Identifying High-Rate Flows Based on Sequential Sampling

doi:10.1587/transinf.E93.D.1162

	Identifying High-Rate Flows Based on Sequential Sampling
	Zhang, Yu 1,2; Fang, Binxing 1,2; Luo, Hao 2
	2010-05-01
发表期刊	IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS
ISSN	0916-8532
卷号	E93D 期号:5 页码:1162-1174
摘要	We consider the problem of fast identification of high-rate flows in backbone links with possibly millions of flows. Accurate identification of high-rate flows is important for active queue management, traffic measurement and network security such as detection of distributed denial of service attacks. It is difficult to directly identify high-rate flows in backbone links because tracking the possible millions of flows needs correspondingly large high speed memories. To reduce the measurement overhead, the deterministic 1-out-of-k sampling technique is adopted which is also implemented in Cisco routers (NetFlow). Ideally, a high-rate flow identification method should have short identification time, low memory cost and processing cost. Most importantly, it should be able to specify the identification accuracy. We develop two such methods. The first method is based on fixed sample size test (FSST) which is able to identify high-rate flows with user-specified identification accuracy. However, since FSST has to record every sampled flow during the measurement period, it is not memory efficient. Therefore the second novel method based on truncated sequential probability ratio test (TSPRT) is proposed. Through sequential sampling. TSPRT is able to remove the low-rate flows and identify the high-rate flows at the early stage which can reduce the memory cost and identification time respectively. According to the way to determine the parameters in TSPRT, two versions of TSPRT are proposed: TSPRT-M which is suitable when low memory cost is preferred and TSPRT-T which is suitable when short identification time is preferred. The experimental results show that TSPRT requires less memory and identification time in identifying high-rate flows while satisfying the accuracy requirement as compared to previously proposed methods.
关键词	traffic monitoring high-rate flow identification sequential sampling
DOI	10.1587/transinf.E93.D.1162
收录类别	SCI
语种	英语
资助项目	National Natural Science Foundation of China[60703021] ; National High-Tech Development 863 Program of China[2007AA010501] ; National High-Tech Development 863 Program of China[2007AA01Z444] ; National High-Tech Development 863 Program of China[2007AA01Z406] ; National High-Tech Development 863 Program of China[2009AA012437]
WOS研究方向	Computer Science
WOS类目	Computer Science, Information Systems ; Computer Science, Software Engineering
WOS记录号	WOS:000279136500025
出版者	IEICE-INST ELECTRONICS INFORMATION COMMUNICATIONS ENG
引用统计	被引频次：4[WOS] [WOS记录] [WOS相关记录]
文献类型	期刊论文
条目标识符	http://119.78.100.204/handle/2XEOYT63/12514
专题	中国科学院计算技术研究所期刊论文_英文
通讯作者	Zhang, Yu
作者单位	1.Harbin Inst Technol, Res Ctr Comp Network & Informat Secur Technol, Harbin 150001, Peoples R China 2.Chinese Acad Sci, Inst Comp Technol, Beijing 100080, Peoples R China
推荐引用方式 GB/T 7714	Zhang, Yu,Fang, Binxing,Luo, Hao. Identifying High-Rate Flows Based on Sequential Sampling[J]. IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS,2010,E93D(5):1162-1174.
APA	Zhang, Yu,Fang, Binxing,&Luo, Hao.(2010).Identifying High-Rate Flows Based on Sequential Sampling.IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS,E93D(5),1162-1174.
MLA	Zhang, Yu,et al."Identifying High-Rate Flows Based on Sequential Sampling".IEICE TRANSACTIONS ON INFORMATION AND SYSTEMS E93D.5(2010):1162-1174.