网络状态监测仪中丢包检测算法及其实现的关键问题研究
|
摘要
20世纪70年代以来，计算机网络在社会各行业中得到了广泛应用，起到了极其重要的作用。对计算机网络运行状态的深入观测方法也受到学术界和工业界的密切关注，很多专家、学者相继提出了大量的新算法。网络状态监测仪是一种具备观测内部网络运行状态功能的仪器。该仪器使用被动检测方法对截获的网络包记录进行分析，提取其包含的丢包率、延迟时间等特征信息。其中，准确的对内部网络中存在的丢包现象进行推断是实现该仪器的一个重点和难点。本文针对内部网络丢包检测算法进行了深入探讨，提出了两种基于本地网络往返时间的丢包检测算法，并讨论了在网络状态监测仪中实现丢包检测算法的方案。本文的主要研究工作如下：
1.在基于数据包重传机制和基于确认包分析的丢包检测算法的基础上，针对接收数据流中发生本地网络丢包的各种情况进行分析，提出了基于本地网络往返时间的丢包检测算法，并利用本地网络往返时间的极限值对数据包丢失进行判断。从理论分析和实验结果出发，论证该算法在发生虚假快速重传、虚假超时重传、批量丢包和重传过程中丢包等事件时都能正确推断丢失包。
2.针对该丢包检测算法对本地网络往返时间极限值过于敏感的特点，本文通过对TCP协议确认包发送机制的分析，建立了本地网络往返时间的解析模型，将其样本集划分为由四类事件触发的子集，讨论了这些样本子集中最重要的三类样本的分布模型及其对应的极值计算方法，提出了基于该本地往返时间模型的丢包检测算法，进一步细化不同事件发生时该检测算法的处理方案。通过讨论得出如下结论：在该检测算法中设置本地网络往返时间的极限值为立即确认极值（即数据包与其到达TCP连接收端主机后立即触发的确认包到达监听设备的时间差极限值）可以保证算法的稳定性；引入超时规则可对网络中出现的超时重传现象进行检测扩大算法的检测范围。
3.针对处理网络截获记录需要计算能力大，而中央处理芯片能力相对薄弱的问题，设计了基于状态机的包头提取方法，将大量的网络包解析工作放在硬件电路中实现，并提供了相应的协议扩展机制。该包头提取方法具备处理网络嵌套协议的能力，具有解析带宽大（高达44Gbps），占用资源少的特点，可广泛应用于网络检测、网络安全等对网络协议支持较多、处理能力要求较高的领域。使用双层缓存结构的媒介访问控制器设计方法在不影响性能的前提下，对传统媒介访问控制器进行了改进，在软、硬件上解决了包头提取方法与网络媒介访问控制器之间存在的接口差异问题，满足网络监测仪的设计需求。
4.在网络仿真环境和实际截获记录中对基于本地网络丢包检测算法及其改进算法进行了验证，证明这些算法在多种配置的网络环境下，都具有极低的误判率和较高的覆盖率。采样充分时，该算法误判率均小于0.62%，即使在采样数较少的情况下，误判率也可以控制在11.6%以下，这是该算法相对于其他同类检测算法最重要的优势。
Since1970s, computer network have widely applied to every field in the world,and played an extremely important role. Research and industry community have paidmuch attention on digging network’s internal running status, in which many noveltymethods were proposed and adopted. Network Status Monitor(NSM) is a kind ofinstrument which could observe internal status of network. This instrument extractspacket loss and delay characteristic by analyzing the trace file generated by passivecapture method. The challenge is how to exactly infer the loss packet exists in localnetwork.A detection method and its improved version on loss packet based on LocalRound Trip Time(LRTT) was proposed and implemented in NSM. The key point of thiswork can be concluded as follow.
1. By extending detection methods based on TCP retransmission mechanism oracknowledgement packet analysis, a new detection method based on extreme value ofLRTT to infer packet loss exists in local network in receiving flow was proposed. Themethod can correctly deal with all kind of packet loss, as spurious fast retransmission,spurious time out retransmission, batch loss and loss in retransmission.
2. An analytic model for LRTT was setup through TCP acknowledgemechanism,itdivide LRTT’s samples into for four subsets which were triggered bydifferent events. Three of the subsetscan be modeled with experimental distributionswhich make their extreme value estimation available. Profound discussionon details byadopting those extreme values into previous method can conclude that using extremevalue of immediate acknowledgement as its maximum LRTT and introducing a newtime out rule would improve its stability and detecting range.
3. To fulfill the large calculation capabilities of analyzing network packets, a newpacket header extraction method based on finite state machine was designed to moveprinciple workload to FPGA(Field Programmable Gate Array), and provide a flexibleextending mechanism. This method solved the performance shortage of centralprocessing unit and provides ability of extracting nestable shim layer protocol. It isproved that the method support a high extracting bandwidth and low resource usage, which especially suit for the area of network measurement and security. To integrate thispacket header extraction module in traditional Media Access Controller(MAC), wepropose two layeredFIFO (First In First Out) architecture to eliminate thedifferencesbetween their interface both in software and hardware.
4. The proposed loss detection methods have been proved in network emulator andreal captured traces as is stability and performance. In various environment, theexperiment results show an extremely low false detection rate and acceptable cover rate,which is an important advantage of our detection method, especially the false detectionrate is below0.62%when samples are sufficient, even in opposite situation the falsedetection still keep as lower as11.6%.
1.在基于数据包重传机制和基于确认包分析的丢包检测算法的基础上，针对接收数据流中发生本地网络丢包的各种情况进行分析，提出了基于本地网络往返时间的丢包检测算法，并利用本地网络往返时间的极限值对数据包丢失进行判断。从理论分析和实验结果出发，论证该算法在发生虚假快速重传、虚假超时重传、批量丢包和重传过程中丢包等事件时都能正确推断丢失包。
2.针对该丢包检测算法对本地网络往返时间极限值过于敏感的特点，本文通过对TCP协议确认包发送机制的分析，建立了本地网络往返时间的解析模型，将其样本集划分为由四类事件触发的子集，讨论了这些样本子集中最重要的三类样本的分布模型及其对应的极值计算方法，提出了基于该本地往返时间模型的丢包检测算法，进一步细化不同事件发生时该检测算法的处理方案。通过讨论得出如下结论：在该检测算法中设置本地网络往返时间的极限值为立即确认极值（即数据包与其到达TCP连接收端主机后立即触发的确认包到达监听设备的时间差极限值）可以保证算法的稳定性；引入超时规则可对网络中出现的超时重传现象进行检测扩大算法的检测范围。
3.针对处理网络截获记录需要计算能力大，而中央处理芯片能力相对薄弱的问题，设计了基于状态机的包头提取方法，将大量的网络包解析工作放在硬件电路中实现，并提供了相应的协议扩展机制。该包头提取方法具备处理网络嵌套协议的能力，具有解析带宽大（高达44Gbps），占用资源少的特点，可广泛应用于网络检测、网络安全等对网络协议支持较多、处理能力要求较高的领域。使用双层缓存结构的媒介访问控制器设计方法在不影响性能的前提下，对传统媒介访问控制器进行了改进，在软、硬件上解决了包头提取方法与网络媒介访问控制器之间存在的接口差异问题，满足网络监测仪的设计需求。
4.在网络仿真环境和实际截获记录中对基于本地网络丢包检测算法及其改进算法进行了验证，证明这些算法在多种配置的网络环境下，都具有极低的误判率和较高的覆盖率。采样充分时，该算法误判率均小于0.62%，即使在采样数较少的情况下，误判率也可以控制在11.6%以下，这是该算法相对于其他同类检测算法最重要的优势。
Since1970s, computer network have widely applied to every field in the world,and played an extremely important role. Research and industry community have paidmuch attention on digging network’s internal running status, in which many noveltymethods were proposed and adopted. Network Status Monitor(NSM) is a kind ofinstrument which could observe internal status of network. This instrument extractspacket loss and delay characteristic by analyzing the trace file generated by passivecapture method. The challenge is how to exactly infer the loss packet exists in localnetwork.A detection method and its improved version on loss packet based on LocalRound Trip Time(LRTT) was proposed and implemented in NSM. The key point of thiswork can be concluded as follow.
1. By extending detection methods based on TCP retransmission mechanism oracknowledgement packet analysis, a new detection method based on extreme value ofLRTT to infer packet loss exists in local network in receiving flow was proposed. Themethod can correctly deal with all kind of packet loss, as spurious fast retransmission,spurious time out retransmission, batch loss and loss in retransmission.
2. An analytic model for LRTT was setup through TCP acknowledgemechanism,itdivide LRTT’s samples into for four subsets which were triggered bydifferent events. Three of the subsetscan be modeled with experimental distributionswhich make their extreme value estimation available. Profound discussionon details byadopting those extreme values into previous method can conclude that using extremevalue of immediate acknowledgement as its maximum LRTT and introducing a newtime out rule would improve its stability and detecting range.
3. To fulfill the large calculation capabilities of analyzing network packets, a newpacket header extraction method based on finite state machine was designed to moveprinciple workload to FPGA(Field Programmable Gate Array), and provide a flexibleextending mechanism. This method solved the performance shortage of centralprocessing unit and provides ability of extracting nestable shim layer protocol. It isproved that the method support a high extracting bandwidth and low resource usage, which especially suit for the area of network measurement and security. To integrate thispacket header extraction module in traditional Media Access Controller(MAC), wepropose two layeredFIFO (First In First Out) architecture to eliminate thedifferencesbetween their interface both in software and hardware.
4. The proposed loss detection methods have been proved in network emulator andreal captured traces as is stability and performance. In various environment, theexperiment results show an extremely low false detection rate and acceptable cover rate,which is an important advantage of our detection method, especially the false detectionrate is below0.62%when samples are sufficient, even in opposite situation the falsedetection still keep as lower as11.6%.
引文
[1] ISO/IEC7498-1information technology-Open systems interconnection-basic reference model:the basic model[S]第2版. International Organization for Standardization(ISO),1994:34-65.
[2] M. Jain and C. Dovrolis. End-to-end available bandwidth: measurement methodology,dynamics, and relation with TCP throughput[J]. ACM SIGCOMM Computer CommunicationReview, New York, NY, USA: ACM,2002,32:295-308.
[3] V. Paxson. Measurements and analysis of end-to-end Internet dynamics[D]. University ofCalifornia, Berkeley,1997.
[4] M. Siekkinen, G. Urvoy-Keller, E. W. Biersack, et al. A root cause analysis toolkit for TCP[J].Computer Networks,2008,52:1846-1858.
[5] B.-Y. Choi, Z. Duan, and S. Moon. Special issue on measurement based networkmanagement[J]. Journal of Network and Systems Management,2010,19:3-6.
[6] A. Gupta. Network management: current trends and future perspectives[J]. Journal of Networkand Systems Management,2006,14:483-491.
[7] A. Pras, J. Schoenwaelder, M. Burgess, et al. Key research challenges in networkmanagement[J]. PAVLOU G, PRAS A. IEEE communications magazine, New York: IEEECommunications Society,2007,45:104-110.
[8] I. D. Barrera, G. R. Arce, and S. Bohacek. Statistical approach for congestion control ingateway routers[J]. Computer Networks, Elsevier B.V.,2011,55:572-582.
[9] R. L. Carter and M. E. Crovella. Measuring bottleneck link speed in packet-switchednetworks[J]. Performance Evaluation,1996,27:297-318.
[10] I. W. C. Lee and A. O. Fapojuwo. Analysis and modeling of a campus wireless network TCP/IPtraffic[J]. Computer Networks, Elsevier B.V.,2009,53:2674-2687.
[11] M. Smirnov. On model-driven self-engineering of inter-domain traffic[J]. ComputerCommunications,2008,31:3360-3371.
[12] P. Bahl, R. Chandra, A. Greenberg, et al. Towards highly reliable enterprise network servicesvia inference of multi-level dependencies[J]. ACM SIGCOMM Computer CommunicationReview, New York, NY, USA: ACM,2007,37(4):13-24.
[13] M. Casado, M. J. Freedman, J. Pettit, et al. Rethinking enterprise network control[J].IEEE/ACM Transactions on Networking (TON), Piscataway, NJ, USA: IEEE Press,2009,17(4):1270-1283.
[14] B. Nechaev, M. Allman, V. Paxson, et al. A preliminary analysis of TCP performance in anenterprise network[C]//Proceedings of the2010Internet Network Management Conference onResearch on Enterprise Networking. USENIX Association,2010:7-7.
[15] M. A. Shah, G. A. Safdar, C. Maple, et al. Network performance optimization: A case study ofenterprise network simulated in OPNET[C]//Frontiers of Information Technology (FIT),2011.2011:57-62.
[16] B. Stephens, A. L. Cox, S. Rixner, et al. A scalability study of enterprise networkarchitectures[C]//Seventh ACM/IEEE Symposium on Architectures for Networking andCommunications Systems (ANCS),2011.2011:111-121.
[17] Y. Vardi. Network tomography: Estimating source-destination traffic intensities from linkdata[J]. Journal of the American Statistical Association, Taylor&Francis Group,1996,91:365-377.
[18] M. Coates, R. Nowak, and others. Network loss inference using unicast end-to-endmeasurement[C]//Proc. ITC Conf. IP Traffic, Modeling and Management.2000:28-1.
[19] N. Duffield. Network tomography of binary network performance characteristics[J]. IEEETransactions on Information Theory,2006,52:5373-5388.
[20] N. Duffield1, J. Horowitz, F. lo Presti, et al. Network delay tomography from end-to-endunicast measurements[J]. Evolutionary Trends of the Internet, Springer,2001:576-595.
[21] Y. Tsang, M. Coates, and R. D. Nowak. Network delay tomography[J]. IEEE Transactions onSignal Processing, IEEE,2003,51:2125-2136.
[22] P. Barford and J. Sommers. Comparing probe-and router-based packet-loss measurement[J].Internet Computing, IEEE,2004,8:50-56.
[23] T. Auld, A. Moore, and S. Stephen. Bayesian neural networks for internet trafficclassification[J]. IEEE Transaction on Neural Networks,2007,18:223-239.
[24] A. Callado, C. Kamienski, G. Szabo, et al. A survey on internet traffic identification[J]. IEEECommunications Surveys&Tutorials,2009,11:37-52.
[25] A. Callado, J. Kelner, D. Sadok, et al. Better network traffic identification through theindependent combination of techniques[J]. Journal of Network and Computer Applications,2010,33:433-446.
[26] X. Guan, T. Qin, S. Member, et al. Dynamic feature analysis and measurement for large-scalenetwork traffic monitoring[J]. IEEE Transactions on Information Forensics and Security,2010,5:905-919.
[27] J. Jiang and S. Papavassiliou. Enhancing network traffic prediction and anomaly detection viastatistical network traffic separation and combination strategies[J]. Computer Communications,2006,29:1627-1638.
[28] M. Olbrich, F. Nadolni, F. Idzikowski, et al. Measurements of path characteristics inPlanetLab[R]. July, Telecommunication Networks Group, at the Faculty of ElectricalEngineering and Computer Science at the Technische Universit t Berlin.,2009.
[29] K. Papagiannaki, R. Cruz, and C. Diot. Network performance monitoring at small timescales[C]//Proceedings of the3rd ACM SIGCOMM Conference on Internet Measurement.ACM,2003:295-300.
[30] W. Wei, B. Wang, D. Towsley, et al. Model-based identification of dominant congested links[J].IEEE/ACM Transactions on Networking (TON), IEEE Press,2011,19:456-469.
[31] Y. Zhang and N. Duffield. On the constancy of internet path properties[C]//Proceedings of the1st ACM SIGCOMM Workshop on Internet Measurement. San Francisco, California, USA:ACM,2001:197-211.
[32]顾成杰,张顺颐.基于改进SVM的网络流量分类方法研究[J].仪器仪表学报,2011,32:1507-1513.
[33]黄志根,陈健,王珊.一种基于包长和时间间隔的网络流量分类方法[J].电子测量技术,2011,34:109-112.
[34]林青家,陈涤,刘允才.网络流量的小尺度特性分析[J].电子测量与仪器学报,2007,21:92-97.
[35]朱灵波,戴冠中, J.-M. Rétif.一种网络流量分布特性的综合分析方法[J].仪器仪表学报,2009,30:1026-1031.
[36] C. iflikli and A. Gezer. Self similarity analysis via fractional Fourier transform[J]. SimulationModelling Practice and Theory,2011,19:986-995.
[37] T. Akgul, S. Baykut, M. Erol-Kantarci, et al. Periodicity-based anomalies in self-similarnetwork traffic flow measurements[J]. IEEE Transactions on Instrumentation and Measurement,IEEE,2011,60:1358-1366.
[38] A. Erramilli, M. Roughan, D. Veitch, et al. Self-similar traffic and network dynamics[J].Proceedings of the IEEE,2002,90:800-819.
[39] W. E. Leland, M. S. Taqqu, W. Willinger, et al. On the self-similar nature of Ethernet traffic(extended version)[J]. IEEE/ACM Transactions on Networking (TON), IEEE,1994,2:1-15.
[40] K. Park and W. Willinger. Self-similar network traffic and performance evaluation[M]. WileyOnline Library,2000.
[41] G.-L. LI and V. O. Li. Analysis of transient loss performance impact of long-range dependencein network traffic[J]. Self-similar Network Traffic and Performance Evaluation,2000:319.
[42] Y. Bejerano. Taking the skeletons out of the closets: A simple and efficient topology discoveryscheme for large Ethernet LANs[J]. IEEE/ACM Transactions on Networking (TON), IEEEPress,2009,17:1385-1398.
[43] Y. Bejerano, Y. Breitbart, M. Garofalakis, et al. Physical topology discovery for largemultisubnet networks[C]//INFOCOM2003. Twenty-Second Annual Joint Conference of theIEEE Computer and Communications. IEEE,2003,1:342-352.
[44] R. Black, A. Donnelly, and C. Fournet. Ethernet topology discovery without networkassistance[C]//Proceedings of the12th IEEE International Conference on Network Protocols(ICNP). IEEE,2004:328-339.
[45] H. Gobjuka and Y. J. Breitbart. Ethernet topology discovery for networks with incompleteinformation[J]. IEEE/ACM Transactions on Networking (TON), IEEE,2010,18:1220-1233.
[46] S. Pandey, M.-J. Choi, Y. J. Won, et al. SNMP-based enterprise IP network topologydiscovery[J]. International Journal of Network Management, Wiley Online Library,2011,21:169-184.
[47] S. Alcock and R. Nelson. Passive detection of TCP congestion events[C]//18th InternationalConference on Telecommunications,2011(ICT).2011:499-504.
[48] I. D. Barrera, S. Bohacek, and G. R. Arce. Statistical detection of congestion in routers[J]. IEEETransactions on Signal Processing,2010,58:957-968.
[49] I. El Khayat, P. Geurts, and G. Leduc. Enhancement of TCP over wired/wireless networks withpacket loss classifiers inferred by supervised learning[J]. Wireless Networks,2008,16:273-290.
[50] H. Lim and J. C. Hou. Identifying lossy links in wired/wireless networks by exploiting sparsecharacteristics[J]. Computer Networks,2007,51:4442-4459.
[51] A. Markopoulou, F. Tobagi, and M. Karam. Loss and delay measurements of internetbackbones[J]. Computer Communications, Elsevier,2006,29:1590-1604.
[52] J. Ni and S. Tatikonda. Network tomography based on additive metrics[J]. IEEE Transactionson Information Theory,2011,57:7798-7809.
[53] V. N. Padmanabhan and L. Qiu. Network tomography using passive end-to-endmeasurements[C]//DIMACS Workshop on Internet and WWW Measurement, Mapping andModeling. Citeseer,2002.
[54] V. N. Padmanabhan, L. Qiu, and H. J. Wang. Server-based inference of Internet linklossiness[C]//INFOCOM2003. Twenty-Second Annual Joint Conference of the IEEE Computerand Communications. IEEE,2003,1:145-155.
[55] Y. Huang, N. Feamster, and R. Teixeira. Practical issues with using network tomography forfault diagnosis[J]. ACM SIGCOMM Computer Communication Review, ACM,2008,38:53-58.
[56]陈敏,李旺.计算机网络中的故障定位技术研究[J].国外电子测量技术,2007,26:8-11.
[57] J. Delport and M. S. Olivier. Detecting uncooperative Ethernet elements using accurateround-trip time measurements[C]//Southern African Telecommunication Networks andApplications Conference (SATNAC).2005,1:153-156.
[58] S. Li, S. Wei, Y. Zhang, et al. A distributed rate-based congestion control scheme for wirelessnetworks with random losses[J]. Journal of Computational Information Systems,2011,7:5292-5299.
[59] J. Cao, A. Chen, and P. P. C. Lee. Modeling time correlation in passive network losstomography[C]//IEEE/IFIP41st International Conference on Dependable Systems Networks,2011(DSN).2011:550-561.
[60] A. Kesselman and Y. Mansour. Optimizing TCP retransmission timeout[C]//Networking-ICN2005. Heidelberg: Springer,2005:133-140.
[61] L. Ma, G. Arce, and K. Barner. TCP retransmission timeout algorithm using weightedmedians[J]. IEEE Signal Processing Letters,2004,11:569-572.
[62] S. Rewaskar, J. Kaur, and F. D. Smith. A performance study of loss detection/recovery inreal-world TCP implementations[C]//IEEE International Conference on Network Protocols,2007(ICNP). Ieee,2007:256-265.
[63] M. C. Weigle, K. Jeffay, and F. Donelson Smith. Delay-based early congestion detection andadaptation in TCP: impact on web performance[J]. Computer Communications, Elsevier,2005,28:837-850.
[64] V. Arya, N. G. Duffield, and D. Veitch. Multicast inference of temporal loss characteristics[J].Performance Evaluation,2007,64:1169-1180.
[65] N. Duffield, F. lo Presti, V. Paxson, et al. Network loss tomography using striped unicastprobes[J]. IEEE/ACM Transactions on Networking (TON),2006,14:697-710.
[66] D. Ghita, H. Nguyen, M. Kurant, et al. Netscope: Practical network losstomography[C]//INFOCOM2010, Proceedings IEEE.2010:1-9.
[67] H. Tian and H. Shen. Multicast-based inference of network-internal loss[C]//7th InternationalSymposium on Parallel Architectures, Algorithms and Networks,2004.2004:288-293.
[68] D. Zhang, D. Ionescu, and S. Member. A new method for measuring packet loss probabilityusing a Kalman filter[J]. IEEE Transactions on Instrumentation and Measurement,2009,58:488-498.
[69] R. Cáceres, N. G. Duffield, J. Horowitz, et al. Multicast-based inference of network-internalcharacteristics: Accuracy of packet loss estimation[C]//INFOCOM’99. Eighteenth Annual JointConference of the IEEE Computer and Communications Societies. IEEE,1999,1:371-379.
[70] J. Sommers, P. Barford, N. Duffield, et al. Improving accuracy in end-to-end packet lossmeasurement[C]//ACM SIGCOMM Computer Communication Review.2005,35:157-168.
[71] J. Sommers, P. Barford, N. Duffield, et al. A geometric approach to improving active packetloss measurement[J]. IEEE/ACM Transactions on Networking (TON), Piscataway, NJ, USA:IEEE Press,2008,16:307-320.
[72] E. Altman, K. Avrachenkov, and C. Barakat. A stochastic model of TCP/IP with stationaryrandom losses[C]//ACM SIGCOMM Computer Communication Review. ACM,2000,30:231-242.
[73] A. F. Atiya, S. G. Yoo, K. T. Chong, et al. Packet loss rate prediction using the sparse basisprediction model[J]. IEEE Transactions on Neural Networks, IEEE,2007,18:950-954.
[74] E. Baralis, A. Bianco, T. Cerquitelli, et al. NetCluster: A Clustering-Based Framework forInternet Tomography[C]//IEEE International Conference on Communications (ICC’09).2009:1-5.
[75] J.-C. Bolot. End-to-end packet delay and loss behavior in the internet[J]. ACM SIGCOMMComputer Communication Review, New York, NY, USA: ACM,1993,23(4):289-298.
[76] H. X. Nguyen and M. Roughan. On the correlation of internet packetlosses[C]//Telecommunication Networks and Applications Conference (ATNAC2008).2008:22-27.
[77] S. Rewaskar, J. Kaur, and F. D. Smith. Accuracy of probing techniques in estimating TCP lossrates[C]//ACM Sigcomm, Pisa. ACM,2006.
[78] M. Allman, W. M. Eddy, and S. Ostermann. Estimating loss rates with TCP[J]. ACMSIGMETRICS Performance Evaluation Review,2003,31:12-24.
[79] N. Fonseca and M. Crovella. Bayesian packet loss detection for TCP[C]//INFOCOM2005.24th Annual Joint Conference of the IEEE Computer and Communications Societies.2005,3:1826-1837vol.3.
[80] J. Martin, A. Nilsson, and I. Rhee. Delay-based congestion avoidance for TCP[J]. IEEE/ACMTransactions on Networking (TON), IEEE,2003,11:356-369.
[81] H. Nguyen and P. Thiran. Network loss inference with second order statistics of end-to-endflows[C]//SAN DIEGO U California. Proceedings of the7th ACM SIGCOMM Conference onInternet Measurement. ACM,2007:227-239.
[82] N. G. Duffield, V. Arya, R. Bellino, et al. Network tomography from aggregate loss reports[J].Performance Evaluation,2005,62:147-163.
[83] Y. Gu, L. Breslau, N. Duffield, et al. On passive one-way loss measurements using sampledflow statistics[C]//INFOCOM2009. IEEE,2009:2946-2950.
[84] F. Strohmeier, P. Dorfinger, and B. Trammell. Network performance evaluation based on flowdata[C]//7th International Wireless Communications and Mobile Computing Conference,2011(IWCMC). Ieee,2011:1585-1589.
[85] S. Rewaskar. Real world evaluation of techniques for mitigating the impact of packet losses onTCP performance[D]. University of North Carolina at Chapel Hill,2008.
[86] S. Rewaskar, J. Kaur, and D. Smith. A passive state-machine based approach for reliableestimation of TCP losses[R]. Department of Computer Science of the University of NorthCarolina at Chapel Hill,2006.
[87] S. Rewaskar, J. Kaur, and F. D. Smith. A passive state-machine approach for accurate analysisof TCP out-of-sequence segments[J]. ACM SIGCOMM Computer Communication Review,New York, NY, USA: ACM,2006,36(3):51-64.
[88] P. Benko and A. Veres. A passive method for estimating end-to-end TCP packet loss[C]//GlobalTelecommunications Conference,2002(GLOBECOM’02). IEEE,2002,3:2609-2613vol.3.
[89] E. Brosh, G. Lubetzky-Sharon, and Y. Shavitt. Spatial-temporal analysis of passive TCPmeasurements[C]//INFOCOM2005.24th Annual Joint Conference of the IEEE Computer andCommunications Societies.2005,2:949-959vol.2.
[90] I. Din and N. A. Saqib. Passive packet loss detection and its effect on web trafficcharacteristics[C]//International Conference on Computer and Electrical Engineering,2008(ICCEE). IEEE,2008:729-733.
[91] A. Friedl, S. Ubik, A. Kapravelos, et al. Realistic passive packet loss measurement forhigh-speed networks[C]//Traffic Monitoring and Analysis. Springer,2009:1-7.
[92] S. Jaiswal, G. Iannaccone, and C. Diot. Inferring TCP connection characteristics throughpassive measurements[C]//INFOCOM2004. Twenty-third AnnualJoint Conference of the IEEEComputer and Communications Societies. Hong Kong, China: IEEE,2004:1582-1592.
[93] S. Jaiswal, G. Iannaccone, C. Diot, et al. Measurement and classification of out-of-sequencepackets in a tier-1IP backbone[J]. IEEE/ACM Transactions on Networking (TON), Piscataway,NJ, USA: IEEE Press,2007,15(1):54-66.
[94] M. Mellia, M. Meo, L. Muscariello, et al. Passive analysis of TCP anomalies[J]. ComputerNetworks,2008,52:2663-2676.
[95] Z. Wen and K. L. Yeung. On detection algorithms for spurious retransmissions inTCP[C]//Wireless Communications and Networking Conference,2010(WCNC). IEEE,2010:1-6.
[96]高中耀,程光. TCP报文丢包定位方法研究[J].计算机工程与应用,2012,7:1-7.
[97]王敏杰,徐昌彪,刘光明. TCP隐式丢包检测技术分析[J].计算机应用研究,2006,1:184-186.
[98] N. Cardwell, S. Savage, and T. Anderson. Modeling TCP latency[C]//INFOCOM2000.Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies.IEEE,2000,3:1742-1751.
[99] M. J. Coates and R. D. Nowak. Sequential Monte Carlo inference of internal delays innonstationary data networks[J]. IEEE Transactions on Signal Processing, IEEE,2002,50:366-376.
[100] K. Kobayashi and T. Katayama. Analysis and evaluation of packet delay variance in theInternet[J]. IEICE transactions on communications, The Institute of Electronics, Informationand Communication Engineers,2002,85:35-42.
[101] F. lo Presti, N. Duffield, J. Horowitz, et al. Multicast-based inference of network-internaldelay distributions[J]. IEEE/ACM Transactions on Networking (TON), IEEE,2002,10:761-775.
[102] Y. Sato, S. Ata, I. Oka, et al. Using mixed distribution for modeling end-to-end delaycharacteristics[C]//Proceedings of the8th Asia-Pacific Network Operation and ManagementSymposium,2005(APNOMS2005).2005:422-433.
[103] S. Shakkottai, N. Brownlee, A. Broido, et al. The RTT distribution of TCP flows on theInternet and its impact on TCP based flow control[R]. Cooperative Association for Internet DataAnalysis (CAIDA),2004.
[104] W. Zhang and J. He. Modeling end-to-end delay using Pareto distribution[C]//SecondInternational Conference on Internet Monitoring and Protection (ICIMP2007).2007:21.
[105] A. M. K. C. Zhen Zhu. Worst case round trip time prediction and statistical analysis usingextreme values theory[C]//Proc. WIP Session of IEEE-CS Real-Time Systems Symposium.Cancun, Mexico:2003.
[106] B. Veal, K. Li, and D. K. Lowenthal. New methods for passive estimation of TCP round-triptimes[C]//Passive and Active Network Measurement,6th International Workshop. Boston, MA,USA:2005:121-134.
[107] A. Acharya and J. Saltz. A study of internet round-trip delay[R]. Computer ScienceDepartment of University of Maryland,1998:1-18.
[108] J. Aikat, J. Kaur, F. D. Smith, et al. Variability in TCP round-trip times[C]//InternetMeasurement Workshop.2003:279-284.
[109] H. Jiang and C. Dovrolis. Passive estimation of TCP round-trip times[J]. ACM SIGCOMMComputer Communication Review, New York, NY, USA: ACM,2002,32:75-88.
[110] R. Lance and I. Frommer. Round-trip time inference via passive monitoring[J]. ACMSIGMETRICS Performance Evaluation Review, ACM,2005,33:32-38.
[111] D. Leonard and D. Loguinov. Turbo King: Framework for large-scale internet delaymeasurements[C]//INFOCOM2008. The27th Conference on Computer Communications. Ieee,2008:31-35.
[112] Y. Pei, H. Wang, and S. Cheng. A passive method to estimate TCP round trip time fromnonsender-side[C]//2nd IEEE International Conference on Computer Science and InformationTechnology,2009(ICCSIT). IEEE,2009:43-47.
[113] F. Ping, C. McConnell, and J.-H. Hwang. A retrospective approach for accurate networklatency prediction[C]//Proceedings of19th International Conference on ComputerCommunications and Networks,2010(ICCCN). IEEE,2010:1-6.
[114] P. Sessini and A. Mahanti. Observations on round-trip times of TCP connections[C]//Proc. ofSPECTS. Calgary, Canada:2006.
[115] S. B. Kotsiantis, D. Kanellopoulos, and P. E. Pintelas. Data preprocessing for supervisedlearning[J]. International Journal of Computer Science,2006,1:111-117.
[116] F. Fusco and L. Deri. High speed network traffic analysis with commodity multi-coresystems[C]//Proceedings of the10th annual conference on Internet measurement. Melbourne,Australia: ACM,2010:218-224.
[117]曾宪玮,裴昌幸,朱畅华等.基于ARM的分布式网络测量探针的设计与实现[J].仪器仪表学报,2007,28:784-787.
[118] G. Munz, S. Li, and G. Carle. Traffic anomaly detection using k-means clustering[C]//GI/ITGWorkshop MMBnet. Hamburg, Germany: GI/ITG,2007:8.
[119] Z. Q. Wang and X. Y. Wang. NetFlow based intrusion detection system[C]//Proceedings of the2008International Conference on MultiMedia and Information Technology. Washington, DC,USA: IEEE,2008:825-828.
[120] T. Dedek, T. Martinek, and T. Marek. High level abstraction language as an alternative toembedded processors for internet packet processing in FPGA[C]//International Conference onField Programmable Logic and Applications,2007(FPL2007). Amsterdam, Netherlands: IEEE,2007,2:648-651.
[121] P. Kobiersky, J. Korenek, and L. Polcak. Packet header analysis and field extraction formultigigabit networks[C]//Proceedings of the200912th International Symposium on Designand Diagnostics of Electronic Circuits&Systems. Washington, DC, USA: IEEE ComputerSociety,2009:96-101.
[122] C. Kozanitis, J. Huber, S. Singh, et al. Leaping multiple headers in a single bound: Wire-speedparsing using the Kangaroo system[C]//INFOCOM2010, Proceedings IEEE. San Diego, CA,USA: IEEE,2010:1-9.
[123] S. Pati, R. Narayanan, G. Memik, et al. Design and implementation of an FPGA architecturefor high-speed network feature extraction[C]//International Conference on Field-ProgrammableTechnology,2007. Kitakyushu, Japan: IEEE,2007.
[124] F. Braun, J. Lockwood, and M. Waldvogel. Protocol wrappers for layered network packetprocessing in reconfigurable hardware[J]. IEEE Micro, IEEE,2002,22:66-74.
[125]张克农,陆佳华,高明.一种基于FPGA的千兆网络入侵检测方法与实现[C]//全国网络与信息安全技术研讨会’2005论文集（上册）.2005.
[126]杨帆.基于多核平台的网络流量检测研究与优化[D].北京邮电大学,2011.
[127] B. White, J. Lepreau, L. Stoller, et al. An integrated experimental environment for DistributedSystems and Networks[C]//Proceedings of the5th Symposium on Operating Systems Design&Implementation. Boston, MA: USENIXASSOC,2002:255-270.
[128] M. Dusi, W. John, and K. Claffy. Observing routing asymmetry in Internet traffic[R]. CAIDA,2009.
[129] R. Braden. Requirements for internet hosts-communication layers[J]. IETF,1989.
[130] F. Gont and S. Bellovin. Defending against sequence number attacks[J]. IETF,2012.
[131] F. Gont and A. Yourtchenko. On the implementation of the TCP urgent mechanism[J]. IETF,2011.
[132] J. Postel. Transmission Control Protocol[J]. IETF,1981.
[133] K. Ramakrishnan, S. Floyd, and D. Black. The addition of explicit congestion notification(ECN) to IP[J]. IETF,2001.
[134] N. Duffield, C. Lund, and M. Thorup. Estimating flow distributions from sampled flowstatistics[C]//Proceedings of the2003conference on Applications, Technologies, Architectures,and protocols for computer communications. Karlsruhe, Germany: ACM,2003:325-336.
[135] J. C. Mogul. Observing TCP dynamics in real networks[J]. ACM SIGCOMM ComputerCommunication Review, New York, NY, USA: ACM,1992,22:305-317.
[136] V. Paxson and M. Allman. Computing TCP’s retransmission timer[J]. IETF,2000.
[137] Y. Xiao, H. Wang, and K. Liu. Inference on packet loss in local side of networks[J]. Journal ofComputational Information Systems,2012,8:4695-4703.
[138] W. Stevens. TCP slow start, congestion avoidance, fast retransmit, and fast recoveryalgorithms[J]. IETF,1997.
[139]P. Karn and C. Partridge. Improving round-trip time estimates in reliable transport protocols[J].ACM SIGCOMM Computer Communication Review, ACM,1987,17:2-7.
[140] J. C. Bennett, C. Partridge, and N. Shectman. Packet reordering is not pathological networkbehavior[J]. IEEE/ACM Transactions on Networking (TON), IEEE,1999,7:789-798.
[141] V. Paxson. End-to-end routing behavior in the Internet[J]. IEEE/ACM Transactions onNetworking (TON), IEEE,1997,5:601-615.
[142] B. Kim, D. Kim, and J. Lee. Lost retransmission detection for TCP SACK[J]. IEEECommunications Letters,2004,8:600-602.
[143] B. Kim and J. Lee. Retransmission loss recovery by duplicate acknowledgment counting[J].IEEE Communications Letters, IEEE,2004,8:69-71.
[144] J. Bi, Q. Wu, and Z. Li. Packet delay and packet loss in the Internet[C]//Seventh InternationalSymposium on Computers and Communications,2002(ISCC). IEEE Comput. Soc,2002:3-8.
[145] Y. Sun, D. Li, and H. Sun. Network tomography and improved methods for delay distributioninference[C]//The9th International Conference on Advanced Communication Technology.IEEE,2007:1433-1437.
[146] G. Almes, S. Kalidindi, and M. Zekauskas. A Round-trip Delay Metric for IPPM[J]. IETF,1999.
[147] J. Charzinski. HTTP/TCP connection and flow characteristics[J]. Performance Evaluation,Elsevier,2000,42:149-162.
[148] N. G. Duffield and F. L. Presti. Network tomography from measured end-to-end delaycovariance[J]. IEEE/ACM Transactions on Networking (TON), IEEE Press,2004,12:978-992.
[149] W. Team. Leipzig II (collection)[J]. University of Waikato Computer Science Department,2003.
[150] L. de Haan and A. Ferreira. Extreme value theory: An introduction[M]. Springer,2006.
[151] S. Mccanne, S. Floyd, and K. Fall. ns2(network simulator2)[J]. Network Research Group atthe Lawrence Berkeley National Laboratory,1995.
[152] X. Chang. Network simulations with OPNET[C]//Proceedings of the31st conference onWinter simulation: Simulation—a bridge to the future. Phoenix, Arizona, USA: ACM,1999,1:307-314.
[153] R. Jones. Netperf[J].1995.
[154] P. E. McKenney, D. Y. Lee, and B. A. Denny. tg (Traffic Generator)[J]. Information SciencesInstitute of the University of Southern California,2002.
[155] H. E. Hurst, R. Black, and Y. Simaika. Long-term storage: An experimental study[M].Constable,1965.
[156] Y. Xiao and H. Wang. Specified hardware for network frames analysis[C]//Testing andDiagnosis,2009. ICTD2009. IEEE Circuits and Systems International Conference on. IEEE,2009:1-3.
[157]肖寅东.网络故障测试仪中特征数据的提取与软件优化[D].电子科技大学,2007.
[158]肖寅东,王厚军,田书林.高速网络入侵检测系统中包头解析方法[J].仪器仪表学报,2012,33.
[159] A. Patcha and J.-M. Park. Network anomaly detection with incomplete audit data[J].Computer Networks,2007,51:3935-3955.
[160] M. Ramadas, S. Ostermann, and B. Tjaden. Detecting anomalous network traffic withself-organizing maps[C]//In Proceedings of the Sixth International Symposium on RecentAdvances in Intrusion Detection, LNCS. Pittsburgh, PA, USA: Springer,2003:36-54.
[161] H. Dreger, A. Feldmann, M. Mai, et al. Dynamic application-layer protocol analysis fornetwork intrusion detection[C]//Proceedings of the15th conference on USENIX SecuritySymposium. Berkeley, CA, USA: USENIX Association,2006.
[162]郭俊.以太网媒体访问控制(MAC)及其FPGA实现研究[J].现代电子技术,2008,273:88-90.
[163]徐洪波，俞承芳.基于FPGA的以太网MAC子层协议设计实例[J].复旦学报,2004,43:50-53.
[164]田书林,肖寅东,刘科, et al.一种以太网错误帧提取接口装置[P].中国，发明专利，ZL200810044341.3，2008年5月5日.
[165]肖寅东,王厚军,田书林, et al.一种增强型以太网接口装置[P].中国，发明专利，ZL200810045416.X，2008年6月27日.
[2] M. Jain and C. Dovrolis. End-to-end available bandwidth: measurement methodology,dynamics, and relation with TCP throughput[J]. ACM SIGCOMM Computer CommunicationReview, New York, NY, USA: ACM,2002,32:295-308.
[3] V. Paxson. Measurements and analysis of end-to-end Internet dynamics[D]. University ofCalifornia, Berkeley,1997.
[4] M. Siekkinen, G. Urvoy-Keller, E. W. Biersack, et al. A root cause analysis toolkit for TCP[J].Computer Networks,2008,52:1846-1858.
[5] B.-Y. Choi, Z. Duan, and S. Moon. Special issue on measurement based networkmanagement[J]. Journal of Network and Systems Management,2010,19:3-6.
[6] A. Gupta. Network management: current trends and future perspectives[J]. Journal of Networkand Systems Management,2006,14:483-491.
[7] A. Pras, J. Schoenwaelder, M. Burgess, et al. Key research challenges in networkmanagement[J]. PAVLOU G, PRAS A. IEEE communications magazine, New York: IEEECommunications Society,2007,45:104-110.
[8] I. D. Barrera, G. R. Arce, and S. Bohacek. Statistical approach for congestion control ingateway routers[J]. Computer Networks, Elsevier B.V.,2011,55:572-582.
[9] R. L. Carter and M. E. Crovella. Measuring bottleneck link speed in packet-switchednetworks[J]. Performance Evaluation,1996,27:297-318.
[10] I. W. C. Lee and A. O. Fapojuwo. Analysis and modeling of a campus wireless network TCP/IPtraffic[J]. Computer Networks, Elsevier B.V.,2009,53:2674-2687.
[11] M. Smirnov. On model-driven self-engineering of inter-domain traffic[J]. ComputerCommunications,2008,31:3360-3371.
[12] P. Bahl, R. Chandra, A. Greenberg, et al. Towards highly reliable enterprise network servicesvia inference of multi-level dependencies[J]. ACM SIGCOMM Computer CommunicationReview, New York, NY, USA: ACM,2007,37(4):13-24.
[13] M. Casado, M. J. Freedman, J. Pettit, et al. Rethinking enterprise network control[J].IEEE/ACM Transactions on Networking (TON), Piscataway, NJ, USA: IEEE Press,2009,17(4):1270-1283.
[14] B. Nechaev, M. Allman, V. Paxson, et al. A preliminary analysis of TCP performance in anenterprise network[C]//Proceedings of the2010Internet Network Management Conference onResearch on Enterprise Networking. USENIX Association,2010:7-7.
[15] M. A. Shah, G. A. Safdar, C. Maple, et al. Network performance optimization: A case study ofenterprise network simulated in OPNET[C]//Frontiers of Information Technology (FIT),2011.2011:57-62.
[16] B. Stephens, A. L. Cox, S. Rixner, et al. A scalability study of enterprise networkarchitectures[C]//Seventh ACM/IEEE Symposium on Architectures for Networking andCommunications Systems (ANCS),2011.2011:111-121.
[17] Y. Vardi. Network tomography: Estimating source-destination traffic intensities from linkdata[J]. Journal of the American Statistical Association, Taylor&Francis Group,1996,91:365-377.
[18] M. Coates, R. Nowak, and others. Network loss inference using unicast end-to-endmeasurement[C]//Proc. ITC Conf. IP Traffic, Modeling and Management.2000:28-1.
[19] N. Duffield. Network tomography of binary network performance characteristics[J]. IEEETransactions on Information Theory,2006,52:5373-5388.
[20] N. Duffield1, J. Horowitz, F. lo Presti, et al. Network delay tomography from end-to-endunicast measurements[J]. Evolutionary Trends of the Internet, Springer,2001:576-595.
[21] Y. Tsang, M. Coates, and R. D. Nowak. Network delay tomography[J]. IEEE Transactions onSignal Processing, IEEE,2003,51:2125-2136.
[22] P. Barford and J. Sommers. Comparing probe-and router-based packet-loss measurement[J].Internet Computing, IEEE,2004,8:50-56.
[23] T. Auld, A. Moore, and S. Stephen. Bayesian neural networks for internet trafficclassification[J]. IEEE Transaction on Neural Networks,2007,18:223-239.
[24] A. Callado, C. Kamienski, G. Szabo, et al. A survey on internet traffic identification[J]. IEEECommunications Surveys&Tutorials,2009,11:37-52.
[25] A. Callado, J. Kelner, D. Sadok, et al. Better network traffic identification through theindependent combination of techniques[J]. Journal of Network and Computer Applications,2010,33:433-446.
[26] X. Guan, T. Qin, S. Member, et al. Dynamic feature analysis and measurement for large-scalenetwork traffic monitoring[J]. IEEE Transactions on Information Forensics and Security,2010,5:905-919.
[27] J. Jiang and S. Papavassiliou. Enhancing network traffic prediction and anomaly detection viastatistical network traffic separation and combination strategies[J]. Computer Communications,2006,29:1627-1638.
[28] M. Olbrich, F. Nadolni, F. Idzikowski, et al. Measurements of path characteristics inPlanetLab[R]. July, Telecommunication Networks Group, at the Faculty of ElectricalEngineering and Computer Science at the Technische Universit t Berlin.,2009.
[29] K. Papagiannaki, R. Cruz, and C. Diot. Network performance monitoring at small timescales[C]//Proceedings of the3rd ACM SIGCOMM Conference on Internet Measurement.ACM,2003:295-300.
[30] W. Wei, B. Wang, D. Towsley, et al. Model-based identification of dominant congested links[J].IEEE/ACM Transactions on Networking (TON), IEEE Press,2011,19:456-469.
[31] Y. Zhang and N. Duffield. On the constancy of internet path properties[C]//Proceedings of the1st ACM SIGCOMM Workshop on Internet Measurement. San Francisco, California, USA:ACM,2001:197-211.
[32]顾成杰,张顺颐.基于改进SVM的网络流量分类方法研究[J].仪器仪表学报,2011,32:1507-1513.
[33]黄志根,陈健,王珊.一种基于包长和时间间隔的网络流量分类方法[J].电子测量技术,2011,34:109-112.
[34]林青家,陈涤,刘允才.网络流量的小尺度特性分析[J].电子测量与仪器学报,2007,21:92-97.
[35]朱灵波,戴冠中, J.-M. Rétif.一种网络流量分布特性的综合分析方法[J].仪器仪表学报,2009,30:1026-1031.
[36] C. iflikli and A. Gezer. Self similarity analysis via fractional Fourier transform[J]. SimulationModelling Practice and Theory,2011,19:986-995.
[37] T. Akgul, S. Baykut, M. Erol-Kantarci, et al. Periodicity-based anomalies in self-similarnetwork traffic flow measurements[J]. IEEE Transactions on Instrumentation and Measurement,IEEE,2011,60:1358-1366.
[38] A. Erramilli, M. Roughan, D. Veitch, et al. Self-similar traffic and network dynamics[J].Proceedings of the IEEE,2002,90:800-819.
[39] W. E. Leland, M. S. Taqqu, W. Willinger, et al. On the self-similar nature of Ethernet traffic(extended version)[J]. IEEE/ACM Transactions on Networking (TON), IEEE,1994,2:1-15.
[40] K. Park and W. Willinger. Self-similar network traffic and performance evaluation[M]. WileyOnline Library,2000.
[41] G.-L. LI and V. O. Li. Analysis of transient loss performance impact of long-range dependencein network traffic[J]. Self-similar Network Traffic and Performance Evaluation,2000:319.
[42] Y. Bejerano. Taking the skeletons out of the closets: A simple and efficient topology discoveryscheme for large Ethernet LANs[J]. IEEE/ACM Transactions on Networking (TON), IEEEPress,2009,17:1385-1398.
[43] Y. Bejerano, Y. Breitbart, M. Garofalakis, et al. Physical topology discovery for largemultisubnet networks[C]//INFOCOM2003. Twenty-Second Annual Joint Conference of theIEEE Computer and Communications. IEEE,2003,1:342-352.
[44] R. Black, A. Donnelly, and C. Fournet. Ethernet topology discovery without networkassistance[C]//Proceedings of the12th IEEE International Conference on Network Protocols(ICNP). IEEE,2004:328-339.
[45] H. Gobjuka and Y. J. Breitbart. Ethernet topology discovery for networks with incompleteinformation[J]. IEEE/ACM Transactions on Networking (TON), IEEE,2010,18:1220-1233.
[46] S. Pandey, M.-J. Choi, Y. J. Won, et al. SNMP-based enterprise IP network topologydiscovery[J]. International Journal of Network Management, Wiley Online Library,2011,21:169-184.
[47] S. Alcock and R. Nelson. Passive detection of TCP congestion events[C]//18th InternationalConference on Telecommunications,2011(ICT).2011:499-504.
[48] I. D. Barrera, S. Bohacek, and G. R. Arce. Statistical detection of congestion in routers[J]. IEEETransactions on Signal Processing,2010,58:957-968.
[49] I. El Khayat, P. Geurts, and G. Leduc. Enhancement of TCP over wired/wireless networks withpacket loss classifiers inferred by supervised learning[J]. Wireless Networks,2008,16:273-290.
[50] H. Lim and J. C. Hou. Identifying lossy links in wired/wireless networks by exploiting sparsecharacteristics[J]. Computer Networks,2007,51:4442-4459.
[51] A. Markopoulou, F. Tobagi, and M. Karam. Loss and delay measurements of internetbackbones[J]. Computer Communications, Elsevier,2006,29:1590-1604.
[52] J. Ni and S. Tatikonda. Network tomography based on additive metrics[J]. IEEE Transactionson Information Theory,2011,57:7798-7809.
[53] V. N. Padmanabhan and L. Qiu. Network tomography using passive end-to-endmeasurements[C]//DIMACS Workshop on Internet and WWW Measurement, Mapping andModeling. Citeseer,2002.
[54] V. N. Padmanabhan, L. Qiu, and H. J. Wang. Server-based inference of Internet linklossiness[C]//INFOCOM2003. Twenty-Second Annual Joint Conference of the IEEE Computerand Communications. IEEE,2003,1:145-155.
[55] Y. Huang, N. Feamster, and R. Teixeira. Practical issues with using network tomography forfault diagnosis[J]. ACM SIGCOMM Computer Communication Review, ACM,2008,38:53-58.
[56]陈敏,李旺.计算机网络中的故障定位技术研究[J].国外电子测量技术,2007,26:8-11.
[57] J. Delport and M. S. Olivier. Detecting uncooperative Ethernet elements using accurateround-trip time measurements[C]//Southern African Telecommunication Networks andApplications Conference (SATNAC).2005,1:153-156.
[58] S. Li, S. Wei, Y. Zhang, et al. A distributed rate-based congestion control scheme for wirelessnetworks with random losses[J]. Journal of Computational Information Systems,2011,7:5292-5299.
[59] J. Cao, A. Chen, and P. P. C. Lee. Modeling time correlation in passive network losstomography[C]//IEEE/IFIP41st International Conference on Dependable Systems Networks,2011(DSN).2011:550-561.
[60] A. Kesselman and Y. Mansour. Optimizing TCP retransmission timeout[C]//Networking-ICN2005. Heidelberg: Springer,2005:133-140.
[61] L. Ma, G. Arce, and K. Barner. TCP retransmission timeout algorithm using weightedmedians[J]. IEEE Signal Processing Letters,2004,11:569-572.
[62] S. Rewaskar, J. Kaur, and F. D. Smith. A performance study of loss detection/recovery inreal-world TCP implementations[C]//IEEE International Conference on Network Protocols,2007(ICNP). Ieee,2007:256-265.
[63] M. C. Weigle, K. Jeffay, and F. Donelson Smith. Delay-based early congestion detection andadaptation in TCP: impact on web performance[J]. Computer Communications, Elsevier,2005,28:837-850.
[64] V. Arya, N. G. Duffield, and D. Veitch. Multicast inference of temporal loss characteristics[J].Performance Evaluation,2007,64:1169-1180.
[65] N. Duffield, F. lo Presti, V. Paxson, et al. Network loss tomography using striped unicastprobes[J]. IEEE/ACM Transactions on Networking (TON),2006,14:697-710.
[66] D. Ghita, H. Nguyen, M. Kurant, et al. Netscope: Practical network losstomography[C]//INFOCOM2010, Proceedings IEEE.2010:1-9.
[67] H. Tian and H. Shen. Multicast-based inference of network-internal loss[C]//7th InternationalSymposium on Parallel Architectures, Algorithms and Networks,2004.2004:288-293.
[68] D. Zhang, D. Ionescu, and S. Member. A new method for measuring packet loss probabilityusing a Kalman filter[J]. IEEE Transactions on Instrumentation and Measurement,2009,58:488-498.
[69] R. Cáceres, N. G. Duffield, J. Horowitz, et al. Multicast-based inference of network-internalcharacteristics: Accuracy of packet loss estimation[C]//INFOCOM’99. Eighteenth Annual JointConference of the IEEE Computer and Communications Societies. IEEE,1999,1:371-379.
[70] J. Sommers, P. Barford, N. Duffield, et al. Improving accuracy in end-to-end packet lossmeasurement[C]//ACM SIGCOMM Computer Communication Review.2005,35:157-168.
[71] J. Sommers, P. Barford, N. Duffield, et al. A geometric approach to improving active packetloss measurement[J]. IEEE/ACM Transactions on Networking (TON), Piscataway, NJ, USA:IEEE Press,2008,16:307-320.
[72] E. Altman, K. Avrachenkov, and C. Barakat. A stochastic model of TCP/IP with stationaryrandom losses[C]//ACM SIGCOMM Computer Communication Review. ACM,2000,30:231-242.
[73] A. F. Atiya, S. G. Yoo, K. T. Chong, et al. Packet loss rate prediction using the sparse basisprediction model[J]. IEEE Transactions on Neural Networks, IEEE,2007,18:950-954.
[74] E. Baralis, A. Bianco, T. Cerquitelli, et al. NetCluster: A Clustering-Based Framework forInternet Tomography[C]//IEEE International Conference on Communications (ICC’09).2009:1-5.
[75] J.-C. Bolot. End-to-end packet delay and loss behavior in the internet[J]. ACM SIGCOMMComputer Communication Review, New York, NY, USA: ACM,1993,23(4):289-298.
[76] H. X. Nguyen and M. Roughan. On the correlation of internet packetlosses[C]//Telecommunication Networks and Applications Conference (ATNAC2008).2008:22-27.
[77] S. Rewaskar, J. Kaur, and F. D. Smith. Accuracy of probing techniques in estimating TCP lossrates[C]//ACM Sigcomm, Pisa. ACM,2006.
[78] M. Allman, W. M. Eddy, and S. Ostermann. Estimating loss rates with TCP[J]. ACMSIGMETRICS Performance Evaluation Review,2003,31:12-24.
[79] N. Fonseca and M. Crovella. Bayesian packet loss detection for TCP[C]//INFOCOM2005.24th Annual Joint Conference of the IEEE Computer and Communications Societies.2005,3:1826-1837vol.3.
[80] J. Martin, A. Nilsson, and I. Rhee. Delay-based congestion avoidance for TCP[J]. IEEE/ACMTransactions on Networking (TON), IEEE,2003,11:356-369.
[81] H. Nguyen and P. Thiran. Network loss inference with second order statistics of end-to-endflows[C]//SAN DIEGO U California. Proceedings of the7th ACM SIGCOMM Conference onInternet Measurement. ACM,2007:227-239.
[82] N. G. Duffield, V. Arya, R. Bellino, et al. Network tomography from aggregate loss reports[J].Performance Evaluation,2005,62:147-163.
[83] Y. Gu, L. Breslau, N. Duffield, et al. On passive one-way loss measurements using sampledflow statistics[C]//INFOCOM2009. IEEE,2009:2946-2950.
[84] F. Strohmeier, P. Dorfinger, and B. Trammell. Network performance evaluation based on flowdata[C]//7th International Wireless Communications and Mobile Computing Conference,2011(IWCMC). Ieee,2011:1585-1589.
[85] S. Rewaskar. Real world evaluation of techniques for mitigating the impact of packet losses onTCP performance[D]. University of North Carolina at Chapel Hill,2008.
[86] S. Rewaskar, J. Kaur, and D. Smith. A passive state-machine based approach for reliableestimation of TCP losses[R]. Department of Computer Science of the University of NorthCarolina at Chapel Hill,2006.
[87] S. Rewaskar, J. Kaur, and F. D. Smith. A passive state-machine approach for accurate analysisof TCP out-of-sequence segments[J]. ACM SIGCOMM Computer Communication Review,New York, NY, USA: ACM,2006,36(3):51-64.
[88] P. Benko and A. Veres. A passive method for estimating end-to-end TCP packet loss[C]//GlobalTelecommunications Conference,2002(GLOBECOM’02). IEEE,2002,3:2609-2613vol.3.
[89] E. Brosh, G. Lubetzky-Sharon, and Y. Shavitt. Spatial-temporal analysis of passive TCPmeasurements[C]//INFOCOM2005.24th Annual Joint Conference of the IEEE Computer andCommunications Societies.2005,2:949-959vol.2.
[90] I. Din and N. A. Saqib. Passive packet loss detection and its effect on web trafficcharacteristics[C]//International Conference on Computer and Electrical Engineering,2008(ICCEE). IEEE,2008:729-733.
[91] A. Friedl, S. Ubik, A. Kapravelos, et al. Realistic passive packet loss measurement forhigh-speed networks[C]//Traffic Monitoring and Analysis. Springer,2009:1-7.
[92] S. Jaiswal, G. Iannaccone, and C. Diot. Inferring TCP connection characteristics throughpassive measurements[C]//INFOCOM2004. Twenty-third AnnualJoint Conference of the IEEEComputer and Communications Societies. Hong Kong, China: IEEE,2004:1582-1592.
[93] S. Jaiswal, G. Iannaccone, C. Diot, et al. Measurement and classification of out-of-sequencepackets in a tier-1IP backbone[J]. IEEE/ACM Transactions on Networking (TON), Piscataway,NJ, USA: IEEE Press,2007,15(1):54-66.
[94] M. Mellia, M. Meo, L. Muscariello, et al. Passive analysis of TCP anomalies[J]. ComputerNetworks,2008,52:2663-2676.
[95] Z. Wen and K. L. Yeung. On detection algorithms for spurious retransmissions inTCP[C]//Wireless Communications and Networking Conference,2010(WCNC). IEEE,2010:1-6.
[96]高中耀,程光. TCP报文丢包定位方法研究[J].计算机工程与应用,2012,7:1-7.
[97]王敏杰,徐昌彪,刘光明. TCP隐式丢包检测技术分析[J].计算机应用研究,2006,1:184-186.
[98] N. Cardwell, S. Savage, and T. Anderson. Modeling TCP latency[C]//INFOCOM2000.Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies.IEEE,2000,3:1742-1751.
[99] M. J. Coates and R. D. Nowak. Sequential Monte Carlo inference of internal delays innonstationary data networks[J]. IEEE Transactions on Signal Processing, IEEE,2002,50:366-376.
[100] K. Kobayashi and T. Katayama. Analysis and evaluation of packet delay variance in theInternet[J]. IEICE transactions on communications, The Institute of Electronics, Informationand Communication Engineers,2002,85:35-42.
[101] F. lo Presti, N. Duffield, J. Horowitz, et al. Multicast-based inference of network-internaldelay distributions[J]. IEEE/ACM Transactions on Networking (TON), IEEE,2002,10:761-775.
[102] Y. Sato, S. Ata, I. Oka, et al. Using mixed distribution for modeling end-to-end delaycharacteristics[C]//Proceedings of the8th Asia-Pacific Network Operation and ManagementSymposium,2005(APNOMS2005).2005:422-433.
[103] S. Shakkottai, N. Brownlee, A. Broido, et al. The RTT distribution of TCP flows on theInternet and its impact on TCP based flow control[R]. Cooperative Association for Internet DataAnalysis (CAIDA),2004.
[104] W. Zhang and J. He. Modeling end-to-end delay using Pareto distribution[C]//SecondInternational Conference on Internet Monitoring and Protection (ICIMP2007).2007:21.
[105] A. M. K. C. Zhen Zhu. Worst case round trip time prediction and statistical analysis usingextreme values theory[C]//Proc. WIP Session of IEEE-CS Real-Time Systems Symposium.Cancun, Mexico:2003.
[106] B. Veal, K. Li, and D. K. Lowenthal. New methods for passive estimation of TCP round-triptimes[C]//Passive and Active Network Measurement,6th International Workshop. Boston, MA,USA:2005:121-134.
[107] A. Acharya and J. Saltz. A study of internet round-trip delay[R]. Computer ScienceDepartment of University of Maryland,1998:1-18.
[108] J. Aikat, J. Kaur, F. D. Smith, et al. Variability in TCP round-trip times[C]//InternetMeasurement Workshop.2003:279-284.
[109] H. Jiang and C. Dovrolis. Passive estimation of TCP round-trip times[J]. ACM SIGCOMMComputer Communication Review, New York, NY, USA: ACM,2002,32:75-88.
[110] R. Lance and I. Frommer. Round-trip time inference via passive monitoring[J]. ACMSIGMETRICS Performance Evaluation Review, ACM,2005,33:32-38.
[111] D. Leonard and D. Loguinov. Turbo King: Framework for large-scale internet delaymeasurements[C]//INFOCOM2008. The27th Conference on Computer Communications. Ieee,2008:31-35.
[112] Y. Pei, H. Wang, and S. Cheng. A passive method to estimate TCP round trip time fromnonsender-side[C]//2nd IEEE International Conference on Computer Science and InformationTechnology,2009(ICCSIT). IEEE,2009:43-47.
[113] F. Ping, C. McConnell, and J.-H. Hwang. A retrospective approach for accurate networklatency prediction[C]//Proceedings of19th International Conference on ComputerCommunications and Networks,2010(ICCCN). IEEE,2010:1-6.
[114] P. Sessini and A. Mahanti. Observations on round-trip times of TCP connections[C]//Proc. ofSPECTS. Calgary, Canada:2006.
[115] S. B. Kotsiantis, D. Kanellopoulos, and P. E. Pintelas. Data preprocessing for supervisedlearning[J]. International Journal of Computer Science,2006,1:111-117.
[116] F. Fusco and L. Deri. High speed network traffic analysis with commodity multi-coresystems[C]//Proceedings of the10th annual conference on Internet measurement. Melbourne,Australia: ACM,2010:218-224.
[117]曾宪玮,裴昌幸,朱畅华等.基于ARM的分布式网络测量探针的设计与实现[J].仪器仪表学报,2007,28:784-787.
[118] G. Munz, S. Li, and G. Carle. Traffic anomaly detection using k-means clustering[C]//GI/ITGWorkshop MMBnet. Hamburg, Germany: GI/ITG,2007:8.
[119] Z. Q. Wang and X. Y. Wang. NetFlow based intrusion detection system[C]//Proceedings of the2008International Conference on MultiMedia and Information Technology. Washington, DC,USA: IEEE,2008:825-828.
[120] T. Dedek, T. Martinek, and T. Marek. High level abstraction language as an alternative toembedded processors for internet packet processing in FPGA[C]//International Conference onField Programmable Logic and Applications,2007(FPL2007). Amsterdam, Netherlands: IEEE,2007,2:648-651.
[121] P. Kobiersky, J. Korenek, and L. Polcak. Packet header analysis and field extraction formultigigabit networks[C]//Proceedings of the200912th International Symposium on Designand Diagnostics of Electronic Circuits&Systems. Washington, DC, USA: IEEE ComputerSociety,2009:96-101.
[122] C. Kozanitis, J. Huber, S. Singh, et al. Leaping multiple headers in a single bound: Wire-speedparsing using the Kangaroo system[C]//INFOCOM2010, Proceedings IEEE. San Diego, CA,USA: IEEE,2010:1-9.
[123] S. Pati, R. Narayanan, G. Memik, et al. Design and implementation of an FPGA architecturefor high-speed network feature extraction[C]//International Conference on Field-ProgrammableTechnology,2007. Kitakyushu, Japan: IEEE,2007.
[124] F. Braun, J. Lockwood, and M. Waldvogel. Protocol wrappers for layered network packetprocessing in reconfigurable hardware[J]. IEEE Micro, IEEE,2002,22:66-74.
[125]张克农,陆佳华,高明.一种基于FPGA的千兆网络入侵检测方法与实现[C]//全国网络与信息安全技术研讨会’2005论文集（上册）.2005.
[126]杨帆.基于多核平台的网络流量检测研究与优化[D].北京邮电大学,2011.
[127] B. White, J. Lepreau, L. Stoller, et al. An integrated experimental environment for DistributedSystems and Networks[C]//Proceedings of the5th Symposium on Operating Systems Design&Implementation. Boston, MA: USENIXASSOC,2002:255-270.
[128] M. Dusi, W. John, and K. Claffy. Observing routing asymmetry in Internet traffic[R]. CAIDA,2009.
[129] R. Braden. Requirements for internet hosts-communication layers[J]. IETF,1989.
[130] F. Gont and S. Bellovin. Defending against sequence number attacks[J]. IETF,2012.
[131] F. Gont and A. Yourtchenko. On the implementation of the TCP urgent mechanism[J]. IETF,2011.
[132] J. Postel. Transmission Control Protocol[J]. IETF,1981.
[133] K. Ramakrishnan, S. Floyd, and D. Black. The addition of explicit congestion notification(ECN) to IP[J]. IETF,2001.
[134] N. Duffield, C. Lund, and M. Thorup. Estimating flow distributions from sampled flowstatistics[C]//Proceedings of the2003conference on Applications, Technologies, Architectures,and protocols for computer communications. Karlsruhe, Germany: ACM,2003:325-336.
[135] J. C. Mogul. Observing TCP dynamics in real networks[J]. ACM SIGCOMM ComputerCommunication Review, New York, NY, USA: ACM,1992,22:305-317.
[136] V. Paxson and M. Allman. Computing TCP’s retransmission timer[J]. IETF,2000.
[137] Y. Xiao, H. Wang, and K. Liu. Inference on packet loss in local side of networks[J]. Journal ofComputational Information Systems,2012,8:4695-4703.
[138] W. Stevens. TCP slow start, congestion avoidance, fast retransmit, and fast recoveryalgorithms[J]. IETF,1997.
[139]P. Karn and C. Partridge. Improving round-trip time estimates in reliable transport protocols[J].ACM SIGCOMM Computer Communication Review, ACM,1987,17:2-7.
[140] J. C. Bennett, C. Partridge, and N. Shectman. Packet reordering is not pathological networkbehavior[J]. IEEE/ACM Transactions on Networking (TON), IEEE,1999,7:789-798.
[141] V. Paxson. End-to-end routing behavior in the Internet[J]. IEEE/ACM Transactions onNetworking (TON), IEEE,1997,5:601-615.
[142] B. Kim, D. Kim, and J. Lee. Lost retransmission detection for TCP SACK[J]. IEEECommunications Letters,2004,8:600-602.
[143] B. Kim and J. Lee. Retransmission loss recovery by duplicate acknowledgment counting[J].IEEE Communications Letters, IEEE,2004,8:69-71.
[144] J. Bi, Q. Wu, and Z. Li. Packet delay and packet loss in the Internet[C]//Seventh InternationalSymposium on Computers and Communications,2002(ISCC). IEEE Comput. Soc,2002:3-8.
[145] Y. Sun, D. Li, and H. Sun. Network tomography and improved methods for delay distributioninference[C]//The9th International Conference on Advanced Communication Technology.IEEE,2007:1433-1437.
[146] G. Almes, S. Kalidindi, and M. Zekauskas. A Round-trip Delay Metric for IPPM[J]. IETF,1999.
[147] J. Charzinski. HTTP/TCP connection and flow characteristics[J]. Performance Evaluation,Elsevier,2000,42:149-162.
[148] N. G. Duffield and F. L. Presti. Network tomography from measured end-to-end delaycovariance[J]. IEEE/ACM Transactions on Networking (TON), IEEE Press,2004,12:978-992.
[149] W. Team. Leipzig II (collection)[J]. University of Waikato Computer Science Department,2003.
[150] L. de Haan and A. Ferreira. Extreme value theory: An introduction[M]. Springer,2006.
[151] S. Mccanne, S. Floyd, and K. Fall. ns2(network simulator2)[J]. Network Research Group atthe Lawrence Berkeley National Laboratory,1995.
[152] X. Chang. Network simulations with OPNET[C]//Proceedings of the31st conference onWinter simulation: Simulation—a bridge to the future. Phoenix, Arizona, USA: ACM,1999,1:307-314.
[153] R. Jones. Netperf[J].1995.
[154] P. E. McKenney, D. Y. Lee, and B. A. Denny. tg (Traffic Generator)[J]. Information SciencesInstitute of the University of Southern California,2002.
[155] H. E. Hurst, R. Black, and Y. Simaika. Long-term storage: An experimental study[M].Constable,1965.
[156] Y. Xiao and H. Wang. Specified hardware for network frames analysis[C]//Testing andDiagnosis,2009. ICTD2009. IEEE Circuits and Systems International Conference on. IEEE,2009:1-3.
[157]肖寅东.网络故障测试仪中特征数据的提取与软件优化[D].电子科技大学,2007.
[158]肖寅东,王厚军,田书林.高速网络入侵检测系统中包头解析方法[J].仪器仪表学报,2012,33.
[159] A. Patcha and J.-M. Park. Network anomaly detection with incomplete audit data[J].Computer Networks,2007,51:3935-3955.
[160] M. Ramadas, S. Ostermann, and B. Tjaden. Detecting anomalous network traffic withself-organizing maps[C]//In Proceedings of the Sixth International Symposium on RecentAdvances in Intrusion Detection, LNCS. Pittsburgh, PA, USA: Springer,2003:36-54.
[161] H. Dreger, A. Feldmann, M. Mai, et al. Dynamic application-layer protocol analysis fornetwork intrusion detection[C]//Proceedings of the15th conference on USENIX SecuritySymposium. Berkeley, CA, USA: USENIX Association,2006.
[162]郭俊.以太网媒体访问控制(MAC)及其FPGA实现研究[J].现代电子技术,2008,273:88-90.
[163]徐洪波，俞承芳.基于FPGA的以太网MAC子层协议设计实例[J].复旦学报,2004,43:50-53.
[164]田书林,肖寅东,刘科, et al.一种以太网错误帧提取接口装置[P].中国，发明专利，ZL200810044341.3，2008年5月5日.
[165]肖寅东,王厚军,田书林, et al.一种增强型以太网接口装置[P].中国，发明专利，ZL200810045416.X，2008年6月27日.