網路流量測量網路是流量式計費、網路異常偵測與網路安全的重要元件. 隨著網路速度的快速成長，在骨幹網路進行流量測量成為一個具挑戰性議題。封包取樣是目前Cisco的路由器中所使用的方法. 路由器利用間隔性的對封包取樣來去預測資料流的流量. 然而，這個方法的缺點是速度過慢且不夠準確，無法有效使用資源。所以識別監測巨量資料流成為骨幹網路路由器的可行的替代方案。在本研究中，我們針對骨幹網路，提出一個適用於巨量資料流的被動式量測方法。本方法可以進行即時量測，並且有高準確度及低記憶體使用的特性。我們利用以雜湊為底的取樣方法以提高採樣的準確度，並提出一個以瞬間頻寬預測配合sequential hypothesis test為基礎方法來過濾小資料流。為了驗證我們所提方法的效能，利用公開的流量資料進行電腦模擬.結果顯示我們提出的巨量資料流量測方法優於傳統的封包採樣方法。

Traffic measurement is essential for traffic accounting, network abnormal detection, and network security. With rapid growth of link speed in recent years, flow measurement on backbone networks becomes a challenge issue. Packet sampling is state-of-the-art approach used in Cisco’s Netflow. Router periodically counts sampled packet to estimate flow statistics. However, this approach is slow, inaccurate and resource intensive. Consequently, identifying and monitoring elephant flows become much more feasible approach for backbone networks. In this research, we propose a passive elephant flow measurement scheme for backbone networks. The approach can operate on-line with high accuracy and small memory requirements. To increase sampling accuracy, we use hash-based sampling instead of random sampling. To reduce memory requirements, we develop a novel tiny flow filter based on instant bandwidth estimation and the theory of sequential hypothesis test. To evaluate the performance of the proposed elephant flow measurement, we run intensive computer simulations based on public available traces from backbone networks. The results indicate that the new approach outperforms conventional packet sampling in terms of accuracy and memory requirements.

A. Kumar, X. Jun, L Li, W Jia. Space-Code bloom filter for efficient traffic flow measurement. In: Proc. of the 3rd ACM SIGCOMM Conf. on Internet Measurement. New York: ACM Press, 2003. 167-172
C. Estan and G. Varghese, New directions in traffic measurement and accounting ACM SIGCOMM Computer Communication Review, Vol. 32, No. 4
C. Estan, K. Keys, D. Moore, and G. Varghese, "Building a Better NetFlow.", Proc. ACM SIGCOMM 2004.
J. C. Bolot. End-to-End Packet Delay and Loss Behavior in the Internet. In Proceedings of ACM SIGCOM, 1993.
J. Jung, V. Paxson, A. W. Berger and H. Balakrishnan. “Fast Portscan Detection Using Sequential Hypothesis Testing.”, Proceedings of IEEE Symposium on Security and Privacy. May 2004.
K. Lai and M. Baker. Measuring Bandwidth. In Proceedings of IEEE INFOCOM, 1999 PMA, Passive Measurement and Analysis, http://pma.nlanr.net
S. B. Fredj, T. Bonald, A. Proutiere, G. Regnie, and J. Roberts, “Statistical bandwidth sharing: a study of congestion at flow level,” In Proceedings of ACM SIGCOMM, pp. 111–122, August 2001.
S.. Keshav, A control-theoretic approach to flow control. In Proceedings of SIGCOMM, 1991.
T. Mori, R. Kawahara, S. Naito, and S. Goto, “On the characteristics of Internet Traffic variability: Spikes and Elephants,” In Proceedings of IEEE/IPSJ SAINT, pp. 99–106, Tokyo, Japan, Jan 2004
V. Paxson. End-to-End Internet Packet Dynamics. In Proceedings of ACM SIGCOMM, 1997.
Y. Zhang, S. Singh, S. Sen, N. Duffield and C. Lund, Online identification of hierarchical heavy hitters , Proceedings of the 4th ACM SIGCOMM conference on Internet measurement