【摘要】 TCP流显式的连接建立和关闭过程决定了完整的TCP流的不同类型TCP报文之间在数量关系间保持一种宏观平衡性,这种数量间的约束所表现出的宏观平衡性可以用来揭示网络流量行为规律,识别网络流量行为异常的存在,从而可以成为网络安全监测和网络管理的有效手段之一.文章定义了TCP流宏观平衡性的相关测度,根据TCP流的到达模型和流长模型建立了测量误差的模型,并以此导出了实际测量模型和判断正常与异常的临界点.通过实验和仿真对这些测度进行了分析,证明了这些测度和临界点的可用性.更多还原

【Abstract】 The explicit TCP connection opening and closing procedures keep the different packet quantity of a completed TCP flows at a macroscopical balance.This kind of quantitative restraint can be used to discovery the behavior rules of TCP traffics,and to detect the existence of abnormal behavior,which can be deployed as an efficient method in network security monitoring in the network management.Some metrics are proposed in this paper to describe the macroscopical TCP packets quantitative balance of TCP flows,and the measuring errors are modeled by the arrival distribution model and the length distribution model of TCP flow.The thresholds of those metrics to judge the normal and abnormal TCP behaviors are discussed under the measuring error model.The emulation and simulations show the feasibility of these metrics as well as their thresholds.更多还原