ABSTRACT
Malformed packets and overlapping fragments are harmful to Intranet end hosts. A formalization engine was introduced to formalize transit packets and reassemble fragments to eliminate the fragment semantic ambiguity. In the formalization engine, malformed packets are formalized by a packet verification engine layer according to protocol standards. In order to eliminate the fragment semantic ambiguity, OS classes of end hosts were collected by an OS detector, each fragment was reassembled according to its OS class. According to the reassembly algorithm of different OS, the pre-forward fields of the cached data were counted with the application of the pre-forward poiicies and were transmitted to save system resource. Applying the BSD-Linux pre-forward policy, the BSD- right pre-forward policy and the First pre-forward policy, the packet loss rate is dropped and system performance improved. The experiments show that the identification precision can be maintained about 90% in heavy processing load.
ABSTRACT
Objective To detect unknown network worm at its early propagation stage. Methods On the basis of characteristics of network worm attack, the concept of failed connection flow (FCT) was defined. Based on wavelet packet analysis of FCT time series, this method computed the energy associated with each wavelet packet of FCT time series, transformed the FCT time series into a series of energy distribution vector on frequency domain, then a trained K-nearest neighbor (KNN) classifier was applied to identify the worm. Results The experiment showed that the method could identify network worm when the worm started to scan. Compared to theoretic value, the identification error ratio was 5.69%. Conclusion The method can detect unknown network worm at its early propagation stage effectively.
ABSTRACT
Distributed architectures support increased load on popular web sites by dispatching client requests transparently among multiple servers in a cluster. Packet Single-Rewriting technology and client address hashing algorithm in ONE-IP technology which can ensure application-session-keep have been analyzed, an improved request dispatching algorithm which is simple, effective and supports dynamic load balance has been proposed. In this algorithm, dispatcher evaluates which server node will process request by applying a hash function to the client IP address and comparing the result with its assigned identifier subset; it adjusts the size of the subset according to the performance and current load of each server, so as to utilize all servers' resource effectively. Simulation shows that the improved algorithm has better performance than the original one.
ABSTRACT
With the increase of link rate, the arbitrator of centralized switch fabric becomes too complicated to implement. A parallel switch fabric based on crossbar, named as PSFBC (Parallel Switch Fabric Based on Crossbar), has been proposed in this paper. PSFBC is composed of k switches whose rate is 1/k of link', these switches exchange cells in parallel; this increases the arbitrator's period and make it easy to implement. Load is evenly distributed to each switch with FCFS (First Come First Serve) rule, it can keep the order of cells in one stream. A multi-class queue scheduling policy is used in PSFBC to ensure the quality of realtime streams. Experiments show that the load on each switch in PSFBC is well balanced, its average delay of cells is little and its performance is very close to centralized switch; and with the increase of number of parallel switches, the loss of PSFBC's performance keeps very small, it becomes easier to implement.