CN1909554A - Method and system for data flow sampling - Google Patents
Method and system for data flow sampling Download PDFInfo
- Publication number
- CN1909554A CN1909554A CNA2006101113036A CN200610111303A CN1909554A CN 1909554 A CN1909554 A CN 1909554A CN A2006101113036 A CNA2006101113036 A CN A2006101113036A CN 200610111303 A CN200610111303 A CN 200610111303A CN 1909554 A CN1909554 A CN 1909554A
- Authority
- CN
- China
- Prior art keywords
- sampling
- sample frequency
- sampled
- flow amount
- sampling configuration
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Landscapes
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention relates to a method for sampling data flow and a relative system, belonging to the network communication technique, wherein said method comprises: setting system parameter, obtaining the summary value of report character, sampling the data flow, adjusting the sampling frequency and the sampling mode to sample continuously. The inventive system comprises: a setting system parameter module, a sampling module, a mode-frequency adjusting module. The invention can adjust the sampling methods based on the report flux, to confirm the processing property, to make the sampled data flow integrated, and confirm the sampled data flow be able to be sampled continuously, when the processing ability is enough.
Description
Technical field
The present invention relates to network communication field, particularly a kind of method and system that data stream is sampled.
Background technology
In the network of packet switching, desirable switching equipment should carry out linear speed to all messages to be handled.When disposal ability can not satisfy traffic demand, can only abandon newly arrived message.And in non-switching equipment, in network status monitoring or intruding detection system, the message in the network is handled all to do all messages that can not handle according to disposal ability simply and is abandoned.With the network security is example, in intruding detection system, also be based on unusual detection technique owing to no matter be based on misuse, all need the load or the header portion of message are analyzed and handled, only collect and comprise the message of attacking content and could guarantee that intruding detection system is unlikely to fail to report important attack and determines the source of this important attack.Like this, sampling just becomes a kind of valuable scheme.Usually, in the network information is handled, when flow during greater than disposal ability, all need be by the sampling means Coordination Treatment.Can obtain flow information by flow is sampled, flow information so that can be used for network design and planning, based on price, quality of service monitor and the network security used.
In sampling process, wish that sampling algorithm can have the characteristic of two aspects at least: at first, the computational complexity of sampling algorithm itself can not be too high, otherwise can increase the weight of to handle burden; Secondly, sampling algorithm will collect that part of sample to the most worthy of dealing with problems.On this basis, wish that also sampling algorithm can guarantee that self can not cause system crash because flow increases, and can make full use of the disposal ability of system as much as possible according to the change of flow.
In existing sampling algorithm, periodic samples is one of simple algorithm, implements the influence of handling property very little.Secondly, also can utilize randomizer to produce the stochastical sampling set, press the probability uniform sampling.In addition, different messages can be got up by its Attribute Association, i.e. message (stream of formation) sampling to having same alike result based on the sampling of Hash.
At present, NetFlow is a use network state monitoring tool very widely.NetFlow samples by probability to message, but its result can cause the imperfect of tcp data stream.For for the intruding detection system of misuse (characteristic matching), the feature of some attacks can be dispersed in the different messages of same stream, because sampling can not guarantee that the association message of same stream all is sampled, thereby can make this attack might escape detection; Equally, for the abnormality detection based on state, this can cause the discontinuous of state variation, has influence on final detection result.
In addition, also having a kind of sampling is to utilize the convection current of Hash function to sample.During sampling, adjust sample mode to adapt to the variation of flow and disposal ability by mode at random.When fine granularity was sampled, the stream of this fine granularity sampling differed and comprises the stream that last coarseness samples surely from coarseness rollback one-level.Can cause the stream that samples imperfect like this, influence the final result of intrusion detection.
Summary of the invention
The objective of the invention is to overcome the incomplete problem of the data flow that samples in the prior art, a kind of method and system that data stream is sampled are provided.Described technical scheme is as follows:
A kind of method that data stream is sampled said method comprising the steps of:
Steps A: whether judge sample frequency more than or equal to 1, if the attribute of the message in the data flow that receives is carried out computing obtain digest value, then execution in step B; Otherwise the data flow of receiving is all sampled, then execution in step C;
Step B:, described data flow is sampled according to the digest value of the attribute in the message that receives according to sample frequency and sampling configuration;
Step C: regulate sample frequency and sampling configuration according to the data flow that samples, return steps A and continue sampling.
Before described steps A, also comprise the step of initialization system parameter, specifically comprise:
Define a data structure, described data structure comprises overtime flow amount, does not finish flow amount, valuable flow amount and time span;
For described overtime flow amount, do not finish flow amount, valuable flow amount and time span predetermined threshold value respectively;
Initialization sample frequency and sampling configuration are 0.
Computing in the described steps A is a Hash operation.
Described step B specifically comprises:
The result that the digest value mould that calculates the five-tuple of message in the described data flow removes 2 sample frequency time power selects the message that described result equals the digest value correspondence of sampling configuration.
Described step C specifically comprises:
Step C1: according to the data flow that samples new data structure more, judge whether the described flow amount that do not finish surpasses described threshold value, if, execution in step C2; Otherwise execution in step C3;
Step C2: sample frequency adds 1, and time span is set to 0;
Step C3:, rotate sampling configuration if sample when being worth deficiency; Otherwise do not change sampling configuration;
Step C4: if when overtime flow amount surpasses its threshold value, time span adds 1; Otherwise time span is constant;
Step C5: if time span equals threshold value, reduce sample frequency, revising sampling configuration is that former sampling configuration mould removes 2 sample frequency time power, and time span is set to 0; If time span is less than threshold value, sample frequency is constant;
Step C6: proceed sampling according to sample frequency after regulating and sampling configuration.
The present invention also provides a kind of system that data stream is sampled, and described system comprises with lower module:
Sampling module, be used to judge that whether sample frequency is more than or equal to 1, if, the attribute of the message in the data flow that receives is carried out computing obtain digest value, described data flow is sampled according to the digest value of the attribute in the message that receives according to sample frequency and sampling configuration; Otherwise the data flow that receives is all sampled;
Adjusting pattern and frequency module are used for regulating sample frequency and sampling configuration according to the data flow that samples, and continue sampling.
Described system also comprises:
The initialization system parameter module is used to define a data structure, and described data structure comprises overtime flow amount, do not finish flow amount, valuable flow amount and time span;
For described overtime flow amount, do not finish flow amount, valuable flow amount and time span predetermined threshold value respectively;
Initialization sample frequency and sampling configuration are 0.
Computing in the described sampling module is a Hash operation.
Whether described sampling module specifically is used to judge described sample frequency more than or equal to 1, if the result that the digest value mould that calculates five-tuple in the described data flow removes 2 sample frequency time power selects the message that described result equals the digest value correspondence of sampling configuration; Otherwise the data flow that receives is all sampled.
Described adjusting pattern and frequency module specifically comprise:
Regulate the sampling configuration unit, be used for whether judging the described flow amount that do not finish above described threshold value according to the data flow that samples new data structure more, if sample frequency adds 1, time span is set to 0; When sampling is worth deficiency else if, rotates sampling configuration, otherwise do not change sampling configuration; Judge whether overtime flow amount surpasses its threshold value, if time span adds 1; Otherwise time span is constant;
Regulate the sample frequency unit, be used at that time between span when equaling threshold value, reduce sample frequency, revising sampling configuration is that former sampling configuration mould removes 2 sample frequency time power, and time span is set to 0; When span was less than threshold value at that time, sample frequency was constant.
The beneficial effect that technical scheme of the present invention is brought is:
Be mapped as integer by attribute (as five-tuple), integer value is sampled, and adjust sample mode, guaranteed handling property, make the data flow that samples more complete according to the message flow self adaptation with message.
Simultaneously, guarantee that the data flow that has been sampled can be continued sampling and can the data flow that sample most worthy in limited time be arranged in disposal ability when disposal ability is arranged.
Description of drawings
Fig. 1 is the embodiment of the invention 1 a described method of sampling flow chart;
Fig. 2 is the method flow diagram of the embodiment of the invention 1 described adjusting sampling configuration and sample frequency;
Fig. 3 is the embodiment of the invention 2 described sampling system schematic diagrames.
Embodiment
The invention will be further described below in conjunction with the drawings and specific embodiments, but not as a limitation of the invention.
The present invention carries out computing by the attribute to the message in the data flow to obtain digest value, according to digest value data stream is sampled, adjust sample mode according to the message flow self adaptation in the sampling process, the attribute here can be five-tuple (the source IP of message, source port, purpose IP, destination interface, agreement) or the part of five-tuple.
Embodiment 1
Referring to Fig. 1, the invention provides a kind of method that data stream is sampled, this method may further comprise the steps:
Step 101: initialization system parameter.
Adopt the information of the internal memory store data stream of fixed size in system, the replacement policy of data in EMS memory stream is LRU (LeastRecently Used is not used recently).Because it is huge that the life cycle of data flow changes, it is then very of short duration that some data flow can continue other data flow of long period, and the message amount that is comprised in the data flow also varies, and therefore can't determine sampling parameter simply according to the arrival rate of message.So need data structure of definition, this data structure comprises overtime flow amount timeout_count, does not finish flow amount premature_count, valuable flow amount valued_count, time span cycle_times.
Wherein, timeout_count is used for adding up the overtime flow amount of given interval, and this overtime stream refers to sluggish data flow, and promptly the state of data flow does not change, and comprises the data flow that has finished;
Premature_count is used to add up the number of the unclosed stream that is replaced, and unclosed stream refers to the data flow that is replaced too early illustrate that processing speed lags behind the arrival rate of data flow;
Valued_count is used to add up valuable flow amount, requirement according to the sampling applied environment, the method for expressing that is worth can be different, for example in the application of intruding detection system, can be defined as and detect what of doubtful attack, in the network state statistics application, can be defined as the maximum data flow of used resource, i.e. hog_count;
Cycle_times is used to be recorded in the time span under a certain sample frequency, regulates sample frequency by this record, can prevent the shake of sample frequency.
During the initialization system parameter, to timeout_count, premature_count, valued_count, four variable predetermined threshold value of cycle_times, this threshold value are empirical values, can the reference experiment process determine.And sample frequency samp_rate and sampling configuration samp_mode are initialized as 0, sample frequency samp_rate is used to choose data flow, when using the method for sampling of the present invention and sampling, the value of sample frequency is set to more than or equal to 1, sampling configuration is used for determining specifically to choose which message of data flow, and the value of sampling configuration is 0 to 2
Samp_rateBetween-1.
Step 102: judge that whether sample frequency samp_rate is more than or equal to 1; If, execution in step 103; Otherwise execution in step 105.
Step 103: the attribute of the message that receives is carried out computing obtain digest value.
Wherein, the attribute of message refers to the character that is different from other message that message has, and it can be the five-tuple of message, i.e. the five-tuple that special domain constituted in the protocol header of message, and this five-tuple is source IP, source port, purpose IP, destination interface and agreement.Present embodiment is that example adopts with the five-tuple of message.
The computing here obtains integer value for five-tuple is mapped to integer field in addition, with the digest value of this integer value as five-tuple.The present embodiment employing is carried out the Hash computing to five-tuple and is obtained digest value hash_v.This Hash calculating process is a prior art, repeats no more here.
Step 104: if sample frequency samp_rate more than or equal to 1 o'clock, samp_rate chooses data flow according to sample frequency, and the data flow of choosing is chosen message according to sampling configuration samp_mode.
Samp_rate has determined the granularity of sampling, and samp_mode can specify the difference of same particle sizes down-sampling sample.Present embodiment is sampled according to sample frequency samp_rate, promptly samples 2 at every turn
Samp_rateA data flow in the individual data flow removes 2 with the digest value hash_v mould of the five-tuple of all messages in this data flow
Samp_rate, the message that the result is equaled the samp_mode correspondence is selected.
Because sampling step length 2
Samp_rateIncrease by 2 power power, guaranteed that from coarseness rollback one-level the data flow that fine granularity is sampled necessarily can comprise the data flow that last coarseness samples when fine granularity is sampled; When sample frequency increases, guaranteed that the sample of being adopted must be sample this a subclass of a last frequency.
Step 105: if sample frequency samp_rate is 0 o'clock, the data flow that receives is all sampled, promptly all receive.
Step 106: regulate sampling configuration and sample frequency according to the data flow that sampling is received.
Referring to Fig. 2, the adjusting of concrete sampling configuration and sample frequency may further comprise the steps:
Step 201: according to the data flow that samples new data structure more.Promptly add up sometime overtime flow amount timeout_count under the span cycle_times, do not finish flow amount premature_count, how many valuable flow amount valued_count respectively is.
Step 202: judge and not finish flow amount premature_count whether greater than the threshold value of correspondence, if, execution in step 203; Otherwise execution in step 204.
Step 203: do not finish the threshold value of flow amount premature_count greater than correspondence, show that existing sample frequency can not meet the demands, need to increase sample frequency, at this moment sample frequency adds 1, cycle_times is set to 0, and it is continuous for the data flow that guarantees to sample that sample frequency adds 1, also can add 2, add 3 etc., but the data flow of the too big explanation sampling of the numeral that adds can be imperfect.Execution in step 207 then.
Step 204: do not finish the threshold value of flow amount premature_count, judge whether sampling is worth reasonable, if rationally, carry out step 205 and do not change sampling configuration, otherwise carry out step 206 smaller or equal to correspondence.
Step 205: do not change sampling configuration samp_mode.
Step 206: sampling is worth not enough, and promptly valued_count is less than the threshold value of correspondence, sampling configuration by turns, promptly sampling configuration samp_mode add 1 back mould remove 2 samp_rate power with assurance samp_mode 0 to 2
Samp_rateBetween-1.
Step 207: judge whether overtime flow amount surpasses its corresponding threshold value, if, execution in step 208; Otherwise execution in step 209.
Step 208: time span cycle_times adds 1.
Step 209: time span cycle_times remains unchanged.
Step 210: whether judgement time span cycle_times equals corresponding threshold value, if, execution in step 211; Otherwise execution in step 212.
Step 211: if time span cycle_times equals corresponding threshold value, reduce sample frequency samp_rate, be that samp_rate subtracts 1, the while sampling configuration equals former sampling configuration mould and removes samp_rate power of sample frequency of 2, and time span cycle_times is set to 0.
For instance, if samp_rate is 2, samp_mode is 2, and the digest value hash_v of the five-tuple of then sampling is 2,6,10 ..., message; When returning to a last sample frequency, promptly samp_rate is 1 o'clock, and samp_mode is that 2 moulds remove 21 power, promptly 0, and the digest value hash_v of sampling message five-tuple is 2,4,6,8,10, ..., message, comprise the stream of sampling last time, also promptly guaranteed the integrality of the stream that samples.Otherwise when samp_rate is 1, samp_mode is 1 o'clock, if increase sample frequency, samp_rate becomes 2, and samp_mode is that 1 mould removes 22 powers, and promptly 1, then the digest value hash_v of Cai Yang five-tuple is 1,5,9, ..., message, be that the digest value hash_v that was originally sampled is 1,3,5,7,9 ..., the part of message.
Step 212: if time span cycle_times does not reach preset value, sample frequency is constant.
With the Application of Intrusion Detection is example, if the number valued_count of the attack stream that is comprised in the data flow that samples is too small, what at first consider is that wheel changes sampling configuration, if in the replacement of data flow, the stream that being mostly of replacing finished also is that premature_count continues less than predefined threshold value, through after a while at interval after, span cycle_times equaled the corresponding preset value at that time, then can reduce sample frequency to gather more multisample.
Step 213: proceed sampling according to sample frequency after regulating and sampling configuration.The same employing of this sampling method of sampling provided by the invention.
Embodiment 2
Referring to Fig. 2, the present invention also provides a kind of system that data stream is sampled, and comprises with lower module:
Sampling module, be used to judge that whether sample frequency is more than or equal to 1, if, the attribute of the message in the data flow that receives is carried out computing obtain digest value, data stream is sampled according to the digest value of the attribute in the message that receives according to sample frequency and sampling configuration; Otherwise the data flow that receives is all sampled;
Adjusting pattern and frequency module are used for regulating sample frequency and sampling configuration according to the data flow that samples, and continue sampling.
In order to upgrade sampling configuration and sample frequency better, this system also comprises:
The initialization system parameter module, be used to define a data structure, this data structure comprises overtime flow amount, does not finish flow amount, valuable flow amount and time span, also be used to described overtime flow amount, do not finish flow amount, valuable flow amount and time span predetermined threshold value respectively, and initialization sample frequency and sampling configuration are 0.
Wherein, the computing in the sampling module is a Hash operation.
And whether sampling module specifically is used to judge described sample frequency more than or equal to 1, if the digest value mould of five-tuple removes the result of 2 sample frequency time power in the calculated data stream, selects the message that the result equals the digest value correspondence of sampling configuration; Otherwise the data flow that receives is all sampled.
Adjusting pattern and frequency module specifically comprise:
Regulate the sampling configuration unit, be used for judging according to the data flow that samples new data structure more whether surpass threshold value, if sample frequency adds 1, time span is set to 0 if not finishing flow amount; When sampling is worth deficiency else if, rotates sampling configuration, otherwise do not change sampling configuration; Judge whether overtime flow amount surpasses its threshold value, if time span adds 1; Otherwise time span is constant;
Regulate the sample frequency unit, be used at that time between span when equaling threshold value, reduce sample frequency, revising sampling configuration is that former sampling configuration mould removes 2 sample frequency time power, and time span is set to 0; When span was less than threshold value at that time, sample frequency was constant.
Above-described embodiment, the present invention embodiment a kind of more preferably just, the common variation that those skilled in the art carries out in the technical solution of the present invention scope and replacing all should be included in protection scope of the present invention.
Claims (10)
1. the method that data stream is sampled is characterized in that, said method comprising the steps of:
Steps A: whether judge sample frequency more than or equal to 1, if the attribute of the message in the data flow that receives is carried out computing obtain digest value, then execution in step B; Otherwise the data flow of receiving is all sampled, then execution in step C;
Step B:, described data flow is sampled according to the digest value of the attribute in the message that receives according to sample frequency and sampling configuration;
Step C: regulate sample frequency and sampling configuration according to the data flow that samples, return steps A and continue sampling.
2. the method that data stream is sampled as claimed in claim 1 is characterized in that, also comprises the step of initialization system parameter before described steps A, specifically comprises:
Define a data structure, described data structure comprises overtime flow amount, does not finish flow amount, valuable flow amount and time span;
For described overtime flow amount, do not finish flow amount, valuable flow amount and time span predetermined threshold value respectively;
Initialization sample frequency and sampling configuration are 0.
3. the method that data stream is sampled as claimed in claim 1 or 2 is characterized in that, the computing in the described steps A is a Hash operation.
4. the method that data stream is sampled as claimed in claim 1 or 2 is characterized in that, described step B specifically comprises:
The result that the digest value mould that calculates the five-tuple of message in the described data flow removes 2 sample frequency time power selects the message that described result equals the digest value correspondence of sampling configuration.
5. the method that data stream is sampled as claimed in claim 2 is characterized in that, described step C specifically comprises:
Step C1: according to the data flow that samples new data structure more, judge whether the described flow amount that do not finish surpasses described threshold value, if, execution in step C2; Otherwise execution in step C3;
Step C2: sample frequency adds 1, and time span is set to 0;
Step C3:, rotate sampling configuration if sample when being worth deficiency; Otherwise do not change sampling configuration;
Step C4: if when overtime flow amount surpasses its threshold value, time span adds 1; Otherwise time span is constant;
Step C5: if time span equals threshold value, reduce sample frequency, revising sampling configuration is that former sampling configuration mould removes 2 sample frequency time power, and time span is set to 0; If time span is less than threshold value, sample frequency is constant;
Step C6: proceed sampling according to sample frequency after regulating and sampling configuration.
6. the system that data stream is sampled is characterized in that, described system comprises with lower module:
Sampling module, be used to judge that whether sample frequency is more than or equal to 1, if, the attribute of the message in the data flow that receives is carried out computing obtain digest value, described data flow is sampled according to the digest value of the attribute in the message that receives according to sample frequency and sampling configuration; Otherwise the data flow that receives is all sampled;
Adjusting pattern and frequency module are used for regulating sample frequency and sampling configuration according to the data flow that samples, and continue sampling.
7. the system that data stream is sampled as claimed in claim 6 is characterized in that, described system also comprises:
The initialization system parameter module is used to define a data structure, and described data structure comprises overtime flow amount, do not finish flow amount, valuable flow amount and time span;
For described overtime flow amount, do not finish flow amount, valuable flow amount and time span predetermined threshold value respectively;
Initialization sample frequency and sampling configuration are 0.
8. as claim 6 or the 7 described systems that data stream is sampled, it is characterized in that the computing in the described sampling module is a Hash operation.
9. as claim 6 or the 7 described systems that data stream is sampled, it is characterized in that, described sampling module is used to specifically judge that whether described sample frequency is more than or equal to 1, if, the result that the digest value mould that calculates five-tuple in the described data flow removes 2 sample frequency time power selects the message that described result equals the digest value correspondence of sampling configuration; Otherwise the data flow that receives is all sampled.
10. the system that data stream is sampled as claimed in claim 7 is characterized in that, described adjusting pattern and frequency module specifically comprise:
Regulate the sampling configuration unit, be used for whether judging the described flow amount that do not finish above described threshold value according to the data flow that samples new data structure more, if sample frequency adds 1, time span is set to 0; When sampling is worth deficiency else if, rotates sampling configuration, otherwise do not change sampling configuration; Judge whether overtime flow amount surpasses its threshold value, if time span adds 1; Otherwise time span is constant;
Regulate the sample frequency unit, be used at that time between span when equaling threshold value, reduce sample frequency, revising sampling configuration is that former sampling configuration mould removes 2 sample frequency time power, and time span is set to 0; When span was less than threshold value at that time, sample frequency was constant.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNA2006101113036A CN1909554A (en) | 2006-08-18 | 2006-08-18 | Method and system for data flow sampling |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CNA2006101113036A CN1909554A (en) | 2006-08-18 | 2006-08-18 | Method and system for data flow sampling |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN1909554A true CN1909554A (en) | 2007-02-07 |
Family
ID=37700542
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CNA2006101113036A Pending CN1909554A (en) | 2006-08-18 | 2006-08-18 | Method and system for data flow sampling |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN1909554A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102130789A (en) * | 2011-04-15 | 2011-07-20 | 北京网御星云信息技术有限公司 | Method, device and system for measuring and sampling streams based on application groups |
| CN103617022A (en) * | 2013-12-13 | 2014-03-05 | 东莞市富卡网络技术有限公司 | Large data analysis method and terminal based on dynamic intelligent algorithm |
| CN105592041A (en) * | 2015-08-04 | 2016-05-18 | 杭州华三通信技术有限公司 | Network attack packet capturing method and device |
| CN112532444A (en) * | 2020-11-26 | 2021-03-19 | 上海阅维科技股份有限公司 | Data flow sampling method, system, medium and terminal for network mirror flow |
| CN112653588A (en) * | 2020-07-10 | 2021-04-13 | 深圳市唯特视科技有限公司 | Adaptive network traffic collection method, system, electronic device and storage medium |
-
2006
- 2006-08-18 CN CNA2006101113036A patent/CN1909554A/en active Pending
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN102130789A (en) * | 2011-04-15 | 2011-07-20 | 北京网御星云信息技术有限公司 | Method, device and system for measuring and sampling streams based on application groups |
| CN103617022A (en) * | 2013-12-13 | 2014-03-05 | 东莞市富卡网络技术有限公司 | Large data analysis method and terminal based on dynamic intelligent algorithm |
| CN105592041A (en) * | 2015-08-04 | 2016-05-18 | 杭州华三通信技术有限公司 | Network attack packet capturing method and device |
| CN105592041B (en) * | 2015-08-04 | 2019-01-08 | 新华三技术有限公司 | Network attack packet snapping method and device |
| CN112653588A (en) * | 2020-07-10 | 2021-04-13 | 深圳市唯特视科技有限公司 | Adaptive network traffic collection method, system, electronic device and storage medium |
| CN112532444A (en) * | 2020-11-26 | 2021-03-19 | 上海阅维科技股份有限公司 | Data flow sampling method, system, medium and terminal for network mirror flow |
| CN112532444B (en) * | 2020-11-26 | 2023-02-24 | 上海阅维科技股份有限公司 | Data flow sampling method, system, medium and terminal for network mirror flow |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN1909554A (en) | Method and system for data flow sampling | |
| CN1832483A (en) | Method and system for control data transmit in communication system | |
| CN1798436A (en) | Method and system for ensuring safe data service in mobile communication system | |
| CN1878082A (en) | Protective method for network attack | |
| CN101039498A (en) | Base station system having distributed warning process and method for processing warning thereof | |
| CN1556629A (en) | Method for regulating congest window in communication network | |
| CN1968192A (en) | Flow control method and apparatus | |
| CN101079746A (en) | Secure implementation method and device of broadband access device | |
| CN1910868A (en) | Method and device for controlling alignment buffer | |
| CN1878322A (en) | Fault positioning method and device | |
| CN101039314A (en) | Method for realizing safety warranty in evolution accessing network | |
| CN1906905A (en) | Service disabling attack protecting system, service disabling attack protecting method, and service disabling attack protecting program | |
| CN101035025A (en) | Network device management method and system | |
| CN1842022A (en) | Log processing system and method | |
| CN1841285A (en) | Remote monitoring method for network computer | |
| CN1968180A (en) | Multilevel aggregation-based abnormal flow control method and system | |
| CN1863154A (en) | Method for limiting current for point to point application | |
| CN1561043A (en) | Multi-user concurrent insertion device and its method | |
| CN1705308A (en) | User plane data processing method | |
| CN1914872A (en) | Session relay device, session relay method, and session relay program | |
| CN1314293C (en) | System and method for intelligent monitoring message center | |
| CN1855793A (en) | Control of video encoding speed | |
| CN1501622A (en) | Network traffic statistical method of IP device | |
| CN1221099C (en) | Method for controlling service priority for tunneling data packet in general packet wireless service | |
| CN1863403A (en) | Load controlling method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| C02 | Deemed withdrawal of patent application after publication (patent law 2001) | ||
| WD01 | Invention patent application deemed withdrawn after publication |
Open date: 20070207 |