网络综合流量管理关键技术研究
|
摘要
近年来,随着用户数量和多种业务的急速膨胀,互联网呈爆炸性地增长,已发展成为国家政治、经济和社会生活的重要基础设施。互联网的性能及其运行稳定性成为了事关国家和社会发展的关键性问题。加强网络管理和提高网络性能已成为当务之急。网络综合流量管理研究流量采集、分析、优化的方法,其目的是实现网络流量的科学有效管理。网络综合流量管理是高性能协议设计、网络设备开发、网络规划与建设、网络管理与操作的基础,同时也是开发高性能网络应用的基础,开展网络综合流量管理关键技术研究具有重要的理论意义和实用价值。目前国内外研究人员针对网络流量管理展开研究工作,并取得许多有价值的研究成果。
论文面向网络流量管理需求和特点,针对当前网络流量管理技术的不足,从流量数据采集、关键链路选择、关键流量矩阵选择、网络流量分配、网络异常流量检测、流量特征分析和综合流量管理原型系统实现等几个方面展开深入研究。主要完成了以下工作:
(1)提出了两个大象流识别算法:Hits和Holds算法,克服了Estan等人提出的大象流识别算法随机丢弃报文带来采集数据不准确和需要同时多次访存无法实现高速实时数据采集的问题。Hits算法将流直接加入到流缓存表中并开始计数,当计数值超过阈值,则加入到流表中;对于在流缓存表中没有入口的报文,使用多级过滤器计数,如果多级过滤器中每一级过滤器均报超过阈值,则将该报文的流标志加入流表中。Holds算法设计了一种解决冲突问题的流缓存表,使用一级过滤器,实现报文的高速采集。论文对两个算法进行了详细描述,并对算法的有效性进行了理论分析,最后使用网络实际流量数据对算法进行了评估,与Estan等人提出的Sample and Hold及Multistage算法进行了比较。理论和实验表明Hits和Holds算法对网络大象流的误检率和漏检率均优于Sample and Hold及Multistage算法。
(2)提出了一种基于主成分分析的网络关键链路发现算法PCAR及基于关键链路的网络拓扑优化算法BTop。PCAR算法通过分析网络流量的时间和空间的相关性来发现网络中的关键路径,BTop算法基于关键链路分析和图的顶点割来优化网络拓扑结构。论文用Abilene流量和拓扑数据验证了PCAR算法和BTop算法的有效性。
(3)提出了关键流量矩阵发现算法MinMat。该算法引入信息熵和耗费函数等概念,先计算流量矩阵的信息熵并选取信息熵较大的若干个矩阵作为候选关键矩阵,而后对最小耗费的簇进行迭代合并,直到最后获得需要的流量矩阵。使用Abilene提供的网络流量矩阵进行实验,使用TOTEM模拟验证了MinMat算法选择结果的有效性。理论分析与实验表明MinMat比K-means、层次凝聚和CritAC具有更高的效率,选择结果具有更好的代表性。
(4)提出了一种面向大象流的动态负载分配算法FEFDA。FEFDA算法采用Hits或holds算法识别长时效的大象流,对大象流采用动态最小负载分配,对小流负载进行静态分配方法,降低流抖动率和提高负载调度效率。使用NLANR数据对算法的有效性进行了评估。理论和实验表明:与传统流量分配算法相比,FEFDA具有更低的流抖动率和更好的负载均衡度。
(5)提出了基于PCA和信息熵技术发现网络异常流量算法FilterA。FilterA结合报文统计信息和流的特征信息综合判断网络异常行为,同时提出使用均方差偏移作为判断异常的阈值,在保证准确性的前提下有利于提高判断速度。用校园网的真实流量数据对FilterA算法进行了测试,测试表明FilterA算法具有较低漏判率和误判率,检测方法简单,可以应用于对大规模网络流量进行异常检测。
论文还使用R/S方法和聚类方差法对TOTEM公布的AS20965的流量、长沙电信骨干网流量及校园网流量进行了Hurst参数测定。实验显示:这些流量都具有自相似性,但Hurst指数各不相同,AS20965的流量具有更强的自相似性,而校园网流量的自相似性相对较弱一些。同时发现使用聚类方差法分析Hurst指数效果较差,存在较大误差。
在上述研究基础之上,设计并实现了网络综合流量管理系统YHTMS。YHTMS实现了本文提出的网络综合流量管理的各种算法,YHTMS采用面向服务的体系结构,有利于实现管理控制与数据平面分离。论文重点阐述了YHTMS的总体结构、系统布署、数据处理流程、数据库设计、核心系统的调用和依赖关系,对实现技术进行了详细描述,最后展示了系统的运行效果。
综上所述,本文的工作针对网络综合流量管理技术中的关键问题提出了有效的解决方案,对于推进网络综合流量管理技术的理论研究和实用化具有一定的理论价值和应用价值。
With the significant increasing of the number of users and diverse applications, the Internet has grown explosively and become a fundamental infrastructure for national political systems, economic systems and social activities. The performance of internet and its running stability have become the key issues related to the national development of economics and socities. Research on the network traffic management framework and the related techniques including traffic data collection, traffic analysis, traffic control and application-level traffic monitoring, plays an important role in order to improving the network performance, its efficiency, robustness and availability. Network traffic management is the foundation to establish network behavior models and understand the inner principles behind complex network behaviors. It also provides valuable reference for the designing of high performance protocols, the development of network devices, the planning and deployment of networks, the network management and operations, and the development of effective applications.
Though many researchers have carried out quite a lot of research work on network traffic management and have made many valuable achievements so far, we argue that the modeling theory, key techniques, implementation methods in this area are still far from the expectation of network operators, with new issues and open problems keeping on emerging. In this thesis, deep research work on network traffic management framework, flow data collection, critical link selection, critical traffic matrices selection, network traffic allocation, abnormal traffic detection, analysis of traffic characteristics, is conducted to meet the requirements of synthetic network traffic management. The main contributions of our work are as follows:
(1) Novel algorithms for detecting large flows: Hits and Holds Two novel algorithms, Hits and Holds, are proposed to detect large flows quickly and correctly, which overcome the shortcomings of Estan’s algorithms. In Estan’s algorithms, statistic data is imprecise since packets are sampled randomly, and it is difficult to implement the algorithms in hardware since simultaneous memory accessing is required. Hits and Holds solve the above problems effectively using flow cache table and multi-level filters. The efficiency of the algorithms is analyzed theoretically and evaluated using real-sampled network traffic data. The results show that Hits and Holds have lower ratios of checking error and undetected error than Estan’s algorithms.
(2) An efficient algorithm to find critical network links and its application on network topology optimization: PCAR and BTop An algorithm named as PCAR is proposed based on the method of primary component analysis (PCA). In the algorithm, the space and time correlation among traffic flows on long timescales is analyzed to find the critical links of networks. Based on the critical link analysis in PCAR, a network topology optimization algorithm is proposed, called BTop. The efficiency of the two algorithms is verified by the real traffic and topology data sampled from the Abilene network.
(3) An entropy-based algorithm for finding critical traffic matrices: MinMat Aim at extracting a small number of“critical”traffic matrices from thousands of measured traffic matrices, we developed an approximation algorithm, called MinMat. It uses the concept of information entropy to select some candidate matrices at first, then merges the clusters of matrices with minimal cost into the final critical matrices. The algorithm is evaluated using a large number of real traffic matrices collected in the Abilene network. The calculation results are verified by the TOTEM simulator. The experimental results demonstrate that the MinMat algorithm is more effective than the K-means, Hierarchical Agglomeration, the CritAC algorithm, and a small number of critical traffic matrices selected by the MinMat algorithm is sufficient to portray the characteristics of all sampled traffic data.
(4) A new traffic allocation algorithm for elephant flows: FEFDA
A new hybrid approach called FEFDA is proposed to allocate traffic rate for long-lived flows (elephant flows), while forwarding short-lived flows statically. FEFDA uses the Hits algorithm or the Holds algorithm to detect long-lived flows and allocate traffic rates for them in order to achieve dynamic load balance. The effectiveness of the algorithm is evaluated by simulation with NLANR traces. The results show that flow flapping is considerably reduced and better load balance is achieved than traditional schemes.
(5) An abnormal traffic detection algorithm based on PCA and information entropy: FilterA
The FilterA algorithm is designed to detect network anomalies. It uses the statistical traffic information and characteristics of flows to determine abnormity. The mean square deviation is used as the threshold metric for decision so that the algorithm can run fast with the guarantee of correctness. The algorithm is tested using the data collected from our campus network. The test results show that the FilterA algorithm has low ratio of detection error and undetected error. It is simple and can be applied in large-scale networks.
Traffic character analysis using Hurst parameters,Using the R/S method and the variance-time method, the Hurst parameter values of the traffic data from the Abilene network, the Changsha telecom backbone network and our campus network are calculated. The results verify that all traffic data exhibits the self-similarity feature, although the Hurst parameter values are different for traffic data from different networks. The data of Abilene network shows stronger self-similarity feature than the data of campus network.
Based on above research work, a network traffic management prototype named YHTMS is designed and implemented. All the algorithms proposed are integrated in YHTMS. YHTMS adopts service-oriented architecture in favor of the separation of control plane and data plane. The implementation methods are described and the running results are demonstrated.
In summary,several efficient algorithms are developed to tackle the key problems in network traffic management, which provides a basis for future research and development.
论文面向网络流量管理需求和特点,针对当前网络流量管理技术的不足,从流量数据采集、关键链路选择、关键流量矩阵选择、网络流量分配、网络异常流量检测、流量特征分析和综合流量管理原型系统实现等几个方面展开深入研究。主要完成了以下工作:
(1)提出了两个大象流识别算法:Hits和Holds算法,克服了Estan等人提出的大象流识别算法随机丢弃报文带来采集数据不准确和需要同时多次访存无法实现高速实时数据采集的问题。Hits算法将流直接加入到流缓存表中并开始计数,当计数值超过阈值,则加入到流表中;对于在流缓存表中没有入口的报文,使用多级过滤器计数,如果多级过滤器中每一级过滤器均报超过阈值,则将该报文的流标志加入流表中。Holds算法设计了一种解决冲突问题的流缓存表,使用一级过滤器,实现报文的高速采集。论文对两个算法进行了详细描述,并对算法的有效性进行了理论分析,最后使用网络实际流量数据对算法进行了评估,与Estan等人提出的Sample and Hold及Multistage算法进行了比较。理论和实验表明Hits和Holds算法对网络大象流的误检率和漏检率均优于Sample and Hold及Multistage算法。
(2)提出了一种基于主成分分析的网络关键链路发现算法PCAR及基于关键链路的网络拓扑优化算法BTop。PCAR算法通过分析网络流量的时间和空间的相关性来发现网络中的关键路径,BTop算法基于关键链路分析和图的顶点割来优化网络拓扑结构。论文用Abilene流量和拓扑数据验证了PCAR算法和BTop算法的有效性。
(3)提出了关键流量矩阵发现算法MinMat。该算法引入信息熵和耗费函数等概念,先计算流量矩阵的信息熵并选取信息熵较大的若干个矩阵作为候选关键矩阵,而后对最小耗费的簇进行迭代合并,直到最后获得需要的流量矩阵。使用Abilene提供的网络流量矩阵进行实验,使用TOTEM模拟验证了MinMat算法选择结果的有效性。理论分析与实验表明MinMat比K-means、层次凝聚和CritAC具有更高的效率,选择结果具有更好的代表性。
(4)提出了一种面向大象流的动态负载分配算法FEFDA。FEFDA算法采用Hits或holds算法识别长时效的大象流,对大象流采用动态最小负载分配,对小流负载进行静态分配方法,降低流抖动率和提高负载调度效率。使用NLANR数据对算法的有效性进行了评估。理论和实验表明:与传统流量分配算法相比,FEFDA具有更低的流抖动率和更好的负载均衡度。
(5)提出了基于PCA和信息熵技术发现网络异常流量算法FilterA。FilterA结合报文统计信息和流的特征信息综合判断网络异常行为,同时提出使用均方差偏移作为判断异常的阈值,在保证准确性的前提下有利于提高判断速度。用校园网的真实流量数据对FilterA算法进行了测试,测试表明FilterA算法具有较低漏判率和误判率,检测方法简单,可以应用于对大规模网络流量进行异常检测。
论文还使用R/S方法和聚类方差法对TOTEM公布的AS20965的流量、长沙电信骨干网流量及校园网流量进行了Hurst参数测定。实验显示:这些流量都具有自相似性,但Hurst指数各不相同,AS20965的流量具有更强的自相似性,而校园网流量的自相似性相对较弱一些。同时发现使用聚类方差法分析Hurst指数效果较差,存在较大误差。
在上述研究基础之上,设计并实现了网络综合流量管理系统YHTMS。YHTMS实现了本文提出的网络综合流量管理的各种算法,YHTMS采用面向服务的体系结构,有利于实现管理控制与数据平面分离。论文重点阐述了YHTMS的总体结构、系统布署、数据处理流程、数据库设计、核心系统的调用和依赖关系,对实现技术进行了详细描述,最后展示了系统的运行效果。
综上所述,本文的工作针对网络综合流量管理技术中的关键问题提出了有效的解决方案,对于推进网络综合流量管理技术的理论研究和实用化具有一定的理论价值和应用价值。
With the significant increasing of the number of users and diverse applications, the Internet has grown explosively and become a fundamental infrastructure for national political systems, economic systems and social activities. The performance of internet and its running stability have become the key issues related to the national development of economics and socities. Research on the network traffic management framework and the related techniques including traffic data collection, traffic analysis, traffic control and application-level traffic monitoring, plays an important role in order to improving the network performance, its efficiency, robustness and availability. Network traffic management is the foundation to establish network behavior models and understand the inner principles behind complex network behaviors. It also provides valuable reference for the designing of high performance protocols, the development of network devices, the planning and deployment of networks, the network management and operations, and the development of effective applications.
Though many researchers have carried out quite a lot of research work on network traffic management and have made many valuable achievements so far, we argue that the modeling theory, key techniques, implementation methods in this area are still far from the expectation of network operators, with new issues and open problems keeping on emerging. In this thesis, deep research work on network traffic management framework, flow data collection, critical link selection, critical traffic matrices selection, network traffic allocation, abnormal traffic detection, analysis of traffic characteristics, is conducted to meet the requirements of synthetic network traffic management. The main contributions of our work are as follows:
(1) Novel algorithms for detecting large flows: Hits and Holds Two novel algorithms, Hits and Holds, are proposed to detect large flows quickly and correctly, which overcome the shortcomings of Estan’s algorithms. In Estan’s algorithms, statistic data is imprecise since packets are sampled randomly, and it is difficult to implement the algorithms in hardware since simultaneous memory accessing is required. Hits and Holds solve the above problems effectively using flow cache table and multi-level filters. The efficiency of the algorithms is analyzed theoretically and evaluated using real-sampled network traffic data. The results show that Hits and Holds have lower ratios of checking error and undetected error than Estan’s algorithms.
(2) An efficient algorithm to find critical network links and its application on network topology optimization: PCAR and BTop An algorithm named as PCAR is proposed based on the method of primary component analysis (PCA). In the algorithm, the space and time correlation among traffic flows on long timescales is analyzed to find the critical links of networks. Based on the critical link analysis in PCAR, a network topology optimization algorithm is proposed, called BTop. The efficiency of the two algorithms is verified by the real traffic and topology data sampled from the Abilene network.
(3) An entropy-based algorithm for finding critical traffic matrices: MinMat Aim at extracting a small number of“critical”traffic matrices from thousands of measured traffic matrices, we developed an approximation algorithm, called MinMat. It uses the concept of information entropy to select some candidate matrices at first, then merges the clusters of matrices with minimal cost into the final critical matrices. The algorithm is evaluated using a large number of real traffic matrices collected in the Abilene network. The calculation results are verified by the TOTEM simulator. The experimental results demonstrate that the MinMat algorithm is more effective than the K-means, Hierarchical Agglomeration, the CritAC algorithm, and a small number of critical traffic matrices selected by the MinMat algorithm is sufficient to portray the characteristics of all sampled traffic data.
(4) A new traffic allocation algorithm for elephant flows: FEFDA
A new hybrid approach called FEFDA is proposed to allocate traffic rate for long-lived flows (elephant flows), while forwarding short-lived flows statically. FEFDA uses the Hits algorithm or the Holds algorithm to detect long-lived flows and allocate traffic rates for them in order to achieve dynamic load balance. The effectiveness of the algorithm is evaluated by simulation with NLANR traces. The results show that flow flapping is considerably reduced and better load balance is achieved than traditional schemes.
(5) An abnormal traffic detection algorithm based on PCA and information entropy: FilterA
The FilterA algorithm is designed to detect network anomalies. It uses the statistical traffic information and characteristics of flows to determine abnormity. The mean square deviation is used as the threshold metric for decision so that the algorithm can run fast with the guarantee of correctness. The algorithm is tested using the data collected from our campus network. The test results show that the FilterA algorithm has low ratio of detection error and undetected error. It is simple and can be applied in large-scale networks.
Traffic character analysis using Hurst parameters,Using the R/S method and the variance-time method, the Hurst parameter values of the traffic data from the Abilene network, the Changsha telecom backbone network and our campus network are calculated. The results verify that all traffic data exhibits the self-similarity feature, although the Hurst parameter values are different for traffic data from different networks. The data of Abilene network shows stronger self-similarity feature than the data of campus network.
Based on above research work, a network traffic management prototype named YHTMS is designed and implemented. All the algorithms proposed are integrated in YHTMS. YHTMS adopts service-oriented architecture in favor of the separation of control plane and data plane. The implementation methods are described and the running results are demonstrated.
In summary,several efficient algorithms are developed to tackle the key problems in network traffic management, which provides a basis for future research and development.
引文
[1]中国互联网络信息中心.中国互联网络发展状况统计报告. 2008.
[2]张宏莉,方滨兴. Internet测量与分析综述[J].软件学报, 2003, vol. 14(1): 110-116.
[3] D.Awduche, A.Chiu, A.Elwalid. Overview and Principles of Internet Traffic Engineering. vol. RFC3272: Internet Engineering Task Force, 2002.
[4] M. S. Blumenthal, D. D. Clark. Rethinking the design of the Internet: The end to end arguments vs. the brave new world [J]. ACM Transactions on Internet Technology, 2001.
[5] Leland W.E., Taqqu M.S. On the Self-Similar Nature of Ethernet Traffic(extended Version) [J]. Transaction on Networking, 1994, vol. 2(1): 1-15.
[6] Latest Global Internet Statistical Information. 2007. http://www.apira.org/html/report/report_00_en.htm.
[7] Thomas Karagiannis, Richard Mortier, Antony Rowstron. Network Exception Handlers:Host-network Control in Enterprise Networks [C]. in Proc. of ACM SIGCOMM, 2008: 123-134.
[8] N. Brownlee. Traffic Flow Measurement: Architecture [R], 1999.
[9] National Internet Measurement Infrastructure. http://www.ncne.nlanr.net/research /nimi.
[10] Cooperative Association for Internet Data Analysis (CAIDA). .http://www.caida.org/.
[11] National Laboratory for Applied Network Research. .http://www.nlanr.net.
[12]张文杰.可定制的网络测量基础设施研究[D]西安,西安交通大学, 2004.
[13] K.Chaffy, G.Polyzos, H. Braun. Application of Sampling Methodologies to Network Traffic Characterization [C]. in SIGCOMM, 1993.
[14] I. Cozzani, S. Giordano. A passive test and measurement system: traffic sampling for QoS evaluation [C]. in GLOBECOM, 1998: 1235-1241.
[15] N. G. Duffied, M. Grossglauser. Trajectory Sampling for Direct Traffic Observation [J]. IEEE/ACM Trans on Networking, 2001, vol. 9(3): 280-192.
[16] B.Bloom. Space/Time trade-offs in hash coding with allowable errors [J].Communications of the ACM, 1970, vol. 13(7).
[17] C. Estan, G. Varghese. New directions in traffic measurement and accounting [C]. in in Proc. of ACM SIGCOMM, 2002.
[18] T. Mori, M. Uchida, R. Kawahara. Identifying Elephant Flows Through Periodically Sampled Packets [C]. in Proc. of IEEE IMC, 2004.
[19] N.Duffield, C. Lund, M.Thorup. Estimating flow distributions from sampled flow statistics [C]. in Proc. of ACM SIGCOMM, 2003.
[20] C. Estan, G. Varghese, M Fisk. Bitmap algorithms for counting active flows on high speed links [R]: UCSD, 2003.
[21] A. Kumar, M. Sungm. Data streaming algorithms for efficient and accurate estimation of flow size distribution [C]. in Proc. of ACM SIGMETRICS, 2004.
[22]杨策,张永智,庞正社.网络流量监测技术及性能分析[J].空军工程大学学报, 2003, vol. 4(3): 22~26.
[23] G.Cormode, S.Muthukrishnan. An improved data stream summary: the count-min sketch and its applications [J]. Journal of Algorithms, 2004.
[24]金澈清,钱卫宁,周傲英.数据流分析与管理综述[J].软件学报, 2004, vol. 15(8).
[25] G. Cormode, S. Muthukrishnan. What’s new: Finding significant differences in network data streams [C]. in Proc. of IEEE Infocom, 2004.
[26] M. Charikar, K. Chen, M. Farach-Colton. Finding frequent items in data streams [C]. in Proceedings of Symposium on Principles of Database System (PODS), 2002: 1-16.
[27] Kyoungwon Suh, Yang Guo, Jim Kurose, et al. Locating Network Monitors: Complexity, Heuristics, and Coverage [C]. in Proc. of IEEE INFOCOM, 2005.
[28] S. Khuller, A. Moss, J. Naor. The budgeted maximum coverage problem [J]. Information Processing Letters, 1999, vol. 7(1): 39-45.
[29] Slavik. Improved performance of the greedy algorithm for the minimum set cover and minimum partial cover problems [J]. Electronic Colloquium on Computational Complexity, 1995, vol. 2(53).
[30] F. Chudak, D. Shmoys. Improved approximation algorithms for the uncapacitated facility location problems [J]. ACM SIAM Journal on Computing, 2003, vol. 33(1): 1-25.
[31] Zhiping Cai, Jianping Yin, Xianghui Liu, et al. An Approximation Algorithm for Weak Vertex Cover Problem in Network Management [C]. in Proc. of IEEE AAIM, 2005.
[32] K.Kar, M.Kodialam, T.V. Lakshman. Minimum Interference Routing of Bandwidth Guaranteed Tunnels with MPLS Traffic Engineering Applications [J]. IEEE Journal on Selected Areas in Communications, 2000, vol. 18(12): 2566-2579.
[33] M. Kodialam, T. V. Lakshman. Minimum Interference Routing with Applications to MPLS Traffic Engineering [C]. in Proc. of IEEE INFOCOM, 2000: 884-893.
[34] Iliadis Ilias, Bauer Daniel. A new class of online minimum-interference routing algorithms [C]. in International IFIP-TC6 Networking Conference, 2002: 959-971.
[35] Sun Fangting, Shayman Mark. Minimum Interference Algorithm for Integrated Topology Control and Routing in Wireless Optical Backbone Networks [C]. in International Conference on Communications, 2004: 4232-4237.
[36]郑志梅,崔勇. MPLS流量工程最小干扰选路算法研究[J].软件学报, 2006, vol. 17(4): 814-821.
[37] Sa-Ngiamsak Wisitsak, Varakulsiripunth Ruttikorn. A Bandwidth-Based Constraint Routing Algorithm for Multi-Protocol LabelSwitching Networks [C]. in International Conference on Advanced Communication Technology. Phoenix Park, Korea, 2004: 933-937.
[38]孟兆炜.面向流量工程优化的约束路由算法研究[D]湖南长沙,国防科学技术大学, 2007.
[39]赵锋,朱培栋,刘亚萍, et al.割边链路故障对网络流量的影响[J].计算机工程与科学, 2008, vol. 30(4): 13-15.
[40] Bernard Fortz, Mikkel Thorup. Optimizing OSPF/IS-IS Weights in a Changing World [J]. IEEE Selected Areas in Communications, 2002, vol. 20(4): 756-767.
[41] I Juva, S Vaton, J Virtamo. Quick traffic matrix estimation based on link count covariances [C]. in In: Proc. of the IEEE Int'l Conf. on Communications (ICC) ,In:Eager DL, Williamson CL, Borst SC, Lui JCS, eds. Proc. of the ACM SIGMETRICS. Istanbul: IEEE Communications Society ,Banff: ACM Press, 2006,2005: 603-608,350-361.
[42] Zhao Q, Ge Z, Wang J. Robust traffic matrix estimation with imperfect information [J]. ACM SIGMETRICS Performance Evaluation Review, 2006, vol. 34(1): 133~144.
[43]刘紫千,陈常嘉.基于流量矩阵估计的路由推断算法[J].铁道学报, 2005, vol. 27(6): 66-70.
[44] T Hong, LF Tong, GZ Guo. An assignment model on traffic matrix estimation [C]. in Proc. of the Int’l Conf. on Natural Computation (ICNC 2006). xi'an: Springer-Verlag, 2006.: 295-304.
[45] Medina A., Taft N., Salamatian K., et al. Traffic matrix estimation: Existing techniques and new directions. [C]. in Proceedings of ACM SIGCOMM, 2002: 161-174.
[46]周静静,杨家海,杨扬, et al.流量矩阵估算的研究进展[J].软件学报, 2007, vol. 18(11): 2669?2681.
[47] M Roughan, M Thorup, Y Zhang. Traffic engineering with estimated traffic matrices [C]. in Proc. of the ACM SIGCOMM Internet Measurement Conf. (IMC). San Diego: ACM Press, 2003: 248-258.
[48] R Teixeira, S Agarwal, J Rexford. BGP routing changes: Merging views from two ISPs [J]. ACM SIGCOMM Computer Communication Review, 2005, vol. 35(3): 79-82.
[49] K.Papagiannaki, N.Taft, A.Lakhina. A distributed approach to measure IP traffic matrices [C]. in Proc. of the ACM SIGCOMM Internet Measurement Conf. (IMC). Taormina: ACM Press, 2004: 161-174.
[50] G Liang, N Taft, B Yu. A fast lightweight approach to origin-destination IP traffic estimation using partial measurements [J]. IEEE/ACM Trans. on Networking (TON), 2006, vol. 14(S1): 2634-2648.
[51] Steve Uhlig, Olivier Bonaventure, Vincent Magnin, et al. Implications of the Topological Properties of Internet Traffic on Traffic Engineering [C]. in Proc. of ACM SAC, 2004.
[52] Y.Zhang, Z.Ge. Finding critical traffic matrices [C]. in Proc. of the 2005 Int’l Conf. on Dependable Systems and Networks (DSN). Yokohama: IEEE Computer Society, 2005: 188-197.
[53] Cao Z, Wang Z, Zegura E. Performance of hashing-based schemes for Internetload balancing [C]. in Proc. of IEEE INFOCOM. Nokia FB: IEEE Computer and Communications Societies, 2000: 332-341.
[54] L.Kencl, J. Le Boudec. Adaptive load sharing for network processors [C]. in Proc. of IEEE INFOCOM. New York, NY, USA, 2002: 545-554.
[55] G.Dittmann, A.Herkersdorf. Network processor load balancing for high-speed links [C]. in International Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS 2002). San Diego, CA, USA: IEEE, 2002: 727-735.
[56] W. Shi, M. H. MacGregor et al. An Adaptive Load Balancer for Multiprocessor Routers. University of Alberta, Edmonton, AB, T6G 2E8, Canada, 2004.
[57] W. Shi, M. H. MacGregor et al. Load balancing for parallel forwarding [J]. IEEE/ACM Transactions on Networking, 2005, vol. 13(4).
[58] Shaikh, J.Rexford, K.G.Shin. Load-sensitive routing of long-lived IP flows [J]. ACM SIGCOMM Computer Communication Review, October 1999, vol. 29: 215-226.
[59] Widmer J, Denda R, Mauve M. A Survey on TCP-friendly Congestion Control [J]. IEEE Network, 2001, vol. 15(3): 28-37.
[60]高文宇,王建新,陈松乔. PFED:一种基于预测的公平的主动队列管理算法[J].计算机研究与发展, 2006(02).
[61]任丰原,林闯,黄小猛, et al.主动队列管理算法的分类器实现[J].电子学报, 2004(11).
[62]吴纯青.面向组播环境的高性能路由器QoS机制研究与实现[D]长沙,国防科学技术大学, 2006.
[63] Floyd S, Fall K. Promoting the Use of End-to-end Congestion Control in the Internet [J]. IEEE/ACM Transactions on Networking, 1999, vol. 7(4): 458-472.
[64]张鹤颖,刘宝宏,窦文华.一种基于速率和队列长度的主动队列管理机制[J].电子学报, 2003(11).
[65] A.Medina, M. Allman, S. Floyd. Measuring the evolution of transport protocols in the Internet [J]. ACM Computer Communication Review, 2005, vol. 35(2): 37-52.
[66] Wang H, Xin H, Reeves D.S. A Simple Refinement of Slow-start of TCPCongestion Control [C]. in Proceedings of the IEEE Symposium on Computers and Communications (ISCC 2000), 2000: 98-105.
[67] L.A. Larzon, M. Degermark, S. Pink. The Lightweight User Datagram Protocol (UDP-Lite). vol. RFC 3828: Internet Engineering Task Force, 2004.
[68] E. Kohler, M. Handley, S. Floyd. Datagram Congestion Control Protocol. vol. RFC 4340: Internet Engineering Task Force, 2006.
[69]王建新,荣亮,肖雪峰.几种主动队列管理算法的仿真及性能评估[J].计算机工程, 2007(3).
[70] S. Floyd, V. Jacobson. Random Early Detection gateways for congestion avoidance [J]. IEEE/ACM Transactions on Networking, 1997, vol. 1(4).
[71] Floyd S, Gummadi R, Shenker S. Adaptive RED: An algorithm for increasing the robustness of RED's active queue management [R], 2001.
[72] J. Aweya, M. Ouellette, D. Y. Montuno, et al. A control theoretic approach to active queue management [J]. Computer Networks, 2001, vol. 36: 203-235.
[73]崔勇,吴建平,徐恪.互联网络服务质量路由算法研究综述[J].软件学报, 2002, vol. 13(11): 2065-2075.
[74]闵应骅.计算机网络路由研究综述[J].计算机学报, 2003, vol. 26(6).
[75] B Fortz, M Thorup. Internet traffic engineering by optimizing OSPF weights [C]. in Proc. of the IEEE INFOCOM. Tel-Aviv: IEEE, 2000: 519-528.
[76] D. Awduche. MPLS and traffic engineering in IP networks [J]. IEEE Communications Magazine, 1999, vol. 37(12): 42-47.
[77] L. Subramanian, S. Agarwal, J. Rexford. Characterizing the Internet hierarchy from multiple vantage points [C]. in Proc. of IEEE INFOCOM, 2002.
[78] G.Apostolopoulos, D.Williams, S.Kamat. QoS Routing Mechansim and OSPF Extensions. vol. RFC2676: Internet Engineering Task Force, 1999.
[79] A. Elwalid. MATE :MPLS Adaptive Traffic Engineering [C]. in INFOCOM: IEEE, 2001.
[80] Srikanth Kandula, Dina Katabi. TeXCP: Responsive Yet Stable Traffic Engineering [C]. in Proc. of ACM SIGCOMM: ACM, 2005.
[81] C. Zhang, Y. Liu, W. Gong, et al. On optimal routing with multiple traffic matrices [C]. in Proc. of IEEE INFOCOM 2005.
[82] C. Zhang, Z. Ge, J. Kurose, et al. Optimal routing with multiple traffic matrices:Tradeoff between average case and worst case performance [C]. in 13th International Conference on Network Protocols 2005.
[83] D.Applegate, L.Breslau, E.Cohen. Coping with network failures: Routing strategies for optimal demand oblivious restoration [C]. in Joint International Conference on Measurement and Modeling of Computer Systems(SIGMETRICS), 2004.
[84] M. Kodialam, T. V. Lakshman, S. Sengupta. Efficient and robust routing of highly variable traffic [C]. in Third Workshop on Hot Topics in Networks (HotNets-III), 2004.
[85] Hao Wang, Haiyong Xie, Lili Qiu. COPE: Traffic Engineering in Dynamic Networks [C]. in Proc. of ACM SIGCOMM, 2006.
[86] Albert Greenberg, Gisli Hjalmtysson, David A. Maltz. A Clean Slate 4D Approach to Network Control and Management [J]. ACM SIGCOMM Computer Communication Review, 2005, vol. 35(5).
[87] Albert Greenberg, Gisli Hjalmtysson, David A. Maltz. Refactoring Network Control and Management:A Case for the 4D Architecture. CMU, 2005.
[88] Ashok Anand, Archit Gupta, Aditya Akella. Packet Caches on Routers: The Implications of Universal Redundant Traffic Elimination [C]. in Proc. of ACM SIGCOMM, 2008: 219-230.
[89] Murtaza Motiwala, Megan Elmore, Nick Feamster, et al. Path Splicing [C]. in Proc. of ACM SIGCOMM, 2008: 27-38.
[90] Maxim Podlesny, Sergey Gorinsky. RD Network Services:Differentiation through Performance Incentives [C]. in Proc. of ACM SIGCOMM, 2008: 255-266.
[91] Richard Alimi, Ye Wang, Y.Richard Yang. Shadow Configuration as a Network Management Primitive [C]. in Proc. of ACM SIGCOMM, 2008: 111-122.
[92] Franck Le, Geoffrey G. Xie, Dan Pei, et al. Shedding Light on the Glue Logic of the Internet Routing Architecture [C]. in Proc. of ACM SIGCOMM, 2008: 39-50.
[93] Yinglian Xie, Fang Yu, Kannan Achan, et al. Spamming Botnets: Signatures and Characteristics [C]. in Proc. of ACM SIGCOMM, 2008: 171-182.
[94] Kirill Levchenko, Geoffrey M. Voelker, Ramamohan Paturi, et al. XL: An Efficient Network Routing Algorithm [C]. in Proc. of ACM SIGCOMM, 2008: 15-26.
[95] P. Barford, D. Plonka. Characteristics of Network Traffic Flow Anomalies [C]. in Proceedings of ACMSIGCOMM Intemet Measurement Workshop (IMW), 2001.
[96] J. Brutlag. Aberrant behavior detection in time series for network monitoring [J]. USENIX LISA, 2000.
[97] L. Feinstein, D. Schnackenberg, R. Balupari, et al. Statistical Approaches to DDoS Attack Detection and Response [C]. in DARPA Information Survivability Conference and Exposition, 2003: 303-314.
[98] R. S. Boyer, J. S. Moore. A fast string matching algorithm [J]. Communication, 1977, vol. 20(10): 762-772.
[99]陈曙晖.基于内容分析的高速网络协议识别技术研究[D],国防科学技术大学, 2007.
[100] Do M. N., Vetterli M.C. Beyond Wavelets. W. G. V, Ed.: Academic Press, 2003.
[101] A.Lakhina, M.Crovella, C.Diot. Mining Anomalies Using Traffic Feature Distributions [C]. in Proc. of ACM SIGCOMM. USA, 2005.
[102] A.Lakhina, M.Crovella, C.Diot. Diagnosing Network-Wide Traffic Anomalies [C]. in ACM SIGCOMM. Portland, 2004.
[103] M.S. Kim, H.J. Kang, S.C. Hung, et al. A Flow-based Method for Abnormal Network Traffic Detection [C]. in IEEE/IFIP Network Operations and Management Symposium. Seoul, 2004.
[104] S. Kim, A. L. N. Reddy. A Study of Analyzing Network Traffic as Images in Real-Time [C]. in Proc. of IEEE INFOCOM, 2005.
[105] S.S Keerthi, C.J.Lin. Asymptotic behaviors of support vector machines with Gaussian Kernel [J]. Neural Computation, 2003, vol. 15(7).
[106] N.Ye, V.Sean, Q.Chen. Computer intrusion detection through EWMA for auto correlated and uncorrelated data [J]. IEEE Transactions on Reliability, 2003, vol. 52: 75-82.
[107] Chatfield, Yar. Holt-Winters forecasting: some practical issues [M]: The Statistician, 1988.
[108] V.Alarcon-Aquio, J.A.Barria. Anomaly detection in communication network using wavelets [C]. in Proceedings of IEEE Communication, 2001.
[109]饶鲜,董春曦,杨绍全.基于支持向量机的入侵检测系统[J].软件学报, 2003, vol. 14(4).
[110] Thottan M., Ji C. Fault Prodiction at the network layer using intelligent agents [C]. in IEEE/IFIP Integrated Network Management VI, 1999.
[111] Roy, A. Maxion, Frank E. Feather. A Case Study of Ethernet Anomalies in a Distributed Computing Environment [J]. IEEE Transaction on Reliability, 1990, vol. 39(4): 433-443.
[112]程光,龚检,丁伟.基于抽样测量的高速网络实时检测模型[J].软件学报, 2003, vol. 14(3): 594-599.
[113]陈光英,张千里,李星.基于SVM分类机的入侵检测系统[J].软件学报, 2002, vol. 23(5).
[114]单征,刘铁铭,楚蓓蓓.基于网络状态的入侵检测模型[J].信息工程大学学报, 2002, vol. 3(3).
[115] GONG Jian, PENG Yan-Bing, WANG Yang, et al. Reconstructing the Parameter for Massive Abnormal TCP Connections with Bloom Filter [J]. Journal of Software, 2006, vol. 17(3).
[116]王海龙.大规模网络流量异常分析[D]湖南长沙:,国防科技大学, 2006.
[117]陈训逊,方滨兴,李蕾.高速网络环境下入侵检测系统结构研究[J].计算机研究与发展, 2004, vol. 9(41): 1481-1487.
[118]张健,陈松乔.一种基于最大熵原理系统异常检测模型研究[J].小型微型计算机系统, 2007, vol. 20(04).
[119] David G. Andersen. Accountable Internet Protocol (AIP) [C]. in Proc. of ACM SIGCOMM, 2008: 339-350.
[120] Randy Smith, Cristian Estan, Somesh Jha, et al. Deflating the Big Bang: Fast and Scalable Deep Packet Inspection with Extended Finite Automata [C]. in Proc. of ACM SIGCOMM, 2008: 207-218.
[121] Xin Liu, Xiaowei Yang, Yanbin Lu. To Filter or to Authorize: Network-Layer DoS Defense Against Multimillion-node Botnets [C]. in Proc. of ACM SIGCOMM, 2008: 195-206.
[122]孙红杰,方滨兴,张宏莉.基于链路特征的DDoS攻击检测方法[J].通信学报, 2007, vol. 28(2).
[123]程光,龚检,丁伟.大规模网络流量行为累加分解研究[J].计算机工程与科学, 2002, vol. 24(5): 53-56.
[124]程光,龚检.大规模网络流量宏观行为周期性分析研究[J].小型微型计算机系统, 2003, vol. 24(6): 991-994.
[125] A.Lakhina, K.Papagiannaki, M.Crovella, et al. Structural Analysis of Network Traffic Flows [C]. in Proc. of ACM SIGMETRICS. New York, 2004.
[126]郑军,胡铭曾,云晓春, et al.基于数据流方法的大规模网络异常发现[J].通信学报, 2006, vol. 27(2): 1-8.
[127] Anukool Lakhina, Mark Crovella, Christophe Diot. Characterization of Network-Wide Anomalies in Traffic Flows [C]. in Proc. of IEEE IMC. Taormina, Sicily, Italy, 2004: 25-27.
[128]吴桦,丁伟.基于奇异谱方法的网络行为分析[J].东南大学学报(自然科学版), 2002, vol. 32(6): 1-6.
[129] B. Ryu, A. Elwalid. The importance of long-range dependence of VBR video traffic in ATM traffic engineering: myths and realities [C]. in Proc. of ACM SIGCOMM, 1996: 3-14.
[130] M. Grossglauser, J. C. Bolot. On the relevance of long-range dependence in network traffic [C]. in Proc. of SIGCOMM, 1996.
[131] R.H.Riedi, M.S.Crouse, V.J.Ribeiro. A Multifractal Wavelet Model with Application to Network Traffic [J]. IEEE Transactions on Information Theory, 1999, vol. 45(3).
[132] P. Mannersalo, l. Norros. Multifractal analysis of real ATM traffic: A first look [J]. VTT Information Technology, 1997.
[133] S.Kalidindi, M.J.Zekauskas. Surveyor: an infrastructure for Internet performance measurements [C]. in Proceedings of the INET’99. San Jose, 1999.
[134] B. Krishnamurthy, S. Sen. Sketch-based change detection: methods, evaluation, and applications [C]. in Proc. of ACM SIGCOMM IMC, 2003.
[135] W. Fang, L. Peterson9. Inter-as traffic patterns and their implications [C]. in In Proceedings of IEEE GLOBECOM, 1999.
[136]蔡志平,殷建平,刘湘辉.延迟约束的分布式演化网络监测模型[J].软件学报, 2006, vol. 17(1): 117-123.
[137]刘亚萍,龚正虎,朱培栋. BGP最优路径选择中的瓶颈区域的研究[J].软件学报, 2005, vol. 16(5): 946-959.
[138] J. E. Jackson. A User’s Guide to Principal Components [M]. New York, 1991.
[139] TOTEM Project Toolbox for Traffic Engineering Methods, http://totem.run.montefiore.ulg.ac.be/download.html,2005.
[140] A. Daniel, Spielman, Shang-Hua Teng. Spectral Partitioning Works: Planar Graphs and Finite Element Meshes [C]. in IEEE Symposium on Foundations of Computer Science, 1996: 96-105.
[141] T Munzner. Interactive visualization of large graphs and networks [Ph.D. Thesis] [D], Stanford University, 2000.
[142] Abilene Backbone Network.http://abilene.internet2.edu/.
[143] Ben-Nain Arich. Entropy Demystified [M]: World Scientific, 2007.
[144]林亚平,王雷,陈宇等.基于最大熵的隐马尔可夫文本信息抽取[J].电子学报, 2005, vol. 33(2): 236-240.
[145] B.Fortz, M.Thorup. Robust optimization of OSPF/IS-IS weights [C]. in Proc. of International Network Optimization Conference, 2003: 225-230.
[146] R Teixeira, A Shaikh, T Griffin, et al. Dynamics of hot-potato routing in IP networks [C]. in Proc. of the ACM SIGMETRICS. New York: ACM Press, 2004: 307-319.
[147] Barry Raveendran Greene, Philip Smith. Cisco ISP必备手册[M]:人民邮电出版社, 2002.
[148] A. Feldmann, A. Greenberg, C. Lund, et al. Deriving traffic demands for operational IP networks methodology and experience [J]. IEEE/ACM Transactions on Networking, 2001, vol. 9(3): 265-279.
[149] Riikka Susitaival, Samuli Aalto. Adaptive load balancing with OSPF [C]. in Proceedings of the Second International Working Conference on Performance Modelling and Evaluation of Heterogeneous Networks (HETNETs 2004), 2004: 1-10.
[150] J. Le Boudec L. Kencl. Adaptive load sharing for network processors [C]. in INFOCOM 2002. New York, NY, USA, 2002: 545-554.
[151]陈一骄.网络入侵检测系统高速处理技术研究[D]长沙,国防科学技术大学, 2007.
[152]程光,龚俭,丁伟, et al.面向IP流测量的哈希算法研究[J].软件学报, 2005,vol. 16(5): 652-658.
[153]龚俭,彭艳兵,杨望.基于Bloom Filter的大规模异常TCP连接参数再现方法[J].软件学报, 2006, vol. 17(3).
[154]林青家.基于小波的网络流量的特性刻画与模型建立[D],山东大学, 2007.
[155]林兆启,林南晖,汪继东.校园网网络流量自相似性的测定[J].计算机工程与科学, 2008, vol. 30(6): 29-32.
[2]张宏莉,方滨兴. Internet测量与分析综述[J].软件学报, 2003, vol. 14(1): 110-116.
[3] D.Awduche, A.Chiu, A.Elwalid. Overview and Principles of Internet Traffic Engineering. vol. RFC3272: Internet Engineering Task Force, 2002.
[4] M. S. Blumenthal, D. D. Clark. Rethinking the design of the Internet: The end to end arguments vs. the brave new world [J]. ACM Transactions on Internet Technology, 2001.
[5] Leland W.E., Taqqu M.S. On the Self-Similar Nature of Ethernet Traffic(extended Version) [J]. Transaction on Networking, 1994, vol. 2(1): 1-15.
[6] Latest Global Internet Statistical Information. 2007. http://www.apira.org/html/report/report_00_en.htm.
[7] Thomas Karagiannis, Richard Mortier, Antony Rowstron. Network Exception Handlers:Host-network Control in Enterprise Networks [C]. in Proc. of ACM SIGCOMM, 2008: 123-134.
[8] N. Brownlee. Traffic Flow Measurement: Architecture [R], 1999.
[9] National Internet Measurement Infrastructure. http://www.ncne.nlanr.net/research /nimi.
[10] Cooperative Association for Internet Data Analysis (CAIDA). .http://www.caida.org/.
[11] National Laboratory for Applied Network Research. .http://www.nlanr.net.
[12]张文杰.可定制的网络测量基础设施研究[D]西安,西安交通大学, 2004.
[13] K.Chaffy, G.Polyzos, H. Braun. Application of Sampling Methodologies to Network Traffic Characterization [C]. in SIGCOMM, 1993.
[14] I. Cozzani, S. Giordano. A passive test and measurement system: traffic sampling for QoS evaluation [C]. in GLOBECOM, 1998: 1235-1241.
[15] N. G. Duffied, M. Grossglauser. Trajectory Sampling for Direct Traffic Observation [J]. IEEE/ACM Trans on Networking, 2001, vol. 9(3): 280-192.
[16] B.Bloom. Space/Time trade-offs in hash coding with allowable errors [J].Communications of the ACM, 1970, vol. 13(7).
[17] C. Estan, G. Varghese. New directions in traffic measurement and accounting [C]. in in Proc. of ACM SIGCOMM, 2002.
[18] T. Mori, M. Uchida, R. Kawahara. Identifying Elephant Flows Through Periodically Sampled Packets [C]. in Proc. of IEEE IMC, 2004.
[19] N.Duffield, C. Lund, M.Thorup. Estimating flow distributions from sampled flow statistics [C]. in Proc. of ACM SIGCOMM, 2003.
[20] C. Estan, G. Varghese, M Fisk. Bitmap algorithms for counting active flows on high speed links [R]: UCSD, 2003.
[21] A. Kumar, M. Sungm. Data streaming algorithms for efficient and accurate estimation of flow size distribution [C]. in Proc. of ACM SIGMETRICS, 2004.
[22]杨策,张永智,庞正社.网络流量监测技术及性能分析[J].空军工程大学学报, 2003, vol. 4(3): 22~26.
[23] G.Cormode, S.Muthukrishnan. An improved data stream summary: the count-min sketch and its applications [J]. Journal of Algorithms, 2004.
[24]金澈清,钱卫宁,周傲英.数据流分析与管理综述[J].软件学报, 2004, vol. 15(8).
[25] G. Cormode, S. Muthukrishnan. What’s new: Finding significant differences in network data streams [C]. in Proc. of IEEE Infocom, 2004.
[26] M. Charikar, K. Chen, M. Farach-Colton. Finding frequent items in data streams [C]. in Proceedings of Symposium on Principles of Database System (PODS), 2002: 1-16.
[27] Kyoungwon Suh, Yang Guo, Jim Kurose, et al. Locating Network Monitors: Complexity, Heuristics, and Coverage [C]. in Proc. of IEEE INFOCOM, 2005.
[28] S. Khuller, A. Moss, J. Naor. The budgeted maximum coverage problem [J]. Information Processing Letters, 1999, vol. 7(1): 39-45.
[29] Slavik. Improved performance of the greedy algorithm for the minimum set cover and minimum partial cover problems [J]. Electronic Colloquium on Computational Complexity, 1995, vol. 2(53).
[30] F. Chudak, D. Shmoys. Improved approximation algorithms for the uncapacitated facility location problems [J]. ACM SIAM Journal on Computing, 2003, vol. 33(1): 1-25.
[31] Zhiping Cai, Jianping Yin, Xianghui Liu, et al. An Approximation Algorithm for Weak Vertex Cover Problem in Network Management [C]. in Proc. of IEEE AAIM, 2005.
[32] K.Kar, M.Kodialam, T.V. Lakshman. Minimum Interference Routing of Bandwidth Guaranteed Tunnels with MPLS Traffic Engineering Applications [J]. IEEE Journal on Selected Areas in Communications, 2000, vol. 18(12): 2566-2579.
[33] M. Kodialam, T. V. Lakshman. Minimum Interference Routing with Applications to MPLS Traffic Engineering [C]. in Proc. of IEEE INFOCOM, 2000: 884-893.
[34] Iliadis Ilias, Bauer Daniel. A new class of online minimum-interference routing algorithms [C]. in International IFIP-TC6 Networking Conference, 2002: 959-971.
[35] Sun Fangting, Shayman Mark. Minimum Interference Algorithm for Integrated Topology Control and Routing in Wireless Optical Backbone Networks [C]. in International Conference on Communications, 2004: 4232-4237.
[36]郑志梅,崔勇. MPLS流量工程最小干扰选路算法研究[J].软件学报, 2006, vol. 17(4): 814-821.
[37] Sa-Ngiamsak Wisitsak, Varakulsiripunth Ruttikorn. A Bandwidth-Based Constraint Routing Algorithm for Multi-Protocol LabelSwitching Networks [C]. in International Conference on Advanced Communication Technology. Phoenix Park, Korea, 2004: 933-937.
[38]孟兆炜.面向流量工程优化的约束路由算法研究[D]湖南长沙,国防科学技术大学, 2007.
[39]赵锋,朱培栋,刘亚萍, et al.割边链路故障对网络流量的影响[J].计算机工程与科学, 2008, vol. 30(4): 13-15.
[40] Bernard Fortz, Mikkel Thorup. Optimizing OSPF/IS-IS Weights in a Changing World [J]. IEEE Selected Areas in Communications, 2002, vol. 20(4): 756-767.
[41] I Juva, S Vaton, J Virtamo. Quick traffic matrix estimation based on link count covariances [C]. in In: Proc. of the IEEE Int'l Conf. on Communications (ICC) ,In:Eager DL, Williamson CL, Borst SC, Lui JCS, eds. Proc. of the ACM SIGMETRICS. Istanbul: IEEE Communications Society ,Banff: ACM Press, 2006,2005: 603-608,350-361.
[42] Zhao Q, Ge Z, Wang J. Robust traffic matrix estimation with imperfect information [J]. ACM SIGMETRICS Performance Evaluation Review, 2006, vol. 34(1): 133~144.
[43]刘紫千,陈常嘉.基于流量矩阵估计的路由推断算法[J].铁道学报, 2005, vol. 27(6): 66-70.
[44] T Hong, LF Tong, GZ Guo. An assignment model on traffic matrix estimation [C]. in Proc. of the Int’l Conf. on Natural Computation (ICNC 2006). xi'an: Springer-Verlag, 2006.: 295-304.
[45] Medina A., Taft N., Salamatian K., et al. Traffic matrix estimation: Existing techniques and new directions. [C]. in Proceedings of ACM SIGCOMM, 2002: 161-174.
[46]周静静,杨家海,杨扬, et al.流量矩阵估算的研究进展[J].软件学报, 2007, vol. 18(11): 2669?2681.
[47] M Roughan, M Thorup, Y Zhang. Traffic engineering with estimated traffic matrices [C]. in Proc. of the ACM SIGCOMM Internet Measurement Conf. (IMC). San Diego: ACM Press, 2003: 248-258.
[48] R Teixeira, S Agarwal, J Rexford. BGP routing changes: Merging views from two ISPs [J]. ACM SIGCOMM Computer Communication Review, 2005, vol. 35(3): 79-82.
[49] K.Papagiannaki, N.Taft, A.Lakhina. A distributed approach to measure IP traffic matrices [C]. in Proc. of the ACM SIGCOMM Internet Measurement Conf. (IMC). Taormina: ACM Press, 2004: 161-174.
[50] G Liang, N Taft, B Yu. A fast lightweight approach to origin-destination IP traffic estimation using partial measurements [J]. IEEE/ACM Trans. on Networking (TON), 2006, vol. 14(S1): 2634-2648.
[51] Steve Uhlig, Olivier Bonaventure, Vincent Magnin, et al. Implications of the Topological Properties of Internet Traffic on Traffic Engineering [C]. in Proc. of ACM SAC, 2004.
[52] Y.Zhang, Z.Ge. Finding critical traffic matrices [C]. in Proc. of the 2005 Int’l Conf. on Dependable Systems and Networks (DSN). Yokohama: IEEE Computer Society, 2005: 188-197.
[53] Cao Z, Wang Z, Zegura E. Performance of hashing-based schemes for Internetload balancing [C]. in Proc. of IEEE INFOCOM. Nokia FB: IEEE Computer and Communications Societies, 2000: 332-341.
[54] L.Kencl, J. Le Boudec. Adaptive load sharing for network processors [C]. in Proc. of IEEE INFOCOM. New York, NY, USA, 2002: 545-554.
[55] G.Dittmann, A.Herkersdorf. Network processor load balancing for high-speed links [C]. in International Symposium on Performance Evaluation of Computer and Telecommunication Systems (SPECTS 2002). San Diego, CA, USA: IEEE, 2002: 727-735.
[56] W. Shi, M. H. MacGregor et al. An Adaptive Load Balancer for Multiprocessor Routers. University of Alberta, Edmonton, AB, T6G 2E8, Canada, 2004.
[57] W. Shi, M. H. MacGregor et al. Load balancing for parallel forwarding [J]. IEEE/ACM Transactions on Networking, 2005, vol. 13(4).
[58] Shaikh, J.Rexford, K.G.Shin. Load-sensitive routing of long-lived IP flows [J]. ACM SIGCOMM Computer Communication Review, October 1999, vol. 29: 215-226.
[59] Widmer J, Denda R, Mauve M. A Survey on TCP-friendly Congestion Control [J]. IEEE Network, 2001, vol. 15(3): 28-37.
[60]高文宇,王建新,陈松乔. PFED:一种基于预测的公平的主动队列管理算法[J].计算机研究与发展, 2006(02).
[61]任丰原,林闯,黄小猛, et al.主动队列管理算法的分类器实现[J].电子学报, 2004(11).
[62]吴纯青.面向组播环境的高性能路由器QoS机制研究与实现[D]长沙,国防科学技术大学, 2006.
[63] Floyd S, Fall K. Promoting the Use of End-to-end Congestion Control in the Internet [J]. IEEE/ACM Transactions on Networking, 1999, vol. 7(4): 458-472.
[64]张鹤颖,刘宝宏,窦文华.一种基于速率和队列长度的主动队列管理机制[J].电子学报, 2003(11).
[65] A.Medina, M. Allman, S. Floyd. Measuring the evolution of transport protocols in the Internet [J]. ACM Computer Communication Review, 2005, vol. 35(2): 37-52.
[66] Wang H, Xin H, Reeves D.S. A Simple Refinement of Slow-start of TCPCongestion Control [C]. in Proceedings of the IEEE Symposium on Computers and Communications (ISCC 2000), 2000: 98-105.
[67] L.A. Larzon, M. Degermark, S. Pink. The Lightweight User Datagram Protocol (UDP-Lite). vol. RFC 3828: Internet Engineering Task Force, 2004.
[68] E. Kohler, M. Handley, S. Floyd. Datagram Congestion Control Protocol. vol. RFC 4340: Internet Engineering Task Force, 2006.
[69]王建新,荣亮,肖雪峰.几种主动队列管理算法的仿真及性能评估[J].计算机工程, 2007(3).
[70] S. Floyd, V. Jacobson. Random Early Detection gateways for congestion avoidance [J]. IEEE/ACM Transactions on Networking, 1997, vol. 1(4).
[71] Floyd S, Gummadi R, Shenker S. Adaptive RED: An algorithm for increasing the robustness of RED's active queue management [R], 2001.
[72] J. Aweya, M. Ouellette, D. Y. Montuno, et al. A control theoretic approach to active queue management [J]. Computer Networks, 2001, vol. 36: 203-235.
[73]崔勇,吴建平,徐恪.互联网络服务质量路由算法研究综述[J].软件学报, 2002, vol. 13(11): 2065-2075.
[74]闵应骅.计算机网络路由研究综述[J].计算机学报, 2003, vol. 26(6).
[75] B Fortz, M Thorup. Internet traffic engineering by optimizing OSPF weights [C]. in Proc. of the IEEE INFOCOM. Tel-Aviv: IEEE, 2000: 519-528.
[76] D. Awduche. MPLS and traffic engineering in IP networks [J]. IEEE Communications Magazine, 1999, vol. 37(12): 42-47.
[77] L. Subramanian, S. Agarwal, J. Rexford. Characterizing the Internet hierarchy from multiple vantage points [C]. in Proc. of IEEE INFOCOM, 2002.
[78] G.Apostolopoulos, D.Williams, S.Kamat. QoS Routing Mechansim and OSPF Extensions. vol. RFC2676: Internet Engineering Task Force, 1999.
[79] A. Elwalid. MATE :MPLS Adaptive Traffic Engineering [C]. in INFOCOM: IEEE, 2001.
[80] Srikanth Kandula, Dina Katabi. TeXCP: Responsive Yet Stable Traffic Engineering [C]. in Proc. of ACM SIGCOMM: ACM, 2005.
[81] C. Zhang, Y. Liu, W. Gong, et al. On optimal routing with multiple traffic matrices [C]. in Proc. of IEEE INFOCOM 2005.
[82] C. Zhang, Z. Ge, J. Kurose, et al. Optimal routing with multiple traffic matrices:Tradeoff between average case and worst case performance [C]. in 13th International Conference on Network Protocols 2005.
[83] D.Applegate, L.Breslau, E.Cohen. Coping with network failures: Routing strategies for optimal demand oblivious restoration [C]. in Joint International Conference on Measurement and Modeling of Computer Systems(SIGMETRICS), 2004.
[84] M. Kodialam, T. V. Lakshman, S. Sengupta. Efficient and robust routing of highly variable traffic [C]. in Third Workshop on Hot Topics in Networks (HotNets-III), 2004.
[85] Hao Wang, Haiyong Xie, Lili Qiu. COPE: Traffic Engineering in Dynamic Networks [C]. in Proc. of ACM SIGCOMM, 2006.
[86] Albert Greenberg, Gisli Hjalmtysson, David A. Maltz. A Clean Slate 4D Approach to Network Control and Management [J]. ACM SIGCOMM Computer Communication Review, 2005, vol. 35(5).
[87] Albert Greenberg, Gisli Hjalmtysson, David A. Maltz. Refactoring Network Control and Management:A Case for the 4D Architecture. CMU, 2005.
[88] Ashok Anand, Archit Gupta, Aditya Akella. Packet Caches on Routers: The Implications of Universal Redundant Traffic Elimination [C]. in Proc. of ACM SIGCOMM, 2008: 219-230.
[89] Murtaza Motiwala, Megan Elmore, Nick Feamster, et al. Path Splicing [C]. in Proc. of ACM SIGCOMM, 2008: 27-38.
[90] Maxim Podlesny, Sergey Gorinsky. RD Network Services:Differentiation through Performance Incentives [C]. in Proc. of ACM SIGCOMM, 2008: 255-266.
[91] Richard Alimi, Ye Wang, Y.Richard Yang. Shadow Configuration as a Network Management Primitive [C]. in Proc. of ACM SIGCOMM, 2008: 111-122.
[92] Franck Le, Geoffrey G. Xie, Dan Pei, et al. Shedding Light on the Glue Logic of the Internet Routing Architecture [C]. in Proc. of ACM SIGCOMM, 2008: 39-50.
[93] Yinglian Xie, Fang Yu, Kannan Achan, et al. Spamming Botnets: Signatures and Characteristics [C]. in Proc. of ACM SIGCOMM, 2008: 171-182.
[94] Kirill Levchenko, Geoffrey M. Voelker, Ramamohan Paturi, et al. XL: An Efficient Network Routing Algorithm [C]. in Proc. of ACM SIGCOMM, 2008: 15-26.
[95] P. Barford, D. Plonka. Characteristics of Network Traffic Flow Anomalies [C]. in Proceedings of ACMSIGCOMM Intemet Measurement Workshop (IMW), 2001.
[96] J. Brutlag. Aberrant behavior detection in time series for network monitoring [J]. USENIX LISA, 2000.
[97] L. Feinstein, D. Schnackenberg, R. Balupari, et al. Statistical Approaches to DDoS Attack Detection and Response [C]. in DARPA Information Survivability Conference and Exposition, 2003: 303-314.
[98] R. S. Boyer, J. S. Moore. A fast string matching algorithm [J]. Communication, 1977, vol. 20(10): 762-772.
[99]陈曙晖.基于内容分析的高速网络协议识别技术研究[D],国防科学技术大学, 2007.
[100] Do M. N., Vetterli M.C. Beyond Wavelets. W. G. V, Ed.: Academic Press, 2003.
[101] A.Lakhina, M.Crovella, C.Diot. Mining Anomalies Using Traffic Feature Distributions [C]. in Proc. of ACM SIGCOMM. USA, 2005.
[102] A.Lakhina, M.Crovella, C.Diot. Diagnosing Network-Wide Traffic Anomalies [C]. in ACM SIGCOMM. Portland, 2004.
[103] M.S. Kim, H.J. Kang, S.C. Hung, et al. A Flow-based Method for Abnormal Network Traffic Detection [C]. in IEEE/IFIP Network Operations and Management Symposium. Seoul, 2004.
[104] S. Kim, A. L. N. Reddy. A Study of Analyzing Network Traffic as Images in Real-Time [C]. in Proc. of IEEE INFOCOM, 2005.
[105] S.S Keerthi, C.J.Lin. Asymptotic behaviors of support vector machines with Gaussian Kernel [J]. Neural Computation, 2003, vol. 15(7).
[106] N.Ye, V.Sean, Q.Chen. Computer intrusion detection through EWMA for auto correlated and uncorrelated data [J]. IEEE Transactions on Reliability, 2003, vol. 52: 75-82.
[107] Chatfield, Yar. Holt-Winters forecasting: some practical issues [M]: The Statistician, 1988.
[108] V.Alarcon-Aquio, J.A.Barria. Anomaly detection in communication network using wavelets [C]. in Proceedings of IEEE Communication, 2001.
[109]饶鲜,董春曦,杨绍全.基于支持向量机的入侵检测系统[J].软件学报, 2003, vol. 14(4).
[110] Thottan M., Ji C. Fault Prodiction at the network layer using intelligent agents [C]. in IEEE/IFIP Integrated Network Management VI, 1999.
[111] Roy, A. Maxion, Frank E. Feather. A Case Study of Ethernet Anomalies in a Distributed Computing Environment [J]. IEEE Transaction on Reliability, 1990, vol. 39(4): 433-443.
[112]程光,龚检,丁伟.基于抽样测量的高速网络实时检测模型[J].软件学报, 2003, vol. 14(3): 594-599.
[113]陈光英,张千里,李星.基于SVM分类机的入侵检测系统[J].软件学报, 2002, vol. 23(5).
[114]单征,刘铁铭,楚蓓蓓.基于网络状态的入侵检测模型[J].信息工程大学学报, 2002, vol. 3(3).
[115] GONG Jian, PENG Yan-Bing, WANG Yang, et al. Reconstructing the Parameter for Massive Abnormal TCP Connections with Bloom Filter [J]. Journal of Software, 2006, vol. 17(3).
[116]王海龙.大规模网络流量异常分析[D]湖南长沙:,国防科技大学, 2006.
[117]陈训逊,方滨兴,李蕾.高速网络环境下入侵检测系统结构研究[J].计算机研究与发展, 2004, vol. 9(41): 1481-1487.
[118]张健,陈松乔.一种基于最大熵原理系统异常检测模型研究[J].小型微型计算机系统, 2007, vol. 20(04).
[119] David G. Andersen. Accountable Internet Protocol (AIP) [C]. in Proc. of ACM SIGCOMM, 2008: 339-350.
[120] Randy Smith, Cristian Estan, Somesh Jha, et al. Deflating the Big Bang: Fast and Scalable Deep Packet Inspection with Extended Finite Automata [C]. in Proc. of ACM SIGCOMM, 2008: 207-218.
[121] Xin Liu, Xiaowei Yang, Yanbin Lu. To Filter or to Authorize: Network-Layer DoS Defense Against Multimillion-node Botnets [C]. in Proc. of ACM SIGCOMM, 2008: 195-206.
[122]孙红杰,方滨兴,张宏莉.基于链路特征的DDoS攻击检测方法[J].通信学报, 2007, vol. 28(2).
[123]程光,龚检,丁伟.大规模网络流量行为累加分解研究[J].计算机工程与科学, 2002, vol. 24(5): 53-56.
[124]程光,龚检.大规模网络流量宏观行为周期性分析研究[J].小型微型计算机系统, 2003, vol. 24(6): 991-994.
[125] A.Lakhina, K.Papagiannaki, M.Crovella, et al. Structural Analysis of Network Traffic Flows [C]. in Proc. of ACM SIGMETRICS. New York, 2004.
[126]郑军,胡铭曾,云晓春, et al.基于数据流方法的大规模网络异常发现[J].通信学报, 2006, vol. 27(2): 1-8.
[127] Anukool Lakhina, Mark Crovella, Christophe Diot. Characterization of Network-Wide Anomalies in Traffic Flows [C]. in Proc. of IEEE IMC. Taormina, Sicily, Italy, 2004: 25-27.
[128]吴桦,丁伟.基于奇异谱方法的网络行为分析[J].东南大学学报(自然科学版), 2002, vol. 32(6): 1-6.
[129] B. Ryu, A. Elwalid. The importance of long-range dependence of VBR video traffic in ATM traffic engineering: myths and realities [C]. in Proc. of ACM SIGCOMM, 1996: 3-14.
[130] M. Grossglauser, J. C. Bolot. On the relevance of long-range dependence in network traffic [C]. in Proc. of SIGCOMM, 1996.
[131] R.H.Riedi, M.S.Crouse, V.J.Ribeiro. A Multifractal Wavelet Model with Application to Network Traffic [J]. IEEE Transactions on Information Theory, 1999, vol. 45(3).
[132] P. Mannersalo, l. Norros. Multifractal analysis of real ATM traffic: A first look [J]. VTT Information Technology, 1997.
[133] S.Kalidindi, M.J.Zekauskas. Surveyor: an infrastructure for Internet performance measurements [C]. in Proceedings of the INET’99. San Jose, 1999.
[134] B. Krishnamurthy, S. Sen. Sketch-based change detection: methods, evaluation, and applications [C]. in Proc. of ACM SIGCOMM IMC, 2003.
[135] W. Fang, L. Peterson9. Inter-as traffic patterns and their implications [C]. in In Proceedings of IEEE GLOBECOM, 1999.
[136]蔡志平,殷建平,刘湘辉.延迟约束的分布式演化网络监测模型[J].软件学报, 2006, vol. 17(1): 117-123.
[137]刘亚萍,龚正虎,朱培栋. BGP最优路径选择中的瓶颈区域的研究[J].软件学报, 2005, vol. 16(5): 946-959.
[138] J. E. Jackson. A User’s Guide to Principal Components [M]. New York, 1991.
[139] TOTEM Project Toolbox for Traffic Engineering Methods, http://totem.run.montefiore.ulg.ac.be/download.html,2005.
[140] A. Daniel, Spielman, Shang-Hua Teng. Spectral Partitioning Works: Planar Graphs and Finite Element Meshes [C]. in IEEE Symposium on Foundations of Computer Science, 1996: 96-105.
[141] T Munzner. Interactive visualization of large graphs and networks [Ph.D. Thesis] [D], Stanford University, 2000.
[142] Abilene Backbone Network.http://abilene.internet2.edu/.
[143] Ben-Nain Arich. Entropy Demystified [M]: World Scientific, 2007.
[144]林亚平,王雷,陈宇等.基于最大熵的隐马尔可夫文本信息抽取[J].电子学报, 2005, vol. 33(2): 236-240.
[145] B.Fortz, M.Thorup. Robust optimization of OSPF/IS-IS weights [C]. in Proc. of International Network Optimization Conference, 2003: 225-230.
[146] R Teixeira, A Shaikh, T Griffin, et al. Dynamics of hot-potato routing in IP networks [C]. in Proc. of the ACM SIGMETRICS. New York: ACM Press, 2004: 307-319.
[147] Barry Raveendran Greene, Philip Smith. Cisco ISP必备手册[M]:人民邮电出版社, 2002.
[148] A. Feldmann, A. Greenberg, C. Lund, et al. Deriving traffic demands for operational IP networks methodology and experience [J]. IEEE/ACM Transactions on Networking, 2001, vol. 9(3): 265-279.
[149] Riikka Susitaival, Samuli Aalto. Adaptive load balancing with OSPF [C]. in Proceedings of the Second International Working Conference on Performance Modelling and Evaluation of Heterogeneous Networks (HETNETs 2004), 2004: 1-10.
[150] J. Le Boudec L. Kencl. Adaptive load sharing for network processors [C]. in INFOCOM 2002. New York, NY, USA, 2002: 545-554.
[151]陈一骄.网络入侵检测系统高速处理技术研究[D]长沙,国防科学技术大学, 2007.
[152]程光,龚俭,丁伟, et al.面向IP流测量的哈希算法研究[J].软件学报, 2005,vol. 16(5): 652-658.
[153]龚俭,彭艳兵,杨望.基于Bloom Filter的大规模异常TCP连接参数再现方法[J].软件学报, 2006, vol. 17(3).
[154]林青家.基于小波的网络流量的特性刻画与模型建立[D],山东大学, 2007.
[155]林兆启,林南晖,汪继东.校园网网络流量自相似性的测定[J].计算机工程与科学, 2008, vol. 30(6): 29-32.