Network Traffic Sampling System Based on Storage Compression for Application Classification Detection

Shichang Xuan,Youngju Cho,Wu Yang,Xiaojiang Du,Ilyong Chung,Dezhi Tang

doi:10.1109/access.2020.2984258

Abstract

With the development of the Internet, numerous new applications have emerged, the features of which are constantly changing. It is necessary to perform application classification detection on the network traffic to monitor the changes in the applications. Using RelSamp to sample traffic can provide the sampled traffic with sufficient application features to support application classification. RelSamp separately assigns counters for each flow to record the statistical features and introduces a collision chain into the hash flow table to resolve hash conflicts in the table entries. However, in high-speed networks, owing to the number of concurrent flows and heavy-tailed nature of the traffic, the storage allocation method of RelSamp results in a significant waste of storage on the traffic sampling device. Moreover, the hash conflict resolution of RelSamp causes the collision chains of several hash table entries to be excessively deep, thereby reducing the search efficiency of the flow nodes. To overcome the shortcomings of RelSamp, this study presents a sampling model known as MiniSamp. Based on the RelSamp sampling mechanism, MiniSamp introduces shared counter trees to compress the storage space of the counters during the sampling process and integrates an efficient search tree into the hash table. The search tree structure is adjusted according to the network environment to improve the search efficiency of the flow nodes. The experimental results demonstrate that MiniSamp can effectively aid network operators to classify traffic in the high-speed network.

Highlights

Since the birth of ARPANET in the late 1960s, following development over half a century, the Internet has achieved great success
MiniSamp and RelSamp were compared from the perspectives of sampling flow application recognition accuracy and flow table storage space consumption, thereby verifying that MiniSamp effectively reduces the storage space required for the flow table during sampling and can ensure that the sampled traffic contains sufficient application characteristics to support application classification
The memory allocation method of RelSamp may cause a huge waste of storage space on the traffic sampling device and long conflict chains, thereby reducing the searching efficiency of the flow nodes in the high-speed network

Summary

INTRODUCTION

Since the birth of ARPANET in the late 1960s, following development over half a century, the Internet has achieved great success. During this development, the scale of the Internet has continued to increase. RelSamp uses a conflict chain to resolve conflicts within the hash table, but this can cause the conflict chain in certain entries to be excessively deep, thereby decreasing the algorithm searching speed of the sampled flow nodes. To solve the problems of RelSamp operating in a high-speed network, this study proposes a high-performance sampling model for application classification, known as MiniSamp. The remainder of this paper is organized as follows: Section 2 introduces the related work on traffic application classification and sampling technology. The research contents of this paper are summarized in the concluding section

RELATED WORK

Findings

CONCLUSION