计算机工程与应用 ›› 2022, Vol. 58 ›› Issue (3): 159-164.DOI: 10.3778/j.issn.1002-8331.2008-0206

• 网络、通信与安全 • 上一篇    下一篇

基于自适应阈值的大象流检测方法

刘奕,李建华,陈玉   

  1. 1.空军工程大学 信息与导航学院,西安 710077
    2.空军工程大学 研究生院,西安 710038
  • 出版日期:2022-02-01 发布日期:2022-01-28

Elephant Flow Detection Method Based on Adaptive Threshold

LIU Yi, LI Jianhua, CHEN Yu   

  1. 1.College of Information and Navigation, Air Force Engineering University, Xi’an 710077, China
    2.Graduate College, Air Force Engineering University, Xi’an 710038, China
  • Online:2022-02-01 Published:2022-01-28

摘要: 针对数据中心网络异常流量检测难的问题,提出一种自适应阈值的大象流检测系统。系统结合数据中心网络高度灵活性和全局可见性的特点,采用基于高斯分布的加权优化动态流量学习方法实时预测大象流检测阈值,降低检测错误率,通过基于差分估计的平滑机制,降低检测阈值配置更新频率。仿真实验结果表明,该系统可以有效识别数据中心网络中的大小流,识别错误率较低,通过平滑机制处理减少了流表抖动,控制平面的开销和检测时延相对较低,实现了数据中心网络流量的实时有效监控。

关键词: 数据中心, 大象流检测, 动态流量学习, 平滑机制

Abstract: Aiming at the difficulty in detecting abnormal traffic in data center networks, an adaptive threshold elephant flow detection system is proposed. The system combines the flexibility and global visibility of data center network. The system uses the weighted optimized dynamic traffic learning method based on Gaussian distribution to predict the detection threshold of elephant flow in real time. It can reduce the detection error rate. The detection threshold update frequency is reduced through a smoothing mechanism based on difference estimation. Experimental results show that the system can effectively identify large and small flow in the data center network, and the recognition error rate is low. The smoothing mechanism reduces the flow table jitter, the control plane overhead and detection delay are relatively low, and real-time effective monitoring of data center network traffic is realized.

Key words: data center, elephant flow detection, dynamic flow learning, smoothing mechanism