以Netflow 技術發展網際網路資料分析方法

A Study of Internet Traffic Analysis using Netflow

林智清(Jyh-ching Lin)

指導教授 ： 蔡義昌 ； 劉士豪

中原大學/商學院/資訊管理研究所/碩士(2003年)

https://doi.org/10.6840/cycu200300734

摘要

中文摘要

本研究透過以思科路由器之網路資訊流(Netflow)做為網際網路訊務資料分析的一種方式，並以建立系統雛型法(System Prototyping)的方式，於實際的網際網路環境中收集網路的存取資訊。我們產用Perl 將Netflow 資料收集並轉存於關連式資料庫中，同時利用分析模組將欲分析的統計資料（如Top-N, Protocol Distribution… etc），或使用模式（Access Pattern）或來偵測異常的連線模式（如Network Abuse，Virus Attack…etc）。
本篇研究最主要的貢獻在：提出一個經實際驗証的系統雛型，足已承受及提供大量網路流量分析，以供找出網路主要的使用模式並偵測異常狀況。本研究結果將有助於區域網路的管理和提高使用區域網路服務之使用者滿意度。

關鍵字

網路流 ； 流量分析

並列摘要

Abstract

This study focuses on analysis Internet Traffic using Netflow technology, which is proposed by CISCO®. We developed a prototyping system and deployed it in an ISP environment to collect the Netflow data from the edge router of the ISP networks. We use PERL to develop the collector module to receive the flow record, and transform the data into relational database. Also, we developed various modules for generating statistically report (eg. Top-N reports, Protocol distribution reports… etc); or generating access pattern report to analysis and alarm any network resource abuse or any kind of virus attack.
The major contributions of this study are on providing an methodology and prototyping system which is alive in heaving traffic volume ISP network environment; and using this system to analysis the access patterm and detect network alarm. The results can be used for better managing regional network in order to improve user satification in using regional network netwrok services

並列關鍵字

traffic analysis ； netflow

參考文獻

1. C Estan, G Varghese, “New Directions in Traffic Measurement and Accounting”, ACM SIGCOMM Internet Measurement Workshop 2001

2. C. Hood and C. Ji, “Proactive network fault detection,” in Proceedings of IEEE INFOCOM ’97, Kobe, Japan, April 1997.

6. F. Feather, D. Siewiorek, and R. Maxion, “Fault detection in an ethernet network using anomaly signature matching,” in Proceedings of ACM SIGCOMM ’93, San Francisco, CA, September 2000.

7. Feldmann et al. “Deriving traffic demands for operation IP networks: Methodology and experience” , ACM SIGMOD, June 1998

8. Katzela and M. Schwartz, “Schemes for fault identificaiton in communicaitons networks,” IEEE/ACM Transactions on Networking, vol. 3(6), pp. 753–764, December 1995.