一种新的可变采样率的网络流量抽样测量方法

IP flow-based variable sampling method for network traffic measurement

随机报文抽样方法是目前常用的流量抽样测量方法,但是它倾向于采集长流,影响了异常检测的正确性.提出了一种新的基于IP流可变采样率的网络流量抽样测量方法,将到达的数据报文按照流标识分类,并以每一个报文在所属流中的位置和流的大小为参数设置可变采样率进行抽样测量.实验表明,该方法提高了短流中报文的采样率,减少了随机报文抽样方法对异常检测的影响,检测结果能正确地反映原始数据的异常情况.

The random packet sampling method is usually employed by traffic sampling measurement. But the accuracy of anomaly detection is affected by the fact that it biases a large IP flow. Based on the IP flow arrival process, a variable sampling method is proposed. According to the attribute of the IP flow, the incoming packets are classified by their flow identifiers and sampling rates are set by their positions in the IP flow. Experimental results show that sampled traffic data improve the accuracy of anomaly detection because the variable sampling method increases the sampling rate of packets in a small IP flow.