《多级Bloom_Filter技术研究论文》-毕业论文设计（学术）.docVIP

摘要 Bloom Filter算法是Bloom于1970年提出的一种可在时间和空间进行平衡折中的数据压缩管理方法，主要涉及计算时间复杂度、占用空间大小和错误率三个因素。随着互联网的发展，集合中的特定元素存在与否的判断查询技术在现代网络中得到了广泛的应用。多级Bloom Filter 使用多个Bloom Filter位数组组合使用，大大降低了误检率，还能在一定程度上解决计数溢出的问题，但导致了可用空间的分割，影响压缩效果。 论文采用了一种新型的Bloom Filter算法，基于分散哈希函数的多级Bloom Filter算法。该算法中不同的哈希函数映射到不同的Bloom Filter位数组，从而解决了不同哈希函数之间可能产生的冲突。同时算法的每一个Bloom Filter位数组都是一个计数型Bloom Filter位数组，在判断集合中每一个元素个数时，较计数型Bloom Filter算法而言，判断元素个数时只有一种可选判断方法，即选取最小值。 基于上述Bloom Filter算法，论文设计了一个实时检测网络上常见的异常数据包的原型系统。系统从网络上实时的捕获数据包并提取特征值，存入Bloom Filter位数组并进行检测判断网络上是否存在的异常流量。通过试验，系统能够检测到网络上存在的部分异常流量，比如ARP欺骗、Smurf和SYN Flood等。 关键字：哈希函数； Bloom Filter； 多级Bloom Filter； 特征值提取； 网络异常流量。 Abstract Bloom Filter algorithm is proposed by Bloom in 1970, which is a method of data compression management can make balance between time and space, it mainly involves three factors: computational complexity, size of space occupied and error rate. With the development of the Internet, the presence or absence of specific elements of the query has been widely applied in modern network technology. Multi-set Bloom Filter use the median number of Bloom Filter combination group, it can greatly reduce the rate of false alarms, but also solve the problem of spillover counting, to some extent. But, it makes available space division of compression performance. This paper using a new type of Bloom Filter algorithm, decentralized hash functions based on multi-set Bloom Filter algorithm. In the algorithm, different hash function mapped to different Bloom Filter median group, it has resolved the conflict of different hash function. Furthermore, the method of each group median Bloom Filter is a counting Bloom Filter array. When judging the number of element, there is only one method: Minimum likelihood estimate, compared to counting Bloom Filter algorithm. Based on the above Bloom Filter algorithm, papers designed a real-time detection prototype system of network anomaly flow, which can detection some network anomaly packet. System capture packet real