The original paper is in English. Non-English content has been machine-translated and may contain typographical errors or mistranslations. ex. Some numerals are expressed as "XNUMX".
Copyrights notice
The original paper is in English. Non-English content has been machine-translated and may contain typographical errors or mistranslations. Copyrights notice
Nous considérons le problème de l'identification rapide de flux à haut débit dans des liaisons fédérées pouvant contenir des millions de flux. L'identification précise des flux à haut débit est importante pour la gestion active des files d'attente, la mesure du trafic et la sécurité du réseau, comme la détection des attaques par déni de service distribué. Il est difficile d'identifier directement les flux à haut débit dans les liaisons fédérées, car le suivi des millions de flux possibles nécessite des mémoires à grande vitesse correspondantes. Pour réduire les frais généraux de mesure, le modèle déterministe 1-sur-k Une technique d'échantillonnage est adoptée et est également implémentée dans les routeurs Cisco (NetFlow). Idéalement, une méthode d’identification de flux à haut débit devrait avoir un temps d’identification court, un faible coût de mémoire et un faible coût de traitement. Plus important encore, il devrait être capable de préciser l’exactitude de l’identification. Nous développons deux de ces méthodes. La première méthode est basée sur un test à taille d'échantillon fixe (FSST) qui est capable d'identifier les flux à haut débit avec une précision d'identification spécifiée par l'utilisateur. Cependant, étant donné que le FSST doit enregistrer chaque flux échantillonné pendant la période de mesure, il n’est pas efficace en termes de mémoire. Par conséquent, la deuxième nouvelle méthode basée sur le test du rapport de probabilité séquentiel tronqué (TSPRT) est proposée. Grâce à l'échantillonnage séquentiel, TSPRT est capable de supprimer les flux à faible débit et d'identifier les flux à haut débit à un stade précoce, ce qui peut réduire respectivement le coût de la mémoire et le temps d'identification. Selon la manière de déterminer les paramètres dans TSPRT, deux versions de TSPRT sont proposées : TSPRT-M qui convient lorsqu'un faible coût de mémoire est préféré et TSPRT-T qui convient lorsqu'un temps d'identification court est préféré. Les résultats expérimentaux montrent que TSPRT nécessite moins de mémoire et de temps d'identification pour identifier les flux à haut débit tout en satisfaisant aux exigences de précision par rapport aux méthodes proposées précédemment.
The copyright of the original papers published on this site belongs to IEICE. Unauthorized use of the original or translated papers is prohibited. See IEICE Provisions on Copyright for details.
Copier
Yu ZHANG, Binxing FANG, Hao LUO, "Identifying High-Rate Flows Based on Sequential Sampling" in IEICE TRANSACTIONS on Information,
vol. E93-D, no. 5, pp. 1162-1174, May 2010, doi: 10.1587/transinf.E93.D.1162.
Abstract: We consider the problem of fast identification of high-rate flows in backbone links with possibly millions of flows. Accurate identification of high-rate flows is important for active queue management, traffic measurement and network security such as detection of distributed denial of service attacks. It is difficult to directly identify high-rate flows in backbone links because tracking the possible millions of flows needs correspondingly large high speed memories. To reduce the measurement overhead, the deterministic 1-out-of-k sampling technique is adopted which is also implemented in Cisco routers (NetFlow). Ideally, a high-rate flow identification method should have short identification time, low memory cost and processing cost. Most importantly, it should be able to specify the identification accuracy. We develop two such methods. The first method is based on fixed sample size test (FSST) which is able to identify high-rate flows with user-specified identification accuracy. However, since FSST has to record every sampled flow during the measurement period, it is not memory efficient. Therefore the second novel method based on truncated sequential probability ratio test (TSPRT) is proposed. Through sequential sampling, TSPRT is able to remove the low-rate flows and identify the high-rate flows at the early stage which can reduce the memory cost and identification time respectively. According to the way to determine the parameters in TSPRT, two versions of TSPRT are proposed: TSPRT-M which is suitable when low memory cost is preferred and TSPRT-T which is suitable when short identification time is preferred. The experimental results show that TSPRT requires less memory and identification time in identifying high-rate flows while satisfying the accuracy requirement as compared to previously proposed methods.
URL: https://global.ieice.org/en_transactions/information/10.1587/transinf.E93.D.1162/_p
Copier
@ARTICLE{e93-d_5_1162,
author={Yu ZHANG, Binxing FANG, Hao LUO, },
journal={IEICE TRANSACTIONS on Information},
title={Identifying High-Rate Flows Based on Sequential Sampling},
year={2010},
volume={E93-D},
number={5},
pages={1162-1174},
abstract={We consider the problem of fast identification of high-rate flows in backbone links with possibly millions of flows. Accurate identification of high-rate flows is important for active queue management, traffic measurement and network security such as detection of distributed denial of service attacks. It is difficult to directly identify high-rate flows in backbone links because tracking the possible millions of flows needs correspondingly large high speed memories. To reduce the measurement overhead, the deterministic 1-out-of-k sampling technique is adopted which is also implemented in Cisco routers (NetFlow). Ideally, a high-rate flow identification method should have short identification time, low memory cost and processing cost. Most importantly, it should be able to specify the identification accuracy. We develop two such methods. The first method is based on fixed sample size test (FSST) which is able to identify high-rate flows with user-specified identification accuracy. However, since FSST has to record every sampled flow during the measurement period, it is not memory efficient. Therefore the second novel method based on truncated sequential probability ratio test (TSPRT) is proposed. Through sequential sampling, TSPRT is able to remove the low-rate flows and identify the high-rate flows at the early stage which can reduce the memory cost and identification time respectively. According to the way to determine the parameters in TSPRT, two versions of TSPRT are proposed: TSPRT-M which is suitable when low memory cost is preferred and TSPRT-T which is suitable when short identification time is preferred. The experimental results show that TSPRT requires less memory and identification time in identifying high-rate flows while satisfying the accuracy requirement as compared to previously proposed methods.},
keywords={},
doi={10.1587/transinf.E93.D.1162},
ISSN={1745-1361},
month={May},}
Copier
TY - JOUR
TI - Identifying High-Rate Flows Based on Sequential Sampling
T2 - IEICE TRANSACTIONS on Information
SP - 1162
EP - 1174
AU - Yu ZHANG
AU - Binxing FANG
AU - Hao LUO
PY - 2010
DO - 10.1587/transinf.E93.D.1162
JO - IEICE TRANSACTIONS on Information
SN - 1745-1361
VL - E93-D
IS - 5
JA - IEICE TRANSACTIONS on Information
Y1 - May 2010
AB - We consider the problem of fast identification of high-rate flows in backbone links with possibly millions of flows. Accurate identification of high-rate flows is important for active queue management, traffic measurement and network security such as detection of distributed denial of service attacks. It is difficult to directly identify high-rate flows in backbone links because tracking the possible millions of flows needs correspondingly large high speed memories. To reduce the measurement overhead, the deterministic 1-out-of-k sampling technique is adopted which is also implemented in Cisco routers (NetFlow). Ideally, a high-rate flow identification method should have short identification time, low memory cost and processing cost. Most importantly, it should be able to specify the identification accuracy. We develop two such methods. The first method is based on fixed sample size test (FSST) which is able to identify high-rate flows with user-specified identification accuracy. However, since FSST has to record every sampled flow during the measurement period, it is not memory efficient. Therefore the second novel method based on truncated sequential probability ratio test (TSPRT) is proposed. Through sequential sampling, TSPRT is able to remove the low-rate flows and identify the high-rate flows at the early stage which can reduce the memory cost and identification time respectively. According to the way to determine the parameters in TSPRT, two versions of TSPRT are proposed: TSPRT-M which is suitable when low memory cost is preferred and TSPRT-T which is suitable when short identification time is preferred. The experimental results show that TSPRT requires less memory and identification time in identifying high-rate flows while satisfying the accuracy requirement as compared to previously proposed methods.
ER -