【作者】 张果；

【导师】 陈庶樵；

【作者基本信息】 解放军信息工程大学 ， 通信与信息系统， 2010， 硕士

【摘要】 网络测量是对网络行为进行特征化、对各项指标进行量化并充分理解与正确认识互联网的最基本的手段。在骨干链路中，数据处理面临的最大问题是高速带宽带来的处理压力和由此产生的庞大的数据集。因此，为了处理庞大的数据集，抽样是一种重要的数据缩减方式。通过将抽样技术应用于网络数据，然后由抽样所得的数据生成支持常规查询和统计的概要信息，是对高速网络流量有效测量的一个很好的解决方案。论文结合国家863计划重大专项“新一代高可信网络”的研究，从高速网络环境下流量测量的可操作性、可扩展性的应用需求出发，针对现有高速骨干链路中流量测量技术存在的问题，对骨干链路中高速网络数据的抽样技术和基于计数型布鲁姆过滤器的概要表示方法进行了研究，并设计了骨干链路流量测量系统架构，为骨干链路流量测量构建了一种有效的解决方案。本文主要工作如下：夺针对NetFlow静态抽样概率在网络流量变化时不够灵活的缺陷，提出了一种基于包速率自适应的报文抽样算法。通过测量包速率，采用预设测量误差的方法，根据包速率的变化自适应调整抽样概率，从而达到在有限资源情况下控制测量误差的目的。基于实际互联网数据进行了仿真试验，结果显示：与传统的Netflowr算法相比，该方法易于实现，测量误差可控，具有高效性，不失准确性，并有效节约处理资源。夺针对计数型布鲁姆过滤器存储数据时受计数器溢出的限制，提出了一种基于分层计数型布鲁姆过滤器(Hierarchy counl，。mg Bloom Filter HcBF)的概要数据结构及算法。该算法给出了一个严格的计数溢出门限，基于该门限将计数型布鲁姆过滤器fcountmg Bloom Filter，cBFl结构扩展到多层，并能自适应的配置各层计数型布鲁姆过滤器参数，将测量误差控制在预定范围内。仿真结果表明，与cBF相比，在同样溢出概率条件下，该结构节省了大量的内存资源。夺针对骨干链路中流量测量面临的可扩展性挑战，设计了骨干链路网络流量实时管理系统的实现方案。该方案设计了骨干网实时流量管理前端抽样和后端统计的系统实现方法，并对系统的性能进行了仿真，结果表明，该系统能够有效的识别网络中的大流量对象。更多还原

【Abstract】 Traffic Measurement lS the most basic method of characterizing network behavior,estimating the performances，and absolutely understanding and recognizing the network But inthe IP backbone links，the biggest challenge of data processing is the pressure of the data fromthe high speed network and the enormous data volume caused by this process Sampling is animportant method for data decrease Network sampling data,can be used to form summaryinformation，which could support general querying and statistic And this is an effectiveresolution for the backbone traffiC measurementCombined with the research and development ofthe key technologies for“New-GenerationNetwork with High Trustability”，to meet the need of operable and scalable application in highspeed networks，this dissertation，which aims to resolved the problem of the currentmeasurement technology,analyzes the sampling algorithm，studies the summary denotationmethod which is basic on Counting Bloom Filter,and designs a new-structure for traAl]cmeasurement which iS a suitahle resolution for IP backbone Its main W’Ork and COntributions areOutlinedasfollows：_As the inflexibility ofNetFlow’S sampling probability,the packet sampling algorithm．based on adaptive packet rate，is proposed This algorithm measures the packet rate，predefmes the measurement error,and adaptively adjusts the sampling probability according to the packet rate，SO as to control the measurement error under the condition of limited resources Experiments are conducted based on real network traces Results demonstrate that the proposed method is easy to be implemented，with controllable measurement error,higher efficiency and accurac~while memory consumption is lower compared with other methods_To conquer the overflow-limitation of memory structure in Counting Bloom Fiker,a novel mechanism based on Hieraacchy Counting Bloom Fiker(HCBF)for large flow-inspect is proposed This algorithm defines a strict threshold of counting overflow-,and extends the standard structure of Counting Bloom Filter(CBF)to multi-layer The mechanism can not only adjust the configurable parameter,but also control the measurement error to a limited scale Results demonstrate that the proposed mechanism can save enormous space，under the same overflow-probability．_To meet the scalable challenge of backbone traffic measurement．this paper designs the real-time measurement management system structure Based on this structure，this paper summarizes the implement method of sampling for front end and statistic for back end，and simulates the performance of the system and the result shows that：it is effective for large t]0w in the network更多还原