11 results about "Network traffic measurement" patented technology

Systems, switches, network endpoints, and methods are provided. In one example, a system is described that includes a latency measurement circuit to measure traffic on a network from an endpoint sender to an endpoint receiver across multiple paths. The system also includes a packet marking circuit to provide a routing mark for a packet destined for the endpoint receiver according to a network traffic measurement provided by the latency measurement circuit, where the routing mark provides an indication that supports routing for the packet to reach the endpoint receiver via a chosen path or subset of paths among the multiple paths.

The invention discloses a network flow measurement method and device based on a data packet interval sketch data structure and a medium. Each arriving data packet is mapped to each corresponding bucket in a sketch data structure through a plurality of independent hash functions, the sketch data structure is a two-dimensional array form structure comprising multi-row and multi-column buckets, and empty bucket processing, identical flow updating or conflict flow replacement judgment is executed according to the conditions of the data packets and the buckets. According to the method, a brand-new interval value sketch is designed, and efficient and accurate large flow detection is realized on the premise of high processing speed and low memory occupation by comprehensively utilizing two pieces of multi-dimensional statistical information of the flow estimation value and the data packet interval. Meanwhile, the large flow and the small flow in the network environment can be well distinguished, so that the method can be better suitable for network measurement tasks in different scenes such as large flow detection and abrupt flow detection.

A network traffic computing system obtains on-router traffic data, on-server traffic data and application log data. A data processing system extracts features from the data sources, splits the extracted features based upon destination and source ports and performs component-level aggregation of the features. The aggregated data is surfaced for monitoring and traffic control.

This invention relates to a method for analyzing network traffic and measuring the control scale of a botnet. First, it collects samples of discovered botnet programs to establish a dataset of botnet command and control instruction characteristics. By analyzing inbound and outbound network traffic, it identifies and records session information matching the instruction characteristics, recording botnet command and control logs. It then correlates the command and control logs with domain name request logs in network traffic in real time, adding a C2 control domain name field to the command and control logs. Finally, it uses a botnet control scale measurement algorithm to analyze the command and control logs, calculating the cumulative number of communicating botnet IPs and the daily number of communicating botnet IPs for each botnet family, each C2 control domain name, and each C2 IP address, thereby detecting botnets with large or rapidly expanding control scales. This invention accurately identifies botnet traffic from network traffic accessing C2 servers and then calculates the botnet scale, providing more comprehensive coverage and accurate measurement.

Systems, switches, network endpoints, and methods are provided. In one example, a system is described that includes a latency measurement circuit to measure traffic on a network from an endpoint sender to an endpoint receiver across multiple paths. The system also includes a packet marking circuit to provide a routing mark for a packet destined for the endpoint receiver according to a network traffic measurement provided by the latency measurement circuit, where the routing mark provides an indication that supports routing for the packet to reach the endpoint receiver via a chosen path or subset of paths among the multiple paths.

1. The name of the design product: test instrument. 2. The use of the design product: for but not limited to oscilloscope, error code instrument, network flow measuring instrument, fast wavelength meter, precision digital source table, low leakage matrix switch and other high-end test instruments. 3. The design points of the design product: in shape. 4. The picture or photo that can best show the design points: perspective view.

The invention discloses adaptive routing with endpoint feedback. Systems, switches, network endpoints, and methods are provided. In one example, a system is described that includes a delay measurement circuit to measure traffic over a network across multiple paths from an endpoint sender to an endpoint receiver. The system also includes packet marking circuitry for providing a routing mark for a packet addressed to the endpoint recipient based on the network traffic measurements provided by the latency measurement circuitry, where the routing mark provides an indication that supports routing for the packet to the endpoint recipient via a selected path or subset of paths of the plurality of paths.

The invention belongs to the field of network flow measurement and network data processing, and relates to a graph flow data compression and recovery method and system based on a compressed sensing theory. The method comprises the following steps: establishing a multi-layer structure for storing and compressing graph stream data; when the graph stream data arrives, executing a layer-by-layer insertion process by utilizing a multi-layer structure to realize compression storage of the graph stream data; performing query operation on the compressed and stored graph stream data, wherein the query operation comprises edge query, subsequent query and predecessor query; and decompressing the compressed and stored graph stream data to realize recovery of the graph stream data. Layered architecture design is adopted, efficient compression and accurate recovery of graph stream data are achieved through an ingenious coding mode and optimization solution, and efficient precursor and subsequent weight and query under constant complexity are supported.

The invention belongs to the technical field of network flow measurement, and particularly relates to a multi-core network flow measurement method based on sampling and Sketch fusion, electronic equipment and a medium, and the method comprises the following steps: through an intelligent sampling mechanism, a working device does not store a counter structure of Sketch and is only responsible for generating vector messages related to counter values, so that about 67% of data packet processing amount is reduced; and the system throughput is greatly improved. An innovative message aggregation algorithm is adopted, and the measurement precision is equivalent to or even better than that of an existing scheme. According to the Sketch counter row updating method, the Sketch counter row updating operation is adopted, or sampling of a data packet is converted into sampling of the Sketch counter row updating operation, each working device only needs to maintain one hash function and one counter array, and therefore high throughput is maintained, and meanwhile good measuring precision is kept. According to the invention, network flow measurement with high performance and high resource utilization rate is realized, and meanwhile, the measurement precision is kept at a level equivalent to that of an existing mainstream scheme, so that the requirements of high efficiency, economical efficiency and reliability of flow measurement in a modern high-speed network environment are met.

The invention discloses a network flow measurement method and device based on an autonomous system and electronic equipment, the method is applied to the field of network flow detection, and the method comprises the following steps: for each boundary router in a plurality of boundary routers, determining the routing information of the boundary router, and receiving the routing information of the boundary router; deploying a traffic collection program in a plurality of border routers according to the routing information of the border routers, wherein the plurality of border routers are used for calculating real address prefixes of traffic data; and generating a traffic matrix according to the real address prefixes and the traffic data sent by the plurality of boundary routers, and determining a network traffic measurement result of the autonomous system according to the traffic matrix. Through application of the method and the device, the problem that the measured traffic is repeated and omitted due to the fact that a traffic acquisition program needs to be deployed on each host to accumulate the traffic of all hosts under the same address prefix when the traffic of the border router in the autonomous system is measured in the related technology is solved.

The invention discloses a network flow measurement method based on Sketch-INT cooperation, electronic equipment and a medium, and the method comprises the steps: firstly obtaining network topology and source-destination pair information, and constructing a candidate forwarding path set; thirdly, a multi-target optimization model is constructed with the maximization of the flow coverage rate and the minimization of the distance to the control plane as targets, a measurement point set and an assignment relation are solved through Lagrangian relaxation and subgradient optimization, and Sketch and INT measurement programs are cooperatively deployed at selected points; then, flow is divided into a first class flow and a second class flow according to real-time distribution, and Sketch statistics and INT packet-by-packet collection are adopted respectively; and finally, based on a constrained Markov decision process, in combination with states such as a link utilization rate, a queue length and a worst sending rate, intelligently planning a report path and a distribution proportion, and ensuring non-congestion transmission of measurement data. According to the method, high-precision and low-resource-overhead whole-network flow monitoring is realized.