The distributed passive measurement is an important technology for networkbehavior research. To achieve a consistent measurement, the same packets should be sampled atdistributed measurement points. And in order to es...The distributed passive measurement is an important technology for networkbehavior research. To achieve a consistent measurement, the same packets should be sampled atdistributed measurement points. And in order to estimate the character of traffic statistics, thetraffic sample should be random in statistics. A distributed samplingmask measurement model isintroduced to tackle the difficulty of measuring the full trace of high-speed networks. The keypoint of the model is to choose some bits that are suitable to be sampling mask. In the paper, thebit entropy and bit flow entropy of IP packet headers in CERNET backbone are analyzed, and we findthat the 16 bits of identification field in IP packet header are fit to the matching field ofsampling mask. Measurement traffic also can be used to analyze the statistical character ofmeasurement sample and the randomicity of the model. At the same time the experiment resultsindicate that the model has a good sampling performance.展开更多
In order to classify the Intemet traffic of different Internet applications more quickly, two open Internet traffic traces, Auckland I1 and UNIBS traffic traces, are employed as study objects. Eight earliest packets w...In order to classify the Intemet traffic of different Internet applications more quickly, two open Internet traffic traces, Auckland I1 and UNIBS traffic traces, are employed as study objects. Eight earliest packets with non-zero flow payload sizes are selected and their payload sizes are used as the early-stage flow features. Such features can be easily and rapidly extracted at the early flow stage, which makes them outstanding. The behavior patterns of different Intemet applications are analyzed by visualizing the early-stage packet size values. Analysis results show that most Internet applications can reflect their own early packet size behavior patterns. Early packet sizes are assumed to carry enough information for effective traffic identification. Three classical machine learning classifiers, classifier, naive Bayesian trees, i. e., the naive Bayesian and the radial basis function neural networks, are used to validate the effectiveness of the proposed assumption. The experimental results show that the early stage packet sizes can be used as features for traffic identification.展开更多
文摘The distributed passive measurement is an important technology for networkbehavior research. To achieve a consistent measurement, the same packets should be sampled atdistributed measurement points. And in order to estimate the character of traffic statistics, thetraffic sample should be random in statistics. A distributed samplingmask measurement model isintroduced to tackle the difficulty of measuring the full trace of high-speed networks. The keypoint of the model is to choose some bits that are suitable to be sampling mask. In the paper, thebit entropy and bit flow entropy of IP packet headers in CERNET backbone are analyzed, and we findthat the 16 bits of identification field in IP packet header are fit to the matching field ofsampling mask. Measurement traffic also can be used to analyze the statistical character ofmeasurement sample and the randomicity of the model. At the same time the experiment resultsindicate that the model has a good sampling performance.
基金The Program for New Century Excellent Talents in University(No.NCET-11-0565)the Fundamental Research Funds for the Central Universities(No.K13JB00160,2012JBZ010,2011JBM217)+2 种基金the Ph.D.Programs Foundation of Ministry of Education of China(No.20120009120010)the Program for Innovative Research Team in University of Ministry of Education of China(No.IRT201206)the Natural Science Foundation of Shandong Province(No.ZR2012FM010,ZR2011FZ001)
文摘In order to classify the Intemet traffic of different Internet applications more quickly, two open Internet traffic traces, Auckland I1 and UNIBS traffic traces, are employed as study objects. Eight earliest packets with non-zero flow payload sizes are selected and their payload sizes are used as the early-stage flow features. Such features can be easily and rapidly extracted at the early flow stage, which makes them outstanding. The behavior patterns of different Intemet applications are analyzed by visualizing the early-stage packet size values. Analysis results show that most Internet applications can reflect their own early packet size behavior patterns. Early packet sizes are assumed to carry enough information for effective traffic identification. Three classical machine learning classifiers, classifier, naive Bayesian trees, i. e., the naive Bayesian and the radial basis function neural networks, are used to validate the effectiveness of the proposed assumption. The experimental results show that the early stage packet sizes can be used as features for traffic identification.
