一個以機器學習為基礎之軟體定義網路中的大數據流偵測方法

Abstract

軟體定義網路的提出使網路頻寬能夠更有效的利用，而有效率的偵測大數據流變成了一個重要的課題。近年來的大數據流偵測方法大多是事後偵測，無法在大數據流產生前進行路徑規劃。而在少數的事前偵測方法中，大多是使用IP位址和連接埠號作為分類依據，這類型方法對於未知的大數據流的判斷準確度不足，且由於小數據流的數量遠多於大數據流，使得這類型方法偏向將數據流預測為小數據流。因此我們提出了一個以機器學習為基礎的大數據流分類方法，除了不使用IP位址及連接埠號當成主要分類依據外，我們更採用數據流在開始進行傳送的前幾個封包所擁有的特性以及在建立連線時互相交換資料所產生的行為特徵(簡稱application round)，做為大數據流的判斷依據。此外，我們在軟體定義網路中提出了兩層的分類方法，分別運行在控制器端和交換器端來進行大數據流的分類。並會不斷的更新我們的訓練模型。我們的方法可以快速的學習如何利用新服務在application round的特徵，判斷其是否為大數據流。實驗的結果顯示我們不但能夠準確的預測大數據流外，也能保有對數據流判斷的準確度。

The proposed software-defined networking makes the bandwidth used more effectively. So how to detect elephant flow efficient becomes an important issue. Most elephant flow detection in recent papers use posterior detection methods. These methods could not reroute before elephant flow generated. Other methods using previous prediction are often using IP address and port number as feature, but these methods are not accurate while detecting an unknown flow. Most of flows are mice flow, these methods would classify most elephant flows into mice flows. Therefore, we propose an elephant flow detection method based on machine learning. Without using IP address, we adopt the behavior of first few packet between client and server while establish the connection which called Application Round to predict elephant flow. Besides, we propose a two phase classification method. The classifiers are running in controller and switch. We also could update the training model and learn new features. The result shows that we can not only predict the elephant flow accurately but also have a good recall rate.