IP网络流量的预测与分析
|
摘要
伴随着因特网发展,随之而来的是其不断扩充的规模、日益增加的复杂性以及成倍增长的带宽。但是人们对它的认识还远远不够深入,网络测量在这样的情况下应运而生,本文通过对网络流量的测量、建模、预测和分析,从而实现对网络行为的观察和评估。
本文首先介绍了网络测量和网络管理的基本概念以及相关理论。其次,详细说明了网络流量测量技术和流量数据的采集及模型分析。在对流量数据进行数据采集时,使用了数据包捕获技术,基于JPCAP采集共享以太网网段内的数据。由于高速网络技术的发展,对流量数据进行全分组测量开销较大,因此本文引入抽样采集的方法加以解决。最后本文以日常用户的流量为例,阐述了本课题中流量预测与分析的整个过程,包括流量数据的采集,流量预测模型的建立,流量预测值与实际值的对比分析。
本课题实现了在IP网络环境下对日常用户的流量进行了采集,并把采集到的数据进行分组抽样,根据抽样数据特征选取了AR(P)数学模型进行了流量预测,并把预测的流量数据与实际数据进行了对比分析。在采集方面,本文采用了JPCAP监听方式采集数据,在预测方面,由于本文研究的是平稳序列模型,所以本文主要介绍了AR、MA、ARMA模型。通过对(?)_(kk)的图像以及样本数字特征分析发现此序列具有截尾性,模型的阶数为2,因此本文序列适合模型为AR(2)。在分析方面,通过流量预测值与实际值的对比分析,发现两种图形流量的峰值点个数、图形的大致走向以及图形的相似程度基本相似。
Along with the development of the Internet, the attendant is constantly expanding its scale, the increasing complexity of the bandwidth and doubled. But in it is far from enough in-depth knowledge, network measurement in such circumstances came into being, Based on the network traffic measurement, modeling, forecasting and analysis, thus achieving the network of observation and assessment.
In this paper, network measurement and network management related to the basic concepts and theories. Second, the detailed description of network traffic flow measurement technology and data collection and model analysis. The flow of data in data acquisition, the use of a data packet capture technology, based on JPCAP Acquisition Ethernet data sharing. Due to the development of high-speed network technology for the entire data packet flow measurement spending more, this paper introduces the method of sample collection to be addressed. Finally this paper flow to the day-to-day users example, the subjects described in the flow forecasts and analysis of the entire process, including the flow of data acquisition, flow forecast model, flow forecast and the actual value of the comparative analysis.
To achieve this topic in the IP network environment on a day-to-day flow of the user's collection, and the collected data packet sampling, based on sample data selected characteristics AR (P) a mathematical model of flow forecast, and forecast flow data and the actual data were analyzed. In the acquisition area, the paper used JPCAP listening mode data collection, forecasting, as this paper is a smooth series model, this paper AR, MA, ARMA model. Based on the sample images of (φ|^)_(kk) and found several features of this sequence with Censored, the order of the model for 2, so this sequence suitable model AR (2). In the analysis, flow through predictive value and the actual value of the comparative analysis, found that the peak flow of two graphics number of points, graphics and graphics broadly similar to the basic level of similarity.
本文首先介绍了网络测量和网络管理的基本概念以及相关理论。其次,详细说明了网络流量测量技术和流量数据的采集及模型分析。在对流量数据进行数据采集时,使用了数据包捕获技术,基于JPCAP采集共享以太网网段内的数据。由于高速网络技术的发展,对流量数据进行全分组测量开销较大,因此本文引入抽样采集的方法加以解决。最后本文以日常用户的流量为例,阐述了本课题中流量预测与分析的整个过程,包括流量数据的采集,流量预测模型的建立,流量预测值与实际值的对比分析。
本课题实现了在IP网络环境下对日常用户的流量进行了采集,并把采集到的数据进行分组抽样,根据抽样数据特征选取了AR(P)数学模型进行了流量预测,并把预测的流量数据与实际数据进行了对比分析。在采集方面,本文采用了JPCAP监听方式采集数据,在预测方面,由于本文研究的是平稳序列模型,所以本文主要介绍了AR、MA、ARMA模型。通过对(?)_(kk)的图像以及样本数字特征分析发现此序列具有截尾性,模型的阶数为2,因此本文序列适合模型为AR(2)。在分析方面,通过流量预测值与实际值的对比分析,发现两种图形流量的峰值点个数、图形的大致走向以及图形的相似程度基本相似。
Along with the development of the Internet, the attendant is constantly expanding its scale, the increasing complexity of the bandwidth and doubled. But in it is far from enough in-depth knowledge, network measurement in such circumstances came into being, Based on the network traffic measurement, modeling, forecasting and analysis, thus achieving the network of observation and assessment.
In this paper, network measurement and network management related to the basic concepts and theories. Second, the detailed description of network traffic flow measurement technology and data collection and model analysis. The flow of data in data acquisition, the use of a data packet capture technology, based on JPCAP Acquisition Ethernet data sharing. Due to the development of high-speed network technology for the entire data packet flow measurement spending more, this paper introduces the method of sample collection to be addressed. Finally this paper flow to the day-to-day users example, the subjects described in the flow forecasts and analysis of the entire process, including the flow of data acquisition, flow forecast model, flow forecast and the actual value of the comparative analysis.
To achieve this topic in the IP network environment on a day-to-day flow of the user's collection, and the collected data packet sampling, based on sample data selected characteristics AR (P) a mathematical model of flow forecast, and forecast flow data and the actual data were analyzed. In the acquisition area, the paper used JPCAP listening mode data collection, forecasting, as this paper is a smooth series model, this paper AR, MA, ARMA model. Based on the sample images of (φ|^)_(kk) and found several features of this sequence with Censored, the order of the model for 2, so this sequence suitable model AR (2). In the analysis, flow through predictive value and the actual value of the comparative analysis, found that the peak flow of two graphics number of points, graphics and graphics broadly similar to the basic level of similarity.
引文
[1]李晟,宽带互联网流量测量与分析。(郑州大学硕士学位论文)2005.5
[2]刘岩,高传善,网络流量控制若干关键技术研究.(复旦大学博士学位论文)2004年10月。
[3]网络流量研究的意义与方向的探讨VIVIAN 2005-12-6。
[4]张泳天,戴英侠,荆继武,中国科学技术大学研究生院,信息安全国家重点实验室,计算机世界报1995年第40期。
[5]张宏莉,万滨兴等,Internet测量与分析综述,软件学报。2003/04/1
[6]陈刚,鲍剑洋,丁颖,对网络行为进行测量和分析。计算机世界2003,3。
[7]李木金,王光兴,一种被用于网络管理的性能分析模型和实现,软件学报2000年02期。
[8]RFC1213—Management Information Base for Network Management of TCP/IP—based internets:MIB-Ⅱ。
[9]陈丽华,张凌等,基于流量的网络性能分析模型设计与实现,计算机工程2000年1期。
[10]李祥,基于JPcap的网络流量分析研究与应用,贵州大学学报,2003年6月。
[11]杨新宇,魏恒义,程竹林,郑守淇,一种新的端到端采样网络流量测量方法.2003。
[12]Veres A,Boda M.The chaotic nature of TCP congestion control.Proc IEEE INFOCOM 2000:1715-1723.
[13]李木金,王光兴,一种基于web的网络管理模型及实现,计算机研究与发展,1999,第10期。
[14]程光,龚俭,大规模网络流量宏观行为周期性分析研究,小型微型计算机系统,Vol.24 No.6 June 2003。
[15]TRIUMF:http://sitka.triumf.ca/.
[16]崔子药,罗庆华SNMP协议在网络流量分析中的应用,《微型电脑应用》2002年第18卷第6期。
[17]KimberlyC.Claffy,George C.Polyzos,HansWerner Braun.Application of Sampling Methodologies to Network Traffic.
[18]程光,龚俭,丁伟,基于抽样测量的高速网络实时异常检测模型,软件学报,Vol.14,No.3,2003。
[19]刘军,雷振明,以太网流量工程研究,计算机工程与应用,2002。
[20]蔡康汤,艾军IP网络流量与分析,《广东通信技术》2003年1月第23卷第1期。
[21]Paxson V.End-to-End routing behavior in the Internet.IEEE/ACM Transactions on Networking.1997,5(5):601-615.
[22]刘东林,帅典勋,网络流量模型的非线性特征量的提取及分析,电子学报,Vol.31 No.12 Dec.2003。
[23]杨策,张永智,庞正社,网络流量监测技术及性能分析,空军工程大学学报(自然科学版)2003年01期。
[24]赵新辉 李祥,基于JavaPcap网络数据包捕获的研究与应用,计算机科学技术2000年第3期。
[25]谢金星,邢文训,网络优化,清华大学出版社2000年。
[26]Stallings W.Network and Intemetwork Security Principles and Practice.IEEE Computer Society Press,1995.
[27]E.Fuchs and PE.Jackson,"Estimates of Distributions of Random Variables for CertainComputer Communication Traffic Models",Comm.of ACM,Vol.13,No 12,December 1970,pages 752-767.
[28]M.Taqqu and V.Teverosky.Is network traffic self-similar or multifractal? Journal of Fractals,1997,5(1):6374.
[29]RFC3432—Network performance measurement with periodic streams,http://www.faqs.orglrfcs,}rfc3432.html.
[30]Cacers R,Duffield N,Feldmann A.Measurement and analysis of IP Network usage and behavior.IEEE Communication Magazine,2000,38(5):146-151.
[31]曹书生,周立超,桂志波,网络业务流模型综述,江苏通信技术2003年05期。
[32]V.Paxson,G.Almes,J.Mahdavi,et al.Framework for IP Performance Metrics.IETF RFC 2330.May 1998.http://www.ietf.org/rfc/rfc2330.txt.
[33]William Stallings著.SNMP网络管理.胡成松,汪凯译.北京:中国电力出版社.2001年.ISBN 7-5083-0646-S/'I'P.203。
[34]张海波,网络流量检测与分析2001年3月。
[35]B.Mandelbrot,J.V Ness.Fractional Brownian motion,fractional Gaussian noise and application.SIAM Review.1968,10(4):422-437.
[36]邹柏贤,网络流量正常行为模型的建立《计算机应用》2002年7月第22卷第7期。
[37]Jacobson V Congestion Avoidance and Control.IEEE/ACM Transaction Networking.1998,6(3):314-329.
[38]邹柏贤,刘强,基于ARMA模型的网络流量预测《计算机研究与发展》2002年12月第39卷第12期。
[39]T.Tuan and K.Park,Multiple time scale congestion control for self similar network traffic,Performance Evalution,36,1999.
[40]Kalidindi S,Zekauskas MJ.Surveyor:An Infrastructure for Internet Performance Measurements,INET99,http://www.isoc.org/inet99/proceedings/4h/4h_2.htm.
[41]谢喜秋,梁洁,彭巍等,网络流量采集工具的分析与比较.电信科学,2002。
[42]R.Morris,TCP Behavior with Many Flows IEEE International Conference on Network Protocols,Oct.1997.
[43]Homepage of skitter,http://www.caida.org/tools/measurement/skitter/.
[44]T Hansen,J.Otero,T.McGregor,H.Braun.Active measurement data analysistechniques.In:Proceedings of the International Conference on Communications in Computing(CIC'2000),Las Vegas,Nevada,Jun.2000.
[45]NLANR(National Laboratory for Appied Network Research)Measurement and Network Analysis Group.http://moat.nlanr.net/.April 2002.
[46]Lee Breslau,Deborah Estrin,Kevin Fall,et al.Advances in Network Simulation.IEEE Computer2000,33(5):59-67.
[47]谢高岗,IP网络性能测量技术研究.湖南大学博士论文,2002,11-16。
[48]D.R.Cox.Long-range dependence:a review,in Statistics:An Appraisal.H.A.David and H.T.David,Eds.Iowa State University Press,Ames,IA.1984,55-74.
[49]Tsybakov B,Georganas N D.On Self-Similar Traffic in ATM Queues:Defination,Overflow Bound,and Cell Delay Distribution.IEEE/ACM Trans Networking,1997,(5)3.
[50]Kevin Thompson,Gregory J Miller,Rick Wilder.Wide-area Internet traffic patterns and characteristics[J].IEEE Netwok1997,5(6):10-23.
[51]雷擎,王行刚,计算机网络模拟方法与工具,通信学报,2001。
[52]J.Cao,W.S.Cleveland,and D.X.Sun.S-Net:A Software System for Analyzing Packet Databases.Proceedings Passive and Active Measurement,2002.
[2]刘岩,高传善,网络流量控制若干关键技术研究.(复旦大学博士学位论文)2004年10月。
[3]网络流量研究的意义与方向的探讨VIVIAN 2005-12-6。
[4]张泳天,戴英侠,荆继武,中国科学技术大学研究生院,信息安全国家重点实验室,计算机世界报1995年第40期。
[5]张宏莉,万滨兴等,Internet测量与分析综述,软件学报。2003/04/1
[6]陈刚,鲍剑洋,丁颖,对网络行为进行测量和分析。计算机世界2003,3。
[7]李木金,王光兴,一种被用于网络管理的性能分析模型和实现,软件学报2000年02期。
[8]RFC1213—Management Information Base for Network Management of TCP/IP—based internets:MIB-Ⅱ。
[9]陈丽华,张凌等,基于流量的网络性能分析模型设计与实现,计算机工程2000年1期。
[10]李祥,基于JPcap的网络流量分析研究与应用,贵州大学学报,2003年6月。
[11]杨新宇,魏恒义,程竹林,郑守淇,一种新的端到端采样网络流量测量方法.2003。
[12]Veres A,Boda M.The chaotic nature of TCP congestion control.Proc IEEE INFOCOM 2000:1715-1723.
[13]李木金,王光兴,一种基于web的网络管理模型及实现,计算机研究与发展,1999,第10期。
[14]程光,龚俭,大规模网络流量宏观行为周期性分析研究,小型微型计算机系统,Vol.24 No.6 June 2003。
[15]TRIUMF:http://sitka.triumf.ca/.
[16]崔子药,罗庆华SNMP协议在网络流量分析中的应用,《微型电脑应用》2002年第18卷第6期。
[17]KimberlyC.Claffy,George C.Polyzos,HansWerner Braun.Application of Sampling Methodologies to Network Traffic.
[18]程光,龚俭,丁伟,基于抽样测量的高速网络实时异常检测模型,软件学报,Vol.14,No.3,2003。
[19]刘军,雷振明,以太网流量工程研究,计算机工程与应用,2002。
[20]蔡康汤,艾军IP网络流量与分析,《广东通信技术》2003年1月第23卷第1期。
[21]Paxson V.End-to-End routing behavior in the Internet.IEEE/ACM Transactions on Networking.1997,5(5):601-615.
[22]刘东林,帅典勋,网络流量模型的非线性特征量的提取及分析,电子学报,Vol.31 No.12 Dec.2003。
[23]杨策,张永智,庞正社,网络流量监测技术及性能分析,空军工程大学学报(自然科学版)2003年01期。
[24]赵新辉 李祥,基于JavaPcap网络数据包捕获的研究与应用,计算机科学技术2000年第3期。
[25]谢金星,邢文训,网络优化,清华大学出版社2000年。
[26]Stallings W.Network and Intemetwork Security Principles and Practice.IEEE Computer Society Press,1995.
[27]E.Fuchs and PE.Jackson,"Estimates of Distributions of Random Variables for CertainComputer Communication Traffic Models",Comm.of ACM,Vol.13,No 12,December 1970,pages 752-767.
[28]M.Taqqu and V.Teverosky.Is network traffic self-similar or multifractal? Journal of Fractals,1997,5(1):6374.
[29]RFC3432—Network performance measurement with periodic streams,http://www.faqs.orglrfcs,}rfc3432.html.
[30]Cacers R,Duffield N,Feldmann A.Measurement and analysis of IP Network usage and behavior.IEEE Communication Magazine,2000,38(5):146-151.
[31]曹书生,周立超,桂志波,网络业务流模型综述,江苏通信技术2003年05期。
[32]V.Paxson,G.Almes,J.Mahdavi,et al.Framework for IP Performance Metrics.IETF RFC 2330.May 1998.http://www.ietf.org/rfc/rfc2330.txt.
[33]William Stallings著.SNMP网络管理.胡成松,汪凯译.北京:中国电力出版社.2001年.ISBN 7-5083-0646-S/'I'P.203。
[34]张海波,网络流量检测与分析2001年3月。
[35]B.Mandelbrot,J.V Ness.Fractional Brownian motion,fractional Gaussian noise and application.SIAM Review.1968,10(4):422-437.
[36]邹柏贤,网络流量正常行为模型的建立《计算机应用》2002年7月第22卷第7期。
[37]Jacobson V Congestion Avoidance and Control.IEEE/ACM Transaction Networking.1998,6(3):314-329.
[38]邹柏贤,刘强,基于ARMA模型的网络流量预测《计算机研究与发展》2002年12月第39卷第12期。
[39]T.Tuan and K.Park,Multiple time scale congestion control for self similar network traffic,Performance Evalution,36,1999.
[40]Kalidindi S,Zekauskas MJ.Surveyor:An Infrastructure for Internet Performance Measurements,INET99,http://www.isoc.org/inet99/proceedings/4h/4h_2.htm.
[41]谢喜秋,梁洁,彭巍等,网络流量采集工具的分析与比较.电信科学,2002。
[42]R.Morris,TCP Behavior with Many Flows IEEE International Conference on Network Protocols,Oct.1997.
[43]Homepage of skitter,http://www.caida.org/tools/measurement/skitter/.
[44]T Hansen,J.Otero,T.McGregor,H.Braun.Active measurement data analysistechniques.In:Proceedings of the International Conference on Communications in Computing(CIC'2000),Las Vegas,Nevada,Jun.2000.
[45]NLANR(National Laboratory for Appied Network Research)Measurement and Network Analysis Group.http://moat.nlanr.net/.April 2002.
[46]Lee Breslau,Deborah Estrin,Kevin Fall,et al.Advances in Network Simulation.IEEE Computer2000,33(5):59-67.
[47]谢高岗,IP网络性能测量技术研究.湖南大学博士论文,2002,11-16。
[48]D.R.Cox.Long-range dependence:a review,in Statistics:An Appraisal.H.A.David and H.T.David,Eds.Iowa State University Press,Ames,IA.1984,55-74.
[49]Tsybakov B,Georganas N D.On Self-Similar Traffic in ATM Queues:Defination,Overflow Bound,and Cell Delay Distribution.IEEE/ACM Trans Networking,1997,(5)3.
[50]Kevin Thompson,Gregory J Miller,Rick Wilder.Wide-area Internet traffic patterns and characteristics[J].IEEE Netwok1997,5(6):10-23.
[51]雷擎,王行刚,计算机网络模拟方法与工具,通信学报,2001。
[52]J.Cao,W.S.Cleveland,and D.X.Sun.S-Net:A Software System for Analyzing Packet Databases.Proceedings Passive and Active Measurement,2002.