Demand-oriented Traffic Measuring Method for Network Security Situation Assessment

Abstract

In the information of security situation, traffic is necessary data to describe the network performance. It is also an important indicator to measure attacks such as worms or DoS. During the process of situational awareness, the traffic measuring methods are often needed without the privilege of routers. Our work emphasizes on the measuring algorithms based on packet pair in end-to-end measuring technologies. The simulations have shown that the congestion status of network and the length of packet have greater effect on the measurement of path capacity. So on the basis of improved packet pair measuring algorithms, a novel traffic measuring method DTM for demand is put forward. DTM aims to acquire the optimum compromise between measuring overhead and accuracy through the utilization of detecting packets. The relation between sending rate and available bandwidth are decided by one-way delay and changes of packets. Simultaneously, DTM assigns corresponding weight to the transition bandwidth, according to the disturbed degree of packet which is set as transition point, and its adjacent packets. Then it can better reflect the influence caused by background traffic. DTM also provides the rules to judge whether two packets are transition points and it discusses the method to determine the measuring range dynamicly according to specific application bandwidth requirements. The experiments have studied the trend of relativity and the difference of packet pair, when the following factors are changing: size of detecting packet, network load, features of background traffic and bottleneck bandwidth. It is shown that DTM has characteristics in low overhead, high accuracy, good smoothness and sensitivity for network situation, compared to traditional algorithms.