Flow-based網路流量分類技術的可行性之研究

A Study of Applicability of Flow-based Internet Traffic Classification

曾祥信(Hsiang-Hsin Tseng)

指導教授 ： 逄愛君

國立臺灣大學/電機資訊學院/資訊工程學研究所/碩士(2010年)

https://doi.org/10.6342/NTU.2010.00064

摘要

依照應用程式的種類來對 IP 流量進行分類，可說是所有先進網路管理平台必備的功能之一。然而，在過去十年間，由於許多應用程式開始使用各種巧妙的方法去避免輕易地被辨識出來，使得流量分類這項工作逐漸變成一個挑戰。在這種情況下，傳統的分類技術諸如 port-based 偵測機制很快地就失去效用。同時間，許多知名的研究團體陸續針對流量分類這個議題發表了一些有趣的論文，並提出各種不同性質的分類機制。其中不少分類方法在研究實驗裡展現出相當優異的表現。然而，我們認為現實的網路環境中存在一些因素，極可能會影響這些分類技術的表現。

在這篇論文裡，我們實作出一個 flow-based 的 Internet 流量分類器，並利用真實的網路流量進行實驗，以測量此分類器的效能表現。雖然我們的分類方法是立基於前人的理論，不過我們的貢獻在於分析 flow-based 分類技術在真實網路環境下的可行性，根據我們的實驗、觀察及分析結果，可獲得對於此種分類技術更為深刻的洞察。我們的實驗結果展現出在真實世界中採用 flow-based 分類技術時的一些問題，其中有些問題可透過我們提出的機制予以解決，有些則需要更進一步的研究分析。此外，我們的研究也呈現出真實網路中常用的流量採樣（flow sampling）機制對於流量分類技術的影響。我們的結果顯示，flow-based 流量分類技術的有效性只侷限在一定範圍的採樣區間（sampling interval）之內。

關鍵字

流量分類 ； 主機行為 ； 傳輸層 ； 演算法 ； 流量採樣

並列摘要

The classification of IP flows according to the applications that generated them is at the basis of any modern network management platform. It has become a challenge in the last decade since many applications use tricky ways to avoid being easily recognized. Classical techniques such as port-based detection are rapidly becoming ineffective. Many reputable research groups have published several interesting papers on traffic classification, proposing mechanisms of different nature. However, it is our opinion that some factors in real-world network environments would affect the effectiveness of these classification mechanisms.

In this paper we implement a flow-based Internet traffic classifier and conduct an experiment to measure its performance dealing with real-world data traces. Even though the classification method is based on the work in the past, our contribution is to provide insights into flow-based traffic classification technique and to analyze the applicability of it. Our results expose several real-world issues while applying flow-based classification; some can be resolved by the mechanisms we propose, and some still need to be researched in further work. We also present the impact of flow sampling to the technique. Our results show that the effectiveness of flow-based traffic classification is limited in a certain range of sampling intervals.

並列關鍵字

Traffic classification ； NetFlow ； host behavior ； transport layer ； algorithms ； flow sampling

參考文獻

[6] Felix Hernandez-campos, F. Donelson Smith, Kevin JeRay, and Andrew B. Nobel. Statistical clustering of internet communication patterns. 2003.

[10] Andrew W. Moore and Konstantina Papagiannaki. Toward the accurate identification of network applications. In Passive and Active Measurement Conference (PAM). PAM, 2005.

[14] Subhabrata Sen, Oliver Spatscheck, and Dongmei Wang. Accurate, scalable in-network identification of p2p traffic using application signatures. In International World Wide Web Conference, pages 512-521. ACM New York, NY, USA, 2004.

[1] Cisco Corporation. Cisco ios flexible netflow.

http://www.cisco.com/en/US/prod/collateral/iosswrel/ps6537/ps6555/ps6601/ps6965/product data sheet0900aecd804b590b.html.