Method for Estimating the Number of Superpoint Connections in Network Access Based on GPU under Sliding Window

Abstract

The present invention provides a method for estimating the number of superpoint connections based on GPU network access under a sliding window. The data structures are all stored in the video memory of the GPU, and the estimation of the number of superpoint connections is performed in parallel by the GPU, including the following steps: initializing the sliding estimation on the GPU Filter matrix and sliding candidate superpoint list, scan all messages in a time slice, estimate the number of superpoint connections at the end of the time slice, and slide the window. The invention can detect superpoints and estimate the connection number of the device under the sliding window, and the estimated value is more accurate, not affected by the window start time, and superpoints crossing the time boundary will not be missed; it has lower time delay than the existing method , can estimate the number of super-point connections in time; can process high-speed network traffic in parallel in real time, reduces the calculation range, and improves the overall speed of the algorithm. The sliding estimator matrix can be updated by multiple IP address pairs at the same time without generating errors .

Description

technical field [0001] The invention belongs to the technical field of high-speed network management and parallel computing, and relates to a GPU-based high-speed network real-time super-point connection number estimation technology under a sliding window. Background technique [0002] Hyperpoint is a special kind of host. Suppose there are two networks: ANet and BNet. These two networks communicate through the border router ER. ANet can be a metropolitan area network or a network of a certain country. BNet is another MAN or Internet. All traffic between ANet and BNet can be observed from ER. For a host "aip" in ANet, the host in BNet that communicates with aip through ER in a period of time is called the number of connections of aip. When the number of connections of an aip is greater than a specified threshold θ, the aip is called a superpoint. [0003] Hyperpoints are related to many events in the network, such as DDoS, scanning attacks and so on. The number of hos...

AI Technical Summary

Problems solved by technology

[0021] 1) The calculated value is affected by the starting point of the time window, and the super point that crosses the boundary of the time window cannot be detected

[0022] 2) There is a large delay in the calculation result

However, this method needs to store the IP address of each flow record when scanning the data packet, and cannot directly restore the superpoint

Calculating the number of connections for all hosts takes a lot of time

Moreover, this method directly transmits network data packets to the GPU, occupying a large amount of transmission bandwidth.

The communication between the server and the GPU becomes the bottleneck of the method

Images