74 results about "Elephant flow" patented technology

Some embodiments provide a forwarding element that detects and handles elephant flows. In detecting, the forwarding element of some embodiments monitors statistics or measurements relating to a data flow. In handling, the forwarding element marks each packet associated with a detected elephant flow in some manner to differentiate it from a packet associated with a mouse flow. Alternatively, the forwarding element of break elephant flows into a number mouse flow by facilitating in sending packets associated with the detected elephant flow along different paths.

Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

Systems and methods are disclosed for classifying traffic flows. A traffic agent operable to collect classification information for one or more traffic flows may be deployed at an end host communicatively coupled to a data-center network. The traffic agent, deployed in a user space independent of the operating system, may compare the classification information for a given traffic flow to a metric value. Where the classification information achieves a certain threshold indicated by the metric value, the traffic agent may classify the traffic flow as an elephant flow. In some examples, a library may be included with the traffic agent that may include a modified send function. The modified send function may provide classification information to the traffic agent indexed to the traffic flow for which it is called so that the traffic agent may analyze the classification information to potentially provide a classification for the traffic flow.

The invention provides a method and a system for distinguishing and transmitting an elephant flow. The method comprises the following steps: S1, setting characteristic flow entry of the elephant flow and an elephant flow recognizer for recognizing the elephant flow to capture a flow belonging to the elephant flow; S2, extracting a keyword combination in the captured flow to be installed in a micro-flow table, and determining an optimal path for transmitting the data flow; and S3, looking up the micro-flow table and transmitting the elephant flow based on the optimal path, and looking up a second layer or a third layer transmitting table to transmit normal flows. According to the method, by capturing the flow belonging to the elephant flow, making a difference to the elephant flow data package and selecting an optimal transmitting path to transmit the elephant flow, as a result, the possibility of 'congestion' is greatly reduced.

The invention discloses a network management method and system supporting elephant flow, a network switch and a communication network. The network management method supporting the elephant flow comprises the following steps: when the elephant flow is detected in the network, a source address and a target address of the elephant flow are extracted, a plurality of paths between the source address and the target address are acquired, and weight of corresponding paths which support the elephant flow is calculated according to network loads and network topologies of the paths; the network management system generates a forwarding table of the network switch and sends the forwarding table to the network switch, wherein the forwarding table comprises the weight of the corresponding paths which support the elephant flow and an operational order of the network switch, and therefore the network switch can execute the forwarding table and distribute the rate of the elephant flow according to the weight of the corresponding paths. By the adoption of the network management method and system, the flux of the communication network where the elephant flow exists can keep balanced, network performance is improved effectively, and the resource utilization rate is also increased effectively.

Some embodiments provide a forwarding element that inspects the size of each of several packets in a data flow to determine whether the data flow is an elephant flow. The forwarding element inspects the size because, in order for the packet to be of a certain size, the data flow had to already have gone through a slow start in which smaller packets are transferred and by definition be an elephant flow. When the forwarding element receives a packet in a data flow, the forwarding element identifies the size of the packet. The forwarding element then determines if the size of the packet is greater than a threshold size. If the size is greater, the forwarding element specifies that the packet's data flow is an elephant flow.

The invention discloses a method and a device for scheduling a maximum probability path flow of an SDN-oriented data center network. The method comprises the following steps: S1: obtaining flow relevant information via a switch; S2: judging the flow and judging whether the flow is an elephant flow; if the flow is not the elephant flow, obtaining optional paths of the flow according to the information of the flow and global topological information of controller maintenance, and then selecting any path for the flow; and if the flow F is the elephant flow, selecting a probability path algorithm to calculate one path which meets flow bandwidth requirements for the flow F; and S3: after selecting one path for the flow F, sending a flow entry to the switch; and after the flow F is matched with the flow entry, carrying out data forwarding according to an action or matching residual data of the flow F to a new flow entry for forwarding; and the device is used for realizing above method. The method and the device disclosed by the invention have the advantages of simple principle, wide application range, easiness in realization, and capability of reducing network congestion to take a network balancing effect, etc.

The invention discloses an elephant flow detection method based on a three-layer Sketch architecture, and belongs to the technical field of computer networks. The method comprises the following steps:firstly, acquiring network flow data, then analyzing the acquired real-time or offline network flow data, and taking quintuple information of the analyzed network flow data as the input of Sketch; Designing a three-layer Sketch architecture, and carrying out statistics and measurement on input network information through Hash operation and a specific replacement method; And finally, obtaining a measurement result according to the query of the three-layer Sketch architecture, and comparing the result with a preset elephant flow threshold value, thereby realizing an elephant flow detection task. An existing elephant flow detection method is innovated, and the method has the advantage that the accuracy of elephant flow detection can be greatly improved under the condition that memory consumption is not increased.

The invention discloses a data center network dynamic load balancing method based on an SDN, and belongs to the related field of load balancing in the SDN. According to the method, a whole network view is acquired in real time, the influence of mouse flow on switch flow table load and the influence of elephant flow on link load are considered in combination with network flow characteristics of a data center, and an optimal path is selected for flow through an evaluation function. And the network state is periodically monitored, and the routing strategy is adjusted. Therefore, network congestion is relieved, packet loss is reduced, the network utilization rate is improved, and the purpose of optimizing the network performance is achieved. In SDN network transmission, the controller calculates and stores a plurality of alternative paths among the access layer switches, regards a new flow as a mouse flow and selects a path with the highest flow table score for the mouse flow for routing so as to realize flow table equalization. Once the elephant flow is monitored, the elephant flow is rerouted to balance the link load. The network load balancing condition is periodically monitored, and shunting is effectively and quickly achieved by utilizing the group table when the network load is unbalanced. According to the method, the network performance is greatly improved.

The invention relates to a flow scheduling system and method based on accurate elephant flow identification. The system comprises an accurate elephant flow identification module, an elephant flow forwarding path calculation module, and an elephant flow scheduling module, wherein the elephant flow accurate identification module identifies an elephant flow by monitoring a data volume of a TCP queue during a data sending process of a terminal, sets a DSCP field of an IP packet header as an elephant flow identifier, identifies the elephant flow in a network according to the DSCP field of a data packet, calculates the average number of bytes of the flow packet, and deletes the packet from an elephant flow list if the average number of the bytes of the packet is smaller than an elephant flow screening threshold; the elephant flow forwarding path calculation module carries out calculation based on a current routing protocol so as to obtain a path with the maximum available bandwidth, and uses the path with the maximum available bandwidth as the optimum elephant flow forwarding path; and the elephant flow scheduling module sends a flow table to switches on the forwarding path through an SDN controller, so as to achieve elephant flow scheduling. The system and method provided by the invention has the advantage that the elephant flow scheduling efficiency is improved through the accurate elephant flow identification.

Embodiments of the invention provide a detection method for elephant flow, equipment and a system, relate to the technical field of communication and solve a problem that the elephant flow is detected through upgrading a forwarding chip of a switch and storing a flow table to cause high equipment cost in the existing technology. The specific scheme is as follows: a controller receives an SYN message of data flow sent by at least one switch and records parameter information of the data flow, wherein the parameter information includes receiving time of the SYN message, a serial number, a source IP address, a destination IP address, a source port and a destination port which are carried in the SYN message, and a transmission path of the data flow; if an FIN message of the data flow is not received in a preset time threshold, the controller issues a flow strategy to any switch on the data flow transmission path, receives one data message, records the serial number carried by the receiving time of the data message and computes a first average bitrate; and the controller determines the data flow as the elephant flow according to the first average bitrate. The embodiments of the invention are used for detecting the elephant flow.

The invention provides an OpenFlow flow table energy-saving storage architecture supporting QoS (Quality of Service) and application of the OpenFlow flow table energy-saving storage architecture. Thearchitecture comprises three layers, namely a priority flow / elephant flow layer, a mouse flow layer and an active connection cache layer, wherein the priority flow / elephant flow layer adopts a TCAM and a DRAM as storage media, the mouse flow layer adopts an SRAM and a DRAM as storage media, the active connection cache layer adopts an SRAM as a storage medium, and a Cuckoo hash structure is adoptedto cache a mapping relationship between active connection and flow table entries in the TCAM. According to the architecture, the TCAM is adopted to preferentially store the identification fields of the priority flow table entries, and quick flow table lookup of priority data packets is realized, so that the network service quality is guaranteed. Meanwhile, a Cuckoo cache is designed to dynamically store the current active connection and the corresponding TCAM flow entry index value in the elephant flow; the cache is hit by most of the data packets, and the corresponding flow table item is found according to the address of the hit cache item, so that a TCAM flow table lookup process is bypassed, and the flow table lookup energy consumption overhead is greatly reduced.

The invention discloses a dynamic ECMP (Equal-Cost Multi-Path) chip implementation method based on an elephant flow, and the method specifically comprises the steps: detecting the elephant flow and recording the elephant flow in a chip; looking up a route table, and obtaining an ECMP route group; judging whether the ECMP group contains an enabling dynamic ECMP or not: dynamically triggering a chip and automatically selecting a link with the smallest load if the ECMP group contains the dynamic ECMP, or else, selecting one static link according to a Hash value of a message; and finally transmitting the message according to the selected link. The method triggers the chip to automatically select the link at a right moment according to the state of the elephant flow and the current load condition of an ECMP link, selects the link with the smallest load from the ECMP members at each time, and achieves an effect of link load balancing. The method provided by the invention is simple in implementation mode, facilitates the improvement of the utilization rate of network bandwidth, and reduces the impact on the network performance from the elephant flow.

A network element connected to a data network holds a flow of data packets in a queue and periodically determines a metric of the queue. Responsively to a predetermined value of the metric the queue is associated with an elephant flow or a mouse flow. The packets are marked according to the associated flow, and the network element sends the marked packets into the data network. Other network elements process the packets according to the associated flow marked therein.

The invention discloses an elephant flow path monitoring and scheduling method based on an SDN (Software Defined Network) data center network, which specifically comprises the following steps: when aswitch receives a data flow, if the data flow is an elephant flow, the data flow is packaged into a Packet _ in message and reported to a controller; the controller selects a path for the elephant flow for transmission by adopting a path evaluation method, and adds a link on the path through which the elephant flow passes into a link monitoring table; the controller regularly checks the load condition of each link in the link monitoring table, when the load of a certain link exceeds a certain threshold value, an elephant flow is selected to be scheduled to other paths, and the link monitoringtable is updated; and meanwhile, the controller dynamically adjusts the link detection period according to the load condition of each path in the link monitoring table. According to the method, the signaling overhead and the effectiveness of the link state information collected by the controller can be balanced, the problem of link congestion caused by untimely updating of the link state information is reduced, meanwhile, the computing resources of the controller are saved, and the signaling overhead is reduced.

The embodiment of the invention provides a business flow dispatching method and device and belongs to the technical field of communication. The specific realization mode of the method comprises the steps of obtaining a traffic value of each piece of business flow identified as general flow according to set cycle time, and judging each piece of business flow according to an Elephant flow judging condition set by a user; and if the service flow satisfies the judging condition, identifying the service flow as the Elephant flow, and dispatching the Elephant flow according to a set dispatching rule. According to the business flow dispatching method, the Elephant flow can be dispatched to a current optimum exit link timely, the exit bandwidth of a network can be utilized fully, and the transmission efficiency of the business flow can be improved.

The invention provides an elephant-flow load balancing transmitting method and device. The elephant-flow load balancing transmitting method comprises the steps that, after each statistical cycle is started, whether a current flow needs to be switched to any other transmission port of an exchanger or not is judged in sequence; if yes, an output port meeting switching conditions is searched; after the flow is switched to the output port meeting the switching conditions, the output port meeting the switching conditions is locked instantly, and an election right of the output port is stopped; the output port is unlocked after at least one statistical cycle, and the election right of the output port is recovered; if not, the flow is transmitted through a current transmission port. After each transmission port of the exchanger receives any one flow, the corresponding transmission port is locked instantly, and the election right of the transmission port is stopped; the corresponding transmission port is unlocked after at least one statistical cycle, the dynamic load balancing performance of the exchanger is effectively improved, and further the situations of transmission congestion and packet loss are avoided.

The invention discloses a ship-borne network performance self-optimization method based on reinforcement learning, and the method comprises the following steps: 1) monitoring the network state of dataflow in real time, collecting the network state, and obtaining the current network state when an elephant flow arrives; 2) identifying the service type of the data traffic; 3) counting the flow entryAction fields to obtain a service flow source / destination address of the elephant flow, and determining a scheduling path set; 4) training a deep reinforcement learning model by taking the network state of the elephant flow, the service type of the flow and the scheduling path set as input; 4) outputting a globally optimal path solution through the calculation of the deep neural network; 5, afterthe global optimal path is determined, generating a new elephant flow forwarding route, and achieving elephant flow rerouting. According to the invention, the global optimal path is calculated for the elephant flow according to the current state of the network and the service flow information, rerouting of the elephant flow is completed, and the utilization rate of network resources can be effectively increased.

The invention discloses a service function chain (SFC) deployment method based on flow splitting. During deployment of an elephant flow SFC request, an SFC is split into a plurality of sub-chains fordeployment, so that the elephant flow receptance rate is improved; the excessive queuing delay of mouse flow queued after elephant flow due to network congestion caused by occupation of excessive bandwidth resources by the elephant flow can be relieved; and the quality of service of a data center network is improved. According to a deployment algorithm provided by the invention, a chain with mostremaining bandwidth resources is selected based on a worst-fit strategy for deployment, so that the network congestion can be reduced. During deployment of the SFC with the algorithm provided by the invention, the hops between servers deployed with the virtual network function of the same SFC in the network are minimized to lower the consumption of network bandwidth resources.

The invention relates to a method for distinguishing a DDoS attack and an elephant flow based on PCA and a random forest, and belongs to the technical field of attack detection in a network. The method comprises the following steps: firstly, selecting a training set and a test set from a DDoS data set, and adding an elephant stream data set into the training set and the test set respectively; performing PCA processing and dimension reduction on the data in the training set to obtain a low-dimensional feature matrix; then putting the low-dimensional feature matrix into a random forest model for training to obtain a random forest classifier; and finally, inputting a test set sample into the trained random forest classifier to obtain a classification result. When a DDoS attack occurs, a legal elephant stream and a DDoS attack stream can be distinguished by using the random forest.

A method and system for processing data packets in a data network have been disclosed. The method comprising: dividing flows containing data packets into elephant flows and mice flows according to a particular division parameter, wherein, an elephant flow contains more data packets than a mice flow; transmitting the divided elephant flows and mice flows to a virtual switch in a server; processing the mice flows at the virtual switch, and transmitting the elephant flows and the processed mice flows to a hardware switch in network; and processing the elephant flows at the hardware switch, and forwarding the received mice flows and the processed elephant flows. With the method and system, network performance may be effectively improved.

The invention discloses a method and a device for improving delay sensitive flow forwarding performance, and belongs to the technical field of network communication. The method comprises the followingsteps: receiving a message and identifying the message as elephant flow or mouse flow; dynamically adjusting the priorities of the mouse flow and the elephant flow in the forwarding chip, so that thepriority of the mouse flow in the forwarding chip is higher than that of the elephant flow, and the mouse flow and the elephant flow further entering different outlet queues; and scheduling the exitqueue where the mouse flow is located through a priority scheduling algorithm, and scheduling the exit queue where the elephant flow is located through a polling scheduling algorithm. According to themethod, the mouse flow sensitive to the time delay and the elephant flow insensitive to the time delay are identified, the priorities of the mouse flow and the elephant flow are dynamically adjusted,and different scheduling strategies are configured, so that the forwarding performance of the time delay sensitive flow can be effectively improved.

The invention provides a method and a device for precisely detecting aging of an elephant flow. The method comprises the following steps of: scanning an elephant flow table sequentially within each scanning cycle; recording the numerical value of the meet counter of the current flow byte after a flow byte is scanned each time; and judging whether the numerical value of the aging mechanism cycle of the current flow item is equal to or greater than a preset threshold value of the aging mechanism cycle of the system, if so, judging that the current flow time is aged. According to the method and the device for precisely detecting the aging of the elephant flow, a novel aging mechanism of the elephant flow is designed, the numerical value of the aging mechanism cycle of the current flow item is recorded after scanning each time; whether the current flow item is aged is judged according to the numerical value of the aging mechanism cycle of the current flow item; therefore, the judgment of the aging of the elephant flow cannot be affected by the variation and jitter of the TCP conversation variation in discharge; the method and the device can be accurately used for aging the flow items of the elephant flow when the corresponding TCP conversation is about to end, and the elephant flow-based load balancing efficiency is improved.

The embodiment of the invention provides a data stream processing method and device, electronic equipment and a storage medium. The method comprises the following steps: detecting whether a message flow sent to a central processing unit has a high-rate flow or not; if the large-rate flow exists, calculating the proportion of the message flow corresponding to various message header information in the large-rate flow in the large-rate flow; if the proportion of the message flow corresponding to the first message header information is greater than a first preset threshold, installing a hardware speed limiting entry for the message flow corresponding to the first message header information, and limiting the speed of the message flow. According to the data flow processing method provided by theembodiment of the invention, the generation of the elephant flow in the message flow sent to the CPU is detected, the message header information of the elephant flow is analyzed, the message with more bandwidth occupied by the elephant flow is dynamically suppressed, the elephant flow is prevented from influencing the mouse flow sent to the CPU, and the CPU resources of the switch are reasonablyand fully utilized.

The invention discloses a method and a device for improving the utilization rate of an elephant flow table. The method comprises the following steps: receiving a data packet and judging whether the data packet is an elephant flow or not; When the judgment result is the elephant flow, searching an elephant flow table; Judging whether the current elephant flow exists in an elephant flow table or notaccording to a searching result; If the judgment result is that the current elephant flow does not exist, further judging whether the current elephant flow conflicts with the existing elephant flow in the elephant flow table or not; When the judgment result is conflict, the residence time of the elephant flow conflicting with the current elephant flow in the elephant flow table is obtained, the elephant flow with the longest residence time is aged in advance, and the current elephant flow is further learned into the elephant flow table. According to the method, advanced aging is decided by detecting the residence time of the conflict elephant flow, storage items are provided for the current newly detected elephant flow, more elephant flows are recorded by utilizing limited flow table resources, and the utilization rate of the elephant flow table is improved.

Packet flows received in a data network are assigned to respective entries of a database. During an accumulation interval byte counts of the assigned packet flows are accumulated in the respective database entries. The packet flows are classified as elephant flows when differences between the byte counts and a reference byte count exceed a threshold and are reported after expiration of the accumulation interval.

A method includes identifying one or more elephant flows operated by a plurality of user equipment (UE) terminals located in a first coverage area, comparing the one or more elephant flows to threshold characteristics, determining whether the coverage area is congested, causing handover of the plurality of UE terminals from the first coverage area when the one or more elephant flows exceed the threshold characteristics and the first coverage area is congested.

The invention belongs to the technical field of communication networks, and particularly relates to a flow table optimization method and device based on an SDN, the device comprises a network flow distinguishing module and a flow table processing module, a space threshold value St is set, whether the flow table space occupancy rate exceeds the space threshold value St is judged, if not, the fixed maximum timeout time of a flow table item issued by a controller is Thard, if yes, the flow is detected through the network data flow distinguishing module, whether the flow is larger than the average flow on the link or not is judged, if not, the flow is the mouse flow, and the flow table processing module distributes the timeout time Tms for the mouse flow; if yes, the stream is uploaded to the controller, an elephant stream is selected via screening from the streams uploaded to the controller through a stream table processing module, and timeout time Tel is distributed for the elephant stream; according to the method, the dynamic timeout time can be provided for the elephant flow, the possibility that the elephant flow is cut off is reduced, and the invalid time that the flow table entries occupy the flow table space is reduced, so that the controller load is reduced and the network performance is improved.

Some embodiments provide a system that detects whether a data flow is an elephant flow; and if so, the system treats it differently than a mouse flow. The system of some embodiments detects an elephant flow by examining, among other items, the operations of a machine. In detecting, the system identifies an initiation of a new data flow associated with the machine. The new data flow can be an outbound data flow or an inbound data flow. The system then determines, based on the amount of data being sent or received, if the data flow is an elephant flow. The system of some embodiments identifies the initiation of a new data flow by intercepting a socket call or request to transfer a file.

The invention discloses an IPFIX-based elephant flow processing method and device. The method comprises the steps of receiving a message marked as an elephant flow and learning the elephant flow intoan IPFIX flow table through an IPFIX flow table statistical mechanism, wherein the IPFIX flow table performs byte number statistics on each elephant flow; periodically scanning the IPFIX flow table, determining whether the byte number of each elephant flow in the IPFIX flow table is greater than a preset threshold value or not, determining the elephant flow of which the byte number is smaller thanthe preset threshold value as a mistakenly detected mice flow, and uploading the elephant flow to a CPU for processing. According to the method, the mice flow which is mistakenly detected as the elephant flow in the elephant flow can be accurately removed, the accuracy of data center network optimization is improved, and CPU resources are saved.