TY - JOUR
T1 - Network Traffic Sampling System Based on Storage Compression for Application Classification Detection
AU - Xuan, Shichang
AU - Tang, Dezhi
AU - Chung, Ilyong
AU - Cho, Youngju
AU - Du, Xiaojiang
AU - Yang, Wu
N1 - Publisher Copyright:
© 2013 IEEE.
PY - 2020
Y1 - 2020
N2 - With the development of the Internet, numerous new applications have emerged, the features of which are constantly changing. It is necessary to perform application classification detection on the network traffic to monitor the changes in the applications. Using RelSamp to sample traffic can provide the sampled traffic with sufficient application features to support application classification. RelSamp separately assigns counters for each flow to record the statistical features and introduces a collision chain into the hash flow table to resolve hash conflicts in the table entries. However, in high-speed networks, owing to the number of concurrent flows and heavy-tailed nature of the traffic, the storage allocation method of RelSamp results in a significant waste of storage on the traffic sampling device. Moreover, the hash conflict resolution of RelSamp causes the collision chains of several hash table entries to be excessively deep, thereby reducing the search efficiency of the flow nodes. To overcome the shortcomings of RelSamp, this study presents a sampling model known as MiniSamp. Based on the RelSamp sampling mechanism, MiniSamp introduces shared counter trees to compress the storage space of the counters during the sampling process and integrates an efficient search tree into the hash table. The search tree structure is adjusted according to the network environment to improve the search efficiency of the flow nodes. The experimental results demonstrate that MiniSamp can effectively aid network operators to classify traffic in the high-speed network.
AB - With the development of the Internet, numerous new applications have emerged, the features of which are constantly changing. It is necessary to perform application classification detection on the network traffic to monitor the changes in the applications. Using RelSamp to sample traffic can provide the sampled traffic with sufficient application features to support application classification. RelSamp separately assigns counters for each flow to record the statistical features and introduces a collision chain into the hash flow table to resolve hash conflicts in the table entries. However, in high-speed networks, owing to the number of concurrent flows and heavy-tailed nature of the traffic, the storage allocation method of RelSamp results in a significant waste of storage on the traffic sampling device. Moreover, the hash conflict resolution of RelSamp causes the collision chains of several hash table entries to be excessively deep, thereby reducing the search efficiency of the flow nodes. To overcome the shortcomings of RelSamp, this study presents a sampling model known as MiniSamp. Based on the RelSamp sampling mechanism, MiniSamp introduces shared counter trees to compress the storage space of the counters during the sampling process and integrates an efficient search tree into the hash table. The search tree structure is adjusted according to the network environment to improve the search efficiency of the flow nodes. The experimental results demonstrate that MiniSamp can effectively aid network operators to classify traffic in the high-speed network.
KW - application classification
KW - flow table structure
KW - flow tracking
KW - shared counter tree
KW - Traffic sampling
UR - http://www.scopus.com/inward/record.url?scp=85083700607&partnerID=8YFLogxK
UR - http://www.scopus.com/inward/citedby.url?scp=85083700607&partnerID=8YFLogxK
U2 - 10.1109/ACCESS.2020.2984258
DO - 10.1109/ACCESS.2020.2984258
M3 - Article
AN - SCOPUS:85083700607
VL - 8
SP - 63106
EP - 63120
JO - IEEE Access
JF - IEEE Access
M1 - 9050723
ER -