Method for network anomaly detection in a network architecture based on locator/identifier split

摘要

The present invention relates to a method for detecting Network Anomaly in network architectures based on locator/identifier split, the detection flow is as follows: initialization processing, and in ITR: processing data packets, sending a Map-Request, determining whether to send an additional Map-Request, sending the data packet, processing the Map_Reply, processing EID-to-RLOC Cache entry expired; in ETR: processing data packet, processing Map-Request, determining whether the traffic of the ITR currently sending the Map-Request is abnormal, replying to the ITR of which the query traffic is abnormal, replying to ITR of which the query traffic is abnormal. With respect to the characteristic that the network architecture based on locator/identifier split needs to query the relationship between the locator and the identifier for packet delivery, the present invention detects Network Anomaly based on query traffic instead of network data packet traffic. Thus the present invention has the advantages of effectively reducing the investment on detection device, The overhead of exchanging monitoring information and the detection system maintenance cost; facilitating cross domain coordination; and efficiently handling the failures occurring during network operation in time; effectively improve the reliability of the network, being suitable for a large-scale network.