Key Technology Research In Network Flow Analysis

In recent years, Internet has progressed a lot under the background that the scale ofnetworking connection keeping increasing, the number of users keeping growing, thespeed and volume of network is improving and different services are released to public.The profit of Internet is also increasing dramatically due to the flourishing of Internetmarket. It also brings the exponential growth of data traffic of Internet and traditionalInternet.By analyzing the flow characteristics can master the health of the network, providesufficient suggest to network planning, flow control, network management. By statisticing network flow can proving accurate billing for the users which uses the network.Therefore, collecting network traffic and analyzing flow data are crucial important innetwork management. This thesis has studied network traffic collection and trafficclassification technologies, the main work of this thesis reflected in the following fouraspects:(1). On the basis of analysing the traffic data collection technology and itsprinciples, the Traffic Measurement Development Kit (TMDK) based on Libpcap isproposed. IDCFlow traffic collection system is developed in the prototype of TMDK,kernel algorithms is encapsulated into kernel mode of the operating system. theprocessing capacity of the system is improved by programming in kernel mode,zero-copy technology and planning threads reasonably to achieve large scale real-timetraffic collection.(2). In order to analyze the communications and ensure the consistency of thecontext, the collecting packets need to implement flow track. On the basis of researchand verify the locality of traffic, the flow tracking algorithm-Dynamic Hash Table(DHT) is proposed. By setting secondary link list for the nodes with high conflict rates,the Hash conflict is reduced and the performance of the traditional Hash algorithm isimproved.(3). The existing packet classification algorithms and its evaluation criteria arestudied. This thesis focuses on the disadvantages of the HiCuts algorithm in the process of constructing decision trees. N-HiCuts classification algorithm based on non-uniformcutting is proposed aimed at the shortcomings of HiCuts. Algorithm complexity andperformance analysis show that the algorithm performance has been optimized(4). IDCFlow traffic collection system is designed and developped. Systemarchitecture, disposition scheme and overall design are introduced. The key modulesnetwork flow collection, traffic tracking and traffic classification are described in detail.The system is tested in UESTC campus network environment, system testing shows thatthe system could achieve real-time large-scale flow collection and analysis it very well.