CAJ | 학술논문

高速IP网络的流量测量与异常检测是网络测量领域研究的热点。针对目前网络流量测量算法对小流估计精度偏低，对异常流量筛选能力较差的缺陷，该文提出一种基于业务流已抽样长度与完全抽样阈值 S 的自适应流抽样算法(AFPT)。AFPT算法根据完全抽样阈值S筛选对异常流量敏感相关的小流，同时根据业务流已抽样长度自适应调整抽样概率。仿真和实验结果表明，AFPT 算法的估计误差与理论上界相符，具有较强的异常流量筛选能力，能够有效提高异常检测算法的准确率。
고속IP망락적류량측량여이상검측시망락측량영역연구적열점。침대목전망락류량측량산법대소류고계정도편저，대이상류량사선능력교차적결함，해문제출일충기우업무류이추양장도여완전추양역치 S 적자괄응류추양산법(AFPT)。AFPT산법근거완전추양역치S사선대이상류량민감상관적소류，동시근거업무류이추양장도자괄응조정추양개솔。방진화실험결과표명，AFPT 산법적고계오차여이론상계상부，구유교강적이상류량사선능력，능구유효제고이상검측산법적준학솔。
The network traffic measurement and anomaly detection for high-speed IP network become the hotspot research of network measurement field. Because the current measurement algorithms have large estimation error for the mice flows and poor performance for the sampling anomaly traffic, an Adaptive Flow sampling algorithm based on the sampled Packets and force sampling Threshold S (AFPT) is proposed. According to the force sampling threshold S, the AFPT is able to sample the mice flows which is sensitive to the anomaly traffic, while adaptive adjustment the probability of sampling based on the sampled packets. The simulation and experimental results show that the estimation error of AFPT is consistent with the theoretical upper bound, and provide better performance for the anomaly traffic sampled. The proposed algorithm can effectively improve the accuracy of anomaly detection algorithm.