Accelerating Packet Classification with Counting Bloom Filters for Virtual Open Flow Switching

The growing trend of network virtualization results in a widespread adoption of virtual switches in virtualized environments. However, virtual switching is confronted with great performance challenges regarding packet classification especially in Open Flow-based software defined networks. This paper first takes an insight into packet classification in virtual Open Flow switching, and points out that its performance bottleneck is dominated by flow table traversals of multiple failed mask probing for each arrived packet. Then we are motivated to propose an efficient packet classification algorithm based on counting bloom filters. In particular, counting bloom filters are applied to predict the failures of flow table lookups with great possibilities, and bypass flow table traversals for failed mask probing. Finally, our proposed packet classification algorithm is evaluated with real network traffic traces by experiments. The experimental results indicate that our proposed algorithm outperforms the classical one in Open v Switch in terms of average search length, and contributes to promote virtual Open Flow switching performance.

Flow Label-Based TPv6 Packet Classification Algorithm with Dimension Reduction Capability

Traditional packet classification for IPv4 involves examining standard 5-tuple of a packet header, source address, destination address, source port, destination port and protocol. With introduction of IPv6 flow label field which entails labeling the packets belonging to the same flow, packet classification can be resolved based on 3 dimensions： flow label, source address and desti- nation address. In this paper, we propose a novel approach for the 3-tuple packet classification based on flow label. Besides, by introducing a conversion engine to covert the source-destination pairs to the compound address prefixes, we put forward an algorithm called Reducing Dimension （RD） with dimension reduction capability, which combines heuristic tree search with usage of buck- ets. And we also provide an improved version of RD, called Improved RD （IRD）, which uses two mechanisms： path compression and priority tag, to optimize the perforrmnce. To evaluate our algo- rithm, extensive experiraents have been conducted using a number of synthetically generated databas- es. For the memory consumption, the two pro- posed new algorithms only consumes around 3% of the existing algorithms when the number of ill- ters increases to 10 k. And for the average search time, the search time of the two proposed algo- rithms is more than four times faster than others when the number of filters is 10 k. The results show that the proposed algorithm works well and outperforms rmny typical existing algorithms with the dimension reduction capability.

Efficient pipelined flow classification for intelligent data processing in IoT

The packet classification is a fundamental process in provisioning security and quality of service for many intelligent network-embedded systems running in the Internet of Things(IoT).In recent years,researchers have tried to develop hardware-based solutions for the classification of Internet packets.Due to higher throughput and shorter delays,these solutions are considered as a major key to improving the quality of services.Most of these efforts have attempted to implement a software algorithm on the FPGA to reduce the processing time and enhance the throughput.The proposed architectures,however,cannot reach a compromise among power consumption,memory usage,and throughput rate.In view of this,the architecture proposed in this paper contains a pipelinebased micro-core that is used in network processors to classify packets.To this end,three architectures have been implemented using the proposed micro-core.The first architecture performs parallel classification based on header fields.The second one classifies packets in a serial manner.The last architecture is the pipeline-based classifier,which can increase performance by nine times.The proposed architectures have been implemented on an FPGA chip.The results are indicative of a reduction in memory usage as well as an increase in speedup and throughput.The architecture has a power consumption of is 1.294w,and its throughput with a frequency of 233 MHz exceeds 147 Gbps.

High-Performance Flow Classification of Big Data Using Hybrid CPU-GPU Clusters of Cloud Environments

The network switches in the data plane of Software Defined Networking (SDN) are empowered by an elementary process, in which enormous number of packets which resemble big volumes of data are classified into specific flows by matching them against a set of dynamic rules. This basic process accelerates the processing of data, so that instead of processing singular packets repeatedly, corresponding actions are performed on corresponding flows of packets. In this paper, first, we address limitations on a typical packet classification algorithm like Tuple Space Search (TSS). Then, we present a set of different scenarios to parallelize it on different parallel processing platforms, including Graphics Processing Units (GPUs), clusters of Central Processing Units (CPUs), and hybrid clusters. Experimental results show that the hybrid cluster provides the best platform for parallelizing packet classification algorithms, which promises the average throughput rate of 4.2 Million packets per second (Mpps). That is, the hybrid cluster produced by the integration of Compute Unified Device Architecture (CUDA), Message Passing Interface (MPI), and OpenMP programming model could classify 0.24 million packets per second more than the GPU cluster scheme. Such a packet classifier satisfies the required processing speed in the programmable network systems that would be used to communicate big medical data.

ERFC:An Enhanced Recursive Flow Classification Algorithm

Packet classification on multi-fields is a fundamental mechanism in network equipments,and various classification solutions have been proposed.Because of inherent difficulties,many of these solutions scale poorly in either time or space as rule sets grow in size.Recursive Flow Classification（RFC） is an algorithm with a very high classifying speed. However,its preprocessing complexity and memory requirement are rather high.In this paper,we propose an enhanced RFC（ERFC） algorithm,in which a hash-based aggregated bit vector scheme is exploited to speed up its preprocessing procedure.A compressed and cacheable data structure is also introduced to decrease total memory requirement and improve its searching performance.Evaluation results show that ERFC provides a great improvement over RFC in both space requirement and preprocessing time.The search time complexity of ERFC is equivalent to that of RFC in the worst case; and its average classifying speed is improved by about 100%.

基于流粒度的OpenFlow分组缓存管理模型

基于OpenFlow的软件定义网络(SDN)技术通过在OpenFlow交换机中建立有效的缓存模型,能够大幅减少控制平面和数据平面的通信负载,但整条数据流的缓存模型会对数据流的传输造成较大延时,降低整个SDN的数据传输性能。针对该问题,引入PiBuffer流缓存模型,构建基于报文分组粒度的分组缓存模型。通过在控制平面建立流路由和流状态的缓存信息,分别对流报文之间和交换机之间的数据传输采用"分组缓存,组内保序"机制和"传输询问,完成通知"机制,并对控制平面和数据平面的通信消息进行优化,以提高数据中心网络的通信性能。软件模拟结果表明,在数据中心基于OpenFlow技术的SDN网络中,该模型比流缓存模型具有更优的通信性能。

P2P Streaming Traffic Classification in High-Speed Networks

The growing P2P streaming traffic brings a variety of problems and challenges to ISP networks and service providers.A P2P streaming traffic classification method based on sampling technology is presented in this paper.By analyzing traffic statistical features and network behavior of P2P streaming,a group of flow characteristics were found,which can make P2P streaming more recognizable among other applications.Attributes from Netflow and those proposed by us are compared in terms of classification accuracy,and so are the results of different sampling rates.It is proved that the unified classification model with the proposed attributes can identify P2P streaming quickly and efficiently in the online system.Even with 1:50 sampling rate,the recognition accuracy can be higher than 94%.Moreover,we have evaluated the CPU resources,storage capacity and time consumption before and after the sampling,it is shown that the classification model after the sampling can significantly reduce the resource requirements with the same recognition accuracy.

NTCI-Flow:一种可扩展的高速网络流量处理框架

针对当前基于软/硬件的流导出技术存在的数据失真、不易扩展等问题,本文提出一种准确、通用、易扩展的高速网络流量处理框架NTCI-Flow。首先,基于PF_RING DNA实现了高性能的网络包抓取,采用基于网络包五元组的负载均衡策略对网络包进行分组分发,并利用批处理、无锁队列、多线程等技术将多个网络包封装为单条大消息并行发送,改进与优化网络包转发性能;然后,采用Kafka消息系统作为中间件接收并缓存网络包,从而实现网络包的分布式导入;接着,基于Storm搭建实时流处理平台,开发并部署分布式流重组应用,实现从Kafka中读取网络包,解析并抽取五元组、包大小、时间戳等信息后重组成网络流;最后,增加Hive流数据导入模块,将导出的网络流数据以Parquet格式实时存入HDFS,利用Hive Metastore存储并管理元数据,同时采用基于时间的动态分区机制以减少按时间检索时不必要的磁盘IO。实验结果表明:网络流量采集模块可实现万兆流量的准确采集与转发,即使在万兆流量均为最小包(60字节)的情况下,仍可保证仅有0.03%的丢包率;网络流量导入模块吞吐率与磁盘写入性能相关,在使用7块硬盘缓存数据时吞吐率可达775 MB/s;分布式流重组模块具有良好的通用性及扩展性,通过简单配置即可达到1.26×10~7包/s的吞吐率。目前,NTCI-Flow已用于采集与处理某机构的出口流量,该机构平均流量约3.5 Gbps,峰值带宽为6 Gbps,每秒包数最高可达百万级。在该实际应用中,NTCI-Flow运行情况良好,由其得到的流量数据比Net Stream更准确。

小卫星业务调度路由优化

针对小卫星通信链路交换频繁和低资源利用率的问题,提出了一种基于调度的小卫星路由优化策略。建立起小卫星星座模型,根据其运行方向(与赤道平面近似垂直)和所在维度确定链路的实时连接策略,优化其路由路径。面对持续增长的网络业务与有限的星上资源的矛盾,将业务数据包分类为实时性数据包和非实时性数据包,实行加权轮询调度保证其服务质量和资源的利用率。仿真结果证明,相比已有小卫星路由算法,优化的路由算法可以有效减小数据传输时延并增加系统吞吐量。

高速网络流量测量方法

高速网络流量测量是目前实施实时准确地监测、管理和控制网络的基础.基于网络流量测量的应用,将网络流量测量分为抽样方法和数据流方法.从不同的层次,将抽样方法分为分组抽样和流抽样,分别介绍了两类抽样方法;从测度角度介绍了数据流方法.详细介绍了高速网络流量测量的常用数据结构,以及抽样、数据流方法在高速网络流量测量中的应用,比较了各种方法的优劣.概述了高速网络流量测量技术的研究进展.最后,就现有的网络流量测量方法的不足,对网络流量测量的发展趋势和进一步的研究方向进行了讨论.

基于统计分析的高速网络分布式抽样测量模型

分布式被动测量是研究网络行为的一个重要手段 ,其面临的主要问题是难以实现高速网络流量测量 ,因此需要使用抽样技术 .分布式抽样测量技术需要解决两个关键问题 :分布式测量点测量报文的一致性和抽样样本的统计随机性 .为此 ,抽样测量的核心是选择合适的抽样掩码匹配位串 ,以保证抽样样本的随机性 ,且实现分布式测量点的信息一致性 .文章对CERNET主干网络流量IP报头各字段的随机性进行分析 ,结果表明标识字段 16bits满足抽样掩码匹配位串要求 ,并对抽样样本的随机性和统计属性进行分析 .实验验证抽样样本既能用于网络行为研究也能用于流量行为研究 .

网络流量测量与监控系统的设计与实现

在基于TCP/IP网络的SNMP管理协议的基础上,设计完成了B/S模式的动态网络监控系统,实现了网络流量数据获取,网络报文数据获取,流量分析与实时监控的功能。通过重组、分析所获得的数据,将其还原成完整的HTTP、FTP、TELNET应用的内容,并建立保存相应记录的数据库。

基于网络通信指纹的启发式木马识别系统

对比传统木马检测技术的原理及特点,根据网络数据流检测木马的需求,提出一种基于网络通信特征分析的木马识别方法。引入通信指纹的概念扩展通信特征的外延,用实验方法归纳木马在连接、控制和文件传输阶段表现出的通信指纹信息,设计并实现一个启发式木马网络通信指纹识别系统。测试结果表明,该系统运行高效、检测结果准确。

多决策树包分类算法

网络安全、网络测量、服务质量、流路由等都离不开多维包分类算法。设计一种在时间上和空间上都很好的包分类算法非常困难。该文在分析大规模规则集的特征的基础上,根据协议类型域只有有限的几种取值的特点,提出一种多决策树包分类算法。该算法既可用软件实现,也适宜硬件实现,并且在理论上适用于IPv6的包分类。当采用硬件实现时,多棵树可以并行查找,树内查找可以采用流水结构,算法的查找复杂度为O(1)。该算法可用于改进广泛应用的HiCuts和HyperCuts算法,与之相比,多决策树算法在预处理时间、内存占用和查找时间上都有很大提高。

Hash函数实现数据包分流算法研究

随着 Internet 规模的不断扩大与应用技术的不断进步,越来越多的业务需要对数据包进行实时、快速的分类,对数据包分类的研究具有重要的现实意义。Hash 算法采用了散列算法的基本思想,并引入了流的局部性原理加速散列查找的过程。由于时间精确度较高和面向对象的特点,选用了 C^(++)语言编程对该算法进行了仿真测试,最后对 Hash 算法分析表明,Hash 算法具有良好的时间复杂度和空间复杂度,可以实现快速的分流。

Compact RFC:一种内存优化的RFC包分类算法

RFC(Recursive Flow Classification)算法是目前速度较快的基于软件实现的多维包分类算法,但是随着规则集规模的增大,其消耗的内存空间迅速增大.针对这一问题,本文提出了一种基于内存优化的RFC算法-Compact RFC,该算法根据RFC算法构建的交叉乘积表中元素的分布特点设计出了一种压缩的数据结构及压缩方法,能够消除RFC交叉乘积表中60%以上的冗余空间,并且仍然保持与RFC算法相同的时间复杂度.本文在Intel IXP2800网络处理器上实现了RFC和Compact RFC,验证了Compact RFC的优越性能,实验同时表明Compact RFC在Intel IXP2800上消耗较少的资源就能够达到OC-192(10Gbps)的分类速度,具有较高的应用价值.

互联网流量的演化研究

随着网络应用的层出不穷,互联网流量的特征是否发生了显著的变化是网络运营者和研究者关注的重要问题。为了发现互联网流量的长期演化规律,以互联网数据分析合作组织提供的五年骨干网流量数据为研究对象,分别从数据包、数据流和网络应用方面进行了分析研究;同时,基于数据包和字节序列,采用多种方法检验了流量的自相似特性。结果表明,网络流量的多个特征在演化规律上呈现出各异性的同时,网络流量的自相似特性依然存在,并且在数据包序列和字节序列上具有同一性,为互联网的协议设计、设备开发、网络管理等提供了数据支持。

基于抽样分组长度分布的加密流量应用识别

基于确定性抽样数据分组序列的位置、方向、分组长度和连续性、有序性等流统计特征和典型的分组长度统计签名,并结合带数据分组位置、方向约束和半流关联动作的提升型DPI,提出了一种基于假设检验的加密流量应用识别统计决策模型,包括分组长度统计签名决策模型和DFI决策模型,并给出了相应的分组长度统计签名匹配算法以及基于DPI和DFI混合方法的加密流量应用识别算法。实验结果表明,该方法能够成功捕获加密应用在流坐标空间中独特的统计流量行为,并同时具有极高的加密识别精确率、召回率、总体准确率和极低的加密识别误报率、总体误报率。

流特征的Skype流量识别

Skype流识别的研究大多局限于在静态载荷特征和通信机制,没有考虑网络流特征在Skype流量识别中的作用.提出了一种基于朴素贝叶斯分类的Skype流量识别模型.选择流的连接特征和实时特征作为分类特征集,根据流的连接特征组织网络流,再进一步根据流的包长度、平均发送间隔和突发带宽消耗等实时流特征识别Skype流量.在北京联通骨干网络上的实验表明该模型能有效地识别Skype流,是一种有效的Skype流识别算法.

计算机网络安全可视化研究平台设计与实现

基于当前现状设计并实现计算机网络安全可视化研究平台。在对现有可视化工具包分析研究的基础上,结合计算机网络安全可视化研究的特点,提出计算机网络安全可视化研究平台的总体目标:实现安全数据整合、可视化方法整合、分析操作整合。根据插件化、集成化、可扩展性、开放性、平台无关性和易操作性等方面的具体要求,对该研究平台进行设计并实现了原型系统。该平台可作为计算机网络安全可视化研究的工具,同时也可用于教学实验、可视化方法测试、协作交流等工作。