面向業(yè)務(wù)感知的流量監(jiān)控技術(shù)研究
發(fā)布時(shí)間：2018-08-18 10:07
【摘要】： 隨著互聯(lián)網(wǎng)、下一代網(wǎng)絡(luò)等電信技術(shù)的出現(xiàn),寬帶用戶(hù)量急劇上升,網(wǎng)絡(luò)應(yīng)用越來(lái)越多樣化,運(yùn)營(yíng)環(huán)境發(fā)生了很大的變化。P2P、VoIP、VoD、IPTV、在線(xiàn)游戲、即時(shí)通信等各種網(wǎng)絡(luò)應(yīng)用的出現(xiàn),對(duì)IP網(wǎng)絡(luò)提出了越來(lái)越高的品質(zhì)需求和帶寬需求。在當(dāng)前情況下,無(wú)監(jiān)管的VoIP業(yè)務(wù)、P2P業(yè)務(wù)、異常流量以及不受控的寬帶私接占據(jù)了大量的帶寬,沖擊著各大運(yùn)營(yíng)商的運(yùn)營(yíng)管理模式,運(yùn)營(yíng)商逐漸對(duì)網(wǎng)絡(luò)應(yīng)用失去掌控能力,同時(shí),由于網(wǎng)絡(luò)管道化嚴(yán)重,運(yùn)營(yíng)商增加投入提高網(wǎng)絡(luò)容量,但是卻難以分享增值業(yè)務(wù)帶來(lái)的收入,形成“增量不增收”的尷尬局面。這些環(huán)境的變化促使運(yùn)營(yíng)商必須對(duì)網(wǎng)絡(luò)流量進(jìn)行精細(xì)化的管理和控制,提供差異化的服務(wù)。從業(yè)務(wù)監(jiān)控、初級(jí)運(yùn)營(yíng)到高級(jí)階段,通過(guò)詳細(xì)分析流量和用戶(hù)行為數(shù)據(jù),為流量管理和業(yè)務(wù)運(yùn)營(yíng)提供管理手段,并提供定制化服務(wù),從而改進(jìn)運(yùn)營(yíng)手段。針對(duì)這一現(xiàn)狀和需求,本文從運(yùn)營(yíng)商的角度出發(fā),著重研究了面向業(yè)務(wù)感知的流量監(jiān)控技術(shù),在基本網(wǎng)絡(luò)流量監(jiān)管的基礎(chǔ)上,能夠深入發(fā)掘用戶(hù)業(yè)務(wù)類(lèi)型和用戶(hù)行為,減少共享私接帶來(lái)的業(yè)務(wù)損失,通過(guò)定制化的信息推送提高增值業(yè)務(wù)收入,從而推動(dòng)運(yùn)營(yíng)商由管道商向服務(wù)提供商的轉(zhuǎn)型。 本文是以業(yè)務(wù)采集分析平臺(tái)技術(shù)為基礎(chǔ),輻射業(yè)務(wù)識(shí)別檢測(cè)、流量控制、共享接入檢測(cè)和Web推送等多項(xiàng)業(yè)務(wù)類(lèi)型,同時(shí)深入研究并解決了這些業(yè)務(wù)實(shí)現(xiàn)的關(guān)鍵技術(shù),能夠滿(mǎn)足不同方面不同場(chǎng)景下對(duì)于網(wǎng)絡(luò)監(jiān)管和網(wǎng)絡(luò)服務(wù)的要求。具體來(lái)說(shuō),研究工作主要包括以下幾方面： 1、在業(yè)務(wù)識(shí)別監(jiān)控方面,研究了從端口識(shí)別、特征識(shí)別到行為分析的業(yè)務(wù)檢測(cè)技術(shù)以及基于TCP和UDP的業(yè)務(wù)阻斷干擾技術(shù),重點(diǎn)介紹了基于專(zhuān)家?guī)斓牧髁糠诸?lèi)技術(shù)和基于行為特征的分類(lèi)算法,其中在專(zhuān)家?guī)熳R(shí)別領(lǐng)域提出了專(zhuān)家?guī)斓奈宸N特征模式,并引入了一種利用多流特征進(jìn)行識(shí)別的技術(shù)；在行為特征識(shí)別領(lǐng)域,提出了一種基于分形理論進(jìn)行分類(lèi)的檢測(cè)技術(shù)；此外,在業(yè)務(wù)識(shí)別的基礎(chǔ)上,需要對(duì)特定業(yè)務(wù)進(jìn)行限制、干擾甚至阻斷,本文研究了旁路部署模式下的流量控制技術(shù),在面向無(wú)連接的UDP干擾阻斷技術(shù)方面,提出了四種具體的干擾和控制方法及思路,能夠覆蓋大多數(shù)基于UDP的P2P應(yīng)用的干擾控制。 2、在Web推送業(yè)務(wù)方面,分析目前主流的Web推送和廣告推送技術(shù)實(shí)現(xiàn)原理,提出了一種Web推送的方法,同時(shí)比較了四種主流Web推送方案的優(yōu)缺點(diǎn),并分析了各方案所適用的場(chǎng)景,最后從用戶(hù)、推送內(nèi)容、推送類(lèi)型三個(gè)層面對(duì)推送業(yè)務(wù)管理策略提出了建議,使Web推送能更好的具備定制化和針對(duì)性,從而促進(jìn)業(yè)務(wù)增值的拓展。 3、在共享接入檢測(cè)方面,鑒于其既屬于基礎(chǔ)流控平臺(tái)又屬于業(yè)務(wù)范疇的重要性,通過(guò)對(duì)當(dāng)前主流的共享接入主機(jī)數(shù)目檢測(cè)技術(shù)深入的分析,提出了5種檢測(cè)算法,包括被動(dòng)Cookie算法、內(nèi)網(wǎng)IP算法、主動(dòng)Cookie算法、系統(tǒng)時(shí)間算法和MTU算法,按照主動(dòng)算法和被動(dòng)算法進(jìn)行分類(lèi),總結(jié)了各個(gè)算法的優(yōu)缺點(diǎn),指出了當(dāng)前各算法所具有的場(chǎng)景局限性。在此基礎(chǔ)上,提出了一種綜合性共享上網(wǎng)主機(jī)數(shù)目檢測(cè)的模型和系統(tǒng),建立了先使用被動(dòng)算法區(qū)分用戶(hù)類(lèi)型再使用主動(dòng)算法進(jìn)行精確主機(jī)數(shù)目判斷的模型,設(shè)計(jì)了一種可擴(kuò)展的檢測(cè)系統(tǒng),在提高算法準(zhǔn)確度的同時(shí),極大地避免了正常用戶(hù)受到影響,適應(yīng)于各種不同的檢測(cè)場(chǎng)景。 4、引入多軌跡識(shí)別的概念,對(duì)多軌跡識(shí)別問(wèn)題建立了數(shù)學(xué)模型,并將一類(lèi)軌跡——恒變循環(huán)軌跡的問(wèn)題歸結(jié)為特例的剩余類(lèi)循環(huán)軌跡的問(wèn)題,基于這類(lèi)軌跡提出了基于冒泡原理的多軌跡識(shí)別算法,通過(guò)利用各軌跡之間的交替特性依次使各軌跡浮出,容錯(cuò)性能好,在理論上證明了算法的收斂性,利用IPID變化規(guī)律具有恒變循環(huán)軌跡特征可用于共享接入檢測(cè)來(lái)進(jìn)行驗(yàn)證,實(shí)驗(yàn)證明該算法大大提高了檢測(cè)效率,對(duì)異常情況更具容忍度。 5、在多軌跡識(shí)別理論方面,定義了另一類(lèi)軌跡——二值異或群循環(huán)軌跡,并針對(duì)這類(lèi)軌跡提出了高效的檢測(cè)算法,通過(guò)將求解與基軌跡相異或的元素值的問(wèn)題轉(zhuǎn)化為求解每一特征位的模式問(wèn)題,極大地提高了算法的可操作性和準(zhǔn)確高效性。利用DNS變化規(guī)律具備二值異或群循環(huán)軌跡特征進(jìn)行實(shí)驗(yàn),表明該算法需要較少的樣本數(shù)據(jù)即可進(jìn)行檢測(cè),具有較好的容忍度和準(zhǔn)確度。
[Abstract]:With the emergence of Internet, next generation network and other telecommunication technologies, the number of broadband users has risen sharply, network applications are becoming more and more diversified, and the operating environment has changed greatly. Under the circumstances, unregulated VoIP services, P2P services, abnormal traffic and uncontrolled broadband private connection occupy a large amount of bandwidth, which impacts the operation and management mode of major operators. Operators gradually lose control of network applications. At the same time, because of the serious network pipelining, operators increase investment to improve network capacity, but it is difficult to divide them. Enjoying the revenue from value-added services has led to the embarrassing situation of "incremental revenue". These changes in the environment have prompted operators to refine the management and control of network traffic and provide differentiated services. Business operations provide management tools and customized services to improve operational means. In view of this situation and demand, this paper focuses on the study of service-aware traffic monitoring technology from the perspective of operators. On the basis of basic network traffic monitoring, users'business types and behavior can be explored in depth to reduce the total number of users. Enjoy the loss of business brought by private connection, through customized information push to improve value-added business income, thereby promoting the transformation of operators from pipeline providers to service providers.
Based on the technology of service collection and analysis platform, this paper studies and solves the key technologies of these services, which can meet the requirements of network supervision and service in different scenarios. The research work mainly includes the following aspects:
1. In the aspect of service identification and monitoring, the technology of service detection from port identification, feature recognition to behavior analysis and the technology of service blocking jamming based on TCP and UDP are studied. The traffic classification technology based on expert library and the classification algorithm based on behavior feature are introduced in detail. Five kinds of expert library are proposed in the field of expert library identification. In the field of behavior feature recognition, a detection technology based on fractal theory is proposed. In addition, on the basis of service identification, it is necessary to restrict, interfere with and even block specific services. This paper studies the traffic in bypass deployment mode. Control technology, in connection-free UDP interference blocking technology, proposed four specific interference and control methods and ideas, can cover most of the UDP-based P2P applications interference control.
2. In the aspect of Web push service, this paper analyzes the implementation principle of current mainstream Web push and advertising push technology, puts forward a method of Web push, compares the advantages and disadvantages of four mainstream Web push schemes, and analyzes the scenarios suitable for each scheme. Finally, it puts forward the push service management policy from three levels: user, push content and push type. Suggestions are put forward to make Web push more customized and targeted, so as to promote the expansion of business value-added.
3. In view of the importance of shared access detection, which belongs to both basic flow control platform and service category, five detection algorithms are proposed, including passive Cookie algorithm, intranet IP algorithm, active Cookie algorithm, system time algorithm and MTU algorithm, according to the current mainstream shared access host number detection technology. Active algorithms and passive algorithms are classified, the advantages and disadvantages of each algorithm are summarized, and the scenario limitations of the current algorithms are pointed out. Based on this, a model and system for the number detection of shared hosts on the Internet is proposed, and a passive algorithm is used to distinguish user types before the active algorithm is used to precisely determine the number of hosts on the Internet. A scalable detection system is designed to improve the accuracy of the algorithm while avoiding the influence of normal users and adapting to various detection scenarios.
4. By introducing the concept of multi-trajectory identification, the mathematical model of multi-trajectory identification problem is established, and the problem of a class of trajectory-constant variable cycle trajectory is reduced to the problem of residual class trajectory. Based on this kind of trajectory, a multi-trajectory identification algorithm based on bubbling principle is proposed, which makes use of the alternating characteristics of each trajectory in turn. The convergence of the algorithm is proved theoretically. The algorithm can be used to verify the shared access detection by using the characteristic of constant variable cyclic trajectory of IPID. The experimental results show that the algorithm greatly improves the detection efficiency and is more tolerant to abnormal situations.
5. In the theory of multi-trajectory identification, another kind of trajectory-binary XOR Group Cyclic trajectory is defined, and an efficient detection algorithm is proposed for this kind of trajectory. By transforming the problem of solving the value of elements which are different from the basic trajectory into the problem of solving the pattern of each feature bit, the operability and accuracy of the algorithm are greatly improved. Experiments show that the algorithm needs less sample data and has good tolerance and accuracy.
【學(xué)位授予單位】：北京郵電大學(xué)
【學(xué)位級(jí)別】：博士
【學(xué)位授予年份】：2010
【分類(lèi)號(hào)】：TP393.06
本文編號(hào)：2189142
[Abstract]:With the emergence of Internet, next generation network and other telecommunication technologies, the number of broadband users has risen sharply, network applications are becoming more and more diversified, and the operating environment has changed greatly. Under the circumstances, unregulated VoIP services, P2P services, abnormal traffic and uncontrolled broadband private connection occupy a large amount of bandwidth, which impacts the operation and management mode of major operators. Operators gradually lose control of network applications. At the same time, because of the serious network pipelining, operators increase investment to improve network capacity, but it is difficult to divide them. Enjoying the revenue from value-added services has led to the embarrassing situation of "incremental revenue". These changes in the environment have prompted operators to refine the management and control of network traffic and provide differentiated services. Business operations provide management tools and customized services to improve operational means. In view of this situation and demand, this paper focuses on the study of service-aware traffic monitoring technology from the perspective of operators. On the basis of basic network traffic monitoring, users'business types and behavior can be explored in depth to reduce the total number of users. Enjoy the loss of business brought by private connection, through customized information push to improve value-added business income, thereby promoting the transformation of operators from pipeline providers to service providers.
Based on the technology of service collection and analysis platform, this paper studies and solves the key technologies of these services, which can meet the requirements of network supervision and service in different scenarios. The research work mainly includes the following aspects:
1. In the aspect of service identification and monitoring, the technology of service detection from port identification, feature recognition to behavior analysis and the technology of service blocking jamming based on TCP and UDP are studied. The traffic classification technology based on expert library and the classification algorithm based on behavior feature are introduced in detail. Five kinds of expert library are proposed in the field of expert library identification. In the field of behavior feature recognition, a detection technology based on fractal theory is proposed. In addition, on the basis of service identification, it is necessary to restrict, interfere with and even block specific services. This paper studies the traffic in bypass deployment mode. Control technology, in connection-free UDP interference blocking technology, proposed four specific interference and control methods and ideas, can cover most of the UDP-based P2P applications interference control.
2. In the aspect of Web push service, this paper analyzes the implementation principle of current mainstream Web push and advertising push technology, puts forward a method of Web push, compares the advantages and disadvantages of four mainstream Web push schemes, and analyzes the scenarios suitable for each scheme. Finally, it puts forward the push service management policy from three levels: user, push content and push type. Suggestions are put forward to make Web push more customized and targeted, so as to promote the expansion of business value-added.
3. In view of the importance of shared access detection, which belongs to both basic flow control platform and service category, five detection algorithms are proposed, including passive Cookie algorithm, intranet IP algorithm, active Cookie algorithm, system time algorithm and MTU algorithm, according to the current mainstream shared access host number detection technology. Active algorithms and passive algorithms are classified, the advantages and disadvantages of each algorithm are summarized, and the scenario limitations of the current algorithms are pointed out. Based on this, a model and system for the number detection of shared hosts on the Internet is proposed, and a passive algorithm is used to distinguish user types before the active algorithm is used to precisely determine the number of hosts on the Internet. A scalable detection system is designed to improve the accuracy of the algorithm while avoiding the influence of normal users and adapting to various detection scenarios.
4. By introducing the concept of multi-trajectory identification, the mathematical model of multi-trajectory identification problem is established, and the problem of a class of trajectory-constant variable cycle trajectory is reduced to the problem of residual class trajectory. Based on this kind of trajectory, a multi-trajectory identification algorithm based on bubbling principle is proposed, which makes use of the alternating characteristics of each trajectory in turn. The convergence of the algorithm is proved theoretically. The algorithm can be used to verify the shared access detection by using the characteristic of constant variable cyclic trajectory of IPID. The experimental results show that the algorithm greatly improves the detection efficiency and is more tolerant to abnormal situations.
5. In the theory of multi-trajectory identification, another kind of trajectory-binary XOR Group Cyclic trajectory is defined, and an efficient detection algorithm is proposed for this kind of trajectory. By transforming the problem of solving the value of elements which are different from the basic trajectory into the problem of solving the pattern of each feature bit, the operability and accuracy of the algorithm are greatly improved. Experiments show that the algorithm needs less sample data and has good tolerance and accuracy.
【學(xué)位授予單位】：北京郵電大學(xué)
【學(xué)位級(jí)別】：博士
【學(xué)位授予年份】：2010
【分類(lèi)號(hào)】：TP393.06
【引證文獻(xiàn)】
相關(guān)碩士學(xué)位論文 前1條
1 付薇;電信網(wǎng)絡(luò)管理趨勢(shì)監(jiān)控平臺(tái)的設(shè)計(jì)與實(shí)現(xiàn)[D];北京郵電大學(xué);2011年
，本文編號(hào)：2189142
本文鏈接：http://www.sikaile.net/wenyilunwen/guanggaoshejilunwen/2189142.html
最近更新
教材專(zhuān)著
