基于netflow的网络流量监测研究与应用-计算机应用技术专业论文.docxVIP

基于 NetFlow 的网络流量监测研究与应用 关键词: NetFlow; 网络流:流量监测:异常检测 11 济南大学硕士学位论文ABSTRACT 济南大学硕士学位论文 ABSTRACT Due to the development of computer network and the diversity of the network useL network anomalies take place more frequently than ever,anormal network t／afnc，such as DDoS attack、wornl，reduce network efficiency more seriously．Although there are many kinds of anormal network traffic，most of them take effect through consuming unacceptable network resources and causing network anomalies．Monitoring network traffic and finding these anomalies is very meaningful to solve these problems． nis paper uses Nefflow technique，which is developed by CISCO，to gather network traffic data．According to the analysis of traffic data of campus network，accomplish a system that gathers network traffic data and provides query service．Tllis system is made up oftwo—grade server structure： 1)Network traffic data service is established in a Linux server．It gathers traffic data and provides an interface to receive traffic data retrieving request and retum retrieving result．Because of the great quantities of NetFlow data，binary files distributed in multi·-level-directory are used to store fixed length network traffic records instead of a DBMS．Furthermore this paper discusses the advantages and disadvantages of distributed storage of NetFlow data．This paper also describes the aggregation method，traffic data structure and retrieving strategy in detail． Traffic data server also generates the network fee for curtain network users through the traffic data． 2)Web server monitors the query requests，which are committed by users from browser,and relay them to network traffic data server,then return users the results that was generated by network traffic data server．Wi廿1 this structure． presents an efficient and friendly traffic data query service。 Basing on the traffic data gathered by preceding application，this paper presents a time—series—based network anomaly detection novel method．This method，which is based