一种基于分组抽样的TRW改进算法

J4 ›› 2012, Vol. 34 ›› Issue (9): 17-20.

一种基于分组抽样的TRW改进算法

张海，张健，戴少锋

（南方医科大学网络中心，广东广州 510515）

收稿日期:2011-03-30 修回日期:2011-12-07 出版日期:2012-09-25 发布日期:2012-09-25

An Improved TRW Algorithm Based on Packet Sampling

ZHANG Hai,ZHANG Jian,DAI Shaofeng

(Network Centre,Southern Medical University,Guangzhou 510515,China)

Received:2011-03-30 Revised:2011-12-07 Online:2012-09-25 Published:2012-09-25

摘要/Abstract

摘要：

端口扫描是最常见的网络异常流量，TRW是端口扫描检测中最有代表性的算法之一。在高速网络环境下，网络测量通常采用分组抽样技术。已有的研究表明，分组抽样对原始流的流大小分布有细化和扭曲的作用，使得TRW检测算法随着抽样率的增加，成功检测率和误检率呈现出先增加后减少的趋势。本文提出了一种TRW的改进算法，原理是利用抽样后样本流中包含的TCP协议信息改善分组抽样下的流大小分布估计，从而提高TRW检测算法的有效性。实验证明，新算法与原算法相比，在成功检测率差不多的情况下，误检率明显降低了。

关键词: 端口扫描, 分组抽样, 流大小

Abstract:

The portscan is most popular anomaly in the network and the TRW is the most representative algorithm for the portscan detection.The packet sampling is currently the majority of packet selection method used by many business demands.Prior work has shown that the packet sampling thins traffic flows and impacts anomaly detection.The success ratio and the false negative ratio of the TRW initially increases for low sampling intervals before dropping off for high sampling intervals as the traffic is increasingly thinned.Based on previous researches,we design an improved TRW using theTCP protocol information in the sampling packet.Experimental results show that using the algorithm the false negative ratio drops off while the success ratio does not change.

Key words: portscan;sampling;flow size

张海，张健，戴少锋. 一种基于分组抽样的TRW改进算法[J]. J4, 2012, 34(9): 17-20.

ZHANG Hai,ZHANG Jian,DAI Shaofeng. An Improved TRW Algorithm Based on Packet Sampling[J]. J4, 2012, 34(9): 17-20.

[1]	张海1,2 ，朱旭阳2 ，郭文明2. 随机分组抽样下子群体的流大小分布估计[J]. J4, 2010, 32(8): 11-13.
[2]	黄昆张大方. 基于Windows2000的端口扫描系统设计和实现[J]. J4, 2002, 24(2): 29-31.