عنوان مقاله
یک استراتژی تایم اوت تطبیقی برای ساخت پروفایل یا نمایه سازی جریانات UDP
فهرست مطالب
مقدمه
کارهای مرتبط
ویژگی های جریانات UDP
استراتژی تایم اوت تطبیقی
نتایج آزمایش و تحلیل
نتیجه گیری
بخشی از مقاله
ارزش تایم اوت اولیه جریان، ماکزیمم یا حداکثر تعیین شده و این مقدار زمانی کاهش می یابد که برون دهی جریان در طول دوره مشاهده جریان از حد آستانه تجاوز کند. اما مشکلات ذاتی نیز در این استراتژی وجود دارد. اولاً،به محض کاهش ارزش تایم اوت، هیچ گاه مجدداً افزایش نمی یابد. ثانیاً، انتخاب پارامترها بر صحت اندازه گیری اثر می گذارد. تعیین و تنظیم پارامترهای نامناسب به نتایج اندازه گیری نامطلوبی منجر می گردد و با نتیجه حقیقی اختلاف زیادی دارد.
کلمات کلیدی:
An Adaptive Timeout Strategy for Profiling UDP Flows 123Jing Cai 13Zhibin Zhang 13Peng Zhang 13Xinbo Song 1Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China 2Graduate University of Chinese Academy of Sciences, Beijing, China 3National Engineering Laboratory for Information Security, Beijing, China caijing@software.ict.ac.cn Abstract—With the increase of network bandwidth, more and more new applications such as audio, video and online games have become the main body in network traffic. Based on realtime considerations, these new applications mostly use UDP as transport layer protocol, which directly increase UDP traffic. However, traditional studies believe that TCP dominates the Internet traffic and previous traffic measurements were generally based on it while UDP was ignored. In view of this, we mainly discuss the adaptive timeout strategy of UDP flows in this paper. Firstly, due to its dynamism of packets inter-arrival times, we expound and prove that the existing adaptive timeout strategies are not appropriate for UDP flows. Secondly, we present our adaptive strategy using Support Vector Machine techniques. We build six classifiers to accurately predict its corresponding maximum packet inter-arrival time and adapt its timeout value within the flow duration. Limited to its accurate rating, we present another concept of adjust accuracy rating which can probability-guaranteed(90%,95%,98%) to avoid long flow to be cut into short flows. The experiment result reveals that our adaptive strategy has the potential to achieve significant performance advantages over other widely used fixed and other adaptive timeout schemes. I. INTRODUCTION The main purpose of the network traffic measurement is to enhance people’s awareness about traffic characteristics. The traffic measurement that works based on the network layer started from the 1980s. Earlier studies took the packet as the Building Block. But due to its small granularity, it could not meet the needs in many ways. Claffy et al.[1][2] firstly proposed a parameters flow model. The network measurement based on flows can make up the lack of the study based on packets. And in this paper, we formally define a UDP flow to be bidirectional. It is consist of a set of packets with the same 5-tuple {source address, destination address, source port, destination port, transport layer protocol}, and its packet interarrival time does not exceed the fixed timeout 64s. The traffic measurement based on flows have always been a hot issue. However, in the past, during the process of network traffic measurement, people generally believed that TCP traffic occupied the main body of the network traffic, and UDP traffic is negligible, and therefore ignored the measurements of the UDP flows. However, the situation has undergone tremendous changes at present. With the increase of network bandwidth, the traditional networking services based on images and text could no longer satisfy people’s needs. More and more audio, video, and online games, have gradually become the main body of the network traffic. These applications mostly use UDP as their transport layer protocol[3], which directly results in the increase of UDP traffic. The organization of CAIDA[4] analyzed the trace collected in the period 2002-2009 on several backbone links located in the US and Sweden and found the ratio between the UDP and TCP in packets, bytes, and flows have increased greatly. Since the increase of UDP traffic, more and more people have started to pay attention to the traffic of UDP. However, compared with the TCP, we find there at least exist two big differences. Firstly, TCP is a connection-oriented protocol, it has controlling flags such as FIN and RST to explicitly identify the end of flow. But for UDP, it is a connectionless protocol. The main methodology to terminate udp flow is the timeout strategy. The second, compared with TCP, the composition of UDP is more complicated. The characteristics of different applications often demonstrate significant differences. Therefore, the situation is more complex for UDP. Due to these two great differences, earlier network measurement based on flows mostly focused the TCP flows, while UDP flows was ignored. The study on the UDP flows is nearly in the blank stage. In view of this, we mainly discuss the adaptive timeout strategy of UDP flows in this paper. To the best of our knowledge, we are the first to do so. There are two main contributions in our paper. ∙ Firstly, through the indication of COV, we find the flow rate of UDP flows are more unsteadily. In common sense, if the flow rate is steadily, it can be used to forecast the adaptive timeout value. However, for UDP flows, due to its dynamism of packets inter-arrival times, we can not use the known information to forecast the adaptive timeout value. Therefore, the existing adaptive timeout strategies are not appropriate for UDP flows. ∙ Next, we present our adaptive timeout strategy named MSVM. The key notion behind our strategy is that we use the maximum packet inter-arrival as its timeout value. We divided the whole UDP flows into six classes according to its maximum packet inter-arrival. To accurately predict its corresponding class-id, we used the Support Vector Machine techniques. In our strategy, we train six classifiers and use these classifiers to dynamic adapt its timeout value. Limited to its low accurate rating,
