基于CBF流抽样的网络安全

现有网络中常存在DDOS、恶意端口及IP扫描、蠕虫等异常产生大量的只包含1个数据包的流量.针对高速网络流量特点及网络异常导致的流量突然上升,提出了一种改进的基于CBF的流抽样算法.该算法对定长时间内到达的数据包进行固定数量的抽样,使抽样率能适应于流量变化,并可控制资源的消耗,尤其当泛洪攻击、DDOS攻击等导致大规模异常网络流量出现时,能有效保护路由器的处理器和内存资源以及传输流记录所需的带宽资源,同时又不失简单性和准确性.

Research on Network Security Based on CBF flow Sampling

Today's traffic mixes often include massive denial of service attacks or aggressive port and IP scans that generate a large number of "flows"consisting of a single small packet.Considering the characteristic of high-speed network and the sudden rise of traffic caused by attacks,a novel flow sampling method based on Counting Bloom Filter is devised.It samples a fixed number of packets in a constant period,adapts sampling rate to traffic variety and provides the controllability of resource consumption.Especially,when flooding attacks,distributed denial of service attacks that cause large-scale anomaly traffic,it can efficiently protect router's processor and memory resources,and network bandwidth consumed by flow records,without sacrificing simplicity and accuracy.