鉴于失败的DNS查询(failed DNS query)能提供恶意网络活动的证据,以DNS查询失败的数据为切入口,提出一种轻量级的基于Counting Bloom Filter的DNS异常检测方法。该方法使用带语义特征的可逆哈希函数对被查询的域名及发起查询的IP进行快...鉴于失败的DNS查询(failed DNS query)能提供恶意网络活动的证据,以DNS查询失败的数据为切入口,提出一种轻量级的基于Counting Bloom Filter的DNS异常检测方法。该方法使用带语义特征的可逆哈希函数对被查询的域名及发起查询的IP进行快速的聚类和还原。实验结果证明该方法能以较少的空间占用和较快的计算速度有效识别出DNS流量中的异常,适用于僵尸网络、分布式拒绝服务(DDoS)攻击等异常检测的前期筛选和后期验证。展开更多
The growing trend of network virtualization results in a widespread adoption of virtual switches in virtualized environments. However, virtual switching is confronted with great performance challenges regarding packet...The growing trend of network virtualization results in a widespread adoption of virtual switches in virtualized environments. However, virtual switching is confronted with great performance challenges regarding packet classification especially in Open Flow-based software defined networks. This paper first takes an insight into packet classification in virtual Open Flow switching, and points out that its performance bottleneck is dominated by flow table traversals of multiple failed mask probing for each arrived packet. Then we are motivated to propose an efficient packet classification algorithm based on counting bloom filters. In particular, counting bloom filters are applied to predict the failures of flow table lookups with great possibilities, and bypass flow table traversals for failed mask probing. Finally, our proposed packet classification algorithm is evaluated with real network traffic traces by experiments. The experimental results indicate that our proposed algorithm outperforms the classical one in Open v Switch in terms of average search length, and contributes to promote virtual Open Flow switching performance.展开更多
The Counting Bloom Filter （CBF） is a kind of space-efficient data structure that extends a Bloom filter so as to allow approximate multiplicity queries on a dynamic multi-set. This paper evaluates the performance of...The Counting Bloom Filter （CBF） is a kind of space-efficient data structure that extends a Bloom filter so as to allow approximate multiplicity queries on a dynamic multi-set. This paper evaluates the performance of multiplicity queries of three simple CBF schemes-the Naive Counting Bloom Filter （NCBF）, the Space-Code Bloom Filter （SCBF） and the d-left Counting Bloom Filter （dlCBF）-using metrics of space complexity and counting error under both uniform and zipfian multiplicity distributions. We compare their counting error under same space complexity, and their space complexity when similar counting errors are achieved respectively. Our results show that dICBF is the best while SCBF is the worst in terms of both space-efficiency and accuracy. Furthermore, the performance gap between dlCBF and the others has a trend of being enlarged with the increment of space occupation or counting accuracy.展开更多
本文提出使用语义增强的Counting B loom FilterReconstruction(RSECBF)算法来快速还原源串或给出源串的聚类特征.它给每个哈希函数独立的哈希映射空间以消除哈希函数的内部冲突;扩展哈希函数使其不受均匀性限制,使得哈希函数可以带有语...本文提出使用语义增强的Counting B loom FilterReconstruction(RSECBF)算法来快速还原源串或给出源串的聚类特征.它给每个哈希函数独立的哈希映射空间以消除哈希函数的内部冲突;扩展哈希函数使其不受均匀性限制,使得哈希函数可以带有语义;利用哈希串的重叠和数量一致性来解决同源哈希串拼接成源串的问题,为源串的还原创造了条件.本文针对Pareto分布的哈希函数,为主成分的还原提出了一个简洁的源串还原算法.对于直接选择部分比特的哈希映射而言,如果主成分分析中的RSECBF不能还原出源串,则还原出来的最长串就是源串的聚类特征.仿真及实际检验表明,B loom Filter可以扩展其哈希函数来实现语义增强,RSECBF还原的结果是可信的.本算法可以在异常行为发生的时候挖掘网络行为特征.展开更多
文摘鉴于失败的DNS查询(failed DNS query)能提供恶意网络活动的证据,以DNS查询失败的数据为切入口,提出一种轻量级的基于Counting Bloom Filter的DNS异常检测方法。该方法使用带语义特征的可逆哈希函数对被查询的域名及发起查询的IP进行快速的聚类和还原。实验结果证明该方法能以较少的空间占用和较快的计算速度有效识别出DNS流量中的异常,适用于僵尸网络、分布式拒绝服务(DDoS)攻击等异常检测的前期筛选和后期验证。
基金supported in part by National Natural Science Foundation of China(61272148,61572525,61502056,and 61602525)Hunan Provincial Natural Science Foundation of China(2015JJ3010)Scientific Research Fund of Hunan Provincial Education Department(15B009,14C0285)
文摘The growing trend of network virtualization results in a widespread adoption of virtual switches in virtualized environments. However, virtual switching is confronted with great performance challenges regarding packet classification especially in Open Flow-based software defined networks. This paper first takes an insight into packet classification in virtual Open Flow switching, and points out that its performance bottleneck is dominated by flow table traversals of multiple failed mask probing for each arrived packet. Then we are motivated to propose an efficient packet classification algorithm based on counting bloom filters. In particular, counting bloom filters are applied to predict the failures of flow table lookups with great possibilities, and bypass flow table traversals for failed mask probing. Finally, our proposed packet classification algorithm is evaluated with real network traffic traces by experiments. The experimental results indicate that our proposed algorithm outperforms the classical one in Open v Switch in terms of average search length, and contributes to promote virtual Open Flow switching performance.
基金Supported by the National Grand Fundamental Research 973 Program of China (No.2007CB307100, No.2007CB 307102)
文摘The Counting Bloom Filter （CBF） is a kind of space-efficient data structure that extends a Bloom filter so as to allow approximate multiplicity queries on a dynamic multi-set. This paper evaluates the performance of multiplicity queries of three simple CBF schemes-the Naive Counting Bloom Filter （NCBF）, the Space-Code Bloom Filter （SCBF） and the d-left Counting Bloom Filter （dlCBF）-using metrics of space complexity and counting error under both uniform and zipfian multiplicity distributions. We compare their counting error under same space complexity, and their space complexity when similar counting errors are achieved respectively. Our results show that dICBF is the best while SCBF is the worst in terms of both space-efficiency and accuracy. Furthermore, the performance gap between dlCBF and the others has a trend of being enlarged with the increment of space occupation or counting accuracy.
