In order to improve flow-identifying performance

a flow-identifying algorithm for TCP (Transmission Control Protocol) traffic was proposed.This algorithm constructs bidirectional-flow finite state automaton based on TCP communication process and judges flow-termination according to TCP protocol rules and flow states by this automaton.Meanwhile

the algorithm adds filtering mechanism and timeout strategy to identify single-packet flows and abnormal interrupt flows.This algorithm is lower in memory overhead

the total overhead of memory and computing resources than the classic algorithm FT (Fixed Timeout strategy) and the similar representative algorithm TSAT (Two-level Self-Adaptive Timeout).Furthermore

this algorithm is higher than TSAT in accuracy and only loses little accuracy compared to the default accuracy standard.Our algorithm identifies TCP flows based on protocol rules

so it can obtain high identifying accuracy and can save extra flow keeping-time.And our algorithm is especially suitable for situations when the proportion of small flows

medium flows or irregular flows is larger

so it can ensure flow-identifying system to work normally when network anomalies occur

such as worm infection

DDoS attack

and so on.