CN102130789A - Method, device and system for measuring and sampling streams based on application groups - Google Patents
Method, device and system for measuring and sampling streams based on application groups Download PDFInfo
- Publication number
- CN102130789A CN102130789A CN201110095450XA CN201110095450A CN102130789A CN 102130789 A CN102130789 A CN 102130789A CN 201110095450X A CN201110095450X A CN 201110095450XA CN 201110095450 A CN201110095450 A CN 201110095450A CN 102130789 A CN102130789 A CN 102130789A
- Authority
- CN
- China
- Prior art keywords
- message
- stream information
- sampling
- application
- class
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Abstract
The embodiment of the invention provides a method, device and system for measuring and sampling streams based on application groups. The method comprises the following steps: carrying out application identification on received messages so as to obtain application types corresponding to the messages; according to the application types, sending the messages to sample spaces of the corresponding application groups, and recording the number of the messages which are sent to the sample spaces of the application groups; when the number of the messages reaches a preset sample value, determining the corresponding messages to be sample messages; and collecting stream information of the sample messages, and sending the stream information to a server, so that the server stores the stream information. According to the invention, the received messages are identified; the identified messages are sent to the sample spaces of the corresponding application groups; and the messages in each independent sample space are sampled; thus, the error rate of network restoration is ensured to be lower in application fine grit, thereby reducing the distortion of application distribution.
Description
Technical field
The present invention relates to the Network Measurement Technologies field, particularly a kind of the flow measurement method of sampling, Apparatus and system based on set of applications.
Background technology
Along with the continuous development of the Internet (Internet), for the controlled and manageability of Internet new requirement has been proposed also, such as on network, implementing safety measure and realizing service quality (QoS) control etc.These work need all to measure to the certain monitoring of network implementation and to the running status of network that network operation state is measured can be to measure different network parameters, its method of measurement has multiple, but in multiple method of measurement, the most frequently used is exactly sampling, i.e. the current running status that the partial data of dependence sampling comes estimation network.But, in the actual samples process, can there be the situation of leaking sampling, such as, the fixed sample algorithm is to choose 1 message in N message, flows collection.Such acquisition method will make the macroscopic view statistics be partial to some big streams to a certain extent, and some rills will gather less than, cause the network collection result can not reflect the truth of network comprehensively.That is to say, existing flow measurement is to be that sample space is sampled according to flows all in the network, the consistency of message and statistics randomness but this sampling algorithm can't guarantee again to sample fully, therefore, the network condition that will cause reducing by the sample point of sampling is understood distortion on fine granularity, such as on using, may more be partial to the flow that P2P etc. uses, flow smaller applications such as some flows commonly used will lack than reality, some real time communication even can't sample.
Therefore, in research and practice process to prior art, the present inventor finds, in the existing implementation, owing in sampling, exist and miss the flow smaller applications, and the sample point by sampling can not comprehensively reduce the distribution situation of using in the network, promptly has bigger distortion using fine granularity.
Summary of the invention
The embodiment of the invention provides a kind of flow measurement method of sampling, Apparatus and system based on set of applications, solving the technical problem that comprehensive reduction network distributes, and reduces the distortion of application distribution.
For solving the problems of the technologies described above, the present invention is that embodiment provides a kind of flow measurement method of sampling based on set of applications, and described method comprises:
The message that receives is used identification, obtain the application type of described message correspondence;
According to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet;
When described message number reaches default sampled value, determine that corresponding described message is the sampling message;
Described sampling message is carried out the collection of stream information, and described stream information is sent to server, so that the described stream information of described server stores.
Preferably, described method also comprises:
Network message is divided into the sample space of different application packet according to application type, and described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class.
Preferably, described method also comprises:
The stream information of analyzing stored on described server is the corresponding network condition of multiple reduction with the sample rate.
Preferably, described method also comprises: judge whether described message number reaches default sampled value, if carry out the step of the described message of described definite correspondence for the sampling message.
Preferably, described stream information comprises five-tuple information at least.
Accordingly, the embodiment of the invention also provides a kind of flow measurement sampling apparatus based on set of applications, comprising:
Recognition unit is used for the message that receives is discerned, and obtains the application type of described message correspondence;
First transmitting element is used for according to described application type described message being sent to the sample space of corresponding application packet;
Record cell is used to write down the message number that described first transmitting element sends to the sample space of described application packet;
Determining unit is used for determining that corresponding described message is the sampling message when described message number reaches default sampled value;
Collecting unit is used for gathering the stream information of described sampling message;
Second transmitting element is used for described stream information is sent to server, so that the described stream information of described server stores.
Preferably, also comprise:
Division unit is used for network message is divided into different application packet according to application type, and described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class.
Preferably, also comprise:
Judging unit is connected with record cell, be used to judge whether described message number reaches default sampled value, and the judged result that will reach sends to determining unit.
Accordingly, the embodiment of the invention also provides a kind of flow measurement sampling system based on set of applications, and described system comprises: the network equipment and server, wherein,
The described network equipment is used for the message that receives is discerned, and obtains the application type of described message correspondence; According to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet; When described message number reaches default sampled value, determine that corresponding described message is the sampling message; Described sampling message is carried out the collection of stream information, and described stream information is sent to server;
Described server is used for the described stream information that receives is stored and analyzed, and is the corresponding network condition of multiple reduction with the sample rate.
Preferably, the above-mentioned network equipment of the described network equipment.
As shown from the above technical solution, in the embodiment of the invention, the message that receives is discerned, and the message after will discerning sends in the sample space of corresponding application packet, afterwards, again to each independently the message of sample space sample.Thereby guaranteed that network reduction situation has lower error rate on the application fine granularity, thereby reduced the distortion of application distribution.Further, owing in the embodiment of the invention, with the flow of the network mode according to application packet, it is divided into a plurality of independently sample spaces, the less sample space of some flow-rate ratios is just got up by insulation blocking like this, can not substituted by big sample space.When greatly saving memory space and calculation cost, the distribution of using in can accurately reaction network is convenient to the network manager and is carried out network management and configuration.
Description of drawings
The flow chart of a kind of flow measurement method of sampling based on set of applications that Fig. 1 provides for the embodiment of the invention 1;
The flow chart of a kind of flow measurement method of sampling based on set of applications that Fig. 2 provides for the embodiment of the invention 2;
The flow chart of a kind of flow measurement method of sampling based on set of applications that Fig. 3 provides for the embodiment of the invention 3;
The structural representation of a kind of flow measurement sampling apparatus based on set of applications that Fig. 4 provides for the embodiment of the invention;
The structural representation of a kind of flow measurement sampling system based on set of applications that Fig. 5 provides for the embodiment of the invention.
Embodiment
Below we will be in conjunction with the accompanying drawings, embodiment of the present invention are described in detail.
See also Fig. 1, the flow chart of a kind of flow measurement method of sampling based on set of applications that provides for the embodiment of the invention 1; Described method comprises:
Step 101: the message that receives is discerned, obtained the application type of described message correspondence;
Step 102: according to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet;
Step 103: when described message number reaches default sampled value, determine that corresponding described message is the sampling message;
Step 104: described sampling message is carried out the collection of stream information, and described stream information is sent to server, so that the described stream information of described server stores.
Wherein, stream information comprises five-tuple information at least, but is not limited to this.
In the embodiment of the invention, described application packet is exactly that application with same type is divided into a group, can comprise polytype application packet in the set of applications, and each divides into groups all to independently sample space should be arranged.
In the embodiment of the invention, the message that receives is discerned, and the message after will discerning sends in the sample space of corresponding application packet, afterwards, to each independently sample space sample.Thereby guaranteed that network reduction situation has lower error rate on the application fine granularity, thereby reduced the distortion of application distribution.
Preferably, on the basis of Fig. 1, described method can also comprise step 100: network message is divided into different application packet according to application type, described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class, specifically as shown in Figure 2, the flow chart of a kind of flow measurement method of sampling based on set of applications that provides for the embodiment of the invention 2.In this embodiment, described common protocol, as HTML (Hypertext Markup Language) (HTTP, HyperText Transfer Protocol is an OO agreement that belongs to application layer), file transfer protocol (FTP) (FTP, File Transfer Protocol), domain name analysis system agreement (DNS, Domain Name Server Protocol), etc.; Described P2P downloads class, downloads (bittorrent), a sudden peal of thunder (thunder), express (flashget) etc. as metamorphosis; Described P2P video class, as Web TV software (ppstream), QQ live (qqlive) is excellent cruel etc.; Described real time communication class is as the QQ of instant messaging, MSN, GoogleTalk etc.Described game class, as World of Warcraft, CS, legend etc.; Described stock class, as big wisdom, sequence, the magnitude of security, but be not limited to this.
Preferably, last at Fig. 1 and Fig. 2, described method can also comprise respectively: the stream information of analyzing stored on described server is the corresponding network condition of multiple reduction with the sample rate.That is to say that the network manager can analyze the stream information that is stored on the described server, obtains network traffics and bandwidth, is the corresponding network condition of multiple reduction with the sample rate.
In the embodiment of the invention, with the flow of the network mode according to application packet, it is divided into a plurality of independently sample spaces, present embodiment is an example with six, but is not limited to this.The less sample space of some flow-rate ratios is just got up by insulation blocking like this, can not substituted by big sample space.Then the message that receives is discerned, and the message after will discerning sends in the corresponding application packet (being sample space), afterwards, to each independently sample space sample.Thereby guaranteed that network reduction situation has lower error rate on the application fine granularity, thereby reduced the distortion of application distribution.That is to say that six independently can't exist error between the application packet, thereby when greatly saving memory space and calculation cost, the distribution of using in can accurately reaction network.
Also see also Fig. 3, the flow chart of a kind of flow measurement method of sampling based on set of applications that provides for the embodiment of the invention 3, described method comprises:
Step 301: the message that receives is discerned, obtained the application type of described message correspondence;
Step 302: according to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet;
In this step 301 and 302, the network equipment is discerned the message that receives earlier, obtains corresponding application type, afterwards, each message after the identification is sent in the different application packet, that is to say that each message all is sent in the sample space of different application packet.In the present embodiment, network message is divided into six application packet, each application packet is exactly an independently sample space, and concrete application packet sees above-mentioned not repeating them here for details.Again, when message sent to application packet, record was sent to the number of the message of each sample space.
Step 303: judge whether described message number reaches default sampled value, if, execution in step 304; Otherwise, execution in step 307: skip, promptly again the message that receives such as is discerned at subsequent step.
Algorithm according to 1 of N packet sampling in each application packet hits judgement.When having added up N in each application packet and flow through message, then this message is hit.Wherein, N can set according to actual needs, and present embodiment is not done qualification.
Step 304: determine that corresponding described message is sampling message (message that promptly hits);
Step 305: described sampling message is carried out the collection of stream information; And described stream information sent to server; Wherein, sampling message (message that hits) is carried out the collection of stream information, comprise the extraction of stream details such as five-tuple at least.
Step 306: the described stream information of storage on the server is analyzed, and is the corresponding network condition of multiple reduction with the sample rate, and this analytic process can be the keeper, also can analyze automatically by equipment, and present embodiment does not limit.
Certainly, in this embodiment, described method can also comprise: network message is divided into the sample space of different application packet according to application type, and described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class.
In this embodiment, described method can also comprise: the stream information of analyzing stored on described server is the corresponding network condition of multiple reduction with the sample rate.
In the present embodiment, be that foundation has been divided into six independently sample spaces with the set of applications with network message, the less sample space of some flow-rate ratios is just got up by insulation blocking like this, can not substituted by big sample space.Therefore error only is present within each set of applications, six independently can't exist error between the set of applications, thereby when greatly saving memory space and calculation cost, the distribution of using in can accurately reaction network is so that the network manager carries out network management and configuration.
Implementation procedure based on said method, the embodiment of the invention also provides a kind of flow measurement sampling apparatus based on set of applications, and its structural representation sees Fig. 4 for details, and described device comprises: recognition unit 41, first transmitting element 42, record cell 43, determining unit 44, the collecting unit 45 and second transmitting element 46, wherein, described recognition unit 41 is used for the message that receives is discerned, and obtains the application type of described message correspondence; Described first transmitting element 42 is used for according to described application type described message being sent to the sample space of corresponding application packet; Described record cell 43 is used to write down the message number that described first transmitting element sends to the sample space of described application packet; Described determining unit 44 is used for determining that corresponding described message is the sampling message when described message number reaches default sampled value; Described collecting unit 45 is used for gathering the stream information of described sampling message, and described stream information comprises five-tuple information at least; Described second transmitting element 43 is used for described stream information is sent to server, so that the described stream information of described server stores.
Preferably, described device can also comprise: division unit, be used for network message is divided into different application packet according to application type, described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class, but are not limited to this.
Preferably, described device can also comprise: judging unit, be connected with record cell, and be used to judge whether described message number reaches default sampled value, and the judged result that will reach sends to determining unit.
Described device can be integrated in the network equipment, also can independent part be deployed in the network, and present embodiment does not limit.
In the described device, the function of each unit and the implementation procedure of effect see implementation procedure corresponding in the said method for details, do not repeat them here.
Accordingly, the embodiment of the invention also provides a kind of flow measurement sampling system based on set of applications, and its structural representation sees Fig. 5 for details, and described system comprises: the network equipment 51 and server 52, wherein,
The described network equipment 51 is used for the message that receives is discerned, and obtains the application type of described message correspondence; According to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet; When described message number reaches default sampled value, determine that corresponding described message is the sampling message; Described sampling message is carried out the collection of stream information, and described stream information is sent to server;
Described server 52 is used for the described stream information that receives is stored and analyzed, and is the corresponding network condition of multiple reduction with the sample rate.
Wherein, the described network equipment 51 comprises: recognition unit 511, the first transmitting elements 512, record cell 513, determining unit 514, collecting unit 515 and second transmitting element 516.The function of its each unit and effect see for details above-mentioned, are not giving unnecessary details at this.
Certainly, the described network equipment 51 can also comprise: division unit and/or judging unit, specifically see for details above-mentioned.
In the described system, the function of each unit and the implementation procedure of effect see implementation procedure corresponding in the said method for details, do not repeat them here.
In the embodiment of the invention, network message serves as that foundation has been divided into six independently sample spaces with set of applications (such as application type), and the less sample space of some flow-rate ratios is just got up by insulation blocking like this, can not substituted by big sample space.Therefore error only is present within each set of applications, six independently can't exist error between the set of applications, thereby when greatly saving memory space and calculation cost, the distribution of using in can accurately reaction network is convenient to the network manager and is carried out network management and configuration.
Need to prove, in this article, relational terms such as first and second grades only is used for an entity or operation are made a distinction with another entity or operation, and not necessarily requires or hint and have the relation of any this reality or in proper order between these entities or the operation.And, term " comprises ", " comprising " or its any other variant are intended to contain comprising of nonexcludability, thereby make and comprise that process, method, article or the equipment of a series of key elements not only comprise those key elements, but also comprise other key elements of clearly not listing, or also be included as this process, method, article or equipment intrinsic key element.Do not having under the situation of more restrictions, the key element that limits by statement " comprising ... ", and be not precluded within process, method, article or the equipment that comprises described key element and also have other identical element.
Through the above description of the embodiments, those skilled in the art can be well understood to the present invention and can realize by the mode that software adds essential general hardware platform, can certainly pass through hardware, but the former is better execution mode under a lot of situation.Based on such understanding, the part that technical scheme of the present invention contributes to prior art in essence in other words can embody with the form of software product, this computer software product can be stored in the storage medium, as ROM/RAM, magnetic disc, CD etc., comprise that some instructions are with so that a computer equipment (can be a personal computer, server, the perhaps network equipment etc.) carry out the described method of some part of each embodiment of the present invention or embodiment.
The above only is a preferred implementation of the present invention; should be pointed out that for those skilled in the art, under the prerequisite that does not break away from the principle of the invention; can also make some improvements and modifications, these improvements and modifications also should be considered as protection scope of the present invention.
Claims (10)
1. the flow measurement method of sampling based on set of applications is characterized in that, comprising:
The message that receives is used identification, obtain the application type of described message correspondence;
According to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet;
When described message number reaches default sampled value, determine that corresponding described message is the sampling message;
Described sampling message is carried out the collection of stream information, and described stream information is sent to server, so that the described stream information of described server stores.
2. method according to claim 1 is characterized in that, described method also comprises:
Network message is divided into the sample space of different application packet according to application type, and described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class.
3. method according to claim 1 and 2 is characterized in that, described method also comprises:
The stream information of analyzing stored on described server is the corresponding network condition of multiple reduction with the sample rate.
4. method according to claim 1 and 2 is characterized in that, described method also comprises: judge whether described message number reaches default sampled value, if carry out the step of the described message of described definite correspondence for the sampling message.
5. method according to claim 1 and 2 is characterized in that described stream information comprises five-tuple information at least.
6. the flow measurement sampling apparatus based on set of applications is characterized in that, comprising:
Recognition unit is used for the message that receives is discerned, and obtains the application type of described message correspondence;
First transmitting element is used for according to described application type described message being sent to the sample space of corresponding application packet;
Record cell is used to write down the message number that described first transmitting element sends to the sample space of described application packet;
Determining unit is used for determining that corresponding described message is the sampling message when described message number reaches default sampled value;
Collecting unit is used for gathering the stream information of described sampling message;
Second transmitting element is used for described stream information is sent to server, so that the described stream information of described server stores.
7. device according to claim 6 is characterized in that, also comprises:
Division unit is used for network message is divided into different application packet according to application type, and described application packet comprises at least: common protocol, electric donkey P2P download class, P2P video class, real time communication class, game class and stock class.
8. according to claim 6 or 7 described devices, it is characterized in that, also comprise:
Judging unit is connected with record cell, be used to judge whether described message number reaches default sampled value, and the judged result that will reach sends to determining unit.
9. the flow measurement sampling system based on set of applications is characterized in that, comprising: the network equipment and server, wherein,
The described network equipment is used for the message that receives is discerned, and obtains the application type of described message correspondence; According to described application type described message is sent in the sample space of corresponding application packet, and record sends to the message number of the sample space of described application packet; When described message number reaches default sampled value, determine that corresponding described message is the sampling message; Described sampling message is carried out the collection of stream information, and described stream information is sent to server;
Described server is used for the described stream information that receives is stored and analyzed, and is the corresponding network condition of multiple reduction with the sample rate.
10. device according to claim 9 is characterized in that, the described network equipment of each claim of the described network equipment such as claim 6 to 8.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110095450XA CN102130789A (en) | 2011-04-15 | 2011-04-15 | Method, device and system for measuring and sampling streams based on application groups |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201110095450XA CN102130789A (en) | 2011-04-15 | 2011-04-15 | Method, device and system for measuring and sampling streams based on application groups |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN102130789A true CN102130789A (en) | 2011-07-20 |
Family
ID=44268687
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201110095450XA Pending CN102130789A (en) | 2011-04-15 | 2011-04-15 | Method, device and system for measuring and sampling streams based on application groups |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN102130789A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102546392A (en) * | 2011-11-28 | 2012-07-04 | 曙光信息产业(北京)有限公司 | System and method used for sampling network messages and based on transmission control protocol (tcp) connection |
| CN108429657A (en) * | 2018-02-28 | 2018-08-21 | 新华三技术有限公司 | Packet sampling method, apparatus and message processor |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1750484A (en) * | 2004-09-14 | 2006-03-22 | 华为技术有限公司 | Device and its method for monitoring excited message |
| CN1881899A (en) * | 2006-04-30 | 2006-12-20 | 国家数字交换系统工程技术研究中心 | Network flow monitoring system and method |
| CN1909554A (en) * | 2006-08-18 | 2007-02-07 | 华为技术有限公司 | Method and system for data flow sampling |
| CN101022370A (en) * | 2007-03-23 | 2007-08-22 | 清华大学 | Automatic clustering method for multi-particle size network under G bit flow rate |
| CN101521630A (en) * | 2009-04-09 | 2009-09-02 | 杭州华三通信技术有限公司 | Analysis method and equipment of network flow |
-
2011
- 2011-04-15 CN CN201110095450XA patent/CN102130789A/en active Pending
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1750484A (en) * | 2004-09-14 | 2006-03-22 | 华为技术有限公司 | Device and its method for monitoring excited message |
| CN1881899A (en) * | 2006-04-30 | 2006-12-20 | 国家数字交换系统工程技术研究中心 | Network flow monitoring system and method |
| CN1909554A (en) * | 2006-08-18 | 2007-02-07 | 华为技术有限公司 | Method and system for data flow sampling |
| CN101022370A (en) * | 2007-03-23 | 2007-08-22 | 清华大学 | Automatic clustering method for multi-particle size network under G bit flow rate |
| CN101521630A (en) * | 2009-04-09 | 2009-09-02 | 杭州华三通信技术有限公司 | Analysis method and equipment of network flow |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102546392A (en) * | 2011-11-28 | 2012-07-04 | 曙光信息产业(北京)有限公司 | System and method used for sampling network messages and based on transmission control protocol (tcp) connection |
| CN102546392B (en) * | 2011-11-28 | 2014-08-27 | 曙光信息产业(北京)有限公司 | System and method used for sampling network messages and based on transmission control protocol (tcp) connection |
| CN108429657A (en) * | 2018-02-28 | 2018-08-21 | 新华三技术有限公司 | Packet sampling method, apparatus and message processor |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| Zheng et al. | Realtime DDoS defense using COTS SDN switches via adaptive correlation analysis | |
| CN104488231B (en) | Method, apparatus and system for selectively monitoring flow | |
| Zhang et al. | Understanding the characteristics of cellular data traffic | |
| US20160234094A1 (en) | Streaming method and system for processing network metadata | |
| EP2084854B1 (en) | Media session identification method for ip networks | |
| US20050234920A1 (en) | System, computer-usable medium and method for monitoring network activity | |
| EP2615777A1 (en) | Monitoring over-the-top adaptive video streaming | |
| CN101924757A (en) | Method and system for reviewing Botnet | |
| US7903657B2 (en) | Method for classifying applications and detecting network abnormality by statistical information of packets and apparatus therefor | |
| Mistry et al. | Network traffic measurement and analysis | |
| WO2014110293A1 (en) | An improved streaming method and system for processing network metadata | |
| KR101602189B1 (en) | traffic analysis and network monitoring system by packet capturing of 10-giga bit data | |
| Bhatia | Ensemble-based model for DDoS attack detection and flash event separation | |
| CN107623745A (en) | A kind of monitoring method, system and computer-readable recording medium | |
| CN112333020A (en) | Network security monitoring and data message analyzing system based on quintuple | |
| KR20130020862A (en) | Apparatus and method for anomaly detection in scada network using self-similarity | |
| Sukhov et al. | Rank distribution for determining the threshold values of network variables and the analysis of DDoS attacks | |
| Lin et al. | A comparative analysis of emulated and real iec-104 spontaneous traffic in power system networks | |
| CN103517292A (en) | Mobile terminal information reporting method and apparatus | |
| CN108712365B (en) | DDoS attack event detection method and system based on flow log | |
| CN102130789A (en) | Method, device and system for measuring and sampling streams based on application groups | |
| Lotfalizadeh et al. | Investigating real-time entropy features of DDoS attack based on categorized partial-flows | |
| CN111080362A (en) | Advertisement monitoring system and method | |
| Bujlow et al. | A method for assessing quality of service in broadband networks | |
| Donner et al. | Unsupervised machine learning for anomaly detection in synchrophasor network traffic |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C12 | Rejection of a patent application after its publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20110720 |