一种高效的网络流记录表示方法

An Efficient Representation of Network Flow Record

带宽和应用不断发展,迫切需要对应用业务的精细化网络流量进行持续监测.NetFlow的表示方法存在数据组织效率低等问题,导致传输开销过大、历史数据存储空间爆炸增长;聚合NetFlow表示方法又带来大量信息丢失.寻找一种高效的网络流记录表示方法对满足网络测量有着非常重要的意义.提出了一种新的方法——基于对象和应用的流量特征统计描述(TABSI),该方法以单位时间周期内各个监测对象在不同应用下的流量统计、流数目统计及分布为流量信息的基本描述单位,周期性地导出该信息来描述链路流量特征.理论分析表明TABSI比聚合NetFlow记录包含更多的信息量,能够很好地描述网络行为;且TABSI历史数据有效性更强.现网运行测试表明该方法可使传输数据量减少、存储组织高效查询分析更快、存储空间大大减少.

Complexity and diversity of traffic are constantly increasing, and the demand for continuous detailed network traffic monitoring is growing. The NetFlow method has its characteristics of low efficient data representation, which causes large transmission bandwidth consuming and storage explosion. And aggregated NetFlow records lose lots of information, which result in being unable to do traffic analysis refinedly. To find an efficient network traffic information representation method is of important significance to satisfy the new demand for network monitor. This paper proposes a new flow of information representation--TABSI （target-and-application-based statistical interpretation）. This method cycles per unit time monitoring of the objects in various different applications, using the flow statistics, flow number statistics and the distribution as the number of the basic description for the traffic information unit, and periodically exports the information to describe the flow characteristics of the link. Theoretical analysis shows that the TABSI can give a good description of network behavior, and the TABSI contain more information content compared with the polymer-based NetFlow, and the effectiveness of historical data is better. The results of running on real network show that the TABSI method has low data transmission, more efficient analysis performance, and large reduction in storage space.