基于统计分析的高速网络分布式抽样测量模型

Distributed Sampling Measurement Model in a High Speed Network Based on Statistical Analysis

分布式被动测量是研究网络行为的一个重要手段 ,其面临的主要问题是难以实现高速网络流量测量 ,因此需要使用抽样技术 .分布式抽样测量技术需要解决两个关键问题 :分布式测量点测量报文的一致性和抽样样本的统计随机性 .为此 ,抽样测量的核心是选择合适的抽样掩码匹配位串 ,以保证抽样样本的随机性 ,且实现分布式测量点的信息一致性 .文章对CERNET主干网络流量IP报头各字段的随机性进行分析 ,结果表明标识字段 16bits满足抽样掩码匹配位串要求 ,并对抽样样本的随机性和统计属性进行分析 .实验验证抽样样本既能用于网络行为研究也能用于流量行为研究 .

The distributed passive measurement is an important technique for network behavior research. But it is very difficult to measure the full trace of high-speed network, so in the paper sampling technology is introduced into network traffic measurement. There are two key problems that should be solved in the distributed passive measurement. In order to corporate the distributed traffic information, the same packets should be sampled in distributed measurement points. And in order to estimate the statistical attributes of network traffic, the traffic sample should be measured with random. So the key point of the sampling measurement model is to choose some mask bits that can assure the randomicity of the measuring sample and accordant measurement information in distributed measurement points. In the paper, the bit random metrics and bit flow random metrics are defined, and after studying and analyzing huge amounts of packet headers captured randomly on CERNET backbone, the result shows that 16 bits of identification field in IP packet header is enough for matching bits of sampling mask. Randomization and statistical attribute of the sampling are analyzed in the paper, and the experiment also reveals that this sampling way can be used not only in traffic measurement but also for network behavior analysis.