KR100537905B1 - Apparatus for limiting bandwith of burst traffic and method thereof - Google Patents

Abstract

An apparatus and method for determining bandwidth limitation of a congested aggregate flow according to the present invention may include: a bandwidth measuring unit configured to measure a bandwidth of at least one aggregate flow input based on predetermined information representing characteristics of the aggregate flow; A rating unit configured to determine a rating according to an abnormal degree of the input aggregate flows; A bandwidth limit determining unit which determines an amount of bandwidth to be restricted and an aggregation flow based on the measured bandwidth and an abnormal class; A bandwidth limiter configured to receive the determination result of the bandwidth limit determiner and limit or release the bandwidth of the selected aggregate flow among the input aggregate flows; And a state information storage unit for storing state information including a usage bandwidth, an abnormal level, and a limited bandwidth amount of the input set flows, and are installed at an access point of a network to affect normal aggregate flows. Without this, it is effective to block attack aggregation flows corresponding to abnormal excessive traffic used in DoS attack and Worm scan attack.

Description

Apparatus for limiting bandwith of burst traffic and method

The present invention relates to an apparatus and method for determining a bandwidth limit for attack traffic that generates abnormal and excessive traffic such as a denial of service attack (DoS) and Worm scan attack, thereby degrading the service quality of the network.

Attacking traffic that generates excessive traffic can cause network congestion by concentrating a lot of traffic in a short time, thus degrading the service quality of normal users and eventually paralyzing the network. Conventional techniques for preventing network congestion are as follows.

(1) queuing technology

Queuing is a technique for determining which packets to drop when the network is congested or to prevent network congestion. The first-in first-out (FIFO), fair queuing (FQ), and random early detection (RED) have been proposed according to the method of determining the packet to drop. This conventional queuing technique has a great effect on blocking or preventing network congestion in the case of traffic that conforms to the state of the network, that is, when the network detects that the network is congested, thereby reducing the amount of transmission. In DoS attacks that generate or generate many kinds of artificial flows, there is a problem that cannot fundamentally block the excessive traffic.

(2) Intrusion detection and intrusion prevention technology

Intrusion detection systems have been proposed to detect activities on the network, such as generating abnormal packets or generating abnormal flows to scan, hack, and paralyze the destination system. The intrusion detection system blocks the traffic determined to be in connection with the firewall or blocks the intrusion detection system itself. In the latter case, a system that detects and directly blocks intrusions is called an intrusion prevention system. These systems are technologies that can protect the destination system and network by detecting and blocking the attack early, but the biggest problem of these systems is false-positive problem which blocks normal traffic by mistaken normal traffic as attack traffic. to be. Because of this problem, almost all systems provide attack detection only, and the blocking function is operated by the administrator's decision and blocking.

(3) denial of service attack blocking technology by traffic volume

This technology blocks DoS attacks by sending or dropping packets by comparing the measured traffic volume with a baseline. The baseline value is obtained by directly measuring the traffic of the subscriber and using the statistics. This technique has the effect of blocking DoS attacks because no traffic can exceed the threshold, but it is virtually impossible to accurately measure the threshold, so false if the threshold is measured incorrectly, even normal traffic can be blocked. can cause positive problems.

(4) Aggregate Congestion Control (ACC)

Monitors the status of packet transmission queues on each interface of routers, and if the transmission queue is full for a certain period of time, it is regarded as network congestion and classified packets into aggregated flows for each destination of the packets. It is a technology to solve network congestion by limiting their bandwidth. This technique blocks the bandwidth of aggregated flows by destination, which effectively blocks DoS attacks that typically target a specific destination. However, this technique completely eliminates the false-positive problem because the blocking effect is halved for attack types that simultaneously attack many different destinations, such as Worm scan attacks, and because bandwidth is determined only by the volume of traffic without checking packets for abnormality. It did not solve.

As mentioned above, the conventional abnormal congestion-type attack countermeasures have partial effects, but do not fundamentally block various attacks such as DoS and Worm scan attacks, and also cause false-positive problems.

The technical problem to be solved by the present invention is to solve the above problems, and to determine how much bandwidth to limit by comprehensively determining the current state of the network, the use bandwidth and abnormal class of the aggregate flow, and what aggregate flow To accurately determine whether to limit the bandwidth of the network, to provide a device and method for prematurely blocking only the attack aggregate flows that generate abnormal excessive traffic while protecting the normal aggregate flows.

According to an aspect of the present invention, there is provided a device for determining a bandwidth limit for a congestion type flow according to an embodiment of the present invention, including: a bandwidth measuring unit configured to measure a bandwidth of at least one set flow input based on predetermined information representing characteristics of the aggregation flow; A rating unit for determining an abnormal degree of the aggregation flows; A bandwidth limit determining unit which determines an amount of bandwidth to be restricted and an aggregation flow based on the measured bandwidth and the degree of abnormality; A bandwidth limiter configured to limit or release a bandwidth of a specific aggregate flow according to a control signal of the bandwidth limit determiner among at least one aggregate flow; And a state information storage unit for storing state information of the input set flows.

According to an aspect of the present invention, there is provided a bandwidth limiting method for a congested aggregate flow according to the present invention, the method comprising: obtaining bandwidth information of at least one aggregate flow input, determining and determining an abnormal level; Calculating a total bandwidth of the input aggregate flows based on the bandwidth information and comparing a network service bandwidth to determine whether a network is at risk of congestion; And when the network is determined to be at risk of congestion in the congestion risk determining step, determining an aggregation flow having the highest abnormality level as an aggregation flow to limit the amount of bandwidth to be restricted and the bandwidth; And determining that the network is in a normal state in the step of determining the congestion risk, releasing the limited bandwidth by selecting the aggregation flow having the lowest abnormal level among the bandwidth-limited aggregation flows.

Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings. First, an overview of the apparatus and method for limiting and releasing bandwidth for an aggregation flow according to the present invention will be described. The aggregation flow is defined based on information including a source IP address, a protocol, and a destination port number. And limit. If the received packet is determined to be an attack, the abnormal grade is determined by combining the attack type and the degree of risk.

Investigating whether the network is at risk is critical in that it can block the congested attack aggregation flow in advance and protect the normal aggregation flow before the network becomes congested.

In determining the congestion type flow, it is desirable to determine and determine not only the bandwidth information of the aggregation flow but also the degree of abnormality and the current network status (risk or normal).

Therefore, it is effective to determine aggregate flows with high abnormality and high usage bandwidth as congested aggregate flows.

In addition, when the network is at risk, it is desirable to provide the congested aggregate flow the remaining bandwidth used by the normal aggregate flow to maximize resource efficiency.

1 is a block diagram illustrating a configuration apparatus for limiting bandwidth to a congested aggregation flow in order to block an abnormal congestion attack aggregation flow according to the present invention. The bandwidth limiting device for the congested aggregation flow according to the present invention as shown in FIG. 1 may be applied to any network device capable of distinguishing the aggregation flow.

First, referring to the configuration, the bandwidth limiting determining apparatus according to the present invention is a bandwidth limiting unit 101 for determining the amount of bandwidth and aggregation flows to be limited by comprehensively determining the current state of the network, the use bandwidth and abnormal class of the aggregate flow, Bandwidth measuring unit 102 for measuring the bandwidth of the aggregate flow, rating determiner 103 for determining the degree of abnormality of the flow, bandwidth limiter 104 that can limit the bandwidth of a specific aggregate flow, and the status of the aggregate flows It comprises a state information storage unit 105 for storing information.

The bandwidth measuring unit 102 classifies the packets received from the network into aggregate flows according to the criteria described below, and also measures the bandwidth used by each aggregate flow to determine the bandwidth limitation periodically or whenever a certain bandwidth is changed. The bandwidth information is transmitted to the unit 101.

Aggregation flow according to the present invention is distinguished by source IP address, protocol, and destination port number, the granularity can be adjusted by the administrator. Aggregate flows with the same protocol and destination port number all belong to an aggregate flow class. For example, if an administrator defines aggregate flow classes with TCP protocol and destination port 80, then there are two aggregate flow classes, that is, aggregate flow class using destination port 80 and TCP destination port 80. Defined as an aggregate flow class that is not used. Each aggregate flow class also consists of one or more aggregate flows, depending on the source IP address. For example, if an administrator defines a source IP address as class C in one aggregate flow class, all flows corresponding to source IP addresses 1.1.1.0 through 1.1.1.255 are assigned to one aggregate flow of 1.1.1.0/24. Corresponding. Therefore, if the aggregate flow class is defined using the source IP address as the C class, the aggregate flow class may have a maximum of 2 ²⁴ (about 1,000,000) aggregate flows.

In the following description with reference to FIGS. 2, 3, and 4, it will be assumed that there is one aggregate flow class. That is, the aggregate flow will be distinguished only by the source IP address without considering the protocol and the destination port number. This is for the purpose of briefly and clearly describing the present technology, but is not intended to limit the invention.

The abnormality class determining unit 103 basically performs the following functions using a typical signature rule-based intrusion detection system. When it is determined that the received packet is an attack, the abnormality rating determiner 103 determines the abnormality rating by combining the attack type and the degree of risk, and then transmits the abnormality rating information to the bandwidth limit determining unit 101. To pass. The more severe the abnormality, the higher the degree of abnormality.

The bandwidth limiter 104 receives a command of the bandwidth limit determiner 101 to perform a function of limiting or releasing a bandwidth for a specific aggregation flow. The state information storage unit 105 stores the bandwidth used by each aggregated flow measured by the bandwidth measuring unit 102, the abnormal grade determined by the grader 103, and the aggregated flow by the bandwidth limit determining unit 101. It stores the amount of bandwidth imposed.

The bandwidth limit determination unit 101 may limit the bandwidth of the aggregate flow or release the limited bandwidth in consideration of network state information on whether the current network is in a critical state and state information of the aggregate flow (used bandwidth and abnormal level). Will perform.

Detailed algorithms performed by the bandwidth limit determination unit 101 under the above configuration will be described in detail with reference to FIGS. 2, 3, and 4.

FIG. 2 is a flowchart illustrating a bandwidth limit determination process for the aggregation flow of the bandwidth limit determiner in FIG. 1.

In FIG. 2, the bandwidth limit determining unit 101 receives bandwidth information and abnormal class information on aggregate flows input from the bandwidth measuring unit 102 and the abnormal class determining unit 103, respectively (step 201). The average bandwidth and the abnormal grade are determined by using the received bandwidth information and the abnormal grade information of the specific aggregate flow and then stored in the state information storage 105 (step 202). The total bandwidth of all aggregate flows is compared with the "total bandwidth allocated to normal aggregate flows" in order to know the current state of the network (danger or steady state) (step 203). Here, the "total bandwidth allocated to normal aggregate flows" is explicitly defined by the administrator. For example, assuming that the total bandwidth available is 100 Mbps, the administrator may set 90 Mbps as "total bandwidth allocated to normal aggregate flows." The remaining 10 Mbps is the "total bandwidth allocated to congested aggregate flows."

If the total bandwidth of all aggregate flows is greater than the "total bandwidth allocated to normal aggregate flows", it is regarded as a network risk state and the aggregate flows to limit bandwidth and the amount of bandwidth to restrict are determined (step 204). According to the determination, the bandwidth limiter 104 also releases the bandwidth restriction of a specific aggregation flow in order to limit the bandwidth of the aggregation flows determined as the congested aggregation flow and to release the bandwidth restriction applied to the aggregation flow determined as the normal aggregation flow. Command (step 205).

On the contrary, if the total bandwidth is less than or equal to the "total bandwidth allocated to normal aggregate flows", the bandwidth limiter 104 releases the bandwidth restriction release of a specific aggregate flow to consider the network steady state and release the bandwidth limitation of the aggregate flow. Command (step 206).

Finally, the bandwidth limit information (whether bandwidth is limited or limited bandwidth) of the aggregate flow changed according to the determination is stored in the state information storage unit 105 (step 207).

When the bandwidth limit is determined due to the network risk condition occurring in the process of FIG. 2, the process of determining the congested aggregation flow to which the bandwidth limit is applied will be described with reference to FIG. 3.

In FIG. 3, the basic principle for determining congestion-type aggregate flows is that aggregate flows having a low abnormal grade and aggregate flows having a low use bandwidth are considered normal aggregate flows when the abnormal grades are the same. Is determined as a congested set flow.

As an initialization process to determine congested aggregate flows, the <Free Bandwidth> variable is the "bandwidth allocated to aggregate flows", the <Abnormal Class> variable is the lowest abnormal level, and <Congested Aggregate Flow List> is all sets. Set to flow (step 301). In step 302, a set flow having the smallest bandwidth is searched among the set flows corresponding to the abnormal level in the congested set flow list. If there is no such aggregate flow, the <abnormal grade> is increased by one level (step 307) and searched again (step 302).

If such an aggregate flow exists in the <congested aggregate flow list> (step 303) and <free bandwidth> is greater than <the aggregate flow bandwidth> (step 304), the aggregate flow is regarded as a normal aggregate flow Delete the set flow from the Type Set Flow List> (step 305). Then, the &quot; free bandwidth &gt; is readjusted by subtracting &quot; the aggregate flow bandwidth &quot; considered normal in &quot; free bandwidth &quot; (step 306).

This task is executed until there is no <free bandwidth> sufficient to provide a normal aggregate flow (step 304) or until there are no aggregate flows to retrieve (step 308). At this time, the set flows stored in the <congested set flow list> variable are congested set flows that will limit the bandwidth.

A process of determining the amount of bandwidth to limit to the congested set flows selected in FIG. 3 will be described with reference to FIG. 4.

In order to maximize resource efficiency, the free bandwidth to be allocated to the congested set flows is the sum of the total bandwidth allocated to the congested set flows and the <free bandwidth> left in FIG. 3 (step 401). Based on the policy, the bandwidth to be limited for each abnormal level is calculated (step 402). In this case, the policy is set so that congested low-flow aggregate flows use more resources than congested high-flow aggregation flows. For example, 10% of <free bandwidth> is given as <limited bandwidth> for congested set flows that fall under the highest abnormal class, and 20% of <free bandwidth> for congested set flows with lower abnormal levels is < The administrator can set the policy provided by Limited Bandwidth>. Finally, by dividing the set flows of the congested set flow list by <abnormal grade>, the bandwidth is limited to <limited bandwidth> corresponding to each abnormal grade (step 403).

The bandwidth limit determination method for the congested aggregate flow according to the present invention may also be implemented as computer readable code on a computer readable recording medium. The computer-readable recording medium includes all kinds of recording devices in which data that can be read by a computer system is stored. Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, flash memory, optical data storage device, and also carrier wave (e.g. transmission over the Internet). It is also included to be implemented in the form of. The computer readable recording medium can also be distributed over computer systems connected over a computer network so that the computer readable code is stored and executed in a distributed fashion. Also, the font ROM data structure according to the present invention can be read by a computer on a recording medium such as a computer readable ROM, RAM, CD-ROM, magnetic tape, hard disk, floppy disk, flash memory, optical data storage device, and the like. It can be implemented as code.

The best embodiments have been disclosed in the drawings and specification above. Although specific terms have been used herein, they are used only for the purpose of describing the present invention and are not used to limit the scope of the present invention as defined in the meaning or claims. Therefore, those skilled in the art will understand that various modifications and equivalent other embodiments are possible from this. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

As described above, the method and apparatus for determining bandwidth limit for congested aggregate flows according to the present invention are installed at an access point of a network and are used for DoS attacks and Worm scan attacks without affecting normal aggregate flows. It is effective to block attack aggregation flows corresponding to abnormal excessive traffic.

In particular, since the bandwidth and aggregation flows to be restricted are determined by combining not only the bandwidth information of the aggregation flow but also the current status of the network and the abnormal grade of the aggregation flow, the false-positive problem of blocking normal traffic can be minimized.

1 is a block diagram illustrating an apparatus for determining a bandwidth limit for a congested aggregation flow for blocking an abnormal congestion attack aggregation flow according to the present invention.

FIG. 2 is a flowchart illustrating a bandwidth limit determination process for the aggregation flow of the bandwidth limit determiner in FIG. 1.

FIG. 3 is a flowchart illustrating a process of determining a congested aggregation flow to which bandwidth limitation is applied when network congestion is expected in the process of FIG. 2.

4 is a flowchart illustrating a process of determining an amount of bandwidth to be limited to the congested aggregation flow determined in the process of FIG. 3.

Description of the main parts of the drawing

101: bandwidth limit determination unit

102: bandwidth measurement unit

103: grading unit

104: bandwidth limitation

105: status information storage unit

Claims (10)

A bandwidth measuring unit configured to measure a bandwidth of at least one aggregate flow to be input based on predetermined information indicating characteristics of the aggregate flow; A rating unit configured to determine a rating according to an abnormal degree of the input aggregate flows; A bandwidth limit determining unit which determines an amount of bandwidth to be restricted and an aggregation flow based on the measured bandwidth and an abnormal class; A bandwidth limiter configured to receive the determination result of the bandwidth limit determiner and limit or release the bandwidth of the selected aggregate flow among the input aggregate flows; And And a state information storage unit for storing state information including a usage bandwidth, an abnormal class, and a limited bandwidth amount of the input set flows. The method of claim 1, wherein the bandwidth measuring unit And a bandwidth of the aggregate flow is measured based on the predetermined information including a source IP address, a protocol, and a port number of a destination. The method of claim 2, wherein the bandwidth measuring unit And outputting the measured result to the bandwidth determiner periodically or whenever the bandwidth fluctuates. 2. The method of claim 1, wherein the rating unit And when the inputted aggregate flow is determined to be an attack, determining the class based on the attack type and the degree of danger. The method of claim 1, wherein the bandwidth determination unit And determining the bandwidth to be limited and the aggregation flow to limit the bandwidth or the aggregation flow to release the limited bandwidth based on the state information and the current state of the network. (a) acquiring and storing bandwidth information of at least one aggregate flow to be input and determining an abnormal level; (b) comparing the total bandwidth of the input aggregate flows with a predetermined bandwidth allocated to normal aggregate flows to determine whether there is a network congestion risk; And (c) if it is determined in step (b) that the network is at risk of congestion, determining a congestion type flow to limit the bandwidth and storing the result; And (d) determining an amount of bandwidth to impose a limit on the congested aggregation flow to impose the limit on and save the result; (e) if it is determined in step (b) that the network is in a normal state, releasing the aggregated flows for which the bandwidth is limited and storing the result; determining the bandwidth limitation for the congested aggregate flow Way. The method of claim 6, wherein step (b) If the total bandwidth is greater than the bandwidth allocated to the normal aggregate flows, determine that the network is at risk, and if the total bandwidth is small, determine the bandwidth limit for the congested aggregate flow. The method of claim 6, wherein step (c) (c1) setting a congested aggregate flow list with the total bandwidth allocated to the normal aggregate flows as a spare bandwidth, the abnormality grade as the lowest abnormality grade, and all aggregate flows; (c2) retrieving the aggregate flows having the least bandwidth from the congested aggregate flow list and having the smallest bandwidth; (c3) repeating the search by raising the abnormal level by one step if there is no aggregate flow that satisfies the condition in step (c2); (c4) If there is an aggregate flow that satisfies the condition in step (c2) and the spare bandwidth is larger than the aggregate flow bandwidth, the aggregate flow is regarded as a normal aggregate flow and the aggregate flow in the congested aggregate flow list. Subtracting a bandwidth of the formal aggregation flow from the spare bandwidth; And (c5) selecting congestion type flows by repeating steps (c1) to (c4) until there is no free bandwidth enough to provide the normal aggregation flow or there is no more aggregation flow to search for; , (c6) summing the total bandwidth allocated to the congested aggregate flows and the total bandwidth allocated to the normal aggregate flows and substituting the free bandwidth; (c7) calculating the limited bandwidth for each abnormal grade based on the substituted free bandwidth and the abnormal grade grant policy; (c8) determining the amount of bandwidth for the aggregate flow selected as the congested aggregate flow by dividing the aggregate flow in the congested aggregate flow list by an abnormal grade and then allocating a limited bandwidth corresponding to each abnormal grade; Bandwidth limit determination method for congested aggregation flow comprising a. The method of claim 8, wherein step (c7) And calculating by multiplying the substituted free bandwidth by a predetermined ratio. A computer-readable recording medium having recorded thereon a program capable of executing the method of determining the bandwidth limit for the congested aggregate flow of claim 6.