基于流特性的测量在网络行为分析中发挥着越来越重要的作用.超时策略作为流识别的主要标志之一,对流特性测量的正确性和性能具有重要的影响.通过对现有流超时策略进行比较和分析,指出这些超时策略的适用范围和存在的问题.在详细分析网络中流长分布和速度测度各项指标的基础上,针对短流占总体流量很大比例的特点,提出了一种动态超时策略(dynamicaltimeoutstrategy,简称DToS).该策略通过实时综合分析网络使用状况,针对不同特性的流采用不同的超时方式,从而增加网络测量性能,提高测量系统的资源利用率;并可以有效地感知可能存在的网络异常,启动应急措施,保证测量系统的安全;然后通过理论分析的方法验证该策略的可行性和鲁棒性;最后通过实验论证该超时策略在实际测量中的性能,并进一步分析其适用范围. Flow-based measurement plays more and more important role in network behavior analysis.One of the major indicators of flow identification is time-out strategy, which has an important influence on the correctness and performance of the convection characteristic measurement.Through the analysis of existing flow timeout strategy And points out the scope and existing problems of these time-out strategies.On the basis of analyzing the indexes of flow length distribution and speed measure in the network in detail, aiming at a large proportion of short flow to total flow, Dynamic timeout strategy (referred to as DToS) .This strategy analyzes network usage in real-time and uses different time-out schemes for different characteristics of flows to increase network measurement performance and improve resource utilization of the measurement system, and can effectively sense Possible network anomalies, start emergency measures to ensure the safety of the measurement system; and then verify the feasibility and robustness of the strategy by theoretical analysis; Finally, the performance of the strategy in the actual measurement is demonstrated through experiments and further analysis Its scope of application.