Research On Algorithms For Measuring Persistent Spreads Based On Bloom Filter

The persistent spread of a destination host is the number of distinct sources that have contracted it persistently in predefined t measurement periods.With the rapid development of internet,incidents of security occurring frequently make people realize the importance of network measurement in network security.Nowadays,there are so many long-term stealthy malicious activities in the network.For example,the stealthy DDOS attacks,whose objective is not to overwhelm the target,but to use a small number of attacking machines to degrade its performance.The problem of detecting these long-term stealthy malicious activities or attacks can be viewed as a kind of detection of persistent spreads.So detection of persistent spreads is essential in network security.The algorithms for measuring host cardinalities have encountered many challenging problems.This paper analyzes the advantages and disadvantages of existing algorithms and presents new algorithms for measuring persistent spreads based on bloom filter.The algorithm consists of two modules on-line updating module and off-line operation module.Also,on-line updating module includes flow filter module and packet updating module.Flow filter module is the core module in this paper,which is used to filter out flows.Flow filter module filters out non-persistent hosts which occur in t-1 measurement periods.In the process of packet updating and off-line operation,to count persistent spreads we use three different methods linked-list,VCDS and CSE,respectively.In experiments,two different traces collected from real networks are used.We compare our algorithm with the related algorithm for detecting persistent spreads.The experimental results indicate that our algorithm can detect the persistent spreads precisely by using small memory space.