Search

In face of confirming user communication relationship in anonymous network, tracing botmaster and detecting stepping stones, traditional intrusion detection and flow correlation methods which mainly rely on passive traffic analysis have shown many drawbacks obviously, such as high space costs, poor real-time, low accuracy, poor flexibility, fail in dealing with encrypted traffic and so on. However, the active network flow watermark(ANFW) which combined the idea of digital watermarking and active traffic analysis can overcome the drawbacks above effectively. ANFW has aroused extensive attention of scholars at home and abroad. Firstly, the general model of ANFW is presented, and the classifica-tion of existing proposals and roles involved in ANFW are summarized. Then, several representative ANFW approaches using distinct network flow characteristics are presented and compared in detail. Finally, threats against existing ANFW technology and their corresponding countermeasures are overviewed, also some future research directions about ANFW are discussed.

Based on the burstiness of network traffic,the peak traffic metric was introduced,and the method which was used to evaluate network operation and plan capacity was proposed.The network intrinsic features and the peak traffic for the 21 CERNET campus networks were analyzed by statistical methodologies(analysis of variance and analysis of covariance),so that the peak traffic is mutually independent and follows Gaussian distribution,the network intrinsic features have dominant impact on the peak traffic,and the number of network users is highly related to link bandwidth demand.On the basis,the linear regression model and capacity planning model were constructed.Experimental results illustrate that the proposed capacity planning model is used to evaluate the access bandwidth of new campus networks exactly.