網路流量多樣性與程式涵蓋率之實驗分析

Abstract

網路流量可以用於測試網路產品。網路流量可以在很多方面有區別，例如流量裡的使用者行為或是流量蒐集的網路區域大小。假設來說，用具有較大多樣性的流量來測試網路產品可以達到較高的測試涵蓋率。但是如何描述流量的多樣性仍是疑問。在本論文中，定義了流量多樣性以及提出計算多樣性與分析測試涵蓋率的方法。以具有不同數量封包及從不等大小的網段蒐集到的流量來對目標原始碼做測試，結果發現測試涵蓋度會隨著封包數量增加及網域變大而增加。以在Snort上面的實驗結果來說，流量來源一可以達到32.2%的測試涵蓋率，而流量來源二可以達到31.8%。在Linux kernel上面，流量來源一可以達到8.16%的測試涵蓋率，而流量來源二可以達到9.47%。隨著封包數量增加及網域變大，流量的豐富度也是隨之增加，但流量的平均度卻可能隨著來自特定用戶或是特定網路協定的流量暴增而減低，因而導致定義的流量多樣性不一定都是呈現增加的狀態。我們可以藉由定義的豐富度及平均度來對取得的網路流量有更多解讀。

Network traffic traces can be used to test network devices. Network traffic traces may differ in many aspects, such as the user’s behaviors and the size of network. It is assumed that using more diverse traffic to test network devices could have larger code coverage. However, how to describe the diversity of traffic traces is still an issue. In this thesis, traffic diversity index is defined and a methodology for calculating traffic diversity and analyzing code coverage is proposed. Packet traces with different number of packets and collected from different size of network segments are used to test target programs. Experiment results show that code coverage increases with more number of packets or larger size of network segments. In experiments on Snort, packet source 1 can achieve 32.2% code coverage while packet source 2 achieves 31.8%, and on Linux kernel, packet source 1 can achieve 8.16% while packet source 2 achieves 9.47%. Richness which is the number of types in a packet trace would not decrease with a larger number of packets or larger size of network segments in packet traces. However, evenness which is the relative proportion of a type of packets among the packets in a packet trace may not increase correspondently since there would be traffic bursts from the same user or the same network protocol, thus the decrease of traffic diversity. In the view of richness and evenness, we can learn more information about packet traces.