利用封包表頭識別來自於大型網站伺服器的封包流

Abstract

網路流量的識別對於網路安全以及管理非常重要。這個技術可以幫助網路管理者找出網路中的異常。許多大型網站已經成為網路攻擊的目標，而當他們遭受到攻擊時，對外流出的流量行為可能會產生異常。在先前的文獻當中，網路流量識別使用到載荷檢查(payload inspection)以及基於同一條流量的特徵(flow-based features)辨識。然而，當封包是加密的時候，載荷檢查無法發揮它的作用，並且檢查載荷時會有隱私問題。再者，在訂定這些檢查規則時造成的負擔很重，也需要定期的更新。再基於同一條流量的特徵辨識時，需要蒐集多個封包來計算統計特徵，運算複雜度相當大，而且耗時。因此，我們提出一個只使用封包表頭來辨認封包是否正常的機制。由於只需要一個封包的表頭資訊來做辨認，不僅降低計算特徵時的負擔，也可降低封包辨認所需要的時間。

Network traffic identification technique plays an important role in modern network security and management architectures. It can help the network manager to find out the anomalies in the network. Some large scale servers have become the targets of security attacks, and the behaviors of the servers may become abnormal. In previous works, network identification requires payload inspection and flow-based features collecting. Payload inspection cannot function when the payload is encrypted and may incur the privacy issue because the content should be scanned. Furthermore, it usually imposes heavy overhead to construct the rules. In the flow-based feature identification technique, the computation overhead to collect multiple packets and calculate the statistic features is very high and time-consuming. Therefore, we proposed a mechanism to determine whether the Internet traffics from large scale servers are normal or not by using the packet header information. Furthermore, because it only requires the information of one packet for detection, the detection time and the computation overhead can be reduced.