光纤骨干网实时流测量关键技术研究
|
摘要
随着网络通信技术的迅猛发展、网络应用的日益丰富，网络已经成为人类社会重要的基础设施，网络的性能及其运行稳定性成为了事关国家和社会发展的重要问题。作为认知网络的重要手段，网络测量技术是网络管理和网络行为研究的基础，也是进行网络优化、确保网络安全的重要前提。按照测量地域分类，网络测量包括局域网测量、接入网测量和光纤骨干网测量等方式。其中，光纤骨干网测量可以实现大范围、多用户的广域测量，是网络测量领域的研究热点。
传统的网络测量研究主要集中在报文（数据包）层次，这导致后端管理系统需要处理和分析的信息量巨大，并且其测量相对平等地对待每个报文，不能获得报文间的内在联系及更高层次的信息，很难满足日益复杂的网络行为的观测及相关网络管理和优化的需求。为弥补报文层次网络测量的不足，基于流粒度的网络测量引起了国内外研究机构的广泛关注。如何利用有限的硬件计算、存储资源实现光纤骨干网的实时流测量，是一项极具挑战性和实用性的研究课题。
为此，本文在总结和分析国内外已有研究工作的基础上，对光纤骨干网实时流测量中的IP包实时提取、IP包实时流匹配、流超时判定机制、大象流测量等关键技术进行了深入研究。论文的主要研究内容与创新点归纳如下：
1．从最优化利用硬件资源的角度出发，对光纤骨干网IP包提取流程中的并行解扰算法进行了深入研究，提出了一种基于资源最优化的并行解扰算法ROPDA。相对于基于逻辑设计的并行解扰算法，ROPDA算法节省了系统的逻辑资源，降低了系统的复杂度，提高了系统的性能；相对于基于查找表结构的并行解扰算法，ROPDA算法可以运行在较少的片内存储资源的场合；此外，ROPDA算法的相关参数能够根据系统实际逻辑资源与片内存储资源的剩余情况进行灵活调整。依据光纤骨干网IP包实时提取的流程，设计并实现了光纤骨干网IP包实时提取平台。测试结果表明：该平台能够满足光纤骨干网IP包实时提取任务需求。
2．为确保IP包流匹配的实时性，匹配算法的时间复杂度必须为O（1）。针对TCAM（Ternary Content Addressable Memory）器件虽然可以实现时间复杂度为O（1）的匹配查询，但其能容纳的匹配条目无法满足光纤骨干网百万数量级并发流的问题，设计了一种基于两层异或Hash和TCAM的IP包实时流匹配算法RFMA-HT。利用异或Hash算法对IP包五元组进行转换以降低对存储空间的需求，同时通过开辟三级存储空间解决了匹配冲突问题。从时间复杂度、空间复杂度以及处理速度与实现三个方面分析了RFMA-HT算法的可行性，并利用实际的光纤骨干网数据对RFMA-HT算法进行了验证。测试结果表明：RFMA-HT算法具有较低的运算复杂度和冲突率，能够满足光纤骨干网IP包实时流匹配的需求。
3．针对光纤骨干网中存在的单包流占据系统大量资源的现象，研究了光纤骨干网单包流的特性，提出了一种基于单包流优化的流超时判定算法SFOTS。SFOTS算法利用单包流的特性及早发现单包流并通过设置较小的超时值将其尽早从测量系统中剔除，以提高系统资源利用性能。论文对SFOTS算法相关参数的选择进行了详细的理论分析，并利用实际的光纤骨干网数据对SFOTS算法的性能进行了评估。测试结果表明：SFOTS算法在保证判定准确性的同时对系统存储资源要求较低，特别是在网络攻击或蠕虫爆发等异常情况发生时，SFOTS算法具有更佳的性能优势，确保了测量系统的可靠运行。
4．针对现有大象流测量算法存在的判断机制单一、测量粒度偏大、测量结果不稳定等缺点，提出了一种基于三级LRU和状态保持的大象流测量算法3LRU+Hold。3LRU+Hold算法以测量时间片为周期，在每个测量时间片内根据流所包含的IP包个数对流进行分类，将长流、中流、短流分开处理，对准大象流进行保护；在每个测量时间片结束时，对准大象流及大象流的相关状态信息进行保持、更新。论文对3LRU+Hold算法相关参数的选择以及算法的可行性进行了详细的理论分析，并利用实际的光纤骨干网数据和Opnet网络仿真软件，从算法的准确性和测量结果的稳定性两个方面将3LRU+Hold算法与其它算法进行了实验对比。测试结果表明：3LRU+Hold算法对大象流的测量准确性优于LRU算法，且与Sample and Hold、Multistage Filters和LRU等算法相比，3LRU+Hold算法增强了大象流测量结果的稳定性。
综上所述，针对光纤骨干网实时流测量中的若干关键问题，本文的研究工作提出了有效的解决方案，为下一步构建光纤骨干网实时流测量系统、推进网络综合管理和网络行为分析等应用提供了基本的理论和技术支持。
With the rapid development of network communication technologies and theexplosive increase of network applications, the network has become an importantinfrastructure which deeply affects human society. The performance of the network andits running stability become the key issues related to the development of our society. Asan important means to understand the network, network measurement technology is theresearch foundation for network management, network behavior analysis and thepremise condition for optimizing the network, ensuring network security. According tomeasuring zone, network measurement can be classified as measurement on local areanetwork, measurement on access network and measurement on optical fiber backbonenetwork. Among them, measurement on optical fiber backbone network is a popularresearch topic because it can realize large-scale and multi-user’s overall measurement.
The traditional studies of network measurement technology usually concentrate onthe packet-level measurement which makes the management system difficult to processand analyze the huge information. Since it treats the received packets equally, thepacket-level measurement can’t get the internal relations among the packets andhigher-level characteristics of the packets, which are necessary for network behaviorobservation, network management and optimization. To overcome the shortages of thetraditional packet-level network measurement, the flow-level network measurement hasbeen widely concerned by the researchers all over the world. How to realize real-timeflow measurement on optical fiber backbone network by using limited hardwarecomputation and storage resources becomes a challenging and practical research topic.
Based on the summary and analysis of the existing research achievements, thisdissertation conducts an in-depth study of the key technologies of real-time flowmeasurement on optical fiber backbone network, including real-time IP packetextraction algorithm, real-time IP packet flow match algorithm, flow timeout strategyand elephant flow measurement algorithm.The main contents and contributions of thisdissertation are as follows:
1. Aiming at making the most effective use of the hardware resources, the paralleldescrambling algorithm in IP packet extraction process is studied. A novel resource-optimized parallel descrambling algorithm (ROPDA) is proposed. Compared with theparallel descrambling algorithm based on logic design, ROPDA saves the logicresources, reduces system complexity and improves system performance. Comparedwith the parallel descrambling algorithm based on memory structure, ROPDA can runin the situation of less on-chip memory. What is more, the parameters in ROPDA can beadjusted according to the residual logic and on-chip memory resources in the system. According to the real-time IP packet extraction process, a real-time IP packet extractionhardware platform for optical fiber backbone network is designed. The test results showthat this hardware platform can accomplish the real-time IP packet extraction task onoptical fiber backbone network.
2. To ensure the real-time property of flow match for IP packets, the timecomplexity of flow match algorithm should be O(1). For this purpose, theTCAM(Ternary Content Addressable Memory) chip can be used because it can realizeflow match with the time complexity of O(1). However, the memory resource of theTCAM chip can’t contain millions of flows existing on optical fiber backbone network.To solve this bottleneck problem, a real-time IP packet flow match algorithm based ontwo-layer XOR Hash and TCAM (RFMA-HT) is proposed. By using XOR Hashalgorithm, the104bits(96bits) of IP packet head are transferred to reduce the requiredmemory, and a three-layer memory space is designed to avoid conflict in matching. Thetime complexity, memory complexity, processing speed and the feasibility of RFMA-HT are theoretically analyzed. Some practical optical fiber backbone network data areused to evaluate the performance of RFMA-HT. The test results demonstrate thatRFMA-HT is of low computational complexity and conflict rate which can satisfy theneed of real-time IP packet flow matching on optical fiber backbone network.
3. There is a great abundance of single-packet flows existing on optical fiberbackbone network which consume lots of system resources. Based on analyzing thecharacteristics of the single-packet flows on optical fiber backbone network, asingle-packet flow optimized timeout strategy (SFOTS) is presented. In this strategy,the single-packet flows can be found and deleted from the memory quickly by setting alow timeout threshold. Therefore, SFOTS improves the memory utilization efficiency ofthe system greatly. The preferences of SFOTS are theoretically analyzed. Somepractical optical fiber backbone network data are used to evaluate the performance ofSFOTS. The test results demonstrate that SFOTS can ensure measurement accuracywhile consuming less memory resources. Especially in the situation of network attack orworm eruption, SFOTS can perform better which can ensure the stability of the system.
4. Since the existing elephant flow measurement algorithms have some shortages,such as single definition of elephant flow, high granularity and low stability, a novelelephant flow measurement algorithm based on three-layer LRU and state-hold(3LRU+Hold) is proposed. In each periodic time slice, the flows are classified as longflow, middle flow and short flow according to the number of packets involved in theflow and processed respectively. Thus, the possible elephant flows can be protected. Atthe end of each time slice, the information of the possible elephant flows and elephantflows are retained and updated. The preferences and the feasibility of3LRU+Hold aretheoretically analyzed. Performance of3LRU+Hold is investigated with respect to accuracy and stability by using practical optical fiber backbone network data and Opnetnetwork simulation software. The test results demonstrate that compared with LRU,3LRU+Hold has better accuracy. Also,3LRU+Hold has higher stability, compared withSample and Hold, Multistage Filters and LRU.
In summary, several efficient algorithms are developed in this dissertation to tacklethe key problems in real-time flow measurement on optical fiber backbone network.This provides fundamental theory and technique support for the establishment ofreal-time flow measurement system on optical fiber backbone network, networkmanagement and network behavior analysis.
传统的网络测量研究主要集中在报文（数据包）层次，这导致后端管理系统需要处理和分析的信息量巨大，并且其测量相对平等地对待每个报文，不能获得报文间的内在联系及更高层次的信息，很难满足日益复杂的网络行为的观测及相关网络管理和优化的需求。为弥补报文层次网络测量的不足，基于流粒度的网络测量引起了国内外研究机构的广泛关注。如何利用有限的硬件计算、存储资源实现光纤骨干网的实时流测量，是一项极具挑战性和实用性的研究课题。
为此，本文在总结和分析国内外已有研究工作的基础上，对光纤骨干网实时流测量中的IP包实时提取、IP包实时流匹配、流超时判定机制、大象流测量等关键技术进行了深入研究。论文的主要研究内容与创新点归纳如下：
1．从最优化利用硬件资源的角度出发，对光纤骨干网IP包提取流程中的并行解扰算法进行了深入研究，提出了一种基于资源最优化的并行解扰算法ROPDA。相对于基于逻辑设计的并行解扰算法，ROPDA算法节省了系统的逻辑资源，降低了系统的复杂度，提高了系统的性能；相对于基于查找表结构的并行解扰算法，ROPDA算法可以运行在较少的片内存储资源的场合；此外，ROPDA算法的相关参数能够根据系统实际逻辑资源与片内存储资源的剩余情况进行灵活调整。依据光纤骨干网IP包实时提取的流程，设计并实现了光纤骨干网IP包实时提取平台。测试结果表明：该平台能够满足光纤骨干网IP包实时提取任务需求。
2．为确保IP包流匹配的实时性，匹配算法的时间复杂度必须为O（1）。针对TCAM（Ternary Content Addressable Memory）器件虽然可以实现时间复杂度为O（1）的匹配查询，但其能容纳的匹配条目无法满足光纤骨干网百万数量级并发流的问题，设计了一种基于两层异或Hash和TCAM的IP包实时流匹配算法RFMA-HT。利用异或Hash算法对IP包五元组进行转换以降低对存储空间的需求，同时通过开辟三级存储空间解决了匹配冲突问题。从时间复杂度、空间复杂度以及处理速度与实现三个方面分析了RFMA-HT算法的可行性，并利用实际的光纤骨干网数据对RFMA-HT算法进行了验证。测试结果表明：RFMA-HT算法具有较低的运算复杂度和冲突率，能够满足光纤骨干网IP包实时流匹配的需求。
3．针对光纤骨干网中存在的单包流占据系统大量资源的现象，研究了光纤骨干网单包流的特性，提出了一种基于单包流优化的流超时判定算法SFOTS。SFOTS算法利用单包流的特性及早发现单包流并通过设置较小的超时值将其尽早从测量系统中剔除，以提高系统资源利用性能。论文对SFOTS算法相关参数的选择进行了详细的理论分析，并利用实际的光纤骨干网数据对SFOTS算法的性能进行了评估。测试结果表明：SFOTS算法在保证判定准确性的同时对系统存储资源要求较低，特别是在网络攻击或蠕虫爆发等异常情况发生时，SFOTS算法具有更佳的性能优势，确保了测量系统的可靠运行。
4．针对现有大象流测量算法存在的判断机制单一、测量粒度偏大、测量结果不稳定等缺点，提出了一种基于三级LRU和状态保持的大象流测量算法3LRU+Hold。3LRU+Hold算法以测量时间片为周期，在每个测量时间片内根据流所包含的IP包个数对流进行分类，将长流、中流、短流分开处理，对准大象流进行保护；在每个测量时间片结束时，对准大象流及大象流的相关状态信息进行保持、更新。论文对3LRU+Hold算法相关参数的选择以及算法的可行性进行了详细的理论分析，并利用实际的光纤骨干网数据和Opnet网络仿真软件，从算法的准确性和测量结果的稳定性两个方面将3LRU+Hold算法与其它算法进行了实验对比。测试结果表明：3LRU+Hold算法对大象流的测量准确性优于LRU算法，且与Sample and Hold、Multistage Filters和LRU等算法相比，3LRU+Hold算法增强了大象流测量结果的稳定性。
综上所述，针对光纤骨干网实时流测量中的若干关键问题，本文的研究工作提出了有效的解决方案，为下一步构建光纤骨干网实时流测量系统、推进网络综合管理和网络行为分析等应用提供了基本的理论和技术支持。
With the rapid development of network communication technologies and theexplosive increase of network applications, the network has become an importantinfrastructure which deeply affects human society. The performance of the network andits running stability become the key issues related to the development of our society. Asan important means to understand the network, network measurement technology is theresearch foundation for network management, network behavior analysis and thepremise condition for optimizing the network, ensuring network security. According tomeasuring zone, network measurement can be classified as measurement on local areanetwork, measurement on access network and measurement on optical fiber backbonenetwork. Among them, measurement on optical fiber backbone network is a popularresearch topic because it can realize large-scale and multi-user’s overall measurement.
The traditional studies of network measurement technology usually concentrate onthe packet-level measurement which makes the management system difficult to processand analyze the huge information. Since it treats the received packets equally, thepacket-level measurement can’t get the internal relations among the packets andhigher-level characteristics of the packets, which are necessary for network behaviorobservation, network management and optimization. To overcome the shortages of thetraditional packet-level network measurement, the flow-level network measurement hasbeen widely concerned by the researchers all over the world. How to realize real-timeflow measurement on optical fiber backbone network by using limited hardwarecomputation and storage resources becomes a challenging and practical research topic.
Based on the summary and analysis of the existing research achievements, thisdissertation conducts an in-depth study of the key technologies of real-time flowmeasurement on optical fiber backbone network, including real-time IP packetextraction algorithm, real-time IP packet flow match algorithm, flow timeout strategyand elephant flow measurement algorithm.The main contents and contributions of thisdissertation are as follows:
1. Aiming at making the most effective use of the hardware resources, the paralleldescrambling algorithm in IP packet extraction process is studied. A novel resource-optimized parallel descrambling algorithm (ROPDA) is proposed. Compared with theparallel descrambling algorithm based on logic design, ROPDA saves the logicresources, reduces system complexity and improves system performance. Comparedwith the parallel descrambling algorithm based on memory structure, ROPDA can runin the situation of less on-chip memory. What is more, the parameters in ROPDA can beadjusted according to the residual logic and on-chip memory resources in the system. According to the real-time IP packet extraction process, a real-time IP packet extractionhardware platform for optical fiber backbone network is designed. The test results showthat this hardware platform can accomplish the real-time IP packet extraction task onoptical fiber backbone network.
2. To ensure the real-time property of flow match for IP packets, the timecomplexity of flow match algorithm should be O(1). For this purpose, theTCAM(Ternary Content Addressable Memory) chip can be used because it can realizeflow match with the time complexity of O(1). However, the memory resource of theTCAM chip can’t contain millions of flows existing on optical fiber backbone network.To solve this bottleneck problem, a real-time IP packet flow match algorithm based ontwo-layer XOR Hash and TCAM (RFMA-HT) is proposed. By using XOR Hashalgorithm, the104bits(96bits) of IP packet head are transferred to reduce the requiredmemory, and a three-layer memory space is designed to avoid conflict in matching. Thetime complexity, memory complexity, processing speed and the feasibility of RFMA-HT are theoretically analyzed. Some practical optical fiber backbone network data areused to evaluate the performance of RFMA-HT. The test results demonstrate thatRFMA-HT is of low computational complexity and conflict rate which can satisfy theneed of real-time IP packet flow matching on optical fiber backbone network.
3. There is a great abundance of single-packet flows existing on optical fiberbackbone network which consume lots of system resources. Based on analyzing thecharacteristics of the single-packet flows on optical fiber backbone network, asingle-packet flow optimized timeout strategy (SFOTS) is presented. In this strategy,the single-packet flows can be found and deleted from the memory quickly by setting alow timeout threshold. Therefore, SFOTS improves the memory utilization efficiency ofthe system greatly. The preferences of SFOTS are theoretically analyzed. Somepractical optical fiber backbone network data are used to evaluate the performance ofSFOTS. The test results demonstrate that SFOTS can ensure measurement accuracywhile consuming less memory resources. Especially in the situation of network attack orworm eruption, SFOTS can perform better which can ensure the stability of the system.
4. Since the existing elephant flow measurement algorithms have some shortages,such as single definition of elephant flow, high granularity and low stability, a novelelephant flow measurement algorithm based on three-layer LRU and state-hold(3LRU+Hold) is proposed. In each periodic time slice, the flows are classified as longflow, middle flow and short flow according to the number of packets involved in theflow and processed respectively. Thus, the possible elephant flows can be protected. Atthe end of each time slice, the information of the possible elephant flows and elephantflows are retained and updated. The preferences and the feasibility of3LRU+Hold aretheoretically analyzed. Performance of3LRU+Hold is investigated with respect to accuracy and stability by using practical optical fiber backbone network data and Opnetnetwork simulation software. The test results demonstrate that compared with LRU,3LRU+Hold has better accuracy. Also,3LRU+Hold has higher stability, compared withSample and Hold, Multistage Filters and LRU.
In summary, several efficient algorithms are developed in this dissertation to tacklethe key problems in real-time flow measurement on optical fiber backbone network.This provides fundamental theory and technique support for the establishment ofreal-time flow measurement system on optical fiber backbone network, networkmanagement and network behavior analysis.
引文
[1] Mark Crovella, Balachander Krishnamurthy. Internet Measurement:Infrastructure,Traffic and Applications[M]. New York:John Wiley&Sons Inc.,2006.
[2] Wolfgang John, Sven Tafcelin, et al. Passive internet measurement:Overview andguidelines based on experiences[J]. Computer Communications,2010(33):533-550.
[3] Artur Ziviani. Internet Measurements[C]. In: Encyclopedia of InternetTechnologies and Applications, IGI Gobal,2007:235-241.
[4] Dimitrios P.Pezaros, Konstantinos Georgopoulos, David Hutchison. High-speed,in-band performance measurement instrumentation for next generation IPnetworks[J]. Computer Networks,2010(54):3246-3263.
[5]王俊峰.高速互联网性能测量若干关键技术研究[D].成都:电子科技大学,2004.
[6]蔡志平.基于主动测量和被动测量的网络测量技术、模型和算法研究[D].长沙:国防科学技术大学,2005.
[7] Nicolas Larrieu, Philippe Owezarski. Towards a Measurement Based Networkingapproach for Internet QoS improvement[J]. Computer Communications,2005,(28):259-273.
[8] Mehmet H Gunes, Sevcan Bilir, Kamil Sarac, Turgay Korkmaz. A measurementstudy on overhead distribution of value-added internet services[J]. ComputerNetworks,2007(51):4153-4173.
[9] L.Muscoriello, M.Mellia,et al. Markov models of internet traffic and a newhierarchical MMPP model[J]. Computer Communications,2005(28):1835-1851.
[10] Will E.Leland, Murad S.Taqqu, et al. On the Self-Similar Nature of EthernetTraffic[J]. IEEE/ACM Transactions on Networking,1994,2(1):1-15.
[11] Vern Paxson, Sally Floyd. Wide-Area Traffic:The Failure of Poisson Modeling[J].IEEE/ACM Transaction on Networking,1995,3(3):226-244.
[12] Ziqian Dong, Rohan D.W.Perera, et al. Network measurement based modelingand optimization for IP geolocation[J]. Computer Networks,2012(56):85-98.
[13] Felipe Mata, José Luis García-Dorado, Javier Aracil. Detection of traffic changesin large-scale backbone networks:The case of the Spanish academic network[J].Computer Networks,2012(56):686-702.
[14]张宏莉,方滨兴等. Internet测量与分析综述[J].软件学报,2003,14(1):110-116.
[15] Maurizio Molina, Ignasi Paredes-Oliva, Wayne Routly, Pere Barlet-Ros.Operational experiences with anomaly detection in backbone networks[J].Elsevier Computers&Security,2012, article in press.
[16] C. Scoglio, C. Bruni, G.Koch, S.Sutrave. Estimation of data traffic flows fromaggregate measurements[J]. Mathematical and Computer Modelling,2010(52):837-853.
[17] Zhichun Li, Yan Gao,Yan Chen. HiFIND: A high-speed flow-level intrusiondetection approach with DOS resiliency[J]. Computer Networks,2010(54):1282-1299.
[18]代六玲.互联网内容监管系统关键技术研究[D].南京:南京理工大学,2004.
[19]张宏科,张思东,刘文红.路由器原理与技术[M].北京:国防工业出版社,2002.
[20]张羿猛.骨干网测量系统中的POS信号处理关键技术研究[D].长沙:国防科学技术大学,2007.
[21] Prasad Calyam, Dima Krymskiy, Mukundan Sridharan, Paul Schopis. Active andpassive measurements on campus, regional and national network backbonepaths[C]. In: Proc. of the14th International Conference on Computer Communi-cations and Networks,2005:537-542.
[22] Keisuke Ishibashi, Toshiyuki Kanazawa, et al. Active/Passive Combination-typePerformance Measurement Method Using Change-of-measure Framework[J].Computer Communications,2004(27):868-879.
[23] Zhen Qin, Roberto Rojas-Cessa, Nirwan Ansari. Task-execution schedulingschemes for network measurement and monitoring[J]. Computer Communi-cations,2010(33):124-135.
[24] Artur Ziviani, Thiago B Cardozo, Antonio Tadeu A Gomes. Rapid prototyping ofactive measurement tools[J]. Computer Networks,2012(56):870-883.
[25] Jean-Chrysostome Bolot. End to End Packet Delay and Loss Behavior in theInternet[C]. In: Proc. of ACM SIGCOMM,1993:289-298.
[26] Kevin Lai, Mary Baker. Measuring Bandwidth[C].In: Proc. of IEEE INFOCOM,1999(1):235-245..
[27]赵海雁,陈立潮,叶树华.基于Windows的网络监听技术在局域网中的实现[J].计算机工程,2004,30(22):117-118.
[28]董天临.光纤通信与光纤通信网[M].北京:清华大学出版社,2005.
[29]马丽华,李云霞等.光纤通信系统[M].北京:北京邮电大学出版社,2009.
[30]顾畹仪.WDM超长距离光传输技术[M].北京:北京邮电大学出版社,2006.
[31] Michel Joindot, Stéphane Gosselin. Optical fiber transport systems and networks:fundamentals and prospects[J]. C. R. Physique2008(9):914-934.
[32]中国国际海底光缆分布. http://www.enet.com.cn/networks.
[33] Kimberly C.Claffy. Internet traffic characterization[D]. San Diego:University ofCalifornia,1994.
[34] Kimberly C.Claffy, Hans-Werner Braun, George C.Polyzos. A ParameterizableMethodology for Internet Traffic Flow Profiling[J]. IEEE Journal on SelectedAreas in Communications,1995,13(8):1481-1494.
[35] Bo Ryu, David Cheney, Hans-Werner Braun. Internet Flow Characterization:Adaptive Timeout Strategy and Statistical Modeling[C]. In: Proc. of the Passiveand Active Measurements Workshop2001, Amsterdam, Netherlands, April,2001.
[36] The Internet Engineering Task Force. http://www.ietf.org/home.html.
[37] N.Brownlee, et al. Traffic Flow Measuerment:Architecture[EB/OL].http://www.ietf.org/rfc/rfc2722.txt,1999-10.
[38] S.Handelman, et al. RTFM: New Attributes For Traffic Flow Measurement[EB/OL]. http://www.ietf.org/rfc/rfc2724.txt,1999-10.
[39] J.Quittek, et al. Requirements for IP Flow Information Export(IPFIX)[EB/OL].http://www.ietf.org/rfc/rfc3917.txt,2004-10.
[40] S.Leinen, et al. Evaluation of Candidate Protocols for IP Flow InformationExport(IPFIX)[EB/OL].http://www.ietf.org/rfc/rfc3955.txt,2004-10.
[41] G.Sadasivan, et al. Architecture for IP Flow Information Export[EB/OL].http://www.ietf.org/rfc/rfc5470.txt,2009-3.
[42] J.Quittek, et al. Information Model for IP Flow Information Export[EB/OL].http://www.ietf.org/rfc/rfc5102.txt,2008-1.
[43] B.Claise, et al. Specification of the IP Flow Information Export(IPFIX) Protocolfor the Exchange of IP Traffic Flow information[EB/OL]. http://www.ietf.org/rfc/rfc5101.txt,2008-1.
[44] N Brownlee, et al. Traffic Flow Measurement Experiences with NeTraMet[EB/OL]. http://www.ietf.org/rfc/rfc2123.txt,1997-3.
[45]徐加羚.高速多链路逻辑信道环境下的自适应抽样流测量系统[D].南京:东南大学,2006.
[46]李志春,张辉等.高速主干网测量系统的设计与实现[J].计算机工程,2003,29(l):53-55.
[47] Cisco Netflow. http://www.cisco.com/en/US/products/ps6645/products_ios_pro-tocol_option_home.html.
[48] Juniper公司. http://www.juniper.net.
[49]华为公司. http://www.huawei.com.cn.
[50] P.Phaal, et al. InMon Corporation’s sFlow: A Method for Moitoring Traffic inSwitched and Routed Networks[EB/OL].http://www.ietf.org/rfc/rfc3176.txt,2001-9.
[51] Nick Duffield, Carsten Lund, Mikkel Thorup. Properties and Prediction of FlowStatistics from Sampled Packet Streams[C].In: Proc. of the2nd ACM SIGCOMMWorkshop on Internet Measurement,2002:159-171.
[52] Nick Duffield, Carsten Lund, Mikkel Thorup. Flow Sampling Under HardResource Constraints[C]. In: Proc. of the Joint International Conference onMeasurement and Modeling of Computer Systems,2004:85-96.
[53] Edith Cohen, Nick Duffield, Haim Kaplan. Algorithms and Estimators forAccurate Summarization of Internet Traffic[C]. In: Proc. of IMC07, San Diego,2007:265-278.
[54] Ken Keys, David Moore, Cristian Estan. A Robust System for Accurate Real-time Summaries of Internet Traffic[C]. In: Proc. of the2005ACM SIGMETRICSinternet conference on measurement and modeling of computer system,2005(1):85-96.
[55] National Laboratory for Applied Network Research. http://www. nlanr.net.
[56] Passive Measuerment and Analysis.http://pma.nlanr.net.
[57] Joel Apisdorf, K Claffy, et al. OC3MON: Flexible,Affordable,High PerformanceStatistics Collection[C]. In: Proc. of the10th USENIX Conference on Systemadministration,1996.
[58] WAND Network Research Group. htttp://www.wand.net.nz.
[59] Coperative Association for Internet Data Analysis. http://www.caida.org.
[60] Ripe Network Coordination Centre. http://labs.ripe.net.
[61] A Scaleable Monitoring Platform for the Internet. http://www.ist_scampi.org.
[62]祝超,谢应科,王建东,赵自力,韩承德.多核架构下实时IP流测量的硬件加速方法[J].通信学报,2008,29(12):1-9.
[63] M. Molina, A. Chiosi S, D Antonio, G Ventre. Design principles and algorithmsfor effective high-speed IP flow monitoring[J]. Computer Communications,2006(29):1653-1664.
[64]周明中.大规模网络IP流特征及其测量算法研究[D].南京:东南大学,2006.
[65]程光,龚俭,丁伟.基于统计分析的高速网络分布式抽样测量模型[J].计算机学报,2003,26(10):1266-1273.
[66] W J Liu, J. Gong. Double sampling for flow measurement on high speed links[J].Computer Networks,2008(52):2221-2226.
[67] Guang Cheng, Jian Gong. A Resource-Efficient Flow Monitoring System[J].IEEE Communications Letters,2007,11(6):558-560.
[68]周明中,龚俭,丁伟.高速网络中基于流速测度的动态超时策略[J].软件学报,2006,17(10):2141-2151.
[69] Junfeng Wang, Lei Li, Fuchun Sun, Mingtian Zhou. A probability-guaranteedadaptive timeout algorithm for high-speed network flow detection[J]. ComputerNetworks,2005(48):215-233.
[70] Cristian Estan, George Varghese. New Directions in Traffic Measurement andAccounting: Focusing on the elephants, ignoring the mice[J]. ACM Transactionson Computer Systems,2003,21(8):270-313.
[71] Smitha, Inkoo Kim, A.L.N.Reddy. Identifying long-term high-bandwidth flows ata router[J]. Lecture Notes in Computer Science,2001(228):361-371.
[72] Konstantina Papagiannaki. Provisioning IP Backbone Networks Based onMeasurements[D]. London:London University College,2003.
[73]王洪波.互联网测量系统可扩展性问题及其关键算法研究[D].北京:北京邮电大学,2006.
[74]裴育杰.面向互联网流量工程的网络测量及路由调整算法研究[D].北京:北京邮电大学,2009.
[75]王宏.网络综合流量管理关键技术研究[D].长沙:国防科学技术大学,2008.
[76]王风宇,云晓春,王晓峰等.高速网络监控中大流量对象的提取[J].软件学报,2007,12(18):3060-3070.
[77] Ningbo Zhang, Fengyu Wang, Bin Gong, Liangxiong Li. Identifying Heavy-hitterFlows Fast and Accurately[C]. In: Proc. of2nd International Conference onFuture Computer and Communication,2010(3):26-30.
[78] Anees Shaikh, Jennifer Rexford, Kang G.Shin. Load-Sensitive Routing ofLong-Lived IP Flows[C]. In: Proc. of ACM SIGCOMM99,1999:215-226.
[79]韦安明.互联网中基于流测量的P2P流量及异常事件检测[D].北京:北京邮电大学,2007.
[80] W Fang, L Perterson. Inter-as traffic patterns and their implications[C]. In: Proc.of IEEE Global Telecommunications Conference,1999(3):1859-1868.
[81] Simon Leinen. Fluxoscope:A System for Flow-Based Accounting[EB/OL].http://www.tik.ee.ethz.ch/cati/deliv/CATI-SWI-IM-P-000-0.4.pdf,2000-3.
[82] Richard J.Edell, Nick Mckeown, Pravin P.Varaiya. Billing users and pricing forTCP[J]. IEEE Journal of Selected Areas in Communications(Special Issue onAdvances in the Fundamentals of Networking),1995(9):1162-1175.
[83] S.Shenker, D.Clark, D.Esrtin, S.Hezrog. Pricing in Compter Networks:Reshapingthe research agenda[J]. ACM Computer Communications Review,1996,26(2):19-43.
[84] Jorn Altman, Karyen Chu. A Proposal for a flexible service plan that is attractiveto users and Internet service providers[C]. In: Proc. of IEEE INFOCOM,2001(2):953-958.
[85]陆华彪,赵国鸿,陈一骄,苏金树.基于较大流调整的安全分流算法[J].计算机工程,2009,35(13):117-119.
[86]谢冬青,周再红,骆嘉伟.基于LRU和SCBF的大象流提取及其在DDoS防御中的应用[J].计算机研究与发展,2011,48(8):1517-1523.
[87] Hsu-Sheng Tsai, Wei Kuang Lai. Improving fairness among TCP flows bystateless buffer control with early drop maximum[J]. Information Sciences,2008(178):3697-3715.
[88] Konstantina Papagiannaki, Nina Taft, Christophe Diot. Impact of flow dynamicson traffic engineering design principles[C]. In: Proc. of IEEE INFOCOM2004,2004(4):2295-2306.
[89]韦乐平.光纤通信技术和网络技术的发展[J].电信工程技术与标准化,2001(4):1-5.
[90]肖萍萍,周芳.SDH原理与技术[M].北京:北京邮电大学出版社,2002.
[91]韦乐平.光同步数字传送网[M].北京:人民邮电出版社,1999.
[92]邓忠礼,赵晖.光同步数字传输系统测试[M].北京:人民邮电出版社,2001.
[93] Dirceu Cavendish. Evolution of Optical Transport Technology:from SONET/SDH to WDM[J]. IEEE Communications,2000(6):164-172.
[94] O.Gerstel, R.Ramaswami. Upgrading SONET rings with WDM instead of TDM:an economic analysis[C]. In: Proc. of OFC/IOOC99,1999(3):75-77.
[95] M.Garnot, P.A.Perrier. Planning of WDM networks: methods, routing nodemodeling and applications[C]. In: Proc. of Global Telecommunications Confe-rence,1998(1):351-355.
[96]邓忠礼.光同步传送网和波分复用系统[M].北京:北方交通大学出版社,2003.
[97] M. Laubach. Classical IP and ARP Over ATM[EB/OL]. http://www.ietf.org/rfc/rfc1577.txt,1994-1.
[98] S.Kowtha. Encapsulating ATM cells in TCP/IP for transport between ATM basebackbone and end-user terminals, to enable real-time network-aware services[J].ATM Workshop, IEEE Proceedings,1999:195-203.
[99] Berry Kercheval. TCP/IP over ATM:A no-nonsense internetworking guide[M].Upper Saddle River: Prentice Hall,1998.
[100]肖丹.ATM互联网络技术及应用[M].北京:人民邮电出版社,1998.
[101] G.Parr, S.Wright. Reducing ATM cell processing in SDH multiplexers[C]. In:Proc. of IEEE AFRICON,1996(1):118-123.
[102]王伟超,吴建平,徐明伟. IP Over SONET/SDH技术在高性能安全路由器中的应用[J].计算机工程与应用,2001(4):34-37.
[103] James Manchester, Jon Anderson, et al. IP over SONET[J]. IEEE Communi-cations Magazine,1998(5):136-142.
[104]徐荣,龚倩.高速宽带光互联网技术[M].北京:人民邮电出版社,2002.
[105] W.Simpson, et al. The Point-to-Point Protocol(PPP)[EB/OL].http://www.ietf.org/rfc/rfc1661.txt,1994-7.
[106] W.Simpson, et al. PPP in HDLC-Like Framing[EB/OL].http://www.ietf.org/rfc/rfc1662.txt,1994-7.
[107]巴继东,杨九民.IP与光互联网[M].北京:北京邮电大学出版社,2002.
[108]田瑞雄,环翾,贾振生.宽带IP组网技术[M].北京:人民邮电出版社,2003.
[109] W Richard Stevens著,范建华等译. TCP/IP详解,卷1:协议[M].北京:机械工业出版社,2003.
[110] G.McGregor, et al. The PPP Internet Protocol Control Protocol(IPCP)[EB/OL].http://www.ietf.org/rfc/rfc1332.txt,1992-5.
[111] J.Reynolds, et al. ASSIGNED NUMBERS[EB/OL].http://www.ietf.org/rfc/rfc1700.txt,1994-10.
[112] Tze-Wo Leung. Implementing Packet Transfer over SONET/SDH[C]. In: Proc. ofInternational IC Conference, Taipei,1999:119-122.
[113]王廷尧.并行扰码技术及其在光传输系统中的应用[J].现代有线传输,1997(1):12-19.
[114]易波.现代通信导论[M].长沙:国防科技大学出版社,1996.
[115]张晓茹,曾烈光.帧同步扰码器的并行化技术[J].通信学报,1996,17(2):126-130.
[116]张羿猛,黄芝平,毕占坤,王跃科.并行帧同步扰码器的扩充比特设计法[J].光子学报,2006,35(7):1048-1051.
[117]毕占坤.光纤骨干传输网信息处理若干关键技术研究[D].长沙:国防科学技术大学,2007.
[118]王志功.光纤通信集成电路设计[M].北京:高等教育出版社,2003.
[119] Liu Haibo, Long Teng, Zeng Dazhi. Design of a two-channel ultra high frequencedata acquisition system based on FPGA[C]. International Conference on Radar,2006:1-3.
[120] Liu F, Kashyap C, Alpert C J. A delay metric for RC circuits based on theWeibull distribution [C]. In: Proc. of the IEEE/ACM International Conference onComputer Aided Design, San Jose, California,2002:620-624.
[121] Sapatnekar S S. A timing model incorporating the effect of crosstalk on delay andits application to optimal channel routing[J]. IEEE Transactions on Computer-aided Design of Integrated Circuits and Systems,2000,19(5):550-555.
[122] Kyoji Y, Shinji O, et al. Interconnect Scaling Scenario Using a Chip LevelInterconnect Model[J]. IEEE Transactions on Electron Device,2000,47(1):90-96.
[123]吕喜在.光纤骨干网信息处理关键技术研究[D].长沙:国防科学技术大学,2011.
[124]谭聪,卜海祥,唐璞山.一种改进的用于FPGA的快速数字锁相环电路设计[J].复旦学报（自然科学版）,2009,48(4):470-476.
[125]任爱峰,初秀琴,常存.基于FPGA的嵌入式系统设计[M].西安:西安电子科技大学出版社,2004.
[126]左震,张羿猛,唐贵林,黄芝平.基于多字节流水线的POS信号IP包提取算法研究[J].测试技术学报,2009(4):107-109.
[127] H.Jonathan.Chao. Next Generation Routers. Proceedings of the IEEE[J],2002,90(9):1518-1558.
[128] Jim Guichard, Ivan.Pepelnjak, Jeff Apcar. MPLS and VPN Architectures[M].Indianapolis:Cisco Press,2003.
[129] Kubilinskas E, Pioro M, Nilsson.P. Design models for robust multi-layer nextgeneration Internet core networks[J]. Network and Systems Management,2005,13(1):61-68.
[130]彭元喜.高速IP分组分类算法及其实现技术的研究[D].长沙:国防科技大学,2001.
[131] Pankaj Gupta, Nick Mckeown. Packet Classification on Multiplefields[C]. In:Proc. of ACM SIGCOMM,1999, Massachusetts,USA:146-160.
[132] V.Srinivasan. Fast and Efficient Internet Lookups[D]. Washington: WashingtonUniversity,1999.
[133] S.Singh. Packet Classification Using Multi-dimensional Cutting[C]. In: Proc. ofACM SIGCOMM,2003:213-224.
[134] V.Srinivasan, S.Suri, G.Varghese. Packet Classification using Tuple SpaceSearch[C]. In: Proc. of ACM SIGCOMM1999, Massachusetts:135-146.
[135] Pankaj Gupta, Nick Mckeown. Packet Classification using HierarchicalIntelligent Cuttings[J]. IEEE Micro,2000,20(1):34-41.
[136]尚凤军.基于边缘测量的高速网络链路流量测量系统研究[D].重庆:重庆大学,2005.
[137] Detlef Sab, Simon Hauger, Martin Kohn. Architecture and scalability of ahigh-speed traffic measurement platform with a highly flexible packetclassification[J]. Computer Networks,2009(53):810-820.
[138]杨建华,谢高岗,张广兴,李忠诚.一种高效的业务流分类算法[J].电子学报,2006,34(3):549-552.
[139] Zhen Zuo, Zhiping Huang, Shaojing Su, Yimeng Zhang. Research on a Fast IPPacket Flow Match Algorithm Based on Xor Hash and Four-layer MemoryHierarchy[C]. IEEE PACIIA2010,2010(1X):244-248.
[140] Mohit Saxena, Ramana Rao Kompella. CLAMP: Efficient class-based samplingfor flexible flow monitoring[J]. Computer Networks,2010(54):2345-2356.
[141] NL9000RA Knowledge-based Processors(2M,1M,512K,256K,128K Records).Netlogic Microsystems Inc.2010-6-29.
[142] NL11000RA Knowledge-based Processors(1M,512K,256K,and128K Records).Netlogic Microsystems Inc.2011-11-15.
[143] HDL Design House. MD5CRYPTO CORE FAMILY[EB/OL]. http://www.hdl-dh.com/pdf/hcr_7910.pdf,2002-12.
[144] Raj Jain. A comparison of hashing schemes for address lookup in computernetworks[J]. IEEE Transactions on Communications,1992,40(10):1570-1573.
[145] Zhiruo Cao, Zheng Wang, Ellen Zegura. Performance of Hashing-based Schemesfor Internet Load Balancing[C]. In: Proc. of IEEE INFOCOM,2000:332-341.
[146]程光,龚俭,丁伟,徐加羚.面向IP流测量的哈希算法研究[J],软件学报,2005,16(5):652-658.
[147]熊兵.高速网络数据流分析的若干问题研究[D].武汉:华中科技大学,2009.
[148]林柏刚著.网络与信息安全教程[M].北京:机械工业出版社,2004.
[149] The CAIDA Anonymized2008Internet Traces. http://www.caida.org/data/passive/passive_2008_dataset.xml.
[150] The CAIDA Anonymized2011Internet Traces. http://www.caida.org/data/passive/passive_2011_dataset.xml.
[151] The CAIDA Anonymized2012Internet Traces. http://www.caida.org/data/passive/passive_2012_dataset.xml.
[152]周明中,龚俭,丁伟.网络流超时策略研究[J].通信学报,2005,26(4):88-93.
[153] Hohn N, Veitch D. Inverting Sampled Traffic[J]. IEEE/ACM Transactions onNetworking,2006,14(1):68-80.
[154] Jing Cai, Zhibin Zhang, Peng Zhang, Xinbo Song. An Adaptive Timeout Strategyfor Profiling UDP Flows[C]. In: Proc. of the First International Conference onNetworking and Computing, Higashi-Hiroshima,Japan,2010:44-48.
[155] Zhang Y, Breslau L, Paxson V, Shenker S. On the Characteristics and Origins ofInternet Flow Rates[C]. In: Proc. of SIGCOMM,2002,32(4):309-322.
[156] Pang R. M,Yegneswaran V, Barford P, Peterson L. Characteristics of internetbackground radiation[C]. In: Proc. of the4th ACM SIGCOMM conference onInternet measurement,Taormina, Sicily, Italy,2004:27-40.
[157] Bloom B. Space/Time trade-offs in hash coding with allowable errors[J].Communications of the ACM,1970,13(7):422-426.
[158]王远,丁伟,龚俭. TCP数据流超时研究[J].厦门大学学报（自然科学版）,2007，46(11):192-195.
[159] Allen B.Downey. Evidence for long tailed distributions in the internet[C]. In Procof ACM SIGCOMM Internet Measurement Workshop,2001:229-241.
[160] Allen B.Downey. Lognormal and Pareto distributions in the Internet[J]. ComputerCommunications,2005,28(7):790-801
[161] Myung_Sup Kim, Young J.Won, James W.Hong. Characteristic analysis ofinternet traffic from the perspective of flows[J]. Computer Communications,2006(29):1639-1652.
[162] Garetto M, Towsley D. Modelling, Simulation and Measurements of QueuingDelay under Long-tailed Internet Traffic[C]. In: Proc. of ACM SIGMETRICS2003:47-57.
[163] A Feldmann, A Greenberg, et al. Deriving Traffic Demands for Operational IPNetworks: Methodology and Experience[J]. IEEE/ACM Transactions onNetworking,2001(3):265-280.
[164] Y Zhang, L Breslau,V Paxson, et al. On the Characteristics and Origins ofInternet Flow Rates[C]. In: Proc. of the2002Conference on Applications,Technologies,Architectures and Protocols for Computer Communications, NewYork,2002:309-322.
[165] Kun-chan Lan, John Heidemann. A measurement study of correlations of Internetflow characteristics[J]. Computer Networks,2006(50):46-62.
[166] Yousra Chabchoub, Christime Fricker, et al. On the statistical characterization offlows in Internet traffic with application to sampling[J]. Computer Communi-cations,2010(33):103-112.
[167]王宏,龚正虎. Hits和Holds:识别大象流的两种算法[J].软件学报,2010,21(6):1391-1403.
[168]王洪波,裴育杰,林宇.基于LRU的大流检测算法[J].电子与信息学报,2007,29(10):2487-2492.
[169]裴育杰,王洪波,程时端.基于两级LRU机制的大流检测算法[J].电子学报,2009,37(4):684-691.
[170] Lichang Che, Bin Qiu, Hong Ren Wu. Improvement of LRU cache for thedetection and control of long-lived high bandwidth flows[J]. ComputerCommunications,2005(29):103-113.
[171] Lichang Che, Bin Qiu. Landmark LRU:An Efficient Scheme for the Detection ofElephant Flows at Internet Routers[J]. IEEE Communications Letters,2006,10(7):567-569.
[172] Tatsuya Mori, Masato Uchida, et al. Identify Elephant Flows ThroughPeriodically Sampled Packets, In: Proc. of the4th ACM SIGCOMM Conferenceon Internet measurement, Sicily, Italy,2004:115-120.
[173] Tatsuya Mori, Ryoichi Kawahara, et al. On the characteristics of internet trafficvariability:spikes and elephants. In: Proc. of the2004International Symposiumon Applications and the Internet,Tokyo,2004:99-106.
[174]周明中,龚俭,丁伟,程光.基于MGCBF算法的长流信息统计[J].东南大学学报（自然科学版）,2006(5):472-476.
[175]吴桦,龚俭,杨望.一种基于双重Counter Bloom Filter的长流识别算法[J].软件学报,2010,21(5):1115-1126.
[176]张震,汪斌,强陈庶,樵朱珂.基于多维计数型布鲁姆过滤器的大流检测机制[J].电子与信息学报,2010,32(7):1608-1613.
[177] ZHANG Yu, FANG BinXing, ZHANG YongZheng. Identifying heavy hitters inhigh-speed network monitoring[J]. SCIENCE CHINA(Information Sciences),2010,53(3):659-676.
[178] K.Papagiannaki, N.Taft, et al. A Pragnetic Definition of Elephants in IntenetBackbone Traffic. In: Proc. of the2nd Internet Measurement Workshop,Marseille,France,2002:175-176.
[179] X.Xiao, et al. TCP Processing of the IPv4Precedence Field[EB/OL]. http://www.ietf.org/rfc/rfc2873.txt,2000-6.
[180] K.Lahey. TCP Problems with Path MTU Discovery[EB/OL]. http://www.ietf.org/rfc/rfc2923.txt,2000-9.
[181] IEEE STD802.3(2000Edition)[DB/CD].IEEE Computer Society,2000.
[182] C.Hornig. A Standard for the Transmission of IP Datagrams over EthernetNetworks[EB/OL]. http://www.ietf.org/rfc/rfc0894.txt,1984-4.
[183] CAIDA2008Passive Data Description. http://data.caida.org/datasets/passive-2008/README-2008.
[184] CAIDA2009Passive Data Description. http://data.caida.org/datasets/passive-2009/README-2009.
[185] CAIDA2010Passive Data Description. http://data.caida.org/datasets/passive-2010/README-2010.
[186] CAIDA2011Passive Data Description. http://data.caida.org/datasets/passive-2011/README-2011.
[187] CAIDA2012Passive Data Description. http://data.caida.org/datasets/passive-2012/README-2012.
[188] Leonard Kleinrock. Queueing Systems,Volume l: Theory[M]. New York:WileyInterscience,1975.
[189] Jin Cao, William S, Cleveland, Dong Lin, Don X.Sun, Internet tend to Poissonand Independence as the Load Increases[R]. Murray Hill,NJ:Bell Labs,2001.
[190] Karagiannis T, Molle M, Faloutsos M, Broido A. A nonstationary Poisson viewof Internet traffic[C]. In: Proc. of the23rd Annual Joint Conf. of the IEEEComputer and Communications Societies,Hong Kong,2004:1558-1569.
[191] Barbara Gonzalez-Arevalo, Julie Roy. Simulating a Poisson cluster process forInternet traffic packet arrivals[J]. Computer Communications,2010(33):612-618.
[192] J.Mogul, et al. IP MTU Discovery Options[EB/OL]. http://www.ietf.org/rfc/rfc1063.txt,1988-7.
[193]陈敏.OPNET网络仿真[M].北京:清华大学出版社,2004.
[194]王文博,张金文. OPNET Modeler与网络仿真[M].北京:人民邮电出版社,2003.
[2] Wolfgang John, Sven Tafcelin, et al. Passive internet measurement:Overview andguidelines based on experiences[J]. Computer Communications,2010(33):533-550.
[3] Artur Ziviani. Internet Measurements[C]. In: Encyclopedia of InternetTechnologies and Applications, IGI Gobal,2007:235-241.
[4] Dimitrios P.Pezaros, Konstantinos Georgopoulos, David Hutchison. High-speed,in-band performance measurement instrumentation for next generation IPnetworks[J]. Computer Networks,2010(54):3246-3263.
[5]王俊峰.高速互联网性能测量若干关键技术研究[D].成都:电子科技大学,2004.
[6]蔡志平.基于主动测量和被动测量的网络测量技术、模型和算法研究[D].长沙:国防科学技术大学,2005.
[7] Nicolas Larrieu, Philippe Owezarski. Towards a Measurement Based Networkingapproach for Internet QoS improvement[J]. Computer Communications,2005,(28):259-273.
[8] Mehmet H Gunes, Sevcan Bilir, Kamil Sarac, Turgay Korkmaz. A measurementstudy on overhead distribution of value-added internet services[J]. ComputerNetworks,2007(51):4153-4173.
[9] L.Muscoriello, M.Mellia,et al. Markov models of internet traffic and a newhierarchical MMPP model[J]. Computer Communications,2005(28):1835-1851.
[10] Will E.Leland, Murad S.Taqqu, et al. On the Self-Similar Nature of EthernetTraffic[J]. IEEE/ACM Transactions on Networking,1994,2(1):1-15.
[11] Vern Paxson, Sally Floyd. Wide-Area Traffic:The Failure of Poisson Modeling[J].IEEE/ACM Transaction on Networking,1995,3(3):226-244.
[12] Ziqian Dong, Rohan D.W.Perera, et al. Network measurement based modelingand optimization for IP geolocation[J]. Computer Networks,2012(56):85-98.
[13] Felipe Mata, José Luis García-Dorado, Javier Aracil. Detection of traffic changesin large-scale backbone networks:The case of the Spanish academic network[J].Computer Networks,2012(56):686-702.
[14]张宏莉,方滨兴等. Internet测量与分析综述[J].软件学报,2003,14(1):110-116.
[15] Maurizio Molina, Ignasi Paredes-Oliva, Wayne Routly, Pere Barlet-Ros.Operational experiences with anomaly detection in backbone networks[J].Elsevier Computers&Security,2012, article in press.
[16] C. Scoglio, C. Bruni, G.Koch, S.Sutrave. Estimation of data traffic flows fromaggregate measurements[J]. Mathematical and Computer Modelling,2010(52):837-853.
[17] Zhichun Li, Yan Gao,Yan Chen. HiFIND: A high-speed flow-level intrusiondetection approach with DOS resiliency[J]. Computer Networks,2010(54):1282-1299.
[18]代六玲.互联网内容监管系统关键技术研究[D].南京:南京理工大学,2004.
[19]张宏科,张思东,刘文红.路由器原理与技术[M].北京:国防工业出版社,2002.
[20]张羿猛.骨干网测量系统中的POS信号处理关键技术研究[D].长沙:国防科学技术大学,2007.
[21] Prasad Calyam, Dima Krymskiy, Mukundan Sridharan, Paul Schopis. Active andpassive measurements on campus, regional and national network backbonepaths[C]. In: Proc. of the14th International Conference on Computer Communi-cations and Networks,2005:537-542.
[22] Keisuke Ishibashi, Toshiyuki Kanazawa, et al. Active/Passive Combination-typePerformance Measurement Method Using Change-of-measure Framework[J].Computer Communications,2004(27):868-879.
[23] Zhen Qin, Roberto Rojas-Cessa, Nirwan Ansari. Task-execution schedulingschemes for network measurement and monitoring[J]. Computer Communi-cations,2010(33):124-135.
[24] Artur Ziviani, Thiago B Cardozo, Antonio Tadeu A Gomes. Rapid prototyping ofactive measurement tools[J]. Computer Networks,2012(56):870-883.
[25] Jean-Chrysostome Bolot. End to End Packet Delay and Loss Behavior in theInternet[C]. In: Proc. of ACM SIGCOMM,1993:289-298.
[26] Kevin Lai, Mary Baker. Measuring Bandwidth[C].In: Proc. of IEEE INFOCOM,1999(1):235-245..
[27]赵海雁,陈立潮,叶树华.基于Windows的网络监听技术在局域网中的实现[J].计算机工程,2004,30(22):117-118.
[28]董天临.光纤通信与光纤通信网[M].北京:清华大学出版社,2005.
[29]马丽华,李云霞等.光纤通信系统[M].北京:北京邮电大学出版社,2009.
[30]顾畹仪.WDM超长距离光传输技术[M].北京:北京邮电大学出版社,2006.
[31] Michel Joindot, Stéphane Gosselin. Optical fiber transport systems and networks:fundamentals and prospects[J]. C. R. Physique2008(9):914-934.
[32]中国国际海底光缆分布. http://www.enet.com.cn/networks.
[33] Kimberly C.Claffy. Internet traffic characterization[D]. San Diego:University ofCalifornia,1994.
[34] Kimberly C.Claffy, Hans-Werner Braun, George C.Polyzos. A ParameterizableMethodology for Internet Traffic Flow Profiling[J]. IEEE Journal on SelectedAreas in Communications,1995,13(8):1481-1494.
[35] Bo Ryu, David Cheney, Hans-Werner Braun. Internet Flow Characterization:Adaptive Timeout Strategy and Statistical Modeling[C]. In: Proc. of the Passiveand Active Measurements Workshop2001, Amsterdam, Netherlands, April,2001.
[36] The Internet Engineering Task Force. http://www.ietf.org/home.html.
[37] N.Brownlee, et al. Traffic Flow Measuerment:Architecture[EB/OL].http://www.ietf.org/rfc/rfc2722.txt,1999-10.
[38] S.Handelman, et al. RTFM: New Attributes For Traffic Flow Measurement[EB/OL]. http://www.ietf.org/rfc/rfc2724.txt,1999-10.
[39] J.Quittek, et al. Requirements for IP Flow Information Export(IPFIX)[EB/OL].http://www.ietf.org/rfc/rfc3917.txt,2004-10.
[40] S.Leinen, et al. Evaluation of Candidate Protocols for IP Flow InformationExport(IPFIX)[EB/OL].http://www.ietf.org/rfc/rfc3955.txt,2004-10.
[41] G.Sadasivan, et al. Architecture for IP Flow Information Export[EB/OL].http://www.ietf.org/rfc/rfc5470.txt,2009-3.
[42] J.Quittek, et al. Information Model for IP Flow Information Export[EB/OL].http://www.ietf.org/rfc/rfc5102.txt,2008-1.
[43] B.Claise, et al. Specification of the IP Flow Information Export(IPFIX) Protocolfor the Exchange of IP Traffic Flow information[EB/OL]. http://www.ietf.org/rfc/rfc5101.txt,2008-1.
[44] N Brownlee, et al. Traffic Flow Measurement Experiences with NeTraMet[EB/OL]. http://www.ietf.org/rfc/rfc2123.txt,1997-3.
[45]徐加羚.高速多链路逻辑信道环境下的自适应抽样流测量系统[D].南京:东南大学,2006.
[46]李志春,张辉等.高速主干网测量系统的设计与实现[J].计算机工程,2003,29(l):53-55.
[47] Cisco Netflow. http://www.cisco.com/en/US/products/ps6645/products_ios_pro-tocol_option_home.html.
[48] Juniper公司. http://www.juniper.net.
[49]华为公司. http://www.huawei.com.cn.
[50] P.Phaal, et al. InMon Corporation’s sFlow: A Method for Moitoring Traffic inSwitched and Routed Networks[EB/OL].http://www.ietf.org/rfc/rfc3176.txt,2001-9.
[51] Nick Duffield, Carsten Lund, Mikkel Thorup. Properties and Prediction of FlowStatistics from Sampled Packet Streams[C].In: Proc. of the2nd ACM SIGCOMMWorkshop on Internet Measurement,2002:159-171.
[52] Nick Duffield, Carsten Lund, Mikkel Thorup. Flow Sampling Under HardResource Constraints[C]. In: Proc. of the Joint International Conference onMeasurement and Modeling of Computer Systems,2004:85-96.
[53] Edith Cohen, Nick Duffield, Haim Kaplan. Algorithms and Estimators forAccurate Summarization of Internet Traffic[C]. In: Proc. of IMC07, San Diego,2007:265-278.
[54] Ken Keys, David Moore, Cristian Estan. A Robust System for Accurate Real-time Summaries of Internet Traffic[C]. In: Proc. of the2005ACM SIGMETRICSinternet conference on measurement and modeling of computer system,2005(1):85-96.
[55] National Laboratory for Applied Network Research. http://www. nlanr.net.
[56] Passive Measuerment and Analysis.http://pma.nlanr.net.
[57] Joel Apisdorf, K Claffy, et al. OC3MON: Flexible,Affordable,High PerformanceStatistics Collection[C]. In: Proc. of the10th USENIX Conference on Systemadministration,1996.
[58] WAND Network Research Group. htttp://www.wand.net.nz.
[59] Coperative Association for Internet Data Analysis. http://www.caida.org.
[60] Ripe Network Coordination Centre. http://labs.ripe.net.
[61] A Scaleable Monitoring Platform for the Internet. http://www.ist_scampi.org.
[62]祝超,谢应科,王建东,赵自力,韩承德.多核架构下实时IP流测量的硬件加速方法[J].通信学报,2008,29(12):1-9.
[63] M. Molina, A. Chiosi S, D Antonio, G Ventre. Design principles and algorithmsfor effective high-speed IP flow monitoring[J]. Computer Communications,2006(29):1653-1664.
[64]周明中.大规模网络IP流特征及其测量算法研究[D].南京:东南大学,2006.
[65]程光,龚俭,丁伟.基于统计分析的高速网络分布式抽样测量模型[J].计算机学报,2003,26(10):1266-1273.
[66] W J Liu, J. Gong. Double sampling for flow measurement on high speed links[J].Computer Networks,2008(52):2221-2226.
[67] Guang Cheng, Jian Gong. A Resource-Efficient Flow Monitoring System[J].IEEE Communications Letters,2007,11(6):558-560.
[68]周明中,龚俭,丁伟.高速网络中基于流速测度的动态超时策略[J].软件学报,2006,17(10):2141-2151.
[69] Junfeng Wang, Lei Li, Fuchun Sun, Mingtian Zhou. A probability-guaranteedadaptive timeout algorithm for high-speed network flow detection[J]. ComputerNetworks,2005(48):215-233.
[70] Cristian Estan, George Varghese. New Directions in Traffic Measurement andAccounting: Focusing on the elephants, ignoring the mice[J]. ACM Transactionson Computer Systems,2003,21(8):270-313.
[71] Smitha, Inkoo Kim, A.L.N.Reddy. Identifying long-term high-bandwidth flows ata router[J]. Lecture Notes in Computer Science,2001(228):361-371.
[72] Konstantina Papagiannaki. Provisioning IP Backbone Networks Based onMeasurements[D]. London:London University College,2003.
[73]王洪波.互联网测量系统可扩展性问题及其关键算法研究[D].北京:北京邮电大学,2006.
[74]裴育杰.面向互联网流量工程的网络测量及路由调整算法研究[D].北京:北京邮电大学,2009.
[75]王宏.网络综合流量管理关键技术研究[D].长沙:国防科学技术大学,2008.
[76]王风宇,云晓春,王晓峰等.高速网络监控中大流量对象的提取[J].软件学报,2007,12(18):3060-3070.
[77] Ningbo Zhang, Fengyu Wang, Bin Gong, Liangxiong Li. Identifying Heavy-hitterFlows Fast and Accurately[C]. In: Proc. of2nd International Conference onFuture Computer and Communication,2010(3):26-30.
[78] Anees Shaikh, Jennifer Rexford, Kang G.Shin. Load-Sensitive Routing ofLong-Lived IP Flows[C]. In: Proc. of ACM SIGCOMM99,1999:215-226.
[79]韦安明.互联网中基于流测量的P2P流量及异常事件检测[D].北京:北京邮电大学,2007.
[80] W Fang, L Perterson. Inter-as traffic patterns and their implications[C]. In: Proc.of IEEE Global Telecommunications Conference,1999(3):1859-1868.
[81] Simon Leinen. Fluxoscope:A System for Flow-Based Accounting[EB/OL].http://www.tik.ee.ethz.ch/cati/deliv/CATI-SWI-IM-P-000-0.4.pdf,2000-3.
[82] Richard J.Edell, Nick Mckeown, Pravin P.Varaiya. Billing users and pricing forTCP[J]. IEEE Journal of Selected Areas in Communications(Special Issue onAdvances in the Fundamentals of Networking),1995(9):1162-1175.
[83] S.Shenker, D.Clark, D.Esrtin, S.Hezrog. Pricing in Compter Networks:Reshapingthe research agenda[J]. ACM Computer Communications Review,1996,26(2):19-43.
[84] Jorn Altman, Karyen Chu. A Proposal for a flexible service plan that is attractiveto users and Internet service providers[C]. In: Proc. of IEEE INFOCOM,2001(2):953-958.
[85]陆华彪,赵国鸿,陈一骄,苏金树.基于较大流调整的安全分流算法[J].计算机工程,2009,35(13):117-119.
[86]谢冬青,周再红,骆嘉伟.基于LRU和SCBF的大象流提取及其在DDoS防御中的应用[J].计算机研究与发展,2011,48(8):1517-1523.
[87] Hsu-Sheng Tsai, Wei Kuang Lai. Improving fairness among TCP flows bystateless buffer control with early drop maximum[J]. Information Sciences,2008(178):3697-3715.
[88] Konstantina Papagiannaki, Nina Taft, Christophe Diot. Impact of flow dynamicson traffic engineering design principles[C]. In: Proc. of IEEE INFOCOM2004,2004(4):2295-2306.
[89]韦乐平.光纤通信技术和网络技术的发展[J].电信工程技术与标准化,2001(4):1-5.
[90]肖萍萍,周芳.SDH原理与技术[M].北京:北京邮电大学出版社,2002.
[91]韦乐平.光同步数字传送网[M].北京:人民邮电出版社,1999.
[92]邓忠礼,赵晖.光同步数字传输系统测试[M].北京:人民邮电出版社,2001.
[93] Dirceu Cavendish. Evolution of Optical Transport Technology:from SONET/SDH to WDM[J]. IEEE Communications,2000(6):164-172.
[94] O.Gerstel, R.Ramaswami. Upgrading SONET rings with WDM instead of TDM:an economic analysis[C]. In: Proc. of OFC/IOOC99,1999(3):75-77.
[95] M.Garnot, P.A.Perrier. Planning of WDM networks: methods, routing nodemodeling and applications[C]. In: Proc. of Global Telecommunications Confe-rence,1998(1):351-355.
[96]邓忠礼.光同步传送网和波分复用系统[M].北京:北方交通大学出版社,2003.
[97] M. Laubach. Classical IP and ARP Over ATM[EB/OL]. http://www.ietf.org/rfc/rfc1577.txt,1994-1.
[98] S.Kowtha. Encapsulating ATM cells in TCP/IP for transport between ATM basebackbone and end-user terminals, to enable real-time network-aware services[J].ATM Workshop, IEEE Proceedings,1999:195-203.
[99] Berry Kercheval. TCP/IP over ATM:A no-nonsense internetworking guide[M].Upper Saddle River: Prentice Hall,1998.
[100]肖丹.ATM互联网络技术及应用[M].北京:人民邮电出版社,1998.
[101] G.Parr, S.Wright. Reducing ATM cell processing in SDH multiplexers[C]. In:Proc. of IEEE AFRICON,1996(1):118-123.
[102]王伟超,吴建平,徐明伟. IP Over SONET/SDH技术在高性能安全路由器中的应用[J].计算机工程与应用,2001(4):34-37.
[103] James Manchester, Jon Anderson, et al. IP over SONET[J]. IEEE Communi-cations Magazine,1998(5):136-142.
[104]徐荣,龚倩.高速宽带光互联网技术[M].北京:人民邮电出版社,2002.
[105] W.Simpson, et al. The Point-to-Point Protocol(PPP)[EB/OL].http://www.ietf.org/rfc/rfc1661.txt,1994-7.
[106] W.Simpson, et al. PPP in HDLC-Like Framing[EB/OL].http://www.ietf.org/rfc/rfc1662.txt,1994-7.
[107]巴继东,杨九民.IP与光互联网[M].北京:北京邮电大学出版社,2002.
[108]田瑞雄,环翾,贾振生.宽带IP组网技术[M].北京:人民邮电出版社,2003.
[109] W Richard Stevens著,范建华等译. TCP/IP详解,卷1:协议[M].北京:机械工业出版社,2003.
[110] G.McGregor, et al. The PPP Internet Protocol Control Protocol(IPCP)[EB/OL].http://www.ietf.org/rfc/rfc1332.txt,1992-5.
[111] J.Reynolds, et al. ASSIGNED NUMBERS[EB/OL].http://www.ietf.org/rfc/rfc1700.txt,1994-10.
[112] Tze-Wo Leung. Implementing Packet Transfer over SONET/SDH[C]. In: Proc. ofInternational IC Conference, Taipei,1999:119-122.
[113]王廷尧.并行扰码技术及其在光传输系统中的应用[J].现代有线传输,1997(1):12-19.
[114]易波.现代通信导论[M].长沙:国防科技大学出版社,1996.
[115]张晓茹,曾烈光.帧同步扰码器的并行化技术[J].通信学报,1996,17(2):126-130.
[116]张羿猛,黄芝平,毕占坤,王跃科.并行帧同步扰码器的扩充比特设计法[J].光子学报,2006,35(7):1048-1051.
[117]毕占坤.光纤骨干传输网信息处理若干关键技术研究[D].长沙:国防科学技术大学,2007.
[118]王志功.光纤通信集成电路设计[M].北京:高等教育出版社,2003.
[119] Liu Haibo, Long Teng, Zeng Dazhi. Design of a two-channel ultra high frequencedata acquisition system based on FPGA[C]. International Conference on Radar,2006:1-3.
[120] Liu F, Kashyap C, Alpert C J. A delay metric for RC circuits based on theWeibull distribution [C]. In: Proc. of the IEEE/ACM International Conference onComputer Aided Design, San Jose, California,2002:620-624.
[121] Sapatnekar S S. A timing model incorporating the effect of crosstalk on delay andits application to optimal channel routing[J]. IEEE Transactions on Computer-aided Design of Integrated Circuits and Systems,2000,19(5):550-555.
[122] Kyoji Y, Shinji O, et al. Interconnect Scaling Scenario Using a Chip LevelInterconnect Model[J]. IEEE Transactions on Electron Device,2000,47(1):90-96.
[123]吕喜在.光纤骨干网信息处理关键技术研究[D].长沙:国防科学技术大学,2011.
[124]谭聪,卜海祥,唐璞山.一种改进的用于FPGA的快速数字锁相环电路设计[J].复旦学报（自然科学版）,2009,48(4):470-476.
[125]任爱峰,初秀琴,常存.基于FPGA的嵌入式系统设计[M].西安:西安电子科技大学出版社,2004.
[126]左震,张羿猛,唐贵林,黄芝平.基于多字节流水线的POS信号IP包提取算法研究[J].测试技术学报,2009(4):107-109.
[127] H.Jonathan.Chao. Next Generation Routers. Proceedings of the IEEE[J],2002,90(9):1518-1558.
[128] Jim Guichard, Ivan.Pepelnjak, Jeff Apcar. MPLS and VPN Architectures[M].Indianapolis:Cisco Press,2003.
[129] Kubilinskas E, Pioro M, Nilsson.P. Design models for robust multi-layer nextgeneration Internet core networks[J]. Network and Systems Management,2005,13(1):61-68.
[130]彭元喜.高速IP分组分类算法及其实现技术的研究[D].长沙:国防科技大学,2001.
[131] Pankaj Gupta, Nick Mckeown. Packet Classification on Multiplefields[C]. In:Proc. of ACM SIGCOMM,1999, Massachusetts,USA:146-160.
[132] V.Srinivasan. Fast and Efficient Internet Lookups[D]. Washington: WashingtonUniversity,1999.
[133] S.Singh. Packet Classification Using Multi-dimensional Cutting[C]. In: Proc. ofACM SIGCOMM,2003:213-224.
[134] V.Srinivasan, S.Suri, G.Varghese. Packet Classification using Tuple SpaceSearch[C]. In: Proc. of ACM SIGCOMM1999, Massachusetts:135-146.
[135] Pankaj Gupta, Nick Mckeown. Packet Classification using HierarchicalIntelligent Cuttings[J]. IEEE Micro,2000,20(1):34-41.
[136]尚凤军.基于边缘测量的高速网络链路流量测量系统研究[D].重庆:重庆大学,2005.
[137] Detlef Sab, Simon Hauger, Martin Kohn. Architecture and scalability of ahigh-speed traffic measurement platform with a highly flexible packetclassification[J]. Computer Networks,2009(53):810-820.
[138]杨建华,谢高岗,张广兴,李忠诚.一种高效的业务流分类算法[J].电子学报,2006,34(3):549-552.
[139] Zhen Zuo, Zhiping Huang, Shaojing Su, Yimeng Zhang. Research on a Fast IPPacket Flow Match Algorithm Based on Xor Hash and Four-layer MemoryHierarchy[C]. IEEE PACIIA2010,2010(1X):244-248.
[140] Mohit Saxena, Ramana Rao Kompella. CLAMP: Efficient class-based samplingfor flexible flow monitoring[J]. Computer Networks,2010(54):2345-2356.
[141] NL9000RA Knowledge-based Processors(2M,1M,512K,256K,128K Records).Netlogic Microsystems Inc.2010-6-29.
[142] NL11000RA Knowledge-based Processors(1M,512K,256K,and128K Records).Netlogic Microsystems Inc.2011-11-15.
[143] HDL Design House. MD5CRYPTO CORE FAMILY[EB/OL]. http://www.hdl-dh.com/pdf/hcr_7910.pdf,2002-12.
[144] Raj Jain. A comparison of hashing schemes for address lookup in computernetworks[J]. IEEE Transactions on Communications,1992,40(10):1570-1573.
[145] Zhiruo Cao, Zheng Wang, Ellen Zegura. Performance of Hashing-based Schemesfor Internet Load Balancing[C]. In: Proc. of IEEE INFOCOM,2000:332-341.
[146]程光,龚俭,丁伟,徐加羚.面向IP流测量的哈希算法研究[J],软件学报,2005,16(5):652-658.
[147]熊兵.高速网络数据流分析的若干问题研究[D].武汉:华中科技大学,2009.
[148]林柏刚著.网络与信息安全教程[M].北京:机械工业出版社,2004.
[149] The CAIDA Anonymized2008Internet Traces. http://www.caida.org/data/passive/passive_2008_dataset.xml.
[150] The CAIDA Anonymized2011Internet Traces. http://www.caida.org/data/passive/passive_2011_dataset.xml.
[151] The CAIDA Anonymized2012Internet Traces. http://www.caida.org/data/passive/passive_2012_dataset.xml.
[152]周明中,龚俭,丁伟.网络流超时策略研究[J].通信学报,2005,26(4):88-93.
[153] Hohn N, Veitch D. Inverting Sampled Traffic[J]. IEEE/ACM Transactions onNetworking,2006,14(1):68-80.
[154] Jing Cai, Zhibin Zhang, Peng Zhang, Xinbo Song. An Adaptive Timeout Strategyfor Profiling UDP Flows[C]. In: Proc. of the First International Conference onNetworking and Computing, Higashi-Hiroshima,Japan,2010:44-48.
[155] Zhang Y, Breslau L, Paxson V, Shenker S. On the Characteristics and Origins ofInternet Flow Rates[C]. In: Proc. of SIGCOMM,2002,32(4):309-322.
[156] Pang R. M,Yegneswaran V, Barford P, Peterson L. Characteristics of internetbackground radiation[C]. In: Proc. of the4th ACM SIGCOMM conference onInternet measurement,Taormina, Sicily, Italy,2004:27-40.
[157] Bloom B. Space/Time trade-offs in hash coding with allowable errors[J].Communications of the ACM,1970,13(7):422-426.
[158]王远,丁伟,龚俭. TCP数据流超时研究[J].厦门大学学报（自然科学版）,2007，46(11):192-195.
[159] Allen B.Downey. Evidence for long tailed distributions in the internet[C]. In Procof ACM SIGCOMM Internet Measurement Workshop,2001:229-241.
[160] Allen B.Downey. Lognormal and Pareto distributions in the Internet[J]. ComputerCommunications,2005,28(7):790-801
[161] Myung_Sup Kim, Young J.Won, James W.Hong. Characteristic analysis ofinternet traffic from the perspective of flows[J]. Computer Communications,2006(29):1639-1652.
[162] Garetto M, Towsley D. Modelling, Simulation and Measurements of QueuingDelay under Long-tailed Internet Traffic[C]. In: Proc. of ACM SIGMETRICS2003:47-57.
[163] A Feldmann, A Greenberg, et al. Deriving Traffic Demands for Operational IPNetworks: Methodology and Experience[J]. IEEE/ACM Transactions onNetworking,2001(3):265-280.
[164] Y Zhang, L Breslau,V Paxson, et al. On the Characteristics and Origins ofInternet Flow Rates[C]. In: Proc. of the2002Conference on Applications,Technologies,Architectures and Protocols for Computer Communications, NewYork,2002:309-322.
[165] Kun-chan Lan, John Heidemann. A measurement study of correlations of Internetflow characteristics[J]. Computer Networks,2006(50):46-62.
[166] Yousra Chabchoub, Christime Fricker, et al. On the statistical characterization offlows in Internet traffic with application to sampling[J]. Computer Communi-cations,2010(33):103-112.
[167]王宏,龚正虎. Hits和Holds:识别大象流的两种算法[J].软件学报,2010,21(6):1391-1403.
[168]王洪波,裴育杰,林宇.基于LRU的大流检测算法[J].电子与信息学报,2007,29(10):2487-2492.
[169]裴育杰,王洪波,程时端.基于两级LRU机制的大流检测算法[J].电子学报,2009,37(4):684-691.
[170] Lichang Che, Bin Qiu, Hong Ren Wu. Improvement of LRU cache for thedetection and control of long-lived high bandwidth flows[J]. ComputerCommunications,2005(29):103-113.
[171] Lichang Che, Bin Qiu. Landmark LRU:An Efficient Scheme for the Detection ofElephant Flows at Internet Routers[J]. IEEE Communications Letters,2006,10(7):567-569.
[172] Tatsuya Mori, Masato Uchida, et al. Identify Elephant Flows ThroughPeriodically Sampled Packets, In: Proc. of the4th ACM SIGCOMM Conferenceon Internet measurement, Sicily, Italy,2004:115-120.
[173] Tatsuya Mori, Ryoichi Kawahara, et al. On the characteristics of internet trafficvariability:spikes and elephants. In: Proc. of the2004International Symposiumon Applications and the Internet,Tokyo,2004:99-106.
[174]周明中,龚俭,丁伟,程光.基于MGCBF算法的长流信息统计[J].东南大学学报（自然科学版）,2006(5):472-476.
[175]吴桦,龚俭,杨望.一种基于双重Counter Bloom Filter的长流识别算法[J].软件学报,2010,21(5):1115-1126.
[176]张震,汪斌,强陈庶,樵朱珂.基于多维计数型布鲁姆过滤器的大流检测机制[J].电子与信息学报,2010,32(7):1608-1613.
[177] ZHANG Yu, FANG BinXing, ZHANG YongZheng. Identifying heavy hitters inhigh-speed network monitoring[J]. SCIENCE CHINA(Information Sciences),2010,53(3):659-676.
[178] K.Papagiannaki, N.Taft, et al. A Pragnetic Definition of Elephants in IntenetBackbone Traffic. In: Proc. of the2nd Internet Measurement Workshop,Marseille,France,2002:175-176.
[179] X.Xiao, et al. TCP Processing of the IPv4Precedence Field[EB/OL]. http://www.ietf.org/rfc/rfc2873.txt,2000-6.
[180] K.Lahey. TCP Problems with Path MTU Discovery[EB/OL]. http://www.ietf.org/rfc/rfc2923.txt,2000-9.
[181] IEEE STD802.3(2000Edition)[DB/CD].IEEE Computer Society,2000.
[182] C.Hornig. A Standard for the Transmission of IP Datagrams over EthernetNetworks[EB/OL]. http://www.ietf.org/rfc/rfc0894.txt,1984-4.
[183] CAIDA2008Passive Data Description. http://data.caida.org/datasets/passive-2008/README-2008.
[184] CAIDA2009Passive Data Description. http://data.caida.org/datasets/passive-2009/README-2009.
[185] CAIDA2010Passive Data Description. http://data.caida.org/datasets/passive-2010/README-2010.
[186] CAIDA2011Passive Data Description. http://data.caida.org/datasets/passive-2011/README-2011.
[187] CAIDA2012Passive Data Description. http://data.caida.org/datasets/passive-2012/README-2012.
[188] Leonard Kleinrock. Queueing Systems,Volume l: Theory[M]. New York:WileyInterscience,1975.
[189] Jin Cao, William S, Cleveland, Dong Lin, Don X.Sun, Internet tend to Poissonand Independence as the Load Increases[R]. Murray Hill,NJ:Bell Labs,2001.
[190] Karagiannis T, Molle M, Faloutsos M, Broido A. A nonstationary Poisson viewof Internet traffic[C]. In: Proc. of the23rd Annual Joint Conf. of the IEEEComputer and Communications Societies,Hong Kong,2004:1558-1569.
[191] Barbara Gonzalez-Arevalo, Julie Roy. Simulating a Poisson cluster process forInternet traffic packet arrivals[J]. Computer Communications,2010(33):612-618.
[192] J.Mogul, et al. IP MTU Discovery Options[EB/OL]. http://www.ietf.org/rfc/rfc1063.txt,1988-7.
[193]陈敏.OPNET网络仿真[M].北京:清华大学出版社,2004.
[194]王文博,张金文. OPNET Modeler与网络仿真[M].北京:人民邮电出版社,2003.