Network traffic monitoring system design based on the unconstrained

Transcription

1 Networ traffic monitoring system design based on the unconstrained clustering queuing School of Telecommunications and Information Engineering, Xi'an University of Posts & Telecommunications, Xi an Shaanxi, Abstract Networ traffic monitoring system is an important way to realize networ performance analysis and monitor. This paper puts forward the networ traffic monitoring model based on unconstrained clustering queuing theory. It constructs the networ flow estimation model to effectively monitor and analyze the networ flows which are according to the analysis of the high-flow areas in the networ with unconstrained clustering queuing theory based on the comprehensive generalize on the basis of networ traffic characteristics. The simulation shows the proposed networ traffic monitoring system based on unconstrained clustering queuing theory can effectively control the flow distribution in the networ, ensure the networ flow balance and data validity, improve the efficiency of the networ traffic transmission, and restrain the networ congestion phenomenon. Keywords: Unconstrained Clustering, Queuing Theory, Networ Flow, Monitoring System 1. Introduction With the development of computer networ and Internet technology, the demands for networ resources are increasing. Intrusion detection is extremely beneficial to the supplement of the firewalls. Intrusion Detection System (IDS) can examine the attac before it causes any destruction, and also use the alert and protection system to get rid of the intrusion. In this process, the loss caused by intrusion can be reduced. After the intrusion, related information can be collected for later use as the protection system nowledge. This nowledge can be ept in nowledge library so that this ind of intrusion will no more happen. However, the increasing expansion of the networ scale and the increasing renewal of the intrusion method require Intrusion Detection System with higher quality. Based on the research of IDS developing status and direction at home and abroad, the author discusses the status of the networing security, networ intrusion methods and measures, the importance of networ security and introduced a networ intrusion detection system definition, function and component modules. To effectively monitor the networ flow and ensure the networ data high-speed transmission is current hot research area. The networ flow monitoring system can reasonably plan the networ flow distribution and low the networ communication congestion to increase the efficiency and stability of the networ transmission [1~2]. The traditional monitoring system normally applies port method, depth pacage detection method, flow statistical method and a machine learning method to monitor the networ flows [3~5]. The post method is easy to implement, but it s constrained to statistic port analysis. The depth pacage detection method is based on the distribution situations of the pacage loading in the networ [6~13]. However, this method can t effectively analyze the encrypted channels and detection cost lots of energy. This paper proposes the networ flow monitoring model based on unconstrained clustering queuing theory in order to solve the problems in traditional networ monitoring system, which is according to the comprehensive generalize on the basis of networ traffic characteristics. The simulation shows the proposed networ traffic monitoring system based on unconstrained clustering queuing theory can effectively control the flow distribution in the networ, ensure the networ flow balance and data validity, improve the efficiency of the networ traffic transmission, and restrain the networ congestion phenomenon. Journal of Convergence Information Technology(JCIT) Volume8, Number5,Mar 2013 doi: /jcit.vol8.issue

2 2. Analysis of high-flow areas in the networ In order to monitor the networ flow effectively, this paper mainly analyzes the high-flow areas in which ( x, y) represents the two-dimension coordinates of the area [14-18]. According to the multi-iteration principle, the coordinates of the nodes in large-scale networ with high flow can be attained. Assuming the area consisted of three ernel nodes is represented by EsGU s s the strategy ; area consisted of the ernel nodes with strategy capabilities are represented as Fs 1KsRs. EsGU s s and Fs 1KsRs are different strategy areas with different ernel nodes. When the lines between the ernel node F s and the node Fs 1 in some high-flow area Fs 1KsRs are intersected while mapping to the 2-dimension surface, and the corresponding central line through some strategy area EsGU s s, these nodes are located in high-flow area which have high probability for congestion happen. The effective flow monitoring method can effectively adjust the nodes. 3. High-flow areas optimization with unconstrained clustering association method After acquiring the high-flow areas, due to the interior factors in the networ and exterior interference effects, some corresponding interference nodes will appear which will affect the accurate characteristic expression of normal flow nodes. Thus, this paper applies unconstrained clustering association method to analyze the association among the networ flow data, classify the interference nodes and extract effective networ flow data. Assume e describes the amount of anomalous nodes, s in the t ( 0,1,, e) interference characteristic. Then the local interference characteristics should be classified to W classes, and ( r1, r2,..., rn ) describes different interference characteristics, n describe the amount of local interference and local interference are s( r1, r2,..., rn) in which h 0,1,, n. s ( r1, r2,..., rn) describes all the networ interference nodes. The unconstrained clustering association method can segment the local interferences based on different nodes characteristics. The local interference c j belongs to some media class of w l. The probability is s( w c ) and there are j s( w c ) ( s( w ) s( w ))/ s( c ) 0,1,, e (1) j l t j In the equation, s( c j ) describes the priori probability of the anomalous networ node monitoring; s( w cj) 用 describes the priori probability of the nodes segments. The monitoring results with same local infection characteristic probabilities sw ( ) are constant. If the local interferences are independent for each other, there are: s s( wc ) src ( ) src ( ) src ( ) src ( ) s( cj ) s( w)/ s( cj w) (2) j 1 j 2 j m j j 2 Through equation (3), the association probability among different nodes interference is: 2 j j r e 2 sc ( w) Uec ( ( ) w)/ U (3) 805

3 In the equation, Uec (( ) w) describe the networ local interference of class w. U r j describes the corresponding nodes of local interference in the pending detection samples. If zsin / cos l,the node is interference one. 4. Networ flow data analysis by queuing theory After unconstrained clustering association method filtering the interference factors in the high-flow areas, the queuing theory can analyze the congestion issue in the networ flow area to ensure the balance and validity of the networ flows, which can increase the networ transmission efficiency and stability Mathematical model of queuing theory A queue is a waiting line which is familiar with the customers waiting at a supermaret checout counter. The queuing theory applies mathematical model to analyze the waiting lines. More generally speaing, the queuing theory is concerned with the mathematical modeling and analysis of systems that provide service to random amounts of customers. The model is an abstract description of such a server-customer system which has physical meaning. Typically, a queuing model represents (1) the physical configurations of the system in which the specific amounts of servers provide service to the customers, and (2) the demands is stochastic (that is, probabilistic or statistical). The variability in the arrival process and in the service process should be specified. Queuing system is also called service system which includes service module and service objects. For networ communication, the data send, transmission, and receive can build a simple queuing model which is shown in figure 1. Figure1. Queuing system model The input module mainly analyzes the networ flow change characteristics. Normally, it s the flow appeared in some specific time or the time interval between two contiguous flows. The movement of networ flows is complex with random characteristic. Assume the flow is n(t)in t time periods and follow Poison distribution, the probability of L flows appear in time t in the queuing system is: l z ( t) El () t ( l 0,1,2,... L) (4) l! If the contiguous flow appearance interval time T follows negative exponential distribution, there is E( T t) 1 z t (5) 806

4 In the equation, represents the flow expectation in unit time; 1 describes the average time interval. Figure2. Using queuing theory to solve the problem with flow model 4.2. Networ flow prediction with queuing theory If there are large amounts of data pacages in the networ, the networ will be congested and the networ transmission efficiency will be reduced. Even more badly, the networ will be collapsed. This paper analyzed the router data processing capabilities in the networ data lin layer intend to solve the congestion problem. If the data outflow probability of the data segments in some data lin layer is G, the average processing time of the router for each segment is 1/W, the buffer size of the router is D, when some segment appears, the pending segment are saturated, then the segment will be discarded. The segment will be resent after Tn time. The average of the segment exceeding Tn is 1/W. Si(t) represents the appearance probability of the router length with i at time t, there are: St () ( s(), t s(),..., t s ()), t i 0,1,... d n1 (6) 4.3. Networ congestion rate analysis Networ congestion rate has random characteristic and normally the networ flow is analyzed by transient congestion rate and stable congestion rate. The transient congestion rate BD(t) represents the congestion probability at time t, which can be described by system queue probability distribution sn-1(t). Based on Marov characteristic, the transient congestion rate can be attained as equation (7). B t S t g ( ) 0() 1() (1 t ) (7) The stable networ congestion rate can analyze the networ stable operation situation which means when the system is stable; the congestion rate can eep unchanged. The expression is: B () t lim B () t (8) d x d 807

5 Assume the system stable queue is represented as R lim st ( ), according to Marov process characteristics, the stable congestion rate is: SE 0 d 1 (9) Si 1 in x In the equations, s=(s0,s1,,,sd+1) When d=0, the equation (9) can be solved as B S 0 1 (10) When d=1, the equation (9) can be solved as B ( 1) S ( 1) ( ) (11) 0 2 When d=2, the equation (9) can be solved as ( n) B3S41 ( 2 nb ) ( n )(1 B ) B (12) Similarly, when the system buffer d is larger than 2, the stable congestion rate can be shown in equation (13). BdSd 11 / ( dn) Bd 1 ( ( d 1) (1 B d 1 )) (13) Figure3. Cluster model unconstrained clustering correlation method 808

6 5. Simulation experiment verification The simulation comparison experiment is applied to testify the validity of the proposed networ flow monitoring system based on unconstrained clustering queuing theory. The experimental sample is 1000 access data pacages from some library management website in which there are 45 interference data pacages and average 20 pacages will share the same channel leading to networ congestion. The simulation experiment environment is: P4 3.0 CPU, 2G memory, Windows XP operation system, Visual C++ and C language. The comparison methods are port method, depth pacage detection method, flow statistical method and machine learning method. The experiment operates the proposed method and other comparison methods to monitor the same networ flow and analyzes the monitoring efficiency and error rates which are shown in figure 4, figure 5 and figure6 separately. Figure4. Networ monitoring efficiency of different methods Figure5. Monitoring error rates of different networ monitoring methods Figure6. Different networ detection miss rate of the method 809

7 By analyzing the figure 4 figure 5andfigure6 of the results from proposed method and other experimental comparison methods to monitor the same networ, the efficiency of the proposed method is higher than other methods while the error rates are lower that those. It illustrates the constructed networ flow monitoring system proposed in this paper has better performance and can effectively solve the networ congestion problem. In order to further verify the advantages of the proposed method, statistical simulation comparison experiment is operated to compare the operation time, accuracy rate, monitoring precisions, and loss rates, whose results are shown in table 1. Method Types Table 1.the data statistics of different monitoring results Operation time Accuracy rate Monitoring (s) (%) Precision Loss Rate (%) Port Method Depth pacage detection Flow statistic analysis method Machine Learning Method Proposed Method From table 1, the index of the proposed method for the networ flow monitoring is better than other comparison experimental method because the proposed method firstly applies unconstrained clustering method to filter the interference factors in the networ channels, then queuing theory is applied to solve the congestion problem in networ which greatly increase the monitoring efficiency and precisions. 6. Conclusions This paper puts forward the networ traffic monitoring model based on unconstrained clustering queuing theory. It constructs the networ flow estimation model to effectively monitor and analyze the networ flows which is according to the analysis on the high-flow areas in the networ with unconstrained clustering queuing theory based on the comprehensive generalize of the basis of networ traffic characteristics. The simulation shows the proposed networ traffic monitoring system based on unconstrained clustering queuing theory can effectively control the flow distribution in the networ, ensure the networ flow balance and data validity, improve the efficiency of the networ traffic transmission, and restrain the networ congestion phenomenon. It constructs the networ flow estimation model to effectively monitor and analyze the networ flows which is according to the analysis on the high-flow areas in the networ with unconstrained clustering queuing theory based on the comprehensive generalize of the basis of networ traffic characteristics. The simulation shows the proposed networ traffic monitoring system based on unconstrained clustering queuing theory can effectively control the flow distribution in the networ, ensure the networ flow balance and data validity, improve the efficiency of the networ traffic transmission, and restrain the networ congestion phenomenon. 7. Acnowledgements 1. Research on the method for dynamic ris security assessment of IP networ, Special Scientific Research plan of the department of education Shaanxi Province, 11JK The evaluation for dynamic ris of networ security, Natural science fund of Shaanxi Province, 2009MJ8002-3,

8 8 References [1] Chen-xu Liu, Yun Liu, Zhen-jiang Zhang, "Analytical Research on the Efficiency of Smart Grid with Delay Performance of Wireless Sensor Networ Based on Queuing Theory", JCIT, Vol. 7, No. 1, pp. 448 ~ 456, 2012 [2] Peng Han, Jinuan Wang, Yinghua Han, Lei Tan, "Assessment of Smart Grid PEV Charging Management Mechanism in Grid Safety and Environmental Impact", AISS, Vol. 4, No. 13, pp. 144 ~ 152, 2012 [3] Xi Ning, Shen Yulong, Zhang ZhiWei, Ma Jianfeng, "MADA: A Multi Application Domain Architecture for Home Networ", IJACT, Vol. 4, No. 11, pp. 66 ~ 76, 2012 [4] Li Meng, Hui Xiaofeng, Feng Wei, "Research on the Gold Prediction Base on Particle Filter Maximum Entropy Algorithm", IJACT, Vol. 4, No. 18, pp. 633 ~ 639, 2012 [5] Jing Gao, Jinuan Wang, Bin Wang, Xin Song, "Networ Flow Prediction by Genetic-Relevance Vector Regression Algorithm", JCIT, Vol. 7, No. 20, pp. 481 ~ 487, 2012 [6] Xiaoqian Song, Zhongxue Li, "Modified Index System for Eco-Efficiency Evaluation of Circular Economy in Economy in Coal Mining Area Based on Networ Flow Analysis", JCIT, Vol. 7, No. 13, pp. 1 ~ 9, 2012 [7] Wang Juan, Zhang Chunsheng, Niu Xiaohua, Mei Qiang, Zhang Fengxian, Wang Yuling, "Design and Performance Simulation Analysis of High Real-time IP-based Networ", JDCTA, Vol. 6, No. 18, pp. 294 ~ 300, 2012 [8] Dan-dan LI, Run-tong ZHANG, Xiao-pu SHANG, "A New Application in Neural Networ", AISS, Vol. 3, No. 6, pp. 151 ~ 159, 2011 [9] Lansheng Han, Ming Liu, Qiwen Liu, Mengsong Zou, "Sub-connection Based Isolation Against Networ Virus", JDCTA, Vol. 3, No. 1, pp. 110 ~ 122, 2009 [10] Yanhong Zhou, Dong Wen, Fuyong Yuan, Jianye Li, Mingwei Li, "Research of Online Water Quality Monitoring System Based on Zigbee Networ", AISS, Vol. 4, No. 5, pp. 255 ~ 261, 2012 [11] Ting YOU, Peijiang LI, Yumin chen, Hong Ye, "Structural Health Monitoring of Bridge Using an Adaptive Real-Time Wireless Sensor Networ", JCIT, Vol. 7, No. 5, pp. 28 ~ 35, 2012 [12] Shunzhou Yu, Xiaodong Xu, "An Input and Output Monitoring System for FPGA-based Hardware PLC", IJEI, Vol. 3, No. 1, pp. 34 ~ 44, 2012 [13] Sang Boem Lim, Kyoungro Yoon, Yang Dam Eo, "Ubiquitous Air Quality Monitoring System with Service Oriented Architecture Middleware", JCIT, Vol. 7, No. 6, pp. 193 ~ 201, 2012 [14] Mei-Yu Wu, Wen-Yen Huang, "WSN-based Health Care Management Platform for Long-Term Care Institutions", JCIT, Vol. 7, No. 7, pp. 303 ~ 311, 2012 [15] Chao Yang, "Optimized Design and Research of The Intelligent Residential Security Systems Based on Lonwors", JCIT, Vol. 7, No. 8, pp. 9 ~ 18, 2012 [16] Gang Li, XiLong Che, "The Remote Monitoring System Based on GPRS for the Health State of Civil Engineering ", JDCTA, Vol. 6, No. 8, pp. 26 ~ 33, 2012 [17] Xu Bing, Zhang Ying, Li Jing, "Dynamic Monitoring System of Sea Area Utilization based on 3S Technology", JCIT, Vol. 7, No. 9, pp. 413 ~ 421, 2012 [18] Sang Boem Lim, Mu Woo Pyeon, Nam Gyu Kim, "U-Subway: A Smart Monitoring and Control System", JDCTA, Vol. 6, No. 9, pp. 270 ~ 278,