A PARALLEL SWITCH FABRIC BASED ON CROSSBAR

With the increase of link rate, the arbitrator of centralized switch fabric becomes too complicated to implement. A parallel switch fabric based on crossbar, named as PSFBC （Parallel Switch Fabric Based on Crossbar）, has been proposed in this paper. PSFBC is composed of k switches whose rate is 1/k of link, these switches exchange cells in parallel; this increases the arbitrator＇s period and make it easy to implement. Load is evenly distributed to each switch with FCFS （First Come First Serve） rule, it can keep the order of cells in one stream. A multi-class queue scheduling policy is used in PSFBC to ensure the quality of realtime streams. Experiments show that the load on each switch in PSFBC is well balanced, its average delay of cells is little and its performance is very close to centralized switch; and with the increase of number of parallel switches, the loss of PSFBC＇s performance keeps very small, it becomes easier to implement.     

FAULT IDENTIFICATION IN HETEROGENEOUS NETWORKS USING TIME SERIES ANALYSIS

Fault management is crucial to provide quality of service grantees for the future networks, and fault identification is an essential part of it. A novel fault identification algorithm is proposed in this paper, which focuses on the anomaly detection of network traffic. Since the fault identification has been achieved using statistical information in management information base, the algorithm is compatible with the existing simple network management protocol framework. The network traffic time series is verified to be non-stationary. By fitting the adaptive autoregressive model, the series is transformed into a multidimensional vector. The training samples and identifiers are acquired from the network simulation. A k-nearest neighbor classifier identifies the system faults after being trained. The experiment results are consistent with the given fault scenarios, Which prove the accuracy of the algorithm. The identification errors are discussed to illustrate that the novel fault identification algorithm is adaptive in the fault scenarios with network traffic change.     

DYNAMIC REQUEST DISPATCHING ALGORITHM FOR WEB SERVER CLUSTER

Distributed architectures support increased load on popular web sites by dispatching client requests transparently among multiple servers in a cluster. Packet Single-Rewriting technology and client address hashing algorithm in ONE-IP technology which can ensure application-session-keep have been analyzed, an improved request dispatching algorithm which is simple, effective and supports dynamic load balance has been proposed. In this algorithm, dispatcher evaluates which server node will process request by applying a hash function to the client IP address and comparing the result with its assigned identifier subset; it adjusts the size of the subset according to the performance and current load of each server, so as to utilize all servers＇ resource effectively. Simulation shows that the improved algorithm has better performance than the original one.     

A NOVEL METHOD FOR NETWORK WORM DETECTION BASED ON WAVELET PACKET ANALYSIS

Objective To detect unknown network worm at its early propagation stage. Methods On the basis of characteristics of network worm attack, the concept of failed connection flow （FCT） was defined. Based on wavelet packet analysis of FCT time series, this method computed the energy associated with each wavelet packet of FCT time series, transformed the FCT time series into a series of energy distribution vector on frequency domain, then a trained K-nearest neighbor （KNN） classifier was applied to identify the worm. Results The experiment showed that the method could identify network worm when the worm started to scan. Compared to theoretic value, the identification error ratio was 5.69%. Conclusion The method can detect unknown network worm at its early propagation stage effectively.     

RESEARCH ON IP FLOW FORMAT AND SEMANTIC FORMALIZATION

The robustness of the i mplementation in IPprotocol is the key to ensure the well data trans mis-sion.IPreassemblyis ani mportant module inthe IPprotocol.The IP fragment reassembly policies aredifferent in different OSes.Making use of the char-acter of IPfragment reassembly policy,attackers canevade the detection of audit systemand penetrate thedefense[1].However many audit systems just audit IPpackets without reassembly.Even the module offragment reassembly is i mplemented,an audit sys-…