KR101047152B1 - Data Driven Traffic Management System and Traffic Management Method - Google Patents

Abstract

The present invention relates to a data-based traffic management system and a traffic management method. The present invention provides a data-based traffic management system including a traffic management device, a communication network, a router, a gateway, a switch, a hub, and a terminal, wherein the traffic management device includes each of the communication network, router, gateway, switch, and hub. The system collects system log (syslog) and simple network management protocol (SNMP) and performs log management and traffic management based on the data. On the other hand, the traffic management device, Transmitting and receiving unit for performing data transmission and reception between the router and the gateway, or at least one switch; Collect the system log (syslog) and simple network management protocol (SNMP) of the router, gateway, switch, hub through the transceiver to perform log management and traffic management based on the data, the received A controller configured to configure a network between the router, the gateway, the switch, and the hub through data, and outputting the speed of each section in real time so that the usage can be checked visually by color; And a database collecting and storing a system log and a simple network management protocol (SNMP) of the router, the gateway, the switch, and the hub under the control of the controller. It includes. In this way, data such as system log (syslog) and simple network management protocol (SNMP), which are data used in each device such as routers, gateways, switches, and hubs, are collected. Traffic can be managed without

syslog, SNMP, network, management, traffic management, ARP

Description

Traffic management system and method based on data

The present invention relates to, and more particularly, to a data-based traffic management system and a traffic management method.

Recently, as the cyber attack through the Internet becomes more diverse and complicated, it is difficult to detect and respond effectively to a single security system. Therefore, integrated security management technology and integrated control systems have been proposed to organically associate and automatically manage single security systems. However, the passive security management system that centrally manages only a limited single security management area has difficulty in preventing cyber attacks through the global wide area network of the Internet.

In addition, the recent issue of Distributed Denied Of Service (DDoS) attacks has been recognized as a serious network security problem. DDoS attacks are difficult to distinguish from normal traffic, making it difficult to predict in advance, and the magnitude of damage is very large across the network. In addition, the majority of DDoS attacks are developing into a bandwidth-consuming attack trend that depletes resources of the entire network by introducing a large amount of harmful traffic into the network, which causes serious problems not only in terms of network security but also in terms of network resource management. . In particular, even if the DDos attack blocks the harmful packet in the attacker's domain, since the harmful traffic flows into the delivery network, congestion and resource depletion of the entire network are not solved. Therefore, serious problems are emerging that cannot be solved by existing local security structures. In light of this situation, a detection / response technique is needed to minimize the loss of network resources and services.

This requires an active and intelligent response technology that can detect the traffic of each device in advance and analyze the traffic of each device at the first entry point of the hacker domain or security management area that transmits harmful traffic. This functionality requires a flexible, dynamic, decentralized and collaborative active security management mechanism rather than the traditional passive and static integrated management approach.

Accordingly, the technical field collects traffic such as system log (syslog) and simple network management protocol (SNMP), which are data that are used in each equipment such as routers, gateways, switches, and hubs. The development of technology to manage the

Technical problem of the present invention devised to improve the above problems is a system log (syslog) and simple network management protocol (syslog), which is data that is conventionally used in each equipment, such as routers, gateways, switches, and hubs : It aims to provide a data-based traffic management system and traffic management method for managing traffic without collecting data such as SNMP).

According to an embodiment of the present invention, an object of the present invention is to provide a data-based traffic management system and a traffic management method capable of deriving analysis data for various network environments through an integrated network analysis system for comprehensive network management.

According to an embodiment of the present invention, it is possible to provide a data-based traffic management system and a traffic management method that can not only reduce the cost of a plurality of equipment, but also can expect advantages such as easy use based on a single interface. For the purpose of

However, the objects of the present invention are not limited to the above-mentioned objects, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

In a data-based traffic management system according to an embodiment of the present invention, in the data-based traffic management system including a traffic management device, a communication network, a router, a gateway, a switch, a hub, and a terminal, the traffic management device may include the communication network. It collects system log and simple network management protocol (SNMP) from each device of router, gateway, switch, and hub and performs log management and traffic management based on the data. You can do

The traffic management apparatus may include a transceiver configured to perform data transmission / reception between the router and the gateway or with at least one switch; Collect the system log (syslog) and simple network management protocol (SNMP) of the router, gateway, switch, hub through the transceiver to perform log management and traffic management based on the data, the received A controller configured to configure a network between the router, the gateway, the switch, and the hub through data, and outputting the speed of each section in real time so that the usage can be checked visually by color; And a database collecting and storing a system log and a simple network management protocol (SNMP) of the router, the gateway, the switch, and the hub under the control of the controller. It may be characterized in that it comprises a.

The controller may be configured to display speed or usage of each section between the router, gateway, switch, and hub through the received data, and CPU usage, system temperature, and equipment name of the router, gateway, switch, and hub. can do.

The control unit collects ARP information of the plurality of terminals connected to the plurality of hubs, and collects information on which switch the IP / MAC information of the outlet location for any one of the terminals has come through. Displays the outlet location on the input drawing, the outlet port is turned on to provide an outlet location tracking in the drawing that is pre-input when the IP address of any one terminal is input, and when the illuminated outlet is clicked, the one from the backbone It may also be characterized by displaying the connection of the equipment connected to the terminal.

In a data-based traffic management method according to an embodiment of the present invention, in the data-based traffic management method using a traffic management device, a communication network, a router, a gateway, a switch, a hub, and a terminal, the traffic management device may include the communication network, Collecting a system log and a simple network management protocol (SNMP) from each device of a router, a gateway, a switch, and a hub; And a second step of the traffic management apparatus performing log management and traffic management based on the data; It may be characterized in that it comprises a.

In a second step of the data-based traffic management method, the traffic management apparatus may configure a network between the router, the gateway, the switch, and the hub through the data, and the speed of each section in real time for each color. The display may be output such that the amount of usage can be checked visually.

In a second step of the data-based traffic management method, the traffic management apparatus may include a speed or usage rate for each section between the router, gateway, switch, and hub through the data, and the CPU for the router, gateway, switch, and hub. It can be used to display the usage, system temperature and equipment name.

Data-based traffic management method according to another embodiment of the present invention, in the data-based traffic management method using a traffic management device, a communication network, a router, a gateway, a switch, a hub, a terminal, the traffic management device, a plurality of A first step of collecting ARP information of a plurality of terminals connected to the hub; And collecting, by the traffic management device, information on which switch the IP / MAC information of the outlet location of any one of the terminals came through and displaying the outlet location in a previously inputted drawing, wherein the one terminal A second step of displaying an outlet port by lighting an outlet port on a drawing previously input when the IP address is input, and displaying a connection of equipment connected to a terminal from a backbone when the lit outlet is clicked; It may be characterized in that it comprises a.

Data-based traffic management system and traffic management method according to the present invention is a system log (syslog) and simple network management protocol (syslog), which is data that is conventionally used in each equipment, such as routers, gateways, switches, and hubs: It collects data such as SNMP) and provides the effect of managing traffic without separate data traffic.

In addition, the data-based traffic management system and traffic management method according to the present invention provides an effect that can be derived from the analysis data for a variety of network environment through an integrated network analysis system for comprehensive network management.

In addition, by the present invention, not only can reduce the cost of a plurality of equipment, but also provides the effect that can be expected, such as ease of use based on a single interface.

Hereinafter, a detailed description of a preferred embodiment of the present invention will be described with reference to the accompanying drawings. In the following description of the present invention, detailed descriptions of well-known functions or configurations will be omitted when it is deemed that they may unnecessarily obscure the subject matter of the present invention.

In the present specification, when one component 'transmits' data or a signal to another component, any one component may directly transmit data or a signal to another component, and at least one other component. This means that data or a signal can be transmitted to other components through the APC.

1 is a diagram illustrating a data-based traffic management system according to an exemplary embodiment of the present invention. Referring to FIG. 1, a data-based traffic management system includes a traffic management apparatus 100, a communication network 10, a router 30, a gateway 50, a switch 70, a hub 80, and a terminal 90. It may include.

Traffic management apparatus 100 is a system log (syslog) and simple network management protocol (simple network management protocol) in each device of the communication network 10, router 30, gateway 50, switch 70, hub 80 : Collects SNMP) and performs log management and traffic management based on the data. Here, the system log (syslog) is a collection of data that stores messages or commands received from the machine operator, and a description of infrequently occurring events and information related to the data or operation in operation. Simple Network Management Protocol (SNMP) is CP / IP's Network Management Protocol (RFC 1157), which is used to send network management information of network agents such as routers and hubs to network management systems. Adopted as standard communication protocol. It is developed based on TCP / IP's Simple Gateway Management Protocol (SGMP) and corresponds to Open System Interconnection (OSI) Network Common Management Information Protocol (CMIP). The network management information is collected and managed using two functions, request and response. In 1988, RFC 1157 was introduced as the Simple Network Management Protocol (SNMP) standard. In 1991, a revised version of SNMP2 was developed to sell products that support SNMP2. Meanwhile, the simplified network protocol (SNMP) is a general term for a network management information base (MIB) that is closely related to SNMP. The traffic management apparatus 100 stores the source IP address used by capturing the Internet side as a mirror (1) or in-line (2) to distinguish between the used IP and the unused IP. To perform the function.

The communication network 10 is a communication network that is a high-speed network of a large communication network capable of large-capacity, long-distance voice and data services, and may be a next-generation wired and wireless network for providing an Internet or high-speed multimedia service. When the communication network 10 is a mobile communication network, it may be a synchronous mobile communication network or an asynchronous mobile communication network. As an embodiment of the asynchronous mobile communication network, a WCDMA (Wideband Code Division Multiple Access) communication network is exemplified. In this case, although not shown in the figure, the mobile communication network 700 may include a Radio Network Controller (RNC). Meanwhile, although the WCDMA network is taken as an example, it may be an IP network based on a next generation communication network such as 3G LTE network, 4G network, or other IP.

The router 30 is a network device that serves to connect a network between different models, and connects an arbitrary network with an internal network. The router 30 is often used to connect an internal network, LAN, with an external network, WAN, and connects the physical layer, the data link layer, and the network layer of the OSI 7 layer reference model. The router 30 should be able to accept packets transmitted in various protocols, and perform bridge and route allocation, which is a function of finding the least traffic route of the network and transmitting data to a destination. Router 30 is necessary when using the Internet through a dedicated line, there is also a model that functions as a firewall (Firewall) for the security of the network. The router 30 may be divided into a static router and a dynamic router.

The gateway 50 is a network device that includes all layers of the OSI reference model and is a device for converting data formats between two completely different networks.

The gateway 50 provides a function of connecting network environments having different protocol structures, and may be a point of causing bottlenecks in a network by performing protocol conversion functions of various layers. The advantages of the gateway 50 include the ability to connect completely different systems, to execute only the unique functions of the gateway, and to the disadvantages, which are more expensive than other devices, difficult to install and configure, and data conversion. The transmission speed can be very slow because it has the function of.

Switch 70 is a network device in the field of communication that selects a path or line to send unit data to the next destination. The switch 70 is a device that can determine where data should be sent to a route, more specifically, to an adjacent network point. In general, a switch is a much simpler and faster device than a router that requires knowledge of the network and how to determine the route.

The switch 70 is usually associated with two layers, or datalink layers, in the OSI reference model. However, some newer switches perform the routing function of the three-layer network layer, which is often called an IP switch.

The hub 80 is a network device used to connect computers in an office or a short distance by using a UTP cable. The hub 80 connects to another network in a short distance (ie, another hub) and checks network status (monitoring function). It performs a signal amplification function (the role of a repeater). The hub 80 facilitates network management, makes it easy to detect network errors, and reduces bottlenecks to some extent. In addition, the hub 80 is easy to expand, can be connected to other networks and network equipment, and amplifies the signal.

The terminal 90 is a broad concept including a wired terminal or a wireless terminal, and includes a personal computer (PC), an IP television (Internet Protocol Television), a notebook-sized personal computer, a personal digital assistant (PDA), and a smart terminal. Phone, International Mobile Telecommunication 2000 (IMT-2000) phone, Global System for Mobile Communication (GSM) phone, General Packet Radio Service (GPRS) phone, Wideband Code Division Multiple Access (WCDMA) phone, Universal Mobile Telecommunication Service (UMTS) phone And a mobile broadband system (MBS) phone and the like, and may be provided with a function of performing transmission and reception of data for voice and video with different terminals, servers, and systems.

2 is a block diagram illustrating a configuration of the traffic management apparatus 100 of FIG. 1, and FIG. 3 is a diagram illustrating a screen output from the traffic management apparatus 100 of FIG. 1. 1 to 3, the traffic management apparatus 100 includes a transceiver 110, a controller 130, and a database 150.

The transceiver 110 may perform data transmission and reception between the router 30 and the gateway 50 or with a plurality of switches 70.

The control unit 130 is a system log (syslog) and simple network management protocol of each device (router 30, gateway 50, switch 70, hub 80) through the transmission and reception unit 110 (simple network management) protocol: SNMP) is collected and log management and traffic management are performed based on the data. The controller 130 may configure a network of a specific region through the received data, and may output the speed of each section in real time so that the usage can be visually checked by color. Meanwhile, the controller 130 may pop-up the CPU, temperature, etc. of the device when the device contacts with the mouse, and may intuitively display the traffic accumulation value of the line when the device contacts the line.

In addition, the controller 130 collects ARP information of each terminal 90 through the transceiver 110 and collects information on which switch the IP / MAC information of the inputted outlet location comes through to the previously inputted drawing. The outlet location can be displayed. The control unit 130 provides an outlet location tracking without a separate line number after the outlet port is turned on in the drawing previously inputted when the IP is input after the connection of the specific terminal to the transceiver 110 of the plurality of terminals 90. In addition, the controller 130 may display a connection of equipment connected from the backbone to the terminal 90 when the lit outlet is clicked.

The database 150 is a system log of each device (router 30, gateway 50, switch 70, hub 80) received through the transmission and reception unit 110 under the control of the controller 130 ( syslog) and simple network management protocol (SNMP). In addition, the database 150 may receive and store ARP information of each terminal 90 through the transceiver 110 under the control of the controller 130.

In the present specification, the database 150 may refer to a functional structural combination of software and hardware for storing information corresponding to each database. The database 150 may be implemented with at least one table, and may further include a separate database management system (DBMS) for searching, storing, and managing information stored in the database. In addition, it may be implemented in various ways, such as a linked-list, a tree, a relational database, and includes all data storage media and data structures capable of storing information corresponding to the database.

As shown, the traffic management apparatus 100 may display the speed or usage for each section, the CPU usage and system temperature for each equipment, and the equipment name.

4 is a diagram illustrating a user interface screen implemented by the traffic management apparatus 100 of FIG. 1. 1 to 4, the traffic management apparatus 100 collects ARP information, collects information on which switch the IP / MAC information of the inputted outlet location is through, and displays the outlet location on a previously inputted drawing. can do.

The ARP information is address resolution protocol information and is protocol information used for mapping an IP address to a physical network address. You connect to the Internet using an IP address, but you use an Ethernet address over Ethernet. To this end, the IP address must be converted into an Ethernet address. The protocol for converting an IP address into a physical address is called an address resolution protocol (ARP). The reverse process is called reverse address resolution protocol (RARP), and the traffic management apparatus 100 may indicate the outlet location using this address.

After the connection of a specific terminal among the plurality of terminals 90, the traffic management apparatus 100 turns on the outlet port in the drawing which is pre-inputted when the IP is input, thereby providing an outlet location tracking without a separate line number.

The traffic management apparatus 100 may also display a connection of equipment connected from the backbone to the terminal 90 when the lit outlet is lit.

5 is a diagram illustrating a user interface screen implemented by the traffic management apparatus 100 of FIG. 1 according to another exemplary embodiment. 1 to 5, the traffic management apparatus 100 collects a system syslog of each registered network equipment, and thus, it is not necessary to check each device.

As shown, the traffic management apparatus 100 may provide a system log (syslog) for each IP address according to a request of each terminal 90 or a request of a user.

In addition, the traffic management apparatus 100 may perform the IP collision detection function by mounting the IP collision detection function between the respective terminals 90.

FIG. 6 is a diagram illustrating a user interface screen implemented by the traffic management apparatus 100 of FIG. 1 according to another exemplary embodiment. 1 to 6, the traffic management apparatus 100 may support IP state identification for each building. As shown, the traffic management apparatus 100 may assist with IP management by outputting the current issued IP address, unissued IP address, and unused IP address for each period by color.

7 is a flowchart illustrating a data-based traffic management method according to an embodiment of the present invention. 1 to 7 (a), the traffic management apparatus 100 and the system log (syslog) of each device (router 30, gateway 50, switch 70, hub 80) and Collect a simple network management protocol (SNMP) (S1).

The traffic management apparatus 100 may display the speed or usage for each section and the CPU usage, system temperature, and equipment name for each equipment through the received data (S3). More specifically, the traffic management apparatus 100 may be configured in a network of a specific region, and the speed for each section is displayed in color in real time to output to be able to check the usage with the naked eye. On the other hand, the traffic management apparatus 100, the CPU, temperature, etc. of the equipment when the device contacts with the mouse (Pop-Up) pop-up (Pop-Up), when the contact with the line can be displayed intuitively the cumulative traffic value of the line.

Meanwhile, referring to FIGS. 1 to 7 (a), the traffic management apparatus 100 collects ARP information of each terminal 90 (S5).

Thereafter, the traffic management apparatus 100 may collect information on which switch the IP / MAC information of the inputted outlet location comes through and display the outlet position on a previously input drawing. That is, the traffic management apparatus 100 tracks the location of the outlet without a separate line number after the outlet port is turned on in the drawing that is pre-inputted when the IP address is input after accessing the transceiver 110 of a specific terminal among the plurality of terminals 90. To provide. In addition, the traffic management apparatus 100 may display the connection of equipment connected from the backbone to the terminal 90 when the outlet is lit (S7).

The present invention can also be embodied as computer-readable codes on a computer-readable recording medium. Computer-readable recording media include all kinds of recording devices that store data that can be read by a computer system.

Examples of computer-readable recording media include ROM, RAM, CD-ROM, magnetic tape, floppy disks, optical data storage devices, and the like, which are also implemented in the form of carrier waves (eg, transmission over the Internet). It also includes.

The computer readable recording medium can also be distributed over network coupled computer systems so that the computer readable code is stored and executed in a distributed fashion. And functional programs, codes and code segments for implementing the present invention can be easily inferred by programmers in the art to which the present invention belongs.

8 is a diagram illustrating a user interface screen implemented in the traffic management apparatus 100 according to an embodiment of the present invention. Referring to FIGS. 1 to 8, the user of the traffic management apparatus 100 may be manufactured by dragging a corresponding figure in a building example of the illustrated drawing with a mouse, and then drawing a room with a line or the like.

The illustrated figure is not limited to this, and the example of the figure may be drawn by combining a plurality of figures. After the building shape is drawn, the room and the corridor may be divided by lines, and the outlet may be drawn there.

When the outlet is drawn in the figure of FIG. 8, the position is automatically stored and the switch port is tracked when the terminal 90 is tracked, and the light is turned on at the outlet position stored in the figure above.

Although the contents of the present invention have been described with reference to one embodiment shown in the drawings, this is merely exemplary, and those skilled in the art may realize that various modifications and equivalent other embodiments are possible. I will understand. Therefore, the true technical protection scope of the present invention will be defined by the technical spirit of the appended claims.

According to the data-based traffic management system and traffic management method of the present invention, the system log (syslog) and the simple network management protocol, which are data that are conventionally used in each equipment such as a router, a gateway, a switch, and a hub, are used. It can manage traffic by collecting data such as: SNMP) and provide technology for deriving analysis data for various network environments through integrated network analysis system for comprehensive network management. .

BRIEF DESCRIPTION OF THE DRAWINGS In order to more fully understand the drawings recited in the detailed description of the invention, a brief description of each drawing is provided.

1 is a view showing a data-based traffic management system according to an embodiment of the present invention.

2 is a block diagram showing the configuration of the traffic management apparatus of FIG.

3 is a view showing a screen output from the traffic management device of FIG.

4 is a view showing a user interface screen implemented by the traffic management device of FIG.

5 is a diagram illustrating a user interface screen implemented by the traffic management apparatus of FIG. 1 according to another embodiment of the present invention.

6 is a view showing a user interface screen implemented by the traffic management device of FIG. 1 according to another embodiment of the present invention.

7 is a flowchart illustrating a data-based traffic management method according to an embodiment of the present invention.

8 is a view showing a user interface screen implemented in the traffic management apparatus 100 according to an embodiment of the present invention.

<Description of the symbols for the main parts of the drawings>

10: network 30: router

50: gateway 70: switch

80: hub 90: terminal

100: traffic management device 110: transceiver

130: control unit 150: database

Claims (8)

delete delete A transceiver including a traffic management device, a communication network, a router, a gateway, a switch, a hub, and a terminal, and transmitting and receiving data between the router and the gateway or with one or more switches; Collect the system log (syslog) and simple network management protocol (SNMP) of the router, gateway, switch, hub through the transceiver to perform log management and traffic management based on the data, the received A controller configured to configure a network between the router, the gateway, the switch, and the hub through data, and outputting the speed of each section in real time so that the usage can be checked visually by color; And a database for collecting and storing a system log and a simple network management protocol (SNMP) of the router, the gateway, the switch, and the hub under the control of the controller. A data foundation configured to collect system logs and simple network management protocols (SNMP) from each device in the network, routers, gateways, switches, and hubs and perform log management and traffic management based on that data. In the traffic management system of, The control unit, Based on the received data, the speed and usage of the intervals between the routers, gateways, switches and hubs, and the CPU usage and system temperature of the routers, gateways, switches and hubs are displayed. Traffic management system. The method of claim 3, wherein the control unit, After collecting ARP information of the plurality of terminals connected to the plurality of hubs, IP / MAC information of the outlet location for any one of the terminals is collected in advance to collect the information through which switch On the outlet location, When the IP address of any one terminal is input, the outlet port is turned on to provide an outlet location tracking in the drawing that is pre-input, and when the illuminated outlet is clicked, the connection of the equipment connected from the backbone to the one terminal is also displayed. Data-based traffic management system. delete delete The traffic management device is composed of a traffic management device, a communication network, a router, a gateway, a switch, a hub, and a terminal, and a system log and a simple network management protocol in each device of the communication network, the router, the gateway, the switch, and the hub. collecting a simple network management protocol (SNMP); And the traffic management apparatus performs log management and traffic management based on the data, and may configure a network between the router, the gateway, the switch, and the hub through the data, and the speed of each section may be increased in real time. A second step of displaying the colors and outputting the naked eye to check the amount of usage; In the data-based traffic management method consisting of, The second step, Wherein the traffic management device, the speed and usage of the interval between the router, gateway, switch, hub through the data, and displays the CPU usage, system temperature and equipment name for the router, gateway, switch, hub Data-based traffic management. In the data-based traffic management method using a traffic management device, communication network, router, gateway, switch, hub, terminal, A first step of the traffic management apparatus collecting ARP information of a plurality of terminals connected to a plurality of hubs; And The traffic management apparatus collects information on which switch the IP / MAC information of the outlet position of any one of the terminals is through, and displays the outlet position in a previously inputted drawing, A second step of displaying an outlet port by lighting an outlet port on a drawing previously input when an IP address is input, and displaying a connection of equipment connected from a backbone to any one terminal when the lit outlet is clicked; Data-based traffic management method comprising a.

Images