFIX flow table is greater than a preset threshold value or not, determining the elephant flow of which the byte number is smaller thanthe preset threshold value as a mistakenly detected mice flow, and uploading the elephant flow to a CPU for processing. According to the method, the mice flow which is mistakenly detected as the elephant flow in the elephant flow can be accurately removed, the accuracy of data center network optimization is improved, and CPU resources are saved.