TCP Flow Identifying Algorithm Based on Finite State Automaton

Xiao-guo ZHANG,Wei DING
DOI: https://doi.org/10.3969/j.issn.0372-2112.2017.06.017
2017-01-01
Abstract:In order to improve flow-identifying performance,a flow-identifying algorithm for TCP (Transmission Control Protocol) traffic was proposed.This algorithm constructs bidirectional-flow finite state automaton based on TCP communication process and judges flow-termination according to TCP protocol rules and flow states by this automaton.Meanwhile,the algorithm adds filtering mechanism and timeout strategy to identify single-packet flows and abnormal interrupt flows.This algorithm is lower in memory overhead,the total overhead of memory and computing resources than the classic algorithm FT (Fixed Timeout strategy) and the similar representative algorithm TSAT (Two-level Self-Adaptive Timeout).Furthermore,this algorithm is higher than TSAT in accuracy and only loses little accuracy compared to the default accuracy standard.Our algorithm identifies TCP flows based on protocol rules,so it can obtain high identifying accuracy and can save extra flow keeping-time.And our algorithm is especially suitable for situations when the proportion of small flows,medium flows or irregular flows is larger,so it can ensure flow-identifying system to work normally when network anomalies occur,such as worm infection,DDoS attack,and so on.
What problem does this paper attempt to address?