Summary of the invention
The present invention proposes a kind of network flow real time self-adapting measuring method based on fixed storage space, this method is set duration, network flow memory space and sampling measurement parameter between an expectation measurement zone, the duration is used for the index as the sampling measurement parameter adjustment between the expectation measurement zone, the network flow storage size is as the foundation that finishes between current measurement zone, and the sampling measurement parameter is the relation between control survey resource and the network traffics; In measuring process, set a fixed network stream storage size threshold values as a foundation of measuring loop ends,, finish between then current measurement zone, export all discharge record information estimated values if memory space network flow fluxion surpasses threshold values; According to the sampling measurement parameter between duration between the time interval between current measurement zone, expectation measurement zone and the next measurement zone of current sampling measurement calculation of parameter.Duration between the expectation measurement zone that occurs is used for the control survey resource, if the duration is less than the duration between the expectation measurement zone between current measurement zone, and the network flow memory space is full, need be with the discharge record information output of network flow memory space, illustrate that then measuring system need consume processing and storage that more measurement resources are used for network traffic information, thereby measure the sampling parameter and be provided with excessively, strengthened the burden of measuring system; And if between current measurement zone the duration surpass the duration between the expectation measurement zone, and the network flow memory space is not full, illustrate that measuring the parameter of sampling is provided with too smallly, has wasted the measurement resource, has reduced the precision of Measurement Network flow.
Concrete technical step of the present invention is as follows:
The 1st step: parameter is set
The interval T of expectation Measuring Time is set, and the measurement sampling ratio is 1/m, and the size of network flow memory space K is N, measures concluding time End;
The 2nd step: initial value between current measurement zone is set
It is Current_t1 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set;
The 3rd step: judge and measure the concluding time
If the current measuring system time greater than measuring concluding time End, then with all output of the record of the stream in the network flow memory space, measures and finishes; Otherwise wait for that message arrives measuring appliance, if a message A arrives measuring appliance, the quantity that current packet accouter i is set increases by 1, and promptly i=i+1 entered into for the 4th step;
The 4th step: packet sampling
Use the sampling ratio 1/m current message A that samples, if when promptly the quantity i of message equals the m reciprocal of sampling ratio 1/m in the packet accouter, packet sampling A then, and the value that current packet accouter i is set is 0, enters into for the 5th step; If when the quantity i of message was less than the m reciprocal of sampling ratio 1/m in the packet accouter, then message A was dropped, got back to for the 3rd step;
The 5th step: upgrade the network flow storage space information
In network flow memory space K, search this by the network flow a of packet sampling A,, then the message of this network flow a counted K[a if find this network flow a in the network flow memory space] m reciprocal of the sampling probability 1/m that adds up, i.e. K[a]=K[a]+m, got back to for the 3rd step; If in network flow memory space K, do not find by the network flow a of packet sampling A, then in the network flow memory space, increase a record and be used for storage networking stream a, the m reciprocal that its initial message number is set is sampling probability 1/m, be K[a]=m, the stream record quantity n that is provided with among the network flow memory space K adds up 1, be n=n+1, entered into for the 6th step;
The 6th step: judge between current measurement zone and finish
If it is N that the record quantity n that flows among the current network stream memory space K equals the size of network flow memory space K, finish between then current measurement zone, write down that the concluding time is current_t2 between current measurement zone, N the network flow recorded information that current network flows among the memory space K exported from internal memory, entered for the 7th step; Otherwise do not finish between current measurement zone, got back to for the 3rd step;
The 7th step: the sampling parameter in adjusting between next measurement zone
Between current measurement zone altogether duration t be the difference between the interval time started current_t1 of concluding time current_t2 and current Measuring Time between current measurement zone, be t=current_t2-current_t1, the Measuring Time interval of the initial expectation of measuring system is T, the sampling ratio that uses between current measurement zone is 1/m, during then next measurement in the interval computing formula reciprocal of sampling ratio 1/m be
Expression is greater than (minimum positive integer of 1+ (T-t)/t) m got back to for the 2nd step.
Compared with prior art, the present invention has following advantage and beneficial effect:
(1) the present invention uses fixed network stream storage size as the triggering index that finishes between measurement zone to judge, and the foundation of using expectation Measuring Time interval to adjust as the self adaptation of sampling measurement parameter; Realize that the sampling measurement parameter adaptive is adjusted in the different measuring interval, and in the self adaptation adjustment process, avoid recanalization, save consumption of measuring resource in the adaptive process and the precision that keeps network traffic information recorded information in the network flow memory space;
(2) in the measured message data procedures, the estimated value of record network flow message amount replaces measured value in the network flow memory space, make the measurement result of using different sampling parameters in the different measuring interval can directly carry out mutually relatively and calculate, improved the versatility of measurement data;
Embodiment
Referring to Fig. 1, Fig. 2, establish a sequence of message A A B C D A E F B E C E F A H N D, each chronomere arrives a message
1 (the 1st step): parameter is set
Expectation Measuring Time interval 6 is set, and measuring sampling ratio is 1/2, and the size of network flow memory space K is 2, measures the concluding time 15, enters for 2 (the 2nd steps);
2 (the 2nd steps): initial value between current measurement zone is set
It is 0 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set; Entered for 3 (the 3rd steps);
3 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 1, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 4 (the 4th steps);
4 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/2 sampling, when the quantity 1 of message was not equal to the inverse 2 of sampling ratio 1/2 in the packet accouter, then message A was dropped, and got back to for 5 (the 3rd steps);
5 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 2, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 6 (the 4th steps);
6 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/2 sampling, when the quantity i=2 of message equals the inverse 2 of sampling ratio 1/2 in the packet accouter, packet sampling A then, and the value that current packet accouter i is set is 0, enters into for 7 (the 5th steps);
7 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow a of packet sampling A, in network flow memory space K, do not find by the network flow a of packet sampling A, then in the network flow memory space, increase a record and be used for storage networking stream a, the inverse 2 that its initial message number is set is sampling probability 1/2, be K[a]=2, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=1 entered into for 8 (the 6th steps);
8 (the 6th steps): judge between current measurement zone and finish
The record quantity n=1 that flows among the current network stream memory space K does not finish between current measurement zone less than the big or small N=2 of network flow memory space K, gets back to for 9 (the 3rd steps);
9 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 3, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message B arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 10 (the 4th steps);
10 (the 4th steps): packet sampling
Use the current message B of sampling ratio 1/2 sampling, when the quantity 1 of message was not equal to the inverse 2 of sampling ratio 1/2 in the packet accouter, then message B was dropped, and got back to for 11 (the 3rd steps);
11 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 4, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message C arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 12 (the 4th steps);
12 (the 4th steps): packet sampling
Use the current message C of sampling ratio 1/2 sampling, when the quantity i=2 of message equals the inverse 2 of sampling ratio 1/2 in the packet accouter, packet sampling C then, and the value that current packet accouter i is set is 0, enters into for 13 (the 5th steps);
13 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow c of packet sampling C, in network flow memory space K, do not find by the network flow c of packet sampling C, then in the network flow memory space, increase a record and be used for storage networking stream c, the inverse 2 that its initial message number is set is sampling probability 1/2, be K[c]=2, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=2 entered into for 14 (the 6th steps);
14 (the 6th steps): judge between current measurement zone and finish
If the record quantity n=2 that flows among the current network stream memory space K equals the big or small N=2 of network flow memory space K, finish between then current measurement zone, write down that the concluding time is 4 between current measurement zone, 2 network flow recorded informations that current network flows among the memory space K are exported from internal memory, and the result of output is
A?2
C?2
Entered for 15 (the 7th steps);
15 (the 7th steps): the sampling parameter in adjusting between next measurement zone
Between current measurement zone altogether duration t be the difference between the interval time started current_t1=0 of concluding time current_t2=4 and current Measuring Time between current measurement zone, be t=current_t2-current_t1=4-0=4, the Measuring Time interval of the initial expectation of measuring system is T=6, the sampling ratio that uses between current measurement zone is 1/m=1/2, during then next measurement in the interval computing formula reciprocal of sampling ratio 1/m be
Got back to for 16 (the 2nd steps);
16 (the 2nd steps): initial value between current measurement zone is set
It is 4 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set; Entered for 17 (the 3rd steps);
17 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 5, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message D arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 18 (the 4th steps);
18 (the 4th steps): packet sampling
Use the current message D of sampling ratio 1/3 sampling, when the quantity 1 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message D was dropped, and got back to for 19 (the 3rd steps);
19 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 6, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 20 (the 4th steps);
20 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/3 sampling, when the quantity 2 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message A was dropped, and got back to for 21 (the 3rd steps);
21 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 7, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message E arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=3 entered into for 22 (the 4th steps);
22 (the 4th steps): packet sampling
Use the current message E of sampling ratio 1/3 sampling, when the quantity 3 of message equals the inverse 3 of sampling ratio 1/3 in the packet accouter, packet sampling E then, and the value that current packet accouter i is set is 0, enters into for 23 (the 5th steps);
23 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow e of packet sampling E, in network flow memory space K, do not find by the network flow e of packet sampling E, then in the network flow memory space, increase a record and be used for storage networking stream e, the inverse 3 that its initial message number is set is sampling probability 1/3, be K[e]=3, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=1 entered into for 24 (the 6th steps);
24 (the 6th steps): judge between current measurement zone and finish
The record quantity n=1 that flows among the current network stream memory space K does not finish between current measurement zone less than the big or small N=2 of network flow memory space K, gets back to for 25 (the 3rd steps);
25 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 8, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message F arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 26 (the 4th steps);
26 (the 4th steps): packet sampling
Use the current message F of sampling ratio 1/3 sampling, when the quantity 1 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message F was dropped, and got back to for 27 (the 3rd steps);
27 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 9, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message B arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 28 (the 4th steps);
28 (the 4th steps): packet sampling
Use the current message B of sampling ratio 1/3 sampling, when the quantity 2 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message B was dropped, and got back to for 29 (the 3rd steps);
29 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 10, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message E arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=3 entered into for 30 (the 4th steps);
30 (the 4th steps): packet sampling
Use the current message E of sampling ratio 1/3 sampling, when the quantity 3 of message equals the inverse 3 of sampling ratio 1/3 in the packet accouter, packet sampling E then, and the value that current packet accouter i is set is 0, enters into for 31 (the 5th steps);
31 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow e of packet sampling E, in network flow memory space K, find by the network flow e of packet sampling E, the message of this network flow a is counted K[e] inverse 3 of the sampling probability 1/3 that adds up, i.e. K[e]=K[e]+3=6, got back to for 32 (the 3rd steps);
32 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 11, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message C arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 33 (the 4th steps);
33 (the 4th steps): packet sampling
Use the current message C of sampling ratio 1/3 sampling, when the quantity 1 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message C was dropped, and got back to for 34 (the 3rd steps);
34 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 12, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message E arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 35 (the 4th steps);
35 (the 4th steps): packet sampling
Use the current message E of sampling ratio 1/3 sampling, when the quantity 2 of message was not equal to the inverse 3 of sampling ratio 1/3 in the packet accouter, then message E was dropped, and got back to for 36 (the 3rd steps);
36 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 13, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message F arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=3 entered into for 37 (the 4th steps);
37 (the 4th steps); Packet sampling
Use the current message F of sampling ratio 1/3 sampling, when the quantity 3 of message equals the inverse 3 of sampling ratio 1/3 in the packet accouter, packet sampling F then, and the value that current packet accouter i is set is 0, enters into for 38 (the 5th steps);
38 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow f of packet sampling F, in network flow memory space K, do not find by the network flow f of packet sampling F, then in the network flow memory space, increase a record and be used for storage networking stream f, the inverse 3 that its initial message number is set is sampling probability 1/3, be K[f]=3, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=2 entered into for 39 (the 6th steps);
39 (the 6th steps): judge between current measurement zone and finish
If the record quantity n=2 that flows among the current network stream memory space K equals the big or small N=2 of network flow memory space K, finish between then current measurement zone, write down that the concluding time is 13 between current measurement zone, 2 network flow recorded informations that current network flows among the memory space K are exported from internal memory, and the result of output is
E?6
F?3
Entered for 40 (the 7th steps);
40 (the 7th steps): the sampling parameter in adjusting between next measurement zone
Between current measurement zone altogether duration t be the difference between the interval time started current_t1=4 of concluding time current_t2=13 and current Measuring Time between current measurement zone, be t=current_t2-current_t1=13-4=9, the Measuring Time interval of the initial expectation of measuring system is T=6, the sampling ratio that uses between current measurement zone is 1/m=1/3, during then next measurement in the interval computing formula reciprocal of sampling ratio 1/m be
Got back to for 41 (the 2nd steps);
41 (the 2nd steps): initial value between current measurement zone is set
It is 13 that the current measuring system time is set, and the stream record quantity in the network flow memory space is n=0, and it is i=0 that current message reading is set; Entered for 42 (the 3rd steps);
42 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 14, waits for that less than measuring the concluding time 15 message arrives measuring appliance, and a message A arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=1 entered into for 43 (the 4th steps);
43 (the 4th steps): packet sampling
Use the current message A of sampling ratio 1/2 sampling, when the quantity 1 of message was not equal to the inverse 2 of sampling ratio 1/2 in the packet accouter, then message A was dropped, and got back to for 44 (the 3rd steps);
44 (the 3rd steps): judge and measure the concluding time
The current measuring appliance time is 15, equals to measure concluding times 15 wait message and arrives measuring appliance, and a message H arrives measuring appliance, and the quantity that current packet accouter i is set increases by 1, and promptly i=i+1=2 entered into for 44 (the 4th steps);
44 (the 4th steps): packet sampling
Use the current message H of sampling ratio 1/2 sampling, when the quantity 2 of message equals the inverse 2 of sampling ratio 1/2 in the packet accouter, packet sampling H then, and the value that current packet accouter i is set is 0, enters into for 45 (the 5th steps);
45 (the 5th steps): upgrade the network flow storage space information
In network flow memory space K, search this by the network flow h of packet sampling H, in network flow memory space K, do not find by the network flow h of packet sampling H, then in the network flow memory space, increase a record and be used for storage networking stream h, the inverse 2 that its initial message number is set is sampling probability 1/2, be K[h]=2, the stream record quantity n that is provided with among the network flow memory space K adds up 1, and promptly n=n+1=1 entered into for 46 (the 6th steps);
46 (the 6th steps): judge between current measurement zone and finish
If the record quantity 1 that flows among the current network stream memory space K does not finish between then current measurement zone less than the size 2 of network flow memory space K, got back to for 47 (the 3rd steps);
47 (the 3rd steps): judge and measure the concluding time
The current measuring system time 16 then all exports the record of the stream in the network flow memory space greater than measuring the concluding time 15,
H 2
Measure and finish.
In this example, the result of measuring system output is:
A 2
C 2
E 6
F 3
H 2。