Full network flow monitoring method

Abstract

The invention discloses a full network flow monitoring method which comprises the following steps: (1) selecting routers and collectors for monitoring the flow in a full network; (2) acquiring m OD flows, extracting path information of the OD flows to construct an OD flow matrix P, and encoding the OD flows to form an OD pair identity mapping table; (3) computing sampling lists in different ranges by use of the OD flow matrix, the path information of the OD flows, and the resource constraint of the routers; (4) distributing the sampling lists to the routers, and distributing the OD pair identity mapping table while entering the router; (5) enabling the routers and the collectors thereof to monitor a data packet according to the OD pair identity mapping table and the sampling lists so as to update flow data in the collector flow table; and (6) enabling the collectors to collect and upload the flow data to form a monitoring report. Through the adoption of the monitoring method disclosed by the invention, a large number of redundancy cannot be produced between the routers, the communication between the collectors is unnecessary, and the monitoring method has the advantages of being small in network burden, large in full network coverage rate and high in processing efficiency.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a monitoring method for the entire network flow. Background technique [0002] In the prior art, network traffic monitoring relies on the number of flows at all levels collected on routers, but the monitoring capability of each router is limited, and network operators want to use the best way possible to utilize router monitoring capabilities. However, existing routers operate individually, and each router independently records the traffic it monitors. Not only does this approach not utilize router resources efficiently, but it also increases the network operator's impact on handling redundancy and data ambiguity due to multiple router monitoring. From a single point of view, the monitoring method in the prior art cannot achieve the purpose of directly specifying and realizing the whole network measurement by the network operator. And there is a primitive disconne...

AI Technical Summary

Problems solved by technology

[0003] The existing technology also conducts some improved research on the above-mentioned router sampling, but the current improvement method only focuses on the improvement of the solution of a single router, and is still not suitable for the monitoring of big data in the whole network.

In addition, these improved methods lack the generality of applications (e.g., different flow metrics require specific flow algorithms), and the fact that they do not take advantage of application

However, keeping track of a large number of flows increases router monitoring redundancy (each router tracks the same large set of flows), but does not increase flow coverage

Images