於NetFPGA實現基於Sketch演算法之網路流量變異偵測系統

The Implementation of Sketch-based network traffic change detection on NetFPGA

林俊廷(Jun-Ting Lin)

指導教授 ： 賴裕昆

中原大學/工學院/電機工程研究所/碩士(2009年)

https://doi.org/10.6840/CYCU.2009.00752

摘要

在網路蓬勃發展的現今，各種影響網路安全的挑戰也接踵而來，在龐大的資料流中對於每一筆封包進行分析往往超出一般網路設備所系統的負荷，簡單的取樣資料概念以機率採取部分資料做分析，卻又容易受取樣資料影響，因此，在檢驗或偵測流量資料有其必要性的前提下，Sketch演算法以隨機過程的概念並採用少量的資源，實現對於每筆封包進行資料蒐集，並在一定準確率下提供資料勘查，本論文之研究乃於NetFPGA發展板，採用可程式化邏輯閘陣列（FPGA）晶片資源設計，以系統線速度(wire speed)達到高速網路之Sketch更新架構，實現由硬體架構完成Sketch演算法之核心部分，同時提供佐軟體運算組成系統。

關鍵字

Sketch ； 變異偵測 ； NetFPGA

並列摘要

Sketch algorithms are widely used in many networking applications due to the excellent properties known to the communities. Motivated by the capability of summarizing the streaming network traffic in a limited computing and storage resources, we explore and implement the sketch update on NetFPGA platform. The thesis presents the analysis and architecture exploration on the NetFPGA with tradeoffs on system resources and performance. The system is verified with live traffic and capable of updating four Gigabit Ethernet traffic at wire-speed.

並列關鍵字

Change Detection ； Sketch ； NetFPGA

參考文獻

[11] Alon, N., Matias, Y., and Szegedy, M. The space complexity of approximating the frequency moments. J. Comput. Syst. Sci. 58, 1 (1999), 137–147.

[12] Apostolico, A., and Giancarlo, R. The boyer-moore-galil string searching strategies revisited. In SIAM Journal on Computing, vol. 15,no. 1, pp. 98-105, Feb.1986.

[13] Barman, D., Satapathy, P., and Ciardo, G. Detecting attacks in routers using sketches. In High Performance Switching and Routing, 2007. HPSR ’07. Workshop on (2007), pp. 1–6.

[15] Bloom, B. H. Space/time trade-trade-off in hash coding with allowable errors.vol. 13, pp. 422–426.

[17] Broder, A., and Mitzenmacher, M. Network applications of bloom filters: A survey, 2003.