基于链路状态数据库的数据中心网络异常检测算法

Anomaly Detection Algorithm of Data Center Network Based on LSDB

目前IDC数据中心内部由于网络攻击或网络配置等原因路由会经常变化,然而由于缺乏有效的监控软件,路由异常、路由抖动难以发现,故障难以定位.数据中心业务出现网络故障时无法确认故障点导致修复时间延长、用户体验降低和运营收入减少等问题.分析了当前主流数据中心的网络架构、通信协议和路由计算原理,提出了一种基于链路状态数据库(link state database,LSDB)的数据中心网络异常检测方法 LSAP,该方法通过搜集LSDB,使用改进路由算法计算全网路由形成路由择域信息库(routing information base,RIB),根据LSDB快照和RIB快照比对准确关联链路变化和路由变化,发现链路异常、路由异常,能够定位故障.LSAP基于大数据分析平台实时计算路由表,能够实现秒级处理上亿条路由信息,满足当前数据中心对于分析速率的要求.通过在数据中心网络中部署试用,LSAP能够快速发现拓扑变化、复原路由表,统计分析所有路由变化,先于业务发现路由异常、路由攻击,且对网络改动很少,被动搜集数据不影响网络自身稳定性,适用对稳定性要求较高的数据中心部署.

At present,due to network attack,network configuration and etc,routing table changes frequently in data center network.However,because of the lack of effective monitoring software and routing anomalies,route flapping is difficult to find and locate the fault.When data center network failure occurs,we can t locate the problem and it will lead to extend the time to repair,degrade the user experience and reduce operating incoming and etc.This paper analyzes the current mainstream data center network architecture,communication protocol and routing calculation principle,then we proposes LSAP which is an data center network anomaly detection method based on the link state database.According to the comparison of snapshots in LSDB and RIB,it can find abnormal link,abnormal routing and locate the fault by collecting link state database,using the improved routing algorithm to calculate the whole network routing.Based on the large data analysis platform,LSAP can compute routing table in real time,achieve processing millions of routing information in seconds and meet the requirements of the current data center for the analysis rate.Through the deployment of the trial in the data center,LSAP can quickly restore routing table,find the topology change and make statistical analysis of all the changes in the route.It has little change to the network,and doesn t affect the stability of the network,so it applies to the data center with higher stability requirements.