Periodic Sequence in Netflow Recognizing Algorithm
Periodic sequence is used to complete the auxiliary work of applications. It is generally insensitive to the business logic, it is used to detect the existence of a network connection, or check for patches or updates. The existing products can only recognize periodic sequences with pre-defined static features. To improve the ability of recognizing periodic sequences, we develop a general algorithm based on timing characteristics, packet size, and properties of related network and application protocols. This paper presents a novel periodic sequence recognition technique that overcomes some of the limitations of existing approaches. The technique, combined with fuzzy theory, separates the network packets into sequences, extracts the signature of each sequence, and then recognizes the periodic sequences in the separated sequences. Through the assessment of network applications, the periodic sequences can be exactly recognized from the network packets, which produced by the network applications themselves.
periodic sequence netflow network packet
He Tao Zhong Hao
School of Software Beijing Institute of Technology Beijing, China
国际会议
北京
英文
1-4
2010-06-25（万方平台首次上网日期，不代表论文的发表时间）