Network flow real time self-adapting measuring method based on fixed storage space

Abstract

Disclosed is a real time self-adapting measuring method based on the network flow in a permanent storage space, comprising: setting a duration of the interval to be measured, a network flow storage space and a sample measurement parameter; establishing a threshold for defining the storage space size of the network flow as a reference of measurement loop end in the measuring process, thus, if the fluxion of the storage space network flow exceeds the threshold, the present measurement interval is end, subsequently, outputting all the flow record information estimation value; calculating the sample measurement parameter of the next measurement interval according to the period of the present measurement interval, the duration of the interval to be measured and the present sample measurement parameter. The invention can save consumption of the measuring resources in the self-adapting process and maintain the accuracy of the network flow information; intercomparsion and calculation can be achieved directly in different measurement intervals by the measuring results of different sample parameters.

Description

technical field [0001] The invention relates to an adaptive measurement method for network flow, in particular to a real-time adaptive measurement method for network flow based on fixed storage space in a high-speed large-scale network. Background technique [0002] Network flow is widely used in the network. Behavior analysis and anomaly detection based on network flow are hot research issues. In the IETF organization, there are two working groups specializing in network flow related issues. The real-time flow measurement working group RTFM and network flow information Output working group IPFIX, whose job is to establish related common standards for network flow measurement. Due to the "bigger, faster, and sudden change" characteristics of the Internet, the sampling-based approximate measurement technology has become a key research issue in network flow measurement. [0003] Due to the limitation of measurement resources, it is difficult for the measurement system to reco...

AI Technical Summary

Problems solved by technology

The first method cannot adapt to the instability and burstiness of network traffic because the measurement parameters cannot be adjusted during the entire measurement process.

Although the second method can adjust the sampling parameters, it needs to waste measurement resources in the adaptive process to adjust the flow information in the network flow cache, and the adjustment space is at the expense of the measured flow information

[0006] Combining these two methods, the essence of the first method is to fix the network flow storage space and time interval. Once the network flow space is full or the measurement time interval arrives, the current time interval can be ended, and then the measurement of the next time interval can be performed; but In the new time interval, this method does not adjust the measurement parameters, so that the measurement parameters cannot adapt to the coordinated needs of network traffic and measurement resources

Images