CN106411654A - Method and device for processing network traffic analysis - Google Patents
Method and device for processing network traffic analysis Download PDFInfo
- Publication number
- CN106411654A CN106411654A CN201610956892.1A CN201610956892A CN106411654A CN 106411654 A CN106411654 A CN 106411654A CN 201610956892 A CN201610956892 A CN 201610956892A CN 106411654 A CN106411654 A CN 106411654A
- Authority
- CN
- China
- Prior art keywords
- hash
- hash table
- node
- barrelage
- lower limit
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/14—Network analysis or design
- H04L41/142—Network analysis or design using statistical or mathematical methods
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
- G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
- G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
- G06F9/5016—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals the resource being the memory
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F9/00—Arrangements for program control, e.g. control units
- G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
- G06F9/46—Multiprogramming arrangements
- G06F9/50—Allocation of resources, e.g. of the central processing unit [CPU]
- G06F9/5005—Allocation of resources, e.g. of the central processing unit [CPU] to service a request
- G06F9/5011—Allocation of resources, e.g. of the central processing unit [CPU] to service a request the resources being hardware resources other than CPUs, Servers and Terminals
- G06F9/5022—Mechanisms to release resources
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L41/00—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks
- H04L41/24—Arrangements for maintenance, administration or management of data switching networks, e.g. of packet switching networks using dedicated network management hardware
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L43/00—Arrangements for monitoring or testing data switching networks
- H04L43/08—Monitoring or testing based on specific metrics, e.g. QoS, energy consumption or environmental parameters
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Software Systems (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- General Engineering & Computer Science (AREA)
- Pure & Applied Mathematics (AREA)
- Probability & Statistics with Applications (AREA)
- Mathematical Physics (AREA)
- Mathematical Optimization (AREA)
- Mathematical Analysis (AREA)
- Algebra (AREA)
- Environmental & Geological Engineering (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a method and device for processing a network traffic analysis. The method comprises: statistics of the number of Hash nodes in a to-be-measured Hash table is carried out; according to a preset Hash node using upper limit and Hash node using lower limit, whether the bucket number of the to-be-measured Hash table needs to be adjusted is determined; if so, the bucket number of the Hash table is adjusted according to a preset rule and a Hash table is established again. According to the invention, because the bucket number of the Hash table is adjusted, the new Hash table can adapt to the network flow need actively. When the network flow increases, the bucket number of the Hash table can be extended, thereby improving the new Hash table performance. When the network flow is reduced, the bucket number of the Hash table can be reduced, thereby releasing the memory space that is occupied but is not utilized; and thus more idle memory is released for the operating system. Therefore, the processing performance of the existing software can be improved.
Description
Technical field
The present invention relates to network traffic analysis technical field, particularly to a kind of method processing network traffic analysis and dress
Put.
Background technology
In the exploitation of network traffic analysis class software, need to carry out the packet in network according to different five-tuples
Distinguish, packet is reduced into data cube computation, carry out the analysis business on upper strata on the basis of connecting again.Hash algorithm is due to it
Higher operation efficiency, so be frequently utilized for the kernel data structure of connection table.When newly-built connection, new Hash node
It is created；When connecting end, existing Hash node is released；The life span of whole Hash table, Hash node
Quantity is to be changed according to the change of network connection.
The essence of hash algorithm is the mapping to set T for the set K, and the set of K under normal circumstances is greater than T, due to being one
Individual unbalanced mapping, so occurring that different inputs obtain identical cryptographic Hash, such situation is referred to as Hash collision.
The conventional treating method to Hash collision can be slide fastener method, open address method or multistage Hash method, but no
By using which kind of method, Hash collision all can lead to computational efficiency to reduce, and Hash collision rate is higher, and overall algorithm and operation are multiple
Miscellaneous degree is higher.
In addition to from the hash algorithm being optimized according to input, the quantity as far as possible reducing set T and set K is poor
Different it is also possible to reduce Hash collision produce probability.
In actually used, Hash bucket (i.e. set T) is intended to pre- first to file internal memory, when creating just by the internal memory of Hash bucket
Apply for, so the conference of crossing of Hash bucket application leads to EMS memory occupation excessive；And if the quantity of Hash bucket application is too small, meeting again
The probability leading to Hash collision becomes big.
Content of the invention
In order to solve problem of the prior art, embodiments provide a kind of process network traffic analysis method and
Device.Described technical scheme is as follows：
On the one hand, embodiments provide a kind of method processing network traffic analysis, including：
Count the quantity of Hash node in Hash table to be measured, described Hash table to be measured includes and each cryptographic Hash in Hash table
One conflict chained list of correspondence establishment；
Lower limit is used according to default Hash node SC service ceiling and Hash node, to judge that the barrelage of Hash table to be measured is
No need to adjust, described Hash node SC service ceiling is the product of the barrelage of the Hash Duty-circle upper limit and current Hash table,
Described Hash node uses the product that lower limit is Hash Duty-circle lower limit and the barrelage of current Hash table；
When the barrelage judging Hash table to be measured needs adjustment, adjust the barrelage of Hash table according to preset rules, again build
Vertical Hash table.
In the method for the above-mentioned process network traffic analysis of the embodiment of the present invention, described made according to default Hash node
Use lower limit with the upper limit and Hash node, to judge the barrelage of Hash table to be measured the need of adjustment, including：
Whether the Hash number of nodes according to counting on exceedes Hash node SC service ceiling, or, the Hash section counting on
Whether point quantity uses lower limit less than Hash node, and the barrelage to judge Hash table to be measured is the need of adjustment.
In the method for the above-mentioned process network traffic analysis of the embodiment of the present invention, the described bucket that ought judge Hash table to be measured
When number needs adjustment, adjust the barrelage of Hash table according to preset rules, re-establish Hash table, including：
When the Hash number of nodes counting on exceedes Hash node SC service ceiling, from default Prime sequences, choose
Relatively large prime number, as the barrelage of new Hash table, re-establishes Hash table；
When the Hash number of nodes counting on is less than Hash node and uses lower limit, from default Prime sequences, choose
Relatively small prime number, as the barrelage of new Hash table, re-establishes Hash table.
The embodiment of the present invention above-mentioned process network traffic analysis method in, in described default Prime sequences each
Prime number is all higher than 2 times of its adjacent previous prime number.
In the method for the above-mentioned process network traffic analysis of the embodiment of the present invention, described Hash Duty-circle lower limit is little
Half in the described Hash Duty-circle upper limit.
On the other hand, embodiments provide a kind of device processing network traffic analysis, including：
Statistical module, for counting the quantity of Hash node in Hash table to be measured, described Hash table to be measured includes and Hash
A conflict chained list of each cryptographic Hash correspondence establishment in table；
Judge module, for using lower limit according to default Hash node SC service ceiling and Hash node, to judge to be measured
The need of adjustment, described Hash node SC service ceiling is the Hash Duty-circle upper limit and current Hash table to the barrelage of Hash table
Barrelage product, described Hash node utilization rate lower limit is taking advantage of of Hash Duty-circle lower limit and the barrelage of current Hash table
Long-pending；
Processing module, during for needing adjustment when the barrelage judging Hash table to be measured, adjusts Hash table according to preset rules
Barrelage, re-establish Hash table.
In the device of the above-mentioned process network traffic analysis of the embodiment of the present invention, described judge module, it is additionally operable to basis
Whether the Hash number of nodes counting on exceedes Hash node SC service ceiling, or, whether the Hash number of nodes counting on is low
Use lower limit in Hash node, the barrelage to judge Hash table to be measured is the need of adjustment.
In the device of the above-mentioned process network traffic analysis of the embodiment of the present invention, described processing module, it is additionally operable to when system
When the Hash number of nodes counted exceedes Hash node SC service ceiling, from default Prime sequences, choose relatively large element
Number, as the barrelage of new Hash table, re-establishes Hash table；
Described processing module, is additionally operable to when the Hash number of nodes counting on is less than Hash node and uses lower limit, from pre-
If Prime sequences in, choose relatively small prime number as the barrelage of new Hash table, re-establish Hash table.
The embodiment of the present invention above-mentioned process network traffic analysis device in, in described default Prime sequences each
Prime number is all higher than 2 times of its adjacent previous prime number.
In the device of the above-mentioned process network traffic analysis of the embodiment of the present invention, described Hash Duty-circle lower limit is little
Half in the described Hash Duty-circle upper limit.
The beneficial effect that technical scheme provided in an embodiment of the present invention is brought is：
By counting the quantity of Hash node in Hash table to be measured, then according to default Hash node SC service ceiling and Kazakhstan
Uncommon node uses lower limit, and the barrelage to judge Hash table to be measured is the need of adjustment, and ought judge the barrelage need of Hash table to be measured
When to be adjusted, adjust the barrelage of Hash table according to preset rules, re-establish Hash table, to realize processing network traffic analysis
Method.So pass through to adjust the barrelage of Hash table so that new Hash table can actively adapt to the demand of network traffics, work as network
When flow increases, the barrelage of Hash table can be expanded, to improve the performance of new Hash table, when network traffics reduce, permissible
The barrelage of reduction Hash table, is occupied but unemployed memory headroom with discharging, and more freememories are released to operate
System, improves the process performance of existing software on the whole.
Brief description
For the technical scheme being illustrated more clearly that in the embodiment of the present invention, will make to required in embodiment description below
Accompanying drawing be briefly described it should be apparent that, drawings in the following description are only some embodiments of the present invention, for
For those of ordinary skill in the art, on the premise of not paying creative work, other can also be obtained according to these accompanying drawings
Accompanying drawing.
Fig. 1 is a kind of method flow diagram of process network traffic analysis that the embodiment of the present invention one provides；
Fig. 2 is a kind of schematic diagram of Hash table that the embodiment of the present invention one provides；
Fig. 3 is a kind of schematic diagram of Hash table that the embodiment of the present invention one provides；
Fig. 4 is a kind of schematic diagram of Hash table that the embodiment of the present invention one provides；
Fig. 5 is a kind of schematic diagram of Hash table that the embodiment of the present invention one provides；
Fig. 6 is a kind of apparatus structure schematic diagram of process network traffic analysis that the embodiment of the present invention two provides.
Specific embodiment
For making the object, technical solutions and advantages of the present invention clearer, below in conjunction with accompanying drawing to embodiment party of the present invention
Formula is described in further detail.
Embodiment one
Embodiments provide a kind of method processing network traffic analysis, referring to Fig. 1, the method can include：
Step S11, counts the quantity of Hash node in Hash table to be measured, and Hash table to be measured includes and each Kazakhstan in Hash table
One conflict chained list of uncommon value correspondence establishment.
In the present embodiment, the packet in network can be reduced into number by the existing method processing network traffic analysis
According to connection, carry out the analysis business on upper strata on the basis of data cube computation again.Hash table is kind of a data structure, and it can provide soon
The update of speed and search operation, it is usually applied in disparate networks flow analysis software.
It should be noted that the Hash table to be measured in the present embodiment uses chain address method to process hash-collision,
I.e. to each cryptographic Hash in Hash table (i.e. keyword passes through the calculated hash address for storing data of hash function)
Set up a conflict chained list, the data cube computation clashing is stored therein in the form of chained list.Additionally, Hash table to be measured exists
At the beginning of foundation, it can be the Hash bucket application contiguous memory of Hash table.Hash bucket be deposited using a sequence list have identical
The head node of the chained list of the keyword of cryptographic Hash, can find other keywords using this head node.
In actual applications, the counter of Hash node in the data structure of Hash table, can be set, to count Hash
The quantity of Hash node in table, when having new insertion Hash node for every time, in counter, statistical magnitude increases.
Step S12, uses lower limit according to default Hash node SC service ceiling and Hash node, to judge Hash table to be measured
Barrelage the need of adjustment, Hash node SC service ceiling is the Hash Duty-circle upper limit and the taking advantage of of the barrelage of current Hash table
Long-pending, Hash node utilization rate lower limit is the product of Hash Duty-circle lower limit and the barrelage of current Hash table.
In the present embodiment, the barrelage of Hash table refers to the quantity of Hash bucket in Hash table.Hash bucket is suitable using one
Sequence table, to deposit the head node of the chained list of the keyword with identical cryptographic Hash, can find other passes using this head node
Key word.
Specifically, above-mentioned steps S12 can be realized in the following way：
Whether the Hash number of nodes according to counting on exceedes Hash node SC service ceiling, or, the Hash section counting on
Whether point quantity uses lower limit less than Hash node, and the barrelage to judge Hash table to be measured is the need of adjustment.
In the present embodiment, when the quantity of the Hash node counting on exceedes Hash node SC service ceiling, illustrate that this is treated
Survey Hash table performance and can not meet present network traffics, occur the probability of Hash collision to increase, alignment processing network traffics are divided
The efficiency of analysis declines to a great extent, and now it should according to default rule, increase the barrelage of Hash table, resets and suits the requirements
Hash table；When the quantity of the Hash node counting on is less than Hash node and uses lower limit, illustrate that this Hash table to be measured has many
The memory headroom not utilized, now it should according to default rule, reduce the barrelage of Hash table, discharge those occupy for a long time but
Unemployed memory headroom, improves the process performance of existing software on the whole.
Further, Hash Duty-circle lower limit is less than the half of the Hash Duty-circle upper limit, can avoid frequently
The new Hash table of reconstruction.
Step S13, when the barrelage judging Hash table to be measured needs adjustment, adjusts the bucket of Hash table according to preset rules
Number, re-establishes Hash table.
Specifically, above-mentioned steps S13 can be realized in the following way：
1, when the Hash number of nodes counting on exceedes Hash node SC service ceiling, from default Prime sequences, choosing
Take relatively large prime number as the barrelage of new Hash table, re-establish Hash table.
In the present embodiment, when the Hash number of nodes counting on exceedes Hash node SC service ceiling, need to Hash
Bucket is expanded, and again applies for continuous internal memory for new Hash bucket, the barrelage of new Hash table is in default Prime sequences
Next relatively large prime number (barrelage of existing Hash table is also to choose from default Prime sequences).Then travel through old
Hash table, all Hash nodes of old Hash table are reinserted in new Hash table, and for new Hash table setting meter
New Hash node uses upper and lower limit.After the completion of destroy old Hash table, discharge old Hash bucket internal memory.
2, when the Hash number of nodes counting on is less than Hash node and uses lower limit, from default Prime sequences, choosing
Take relatively small prime number as the barrelage of new Hash table, re-establish Hash table.
In the present embodiment, when the Hash number of nodes counting on is less than Hash node and uses lower limit, need to Hash
Bucket is reduced, and is chosen to the direction that numerical value diminishes according to default Prime sequences, until the Hash number of nodes of statistics
(it is that Hash Duty-circle lower limit is chosen with new that this new Hash node uses lower limit to use lower limit more than new Hash node
The product of Hash barrelage), that is, allow, when reducing, reduction of skipping a grade.Again application contiguous memory is used for new Hash table, then travels through
Old Hash table, all nodes of old Hash table are reinserted in new Hash table, and calculate new for new Hash setting
Hash node use upper and lower limit.After the completion of destroy old Hash table, discharge old Hash bucket internal memory.
Additionally, when deleting Hash node, reduce statistics in Hash node counter, carry out deletion action, but not
Carry out any Hash table to expand and reduction operation.Reason is that the use to Hash table is frequently necessary to traverse node, is such as similar to and deletes
Except the operation of all time-out nodes, if there is Hash reduction during traverse node, now old Hash table is released
Put, serious EMS memory error can be led to.
Further, in default Prime sequences, each prime number less times greater than 2 times of its adjacent previous prime number, often
Individual prime number all try one's best remote its nearest neighbours 2 power.
In the present embodiment it is desirable to the Serial No. of Hash bucket is the sequence of a prime number, because in actual treatment environment
Under, if the cryptographic Hash of input possesses certain rule, such as substantial amounts of arithmetic progression, then send out when tolerance and modulus are relatively prime
The probability of raw collision can become big, and just can largely avoid this problem so that Hash table can avoid one with prime number
The performance focus of a little local.
With reference to Fig. 2-5, the method illustrating this process network traffic analysis.
In fig. 2, the barrelage of this Hash table is 5, and due to network traffic data less, data cube computation number is less, and conflict chain
The average chained list length of table is shorter, and hash-collision probability is less；
When network traffic data increases suddenly (hot news of such as burst), referring to Fig. 3, the node of Hash table increases
Many, data cube computation number also increases, and the average chained list length of conflict chained list increases, and hash-collision probability increases, now, this Hash table
Performance be difficult to meet existing demand, need the barrelage of this Hash table is expanded.
Referring to Fig. 4, this Hash table is the new Hash table expanding after Hash bucket, and the quantity of its Hash bucket is 11 (more than former
2 times of barrelage 5), after original Hash node is redistributed, the average chained list length fall of conflict chained list in new Hash table
Low, hash-collision probability reduces；
When network traffic data is greatly reduced, there are many Hash buckets not utilized in Hash table, greatly waste this
A little internal memories occupied by Hash bucket.Referring to Fig. 5, the barrelage of the Hash table in Fig. 4 is reduced, form new Hash table, have
Effect releases unemployed memory headroom.
The embodiment of the present invention is passed through to count the quantity of Hash node in Hash table to be measured, then according to default Hash node
SC service ceiling and Hash node use lower limit, and the barrelage to judge Hash table to be measured is the need of adjustment, and ought judge Kazakhstan to be measured
When the barrelage of uncommon table needs adjustment, adjust the barrelage of Hash table according to preset rules, re-establish Hash table, to realize processing net
The method of network flow analysis.So pass through to adjust the barrelage of Hash table so that new Hash table can actively adapt to network traffics
Demand, when network traffics increase, the barrelage of Hash table can be expanded, to improve the performance of new Hash table, work as network flow
When amount reduces, the barrelage of Hash table can be reduced, be occupied but unemployed memory headroom with discharging, will more leave unused interior
Deposit and be released to operating system, improve the process performance of existing software on the whole.
Embodiment two
Embodiments provide a kind of device processing network traffic analysis, employ the process described in embodiment one
The method of network traffic analysis, referring to Fig. 6, this device can include：
Statistical module 100, for counting the quantity of Hash node in Hash table to be measured, Hash table to be measured includes and Hash table
In one of each cryptographic Hash correspondence establishment conflict chained list.
In the present embodiment, the packet in network can be reduced into number by the existing method processing network traffic analysis
According to connection, carry out the analysis business on upper strata on the basis of data cube computation again.Hash table is kind of a data structure, and it can provide soon
The update of speed and search operation, it is usually applied in disparate networks flow analysis software.
It should be noted that the Hash table to be measured in the present embodiment uses chain address method to process hash-collision,
I.e. to each cryptographic Hash in Hash table (i.e. keyword passes through the calculated hash address for storing data of hash function)
Set up a conflict chained list, the data cube computation clashing is stored therein in the form of chained list.Additionally, Hash table to be measured exists
At the beginning of foundation, it can be the Hash bucket application contiguous memory of Hash table.Hash bucket be deposited using a sequence list have identical
The head node of the chained list of the keyword of cryptographic Hash, can find other keywords using this head node.
In actual applications, the counter of Hash node in the data structure of Hash table, can be set, to count Hash
The quantity of Hash node in table, when having new insertion Hash node for every time, in counter, statistical magnitude increases.
Judge module 200, for using lower limit according to default Hash node SC service ceiling and Hash node, to judge to treat
The need of adjustment, Hash node SC service ceiling is the Hash Duty-circle upper limit and current Hash table to the barrelage surveying Hash table
The product of barrelage, Hash node utilization rate lower limit is the product of Hash Duty-circle lower limit and the barrelage of current Hash table.
In the present embodiment, the barrelage of Hash table refers to the quantity of Hash bucket in Hash table.Hash bucket is suitable using one
Sequence table, to deposit the head node of the chained list of the keyword with identical cryptographic Hash, can find other passes using this head node
Key word.
Processing module 300, during for needing adjustment when the barrelage judging Hash table to be measured, adjusts Hash according to preset rules
The barrelage of table, re-establishes Hash table.
Specifically, judge module 200, are additionally operable to use according to whether the Hash number of nodes counting on exceedes Hash node
The upper limit, or, whether the Hash number of nodes counting on uses lower limit less than Hash node, to judge the barrelage of Hash table to be measured
The need of adjustment.
In the present embodiment, when the quantity of the Hash node counting on exceedes Hash node SC service ceiling, illustrate that this is treated
Survey Hash table and can not meet present network traffics, occur the probability of Hash collision to increase, alignment processing network traffic analysis
Efficiency declines to a great extent, now it should according to default rule, increasing the barrelage of Hash table, reset the Hash suiting the requirements
Table；When the quantity of the Hash node counting on is less than Hash node and uses lower limit, illustrate that this Hash table to be measured has many not sharp
Memory headroom, now it should according to default rule, reduce the barrelage of Hash table, discharge those occupy for a long time but not by
Using memory headroom, improve the process performance of existing software on the whole.
Further, processing module 300, are additionally operable to the Hash number of nodes when counting on and exceed Hash node SC service ceiling
When, from default Prime sequences, choose relatively large prime number as the barrelage of new Hash table, re-establish Hash table.
In the present embodiment, when the Hash number of nodes counting on exceedes Hash node SC service ceiling, need to Hash
Bucket is expanded, and again applies for continuous internal memory for new Hash bucket, the barrelage of new Hash table is in default Prime sequences
Next relatively large prime number (barrelage of existing Hash table is also to choose from default Prime sequences).Then travel through old
Hash table, all Hash nodes of old Hash table are reinserted in new Hash table, and for new Hash table setting meter
New Hash node uses upper and lower limit.After the completion of destroy old Hash table, discharge old Hash bucket internal memory.
Processing module 300, is additionally operable to when the Hash number of nodes counting on is less than Hash node and uses lower limit, from default
Prime sequences in, choose relatively small prime number as the barrelage of new Hash table, re-establish Hash table.
In the present embodiment, when the Hash number of nodes counting on is less than Hash node and uses lower limit, need to Hash
Bucket is reduced, and is chosen to the direction that numerical value diminishes according to default Prime sequences, until the Hash number of nodes of statistics
(it is that Hash Duty-circle lower limit is chosen with new that this new Hash node uses lower limit to use lower limit more than new Hash node
The product of Hash barrelage), that is, allow, when reducing, reduction of skipping a grade.Again application contiguous memory is used for new Hash table, then travels through
Old Hash table, all nodes of old Hash table are reinserted in new Hash table, and calculate new for new Hash setting
Hash node use upper and lower limit.After the completion of destroy old Hash table, discharge old Hash bucket internal memory.
Additionally, when deleting Hash node, reduce statistics in Hash node counter, carry out deletion action, but not
Carry out any Hash table to expand and reduction operation.Reason is that the use to Hash table is frequently necessary to traverse node, is such as similar to and deletes
Except the operation of all time-out nodes, if there is Hash reduction during traverse node, now old Hash table is released
Put, serious EMS memory error can be led to.
Further, in default Prime sequences, each prime number is all higher than 2 times of its adjacent previous prime number.
In the present embodiment it is desirable to the Serial No. of Hash bucket is the sequence of a prime number, because in actual treatment environment
Under, if the cryptographic Hash of input possesses certain rule, such as substantial amounts of arithmetic progression, then send out when tolerance and modulus are relatively prime
The probability of raw collision can become big, and just can largely avoid this problem so that Hash table can avoid one with prime number
The performance focus of a little local.
Further, Hash Duty-circle lower limit is less than the half of the Hash Duty-circle upper limit, can avoid frequently
The new Hash table of reconstruction.
The embodiment of the present invention is passed through to count the quantity of Hash node in Hash table to be measured, then according to default Hash node
SC service ceiling and Hash node use lower limit, and the barrelage to judge Hash table to be measured is the need of adjustment, and ought judge Kazakhstan to be measured
When the barrelage of uncommon table needs adjustment, adjust the barrelage of Hash table according to preset rules, re-establish Hash table.So pass through to adjust
The barrelage of Hash table is so that new Hash table can actively adapt to the demand of network traffics, when network traffics increase, Ke Yikuo
Fill the barrelage of Hash table, to improve the performance of new Hash table, when network traffics reduce, the barrelage of Hash table can be reduced,
It is occupied but unemployed memory headroom with discharging, more freememories are released to operating system, improve on the whole
The process performance of existing software.
The embodiments of the present invention are for illustration only, do not represent the quality of embodiment.
It should be noted that：The device of the process network traffic analysis that above-described embodiment provides is being realized processing network traffics
Analysis method when, be only illustrated with the division of above-mentioned each functional module, in practical application, can as desired by
Above-mentioned functions distribution is completed by different functional modules, the internal structure of equipment will be divided into different functional modules, with complete
Become all or part of function described above.In addition, the device and the place that process network traffic analysis that above-described embodiment provides
The analysis method embodiment of reason network traffics belongs to same design, and it implements process and refers to embodiment of the method, here no longer
Repeat.
One of ordinary skill in the art will appreciate that all or part of step realizing above-described embodiment can pass through hardware
To complete it is also possible to the hardware being instructed correlation by program is completed, described program can be stored in a kind of computer-readable
In storage medium, storage medium mentioned above can be read-only storage, disk or CD etc..
The foregoing is only presently preferred embodiments of the present invention, not in order to limit the present invention, all spirit in the present invention and
Within principle, any modification, equivalent substitution and improvement made etc., should be included within the scope of the present invention.
Claims (10)
1. a kind of method processing network traffic analysis is it is characterised in that include：
Count the quantity of Hash node in Hash table to be measured, described Hash table to be measured includes corresponding with each cryptographic Hash in Hash table
The conflict chained list set up；
Lower limit is used according to default Hash node SC service ceiling and Hash node, to judge whether the barrelage of Hash table to be measured needs
Adjust, described Hash node SC service ceiling is the product of the Hash Duty-circle upper limit and the barrelage of current Hash table, described
Hash node uses the product that lower limit is Hash Duty-circle lower limit and the barrelage of current Hash table；
When the barrelage judging Hash table to be measured needs adjustment, adjust the barrelage of Hash table according to preset rules, re-establish Kazakhstan
Uncommon table.
2. method according to claim 1 it is characterised in that described according to default Hash node SC service ceiling and Hash
Node uses lower limit, to judge the barrelage of Hash table to be measured the need of adjustment, including：
Whether the Hash number of nodes according to counting on exceedes Hash node SC service ceiling, or, the Hash nodes counting on
Whether amount uses lower limit less than Hash node, and the barrelage to judge Hash table to be measured is the need of adjustment.
3. method according to claim 2 is it is characterised in that the described barrelage that ought judge Hash table to be measured needs to adjust
When, adjust the barrelage of Hash table according to preset rules, re-establish Hash table, including：
When the Hash number of nodes counting on exceedes Hash node SC service ceiling, from default Prime sequences, choose relatively
Larger prime number, as the barrelage of new Hash table, re-establishes Hash table；
When the Hash number of nodes counting on is less than Hash node and uses lower limit, from default Prime sequences, choose relatively
Less prime number, as the barrelage of new Hash table, re-establishes Hash table.
4. method according to claim 3 it is characterised in that in described default Prime sequences each prime number be all higher than it
2 times of adjacent previous prime number.
5. the method according to any one of claim 1-4 is it is characterised in that described Hash Duty-circle lower limit is less than institute
State the half of the Hash Duty-circle upper limit.
6. a kind of device processing network traffic analysis is it is characterised in that include：
Statistical module, for counting the quantity of Hash node in Hash table to be measured, described Hash table to be measured include with Hash table in
One conflict chained list of each cryptographic Hash correspondence establishment；
Judge module, for using lower limit according to default Hash node SC service ceiling and Hash node, to judge Hash to be measured
The need of adjustment, described Hash node SC service ceiling is the bucket of the Hash Duty-circle upper limit and current Hash table to the barrelage of table
The product of number, described Hash node utilization rate lower limit is the product of Hash Duty-circle lower limit and the barrelage of current Hash table；
Processing module, during for needing adjustment when the barrelage judging Hash table to be measured, adjusts the bucket of Hash table according to preset rules
Number, re-establishes Hash table.
7. device according to claim 6, it is characterised in that described judge module, is additionally operable to according to the Hash counting on
Whether number of nodes exceedes Hash node SC service ceiling, or, whether the Hash number of nodes counting on makes less than Hash node
With lower limit, the barrelage to judge Hash table to be measured is the need of adjustment.
8. device according to claim 7, it is characterised in that described processing module, is additionally operable to when the Hash section counting on
When point quantity exceedes Hash node SC service ceiling, from default Prime sequences, choose relatively large prime number as new Hash
The barrelage of table, re-establishes Hash table；
Described processing module, is additionally operable to when the Hash number of nodes counting on is less than Hash node and uses lower limit, from default
In Prime sequences, choose relatively small prime number as the barrelage of new Hash table, re-establish Hash table.
9. device according to claim 8 it is characterised in that in described default Prime sequences each prime number be all higher than it
2 times of adjacent previous prime number.
10. the device according to any one of claim 6-9 is it is characterised in that described Hash Duty-circle lower limit is less than
The half of the described Hash Duty-circle upper limit.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610956892.1A CN106411654A (en) | 2016-10-27 | 2016-10-27 | Method and device for processing network traffic analysis |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201610956892.1A CN106411654A (en) | 2016-10-27 | 2016-10-27 | Method and device for processing network traffic analysis |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN106411654A true CN106411654A (en) | 2017-02-15 |
Family
ID=58014710
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201610956892.1A Pending CN106411654A (en) | 2016-10-27 | 2016-10-27 | Method and device for processing network traffic analysis |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN106411654A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109104407A (en) * | 2018-06-29 | 2018-12-28 | 国网湖南省电力有限公司 | A kind of online tracking of network log based on characteristic key and system |
| CN113672619A (en) * | 2021-08-17 | 2021-11-19 | 天津南大通用数据技术股份有限公司 | Method for segmenting data more uniformly according to hash rule |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101582082A (en) * | 2009-06-16 | 2009-11-18 | 深圳市茁壮网络股份有限公司 | Method and device for dynamically adapting for data by Hash table |
| CN101826107A (en) * | 2010-04-02 | 2010-09-08 | 华为技术有限公司 | Hash data processing method and device |
| CN102662988A (en) * | 2012-03-14 | 2012-09-12 | 中山大学 | Method for filtering redundant data of RFID middleware |
| CN103905503A (en) * | 2012-12-27 | 2014-07-02 | 中国移动通信集团公司 | Data storage method, data scheduling method, device and system |
| CN104202409A (en) * | 2014-09-12 | 2014-12-10 | 成都卫士通信息产业股份有限公司 | Balanced load SSL VPN (security socket layer, virtual private network) device cluster system and operating method thereof |
| CN106033420A (en) * | 2015-03-11 | 2016-10-19 | 杭州华三通信技术有限公司 | A Hash table processing method and device |
-
2016
- 2016-10-27 CN CN201610956892.1A patent/CN106411654A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN101582082A (en) * | 2009-06-16 | 2009-11-18 | 深圳市茁壮网络股份有限公司 | Method and device for dynamically adapting for data by Hash table |
| CN101826107A (en) * | 2010-04-02 | 2010-09-08 | 华为技术有限公司 | Hash data processing method and device |
| CN102662988A (en) * | 2012-03-14 | 2012-09-12 | 中山大学 | Method for filtering redundant data of RFID middleware |
| CN103905503A (en) * | 2012-12-27 | 2014-07-02 | 中国移动通信集团公司 | Data storage method, data scheduling method, device and system |
| CN104202409A (en) * | 2014-09-12 | 2014-12-10 | 成都卫士通信息产业股份有限公司 | Balanced load SSL VPN (security socket layer, virtual private network) device cluster system and operating method thereof |
| CN106033420A (en) * | 2015-03-11 | 2016-10-19 | 杭州华三通信技术有限公司 | A Hash table processing method and device |
Non-Patent Citations (1)
| Title |
|---|
| 前利: ""Java8系列之重新认识HashMap"", 《IMPORTNEW》 * |
Cited By (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN109104407A (en) * | 2018-06-29 | 2018-12-28 | 国网湖南省电力有限公司 | A kind of online tracking of network log based on characteristic key and system |
| CN109104407B (en) * | 2018-06-29 | 2020-10-02 | 国网湖南省电力有限公司 | Online tracking method and system for weblog based on feature retrieval |
| CN113672619A (en) * | 2021-08-17 | 2021-11-19 | 天津南大通用数据技术股份有限公司 | Method for segmenting data more uniformly according to hash rule |
| CN113672619B (en) * | 2021-08-17 | 2024-02-06 | 天津南大通用数据技术股份有限公司 | Method for segmenting data according to hash rule to make data more uniform |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN107729147B (en) | Data processing method in stream computing system, control node and stream computing system | |
| CN109903049A (en) | A kind of block chain transaction data storage method, device, equipment and storage medium | |
| US8914491B2 (en) | Assigning telecommunications nodes to community of interest clusters | |
| CN101252541B (en) | Method for establishing network flow classified model and corresponding system thereof | |
| CN113132249A (en) | Load balancing method and equipment | |
| CN100459589C (en) | A method to monitor flow and flow monitoring equipment | |
| CN101296114A (en) | Parallel pattern matching method and system based on stream | |
| CN109639575A (en) | Route planning method based on link congestion coefficient | |
| CN107113323B (en) | Data storage method, device and system | |
| CN106411654A (en) | Method and device for processing network traffic analysis | |
| CN109274593A (en) | A kind of information storage means and device | |
| JP5747393B1 (en) | Flow aggregation apparatus, method, and program | |
| CN105704054A (en) | Data center network flow migration method and system thereof | |
| CN114844708B (en) | Method, equipment and storage medium for relieving flooding attack based on traffic rerouting link | |
| Greenwald et al. | Quantiles and equi-depth histograms over streams | |
| CN107016080A (en) | A kind of high-efficiency network packet classification method | |
| CN103873712A (en) | VoIP gateway detection method and multi-core processing device | |
| CN106095843B (en) | Social account method for digging and device | |
| CN110149221A (en) | A kind of construction method and device of the adaptive network based on alliance's chain | |
| JP5948494B2 (en) | Dynamic allocation of records to clusters in ternary associative memory | |
| CN107688625A (en) | A kind of method and system of the storage small documents based on distributed memory system | |
| CN106453092A (en) | Routing update method and device | |
| CN108345699A (en) | Obtain the method, apparatus and storage medium of multi-medium data | |
| JPWO2015170474A1 (en) | Packet transmission apparatus, packet transmission system, and packet transmission method | |
| CN112087395B (en) | Service type hierarchical flow control method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20170215 |