Research on the Monitoring System based on Next Generation Network

Transcription

1 Research on he Monioring Syse based on Nex Generaion Newor *1 Jianao Gu, 2 Jun Zheng, 3 Yan Wu *1 College of Science, Hebei Unied Universiy, China, [email protected] 2 Finance Deparen, Hebei Unied Universiy, China 3 College of Foreign Languages, Hebei Unied Universiy, China Absrac This paper proposed a new generaion of newor onioring syse sofware by analyzing he exising probles of newor onioring syse. The syse is cenered on service-aware, copaible wih high-speed lin, and applicable o large-scale newor. Through he funcioning of syse, i wors ou specific easures for high-speed daa pace analysis and conrolling, lin-based newor onioring, achieve sring aching of feaures on board, raffic saniizaion, and exper repors. A las he inegraed perspecive of Dill-Down correlaion analysis is given. 1. Inroducion Keywords: Newor Monioring, Flow Online Idenifying, Monioring Analysis Newor onioring syse is operaed by auoaically collecing of webpage, filering of sensiive words [1, 2], inelligen classificaion, hee deecing, subjec focalizing and daa analysis [3, 4], ec., which ees he needs of public senien onioring and adinisering of he relaive newors. And evenually for public senien repors, analysis repors, saisical repors ha provides reliable references for decision aers and anagers [5, 6]. Newor onioring consiss of wo pars, one of which is he onioring of Inerne and he oher is he onioring of inrane. Whichever onioring i is, i needs large aoun of daa soring and updaing, such as he eails in Inerne onioring and he desop in inrane onioring [7, 8]. However, i sees ha newor onioring syse is unsaisfying in he aspecs of syse ariness, services and onioring [9, 1]. Unidenifiable service condiions of newor and bandwidh [11, 12]: (1) Answer he quesions of who, wha, when and where; (2) Exaining he rae of flow of newor, QoS and QoE; (3) The ajor proble is he idenificaion of he rae of flow of applicaion layers [13]. Diversified applicaion causes decreases in he perforances of applicaion [14, 15]. Uniely responses o he excepions and errors: idenifying and purifying of he unusual rae of flow is in need. All hese probles enioned above have been aen ino accoun by us for long [16]. However, i is due o less effecive idenificaion of he rae of flow of applicaion layers and less specific divisions of he rae of flow of he Inerne ha we now lile abou he service condiions of he enire echnology newor of China, he new generaion of Inerne, he oher perforances of newor, and band widh perforance in paricular; hardly can we idenify he abuse of band widh [17]. In addiion, he nex generaion of Inerne is growing naurally wihou effecive sourcing and reoving of errors and service-aware onioring syse. This paper has proposed a new generaion of newor onioring syse sofware by analyzing he exising probles of newor onioring syse. The syse is cenered on service-aware, copaible wih high-speed lin, and applicable o large-scale newor. Through he funcioning of syse, i wors ou specific easures for high-speed daa pace analysis and conrolling, lin-based newor onioring, achieve sring aching of feaures on board, raffic saniizaion, and exper repors. A las he inegraed perspecive of Dill-Down correlaion analysis is given. 2. Proposed schee 2.1. Syse overview The syse is cenered on service-aware, copaible wih high-speed lin, and applicable o largescale newor. Inernaional Journal of Advanceens in Copuing Technology(IJACT) Volue5,Nuber4,February 213 doi:1.4156/ijac.vol5.issue

2 (1) Inelligen analysis: Try o answer he four-w quesions by analysing he rae of flow of newor in deail, fixing he source of newor flow, idenifying he corresponding applicaion ype, following he ie of happening and exising, racing is ransforing roues and desinaion. And afer ha, by exaining he rae of flow of he newor concerned, QoS, QoE and ore specific indexes, wor ou repors, warning and pre-warnings, onior and diagnose he funcion and probles wih he newor. (2) Band widh concerns: I is focused on lin, virue lin, deparen, user, hos and IP, ec and provides various sraegies ha can be uilized o achieve band widh concerns, such as bandwidh prioriy, guaranee and reservaion. (3) Flow purificaion: I consiss of exainaion and clearing of errors. The onioring of flow errors, which is based on daa-pace decoding and sevice-condiion analysis, is siulaneous in discovering housands of errors of DdoS aac, such as abnoral frae fora, newor scanning, Wor, Flooding, Bacdoor aac and Surging. Besides, i can wor correspondingly o blocing, purifying and clearing. (4) Exper repor: The syse can generae exper repor on inelligen analyses, bandwidh concern sraegies and flow clearing acions which suppors periodically ied generaing of on-deand exracion ode and uli-index, uli-phased, uli-dienional inelligence conrass, and fors ordinary docuens, XML, WORD and PDF, ec. Furherore, he conen and for are cusoizable. Plus, he syse also suppors hisorical analysis, endency analysis and exper advice, ec. Causes: (1) IP newor basically operaes on pace-exchanging; (2) Capaciy of onioring syse: no sae; Probles: (1) Qualiy of Pace V.S.Qualiy of Service; (2) Capaciy of carrying of daa paces vs. Capaciy of carrying of services; (3) The propery of daa pace sequencing is required o idenify unusual flows; (4) Pace-level flow conrol ay cause perforance degradaion. Our focus can be seen fro he figure 1 below. Figure 1. Newor Hourglass As is seen fro he figure above, we can see disparae developen of newor, newor echnology and newor proocol. A he boo, a variey of access echnologies are eerging, including Eherne, Opical newor, WLAN, WiMax, ec; on op, various new-born applicaions have coe ino being, such as P2P, VoIP, PPLive, Jooer, Blog, SNS social newwro. Plus, hese new-born applicaions are no siply woring under he frawor of Clien/Server, insead, hey are based on P2P heories direcly or indirecly and have broen hrough he radiional clien-server concep, hus, leading o a coplee refor on he asyric siuaion. Moreover, hese new-born applicaions show uch concern abou he securiy, confidenialiy and privacy of daa ransferring, during which a variey of frawors, proocols and devices are proposed. In he fuure, we believe ha developen will sill say in hese wo areas such as 3G a he boo, GOOGLE, IBM on he op, Clien-2-Cloud, ha is Cloud Copuing, ec High-speed daa pace analysis We ainain ha i is ipossible o process each daa pace in he siuaion of high-speed lin. I is highligh ha our curren wor is focused on 4 G or lins wih uch higher speed. We are able o idenify he flow slower han 4 G and ae conrol over i. a. High-speed lins: 649

3 (1) Even for GE lin: 19bps / 8bis / ( ) byes= pps 64: he iniu size of daa pace 8: he lengh of he head of daa frae 12: daa frae inerval (2) Processing ie of each daa pace: 1Gbps -< 1us, 1Gbps -< 1ns, 4Gbps -< 25ns b. Flow easureen process: (1) daa-pace capure; (2) business-flow aching (concurren flow: 2 illion) ; (3) applicaion layer idenificaion (payload) ; (4) index updae. c. Possible soluions: (1) hash algorih (2) sapling algorih (3) parallel processing. Figure 2. Flow-based Sapling Algorih Analysis: (1) Unifor Sapling: inaccurae esiaes of sall raffic load; (2) SIFCOMM 4 proposed by Esan e al: here is no fundaenal change o Unifor Sapling; (3) SIGMETRICS 4 suggesed by Duffield e al: I canno ee he deand for real-ie analysis of high-speed lin; (4) SGS Infoco 6 proposed by Kuar e al: Liied syse processing capaciy usually leads o perforance degradaion; and resource wase for sech daa srucure sore Flow-based Sapling Algorih approach. See figure 2. In he cases of pace loss reaches 5%, his approach will cu he average relaive erro of flow esiaes down fro 31.37% o 2.6%. Address group and address grouping can be applied o describe virue lins, which is useful in (1) Cusoizing defaul view subjec of a cerain virual lin opening an inerface; (2) Solving he probles wih a large-scale newor: (3) Providing services for users direcly; (4) Realizing unified anageen; (5) Maing probe invisible; (6) Providing ransparen anageen base. Three coon hardware ipleenaions of feaure aching: (1) Based on auoaa (DFA/NFA) ; (2) Based on TCAM; (3) Based on Bloo Filers srucure. The shorcoings of each progra: (1) Auoaon-based progra exis he proble of excessive consupion of harware resources, and he perforance canno ee he requireens of he curren newor bandwidh; (2) TCAM-based ipleenaion perfors beer in oupu, bu in he cases of large collecion odes, is perforances will drop as he sliding windows ge saller; (3) Also, he uncerainy of he collecion odes causes unsable perforances o Bloo Filers progra and when he lengh of paern differs grealy, he nuber of Bloo Filers is rearable, resuling in uneven spread of he nuber of Bloo Filers Sring. Fro he inroducions above, we can see ha auoaon-based feaure aching, which operaing on aing advanage of logic resources on FPGA, leads o fas exhausion of FPGA resources. Thus, his ipleenaion is no applicable o large-scale feaure aching. TCAM s advanage lies in parallel inquiring which offers parallel inquireen of a variey of odes wihin an hour. Though i is hard o achieve parallel inquiring i is superior in coparison wih he oher ipleenaions. Bloo filers-based ipleenaion, by aing use of hash sraegy, wors on copressed sorage of ode 65

4 collecions, which can save he space of sorage grealy and is unliely ha unaching siuaions ae place. Moreover, he occasional unaching siuaion can be filered by Bloo Filers. Therefore, his ipleenaion can achieve scanning for a large aoun of sring in he case of high speed siuaion. Besides, anoher advanage of his ipleenaion is unlie TCAM ipleenaion, paern sring is reaed equally, no aer i is shor or long. Neverhelss, i is hard for Bloo Filers. Figure 3. Achieve Sring Maching of Feaures on Board These hree feaure aching ipleenaions above are disincive respecively. Firs, auoaa ipleenaion is probleaic in over consupion of hardware resources. In addiion, is perforance can hardly ee he deand of curren newor band widh; TCAM-based progra perfors beer in oupu, bu is perforance becoes worse as he sliding windows ge saller; he uncerainy of he collecion paern ses cause unsable perforances o Bloo Filers prograe and when he lengh disincion is large, he nuber of Bloo Filers is rearable, resuling in uneven spread of he nuber of Bloo Filers Sring. By coparing he srenghs and shorcoings of each progra, we hin i is possible ha hey can be cobined o copensae each oher. We propose ha TCAM can be cobined wih Bloo Filers because he handling of long paern sring is as easy as shor sring for he laer, while i is ore coplex for he forer o deal wih long paern sring and sipler and ore direc o deal wih shor paern sring. To be specific, firsly, paern srings in he collecions are divided ino wo ypes, shor and long srings; for long srings, Bloo Filers progra is adoped; for he shor TCAM is used o achieve feaure aching in a direc way and a a higher speed. Soluions: Cobining TCAM and Bloo Filers. (1) Bloo Filers reas long or shor paern sring equally; (2) TCAM s handling of long paern sring is relaively coplex; (3) The handling of shor paern sring is uch sipler and ore iediae for TCAM wih coparison o Bloo Filers. So ha, we can ae he following approach: (1) Divide paern sring in he collecions ino wo groups, one is shor paern sring and he oher is long.; (2) Use Bloo Filers for long paern sring aching; (3) Adop TCAM in he handling of shor paern sring. By coparisons, we hin i is possible ha hese ipleenaions can be cobined and copensae each oher, hrough which beer perforances can be achieved Traffic saniizaion The raffic saniizaion ainly includes he following feaures as shown in Table 1. The accuracy and efficiency are wo iporan erics for evaluaing he raffic idenificaion ehodologies. I is very difficul o evaluae he accuracy of he idenificaion ehodologies due o lac of he well approbaory benchar races. In a cerain exen, he accuracy and he efficiency are conradicory each oher. In order o idenify raffic on high speed lin on line, soe idenificaion ehodologies wih high accuracy bu ore ie coplexiy canno be applied. In his secion, an opiizaion ehodology for iproving he efficiency is presened. 651

5 Anoaly deecion Excepion proocol onioring 3/4 DoSDDoS proecion 7 - DoSDDoS proecion Scan aac proecion Table 1. Feaures of raffic saniizaion. Mulilayer DoSDDoS deecion echanis, o idenify he noral flow and DoSDDoS aacs, abnoral raffic Is blocing refor and no in accordance wih sandard counicaion proocol for paces enering he inernal newor Bi - direcional blocing TCPUDPIGMPIP Flooding, UDPICMP Surfing and oher inds of DoSDDoS aacs can deec DoSDDoS of sofware including XDoS, SUPERDDoS, ore han 5 such as FATBOY Resric access o a uni of ie - based access o a specific nuber of services, blocing he DoSDDoS aac of unnown ype, such as an aac agains Web, DNS and oher services Exclusion on he inernal newor sen ou a variey of IPPor scan excepion pace Soe paraeers are denoed as Table IV. The ie during he period [, ] spen in idenifying flows of applicaion ype wih he ehod i is presened as forula (1). T i ( i* vi) d (1) So he oal ie is suaion of ie wih all ehods as forula (2). n n T T ( * v ) d i i i i1 i1 Noice ha i is liely ha a flow is idenified as a ind of applicaion ype afer processing by several ehodologies. In he ideal siuaion, he os appropriae ehodology can always be seleced for every flow for he efficiency and accuracy. The ie expense for raffic idenificaion in his bes siuaion is showed as forula (3). n i1 T v d ( * ' i i ) Obviously, T T. The opiizaion process is proposed o decrease he ie expense of raffic idenificaion. Supposed he idenificaion procedures for a flow is subse of he ehods sequence < M 1, M 2,, M n >. If for he flow belonging o applicaion ype, he idenificaion ehod of he applicaion ype denoing as M', and M ' = M q. (4) The ie for idenifying he flow is as forula (5). q (2) (3) [ ] (5) Replace forula (5) ino forula (2). I is easy o now he oal ie expense is presened as forula (6). i i1 [ ] ( [ ]* ). 1 1 T T f d To siplify he calculaion process, suppose he [] is independen wih he raffic rae under easureen. Tha is o say [] is independen wih he ie of day. So, forula (6) can be ransfored as forula (7). In forula (7), a ha he oal nuber of flows in he period is 1 [ ] [ ]* [ ]* T T f d a f d is he oal nuber of flows of applicaion ype. So, i is easy o now 1 (6) (7) f d. The goal of opiizaion is o find a schee, which is a ehods sequence in he specific order, wih he inial value of T, viz. M ' ' ' 1, M2,..., Mn, <M1, M2,, Mn>, T ' T. To reove he effec of absolue size of flow rae, T in forula (7) is divided wih he nuber of flows as forula (8). If only if ' T T, T ' T. 652

6 1 1 T r F 1 fd 1 T [ ] [ ]* fd [ ]*, where r is he proporion of he flows of applicaion ype in all applicaions. (8) 3. Experienal resuls In a bacbone newor, he r is coparaively sable lasing a long ie. We can easure he r and i for every applicaion ype for a lin under easureen and find a ehod sequence wih he inial value of ie expense as he bes schee. There are! ehod sequences in oal and for every ehod sequence i is easy o calculae is T, hen we can selec he ehod sequence wih he inial value. Real-ie alar: (1) Flow rae alar; (2) Concurren connecions alar; (3) Alar can rigger daa pace capure sorage. Hisorical analysis: (1) Trend analysis; (2) Error discovery; (3) Coparison of virual lin; (4) Coparison of perforance. I suppors uli-level analysis of Drill-Down. Provides ajor caegories such as (P2P class) of he oal flow ou, ino, and perforance inforaion. Provides ajor caegories such as (P2P) classes bandwidh inforaion flow and perforance. Fro broad caegories such as (P2P class) flow, Drill-Down ou, in, he oal volue of applicaion layer proocols and perforance inforaion. Fro broad caegories such as (P2P) classes bandwidh inforaion, Drill-Down o applicaion specific proocols for bandwidh inforaion. According o a recen coparison of hisorical daa wih a wee/onh bandwidh inforaion in ie (wih he baseline values for he range). Available fro large classes of raffic Drill o he flow, large groups of cusoers, addresses, users ' raffic disribuion inforaion. Fro Drill specific applicaion proocol raffic o flow o large groups of cusoers, addresses, users ' raffic disribuion inforaion Provides baseline hisorical disribuion of raffic, finding deviaions fro baseline of exree flows o furher analysis of Drill-Down. Provides he class (or specific Proocol) raffic flow disribuion of Drill-Down o he newor layer. Provides he class (or specific Proocol) raffic flow disribuion of Drill-Down o he ranspor layer. Figure 4. Drill-Down Correlaion Analysis in Real Tie Fro he Drill o he ajor caegories of raffic flow n in a large class of applicaion proocols. Fro he Drill o he ajor caegories of raffic flow in a large class op n flow, cusoer group, he user's flow disribuion in, address inforaion. Specific applicaion layer proocol raffic coes fro he Drill o he applicaion of large capaciy in he op n proocols. Fro specific Drill applicaion layer proocol raffic o flow in he caegory op n ISP, cusoer group, he user's flow disribuion in, address inforaion. All ajor cliens (address group) in a large class of applicaions includes (such as P2P class) flow disribuion. All ajor clien (address group) is in a newor layer proocol raffic disribuion. All ajor cliens (address group) use a ranspor layer proocol raffic disribuion. Fro a cusoer (address group) Drill-Down size of flows saisics inforaion o he cusoer (address group) corresponds o all caegories of raffic disribuion inforaion. Fro a cusoer (address group) 653

7 Drill-Down size of flows saisics inforaion o he cusoer (address group) he flux disribuion in various applicaion layer proocols inforaion. (Due o applicaion layer proocols, and hen consider do no show his inforaion, bu o inegriy was eporarily reained, consider each cusoer (address group) of flow before he size n of he applicaion layer proocol) Fro a cusoer (address group) Drill-Down size of flows saisics inforaion o he cusoer (address group) corresponding o each newor layer proocol raffic disribuion inforaion. Fro a cusoer (address group) Drill-Down size of flows saisics inforaion o he cusoer (address group) he flux disribuion of each ranspor layer proocol includes inforaion. All ajor clien (address group) flow Drill o is flow o oher flows, large groups of cusoers, addresses, users raffic. All ajor clien (address group) flow Drill o he flow of he applicaion class o oher flows, large cusoer, address groups, users, caegories of flows. All ajor clien (address group) a ranspor layer proocol raffic, Drill o srea i o oher flows, large group of cusoers, addresses, users of he ranspor layer proocol raffic. All ajor clien (address group) Drill newor layer proocol raffic o flow o oher flows, large group of cusoers, addresses, users of he ranspor layer proocol raffic. 4. Conclusions This aricle has inroduced a design for a new generaion of newor onioring syse sofware, ainly by analyzing he curren probles of newor onioring syse. And hrough he achieveen of syse perforance, i has provided specific easureens in high-speed daa pace analysis and conrol; newor onioring based on virual lin; applicaion layer flow idenificaion aided by board. 5. References [1] Moore A W, Papagiannai K., Toward he accurae idenificaion of newor applicaions, Proc of Passive & Acive Measureen Worshop 25 (PAM25). Boson: Springer-Verlag, 41-54, 25. [2] Karagiannis T., Broido A., Falousos M., e al., Transpor layer idenificaion of P2P raffic, Proc of he 4h Inerne easureen Conference. Taorina, Ialy, , 24. [3] Sen S, Spaschec O, Wang Dongei, Accurae, scalable newor idenificaion of P2P raffic using applicaion signaures, Proc of WWW-24, pp , 24. [4] Kang H J, Ki M S, Hog JW, Sreaing edia and uliedia conferencing raffic analysis using payload exainaion, ETRI Journal, vol. 26, no. 3, pp , 24. [5] J. vander Merwe, R. Caceres, Yang-hua Chu, e al. Mdup: a ool foronioring Inerneuliedia raffic, ACM Copuer Co Review, vol. 3, no. 4, pp , 2. [6] Moore A W, Zuev D., Inerne raffic classificaion using Bayesian analysis echniques, Proc of ACM SIGMETRICS 5, pp. 5-6, 25. [7] Zuev D, Moore A W., Traffic classificaion using a saisical approach, Proc of PAM. 25. [8] Moore A W, Zuev D., Discriinaors for use in flow-based classificaion. Cabridge: Inel Research, 24. [9] J. Posel, Transission Conrol Proocol, 1981, Inforaion Sciences Insiue, Transission Conrol Proocol, Sepeber [1] N. G. Duffield, J. T. Lewis, N. O Connell, R. Russell, and F. Tooey, Enropy of ATM raffic sreas, IEEE Journal on Seleced Areas in Counicaions, vol. 13, no. 6, pp , Augus [11] Arapazis T, Lygeros J, Manesis S., A survey of applicaions of wireless sensors and Wireless Sensor Newors, IEEE Inernaional Syposiu on Inelligen Conrol and 13h Medierranean Conference on Conrol and Auoaion. Liassol, Cyprus, vol. 1-2, pp , 25. [12] Jacson T, Mansfield K, Saafi M, Colan T, Roine P., Measuring soil eperaure and oisure using wireless MEMS sensors, Measureen, vol. 41, pp , 28. [13] Wise K D., Inegraed sensors, MEMS, and icrosyses: reflecions on a fanasic voyage, Sens. Acua. A-Physical, 136, 39-5, 27. [14] Technology C., Websie of Crossbow Technology. Available online: hp: // 654

8 [15] Norris A, Saafi M, Roine P., Teperaure and oisure onioring in concree srucures using ebedded nanoechnology/icro elecroechanical syses (MEMS) sensors, Consr. Build. Maer, vol. 22, pp , 28. [16] Saeed Zaani, Rain Nassiri, Sa Jabbehdari, A New Tes Process in Agen-oriened Sofware Engineering, IJACT: Inernaional Journal of Advanceens in Copuing Technology, Vol. 3, No. 7, pp. 1-9, 211 [17] Sanjay Mohapara, Mani Tiwari, Using Business Inelligence for Auoaing Business Processes in Insurance, IJACT: Inernaional Journal of Advanceens in Copuing Technology, Vol. 1, No. 2, pp ,