关键词: 网络流量测量, 异常流量检测, CRT可逆Sketch, 可编程交换机, 运行时重配置

Abstract: Meeting the demands of network management and security protection in high-speed network environments,real-time reversible traffic measurement has become a critical foundation for supporting tasks such as anomaly detection and attack tracing.Traditional reversible Sketch methods face dual challenges when deployed on P4-programmable data planes:the absence of multiplication,division,and modulo instructions in the P4 instruction set prevents the direct implementation of reversible Sketches based on the Chinese Remainder Theorem(CRT).Furthermore,the co-prime moduli required by CRT often conflict with hardware memory allocation granularity,leading to memory fragmentation,while the computational complexity of reverse recovery for multiple anomalous flows grows exponentially.To address these issues,an efficient abnormal traffic detection mechanism is designed.By constructing a special set of co-prime moduli,modulo operations are transformed into bit-shifts and additions/subtractions.A register pool with a complementary allocation strategy is established to eliminate memory fragmentation,supporting the runtime redeployment of measurement tasks.Additionally,a dual-Sketch coordination mechanism is introduced to reduce the computational complexity of reverse recovery from exponential to linear.Experimental results on a P4 switch demonstrate microsecond-level memory allocation(45~58 μs),millisecond-level task switching latency(approximately 80 ms for 8 tasks),and a processing delay of only 0.4 μs.It does not interfere with normal packet forwarding,which effectively validating its feasibility and efficiency in high-speed networks.

Key words: Network traffic measurement, Anomaly traffic detection, CRT reversible Sketch, Programmable switch, Runtime reconfiguration