Research On Key Technologies Of Network Traffic Measurement Based On Application Classification

With the increasing development of the Internet,a lot of new applications have emerged,meanwhile,the characteristics of applications are changing constantly,and even new types of attacks may appear in some applications.Traffic application classification and session state analysis detection can help network operators to measure the application characteristics of traffic.In order to accurately identify the application types of traffic,the sampled traffic should maintain enough application characteristics.At present,Rel Samp has accomplished this goal,but in its sampling process,counters are solely assigned to each flow to record flow statistical features.Due to the heavy-tailed distribution of traffic,this method to allocate space would cause a huge waste of storage space on the router in the high-speed network environment.Therefore,it is necessary to optimize the flow table storage structure of Rel Samp to compress the storage space required during the sampling process.Connection tracking is an important premise for session state analysis detection.Currently,collision chains are widely used to solve hash conflicts within hash flow table entries by connection tracking algorithms.However,in the high-speed network environment,on account of the massive concurrent connections and the unevenly distributed nature of traffic,the collision chain depth of some entries in the hash flow table would be too deep,affecting the algorithm’s retrieval efficiency for connection nodes.This paper studies the optimization of Rel Samp’s flow table storage structure and the improvement of traditional connection tracking algorithms’ retrieval efficiency for connection nodes,aiming at effectively helping network operators to measure the application characteristics in the high-speed network environment.Firstly,due to the space wasting in flow table space allocation of Rel Samp,this paper proposes a method for optimizing the storage space of sampled traffic that supports application classification.By researching on the the structure of the flow table and introducing shared counter tree model,a storage space optimization sampling algorithm based on the shared counter tree is proposed.By comparing the application recognition accuracy of sampled traffic and the storage space required for the flow table during the sampling process with Rel Samp,it is verified that the proposed sampling algorithm can effectively reduce the flow table’s storage space required during the sampling process while maintain sufficient application characteristics.Secondly,in order to solve the challenge of massive connections tracking in the high-speed network environment,this paper proposes a method for optimizing mass connections retrieval speed that supports state tracking.By researching on controlling the depth of conflict chains,an efficient search tree is introduced into the hash flow table to resolve the massive hash conflicts in hash flow table entries,and the search tree structure is adjusted optimally during connections tracking.An adaptive connection tracking algorithm based on efficient search tree is proposed.By comparing retrieval performance with Hash＿List algorithm,Hash＿Splay algorithm,and SHT algorithm and comparing packet loss rates with Hash＿List algorithm,Hash＿Splay algorithm,it is verified that the proposed connection tracking algorithm can effectively track massive connections in the high-speed network environment.