随机分组抽样下流大小的分布估计

Estimation of Flow Size Distribution During Random Packet Sampling

为提高流大小分布估计的精度,比较了运用TCP流的SYN包和TCP序列号信息的几种极大似然估计(MLE)算法.结果表明,运用TCP流中的SYN包和SEQ信息对流大小的分布估计比单纯的抽样估计具有更高的准确性,其中在样本流中同时运用SYN包和SEQ信息的估计效果最佳.在此基础上结合实际提出了一种对小流采取细粒度、对大流采取粗粒度的流大小非均匀粒度分布估计算法,并以实例验证了该方法的适用性.结果表明,该方法在减少算法计算量的情况下,提高了对大流的估计精度.

In order to improve the estimation accuracy of flow size distribution,several maximum likelihood estimate（MLE） algorithms using SYN flag information and TCP sequence numbers are compared.The results show that the algorithms using SYN flag and SEQ information in TCP flow,especially the algorithm using both SYN flag and SEQ sequence numbers,are more accurate than the simple sampling estimation.Then,a nonuniform grained estimation algorithm of flow size is proposed,which implements the estimation with fine-grained estimators for the flow with small size and coarse-grained ones for the flow with large size.Case study demonstrates that the proposed algorithm is applicable and greatly improves the estimation accuracy of large-size flow with less computation.