In the research area of network security, we often need to analyze the Internet traffic in real time. But the Internet traffic is usually very heavy, so it is very hard for us to analysis each packet one by one. Alternatively, analyzing the Internet traffic on flow level is often employed. Before analyzing the traffic flows, how we can fast construct and update these flows is a key issue. To solve this issue, in this paper, we propose a fast connection construction and update algorithm. Firstly, we define bidirectional flows as connection. Then, we use hash table to store the connection records and use this connection construction and update algorithm to ensure that these connection records can to be stored in memory in heavy traffic environment to achieve real-time traffic analysis. At last, the experiments show that the algorithm we proposed is efficient and can meet the traffic analysis need.
Distributed Architecture for Real-time Traffic Analysis
