KR101959757B1 - Apparatus and method for visualizing traffic situation of financial network - Google Patents

Abstract

A method for visualizing a traffic situation of a financial network comprises the steps of: capturing a packet of a predetermined interval for analyzing traffic of at least one financial network protocol among a plurality of financial network protocols used in a financial network; analyzing a structure of the financial network protocol based on the captured packet; selecting a protocol tag and a visualization field to be visualized among layers of the analyzed network protocol; transforming the captured packet so that the packet can be applied to the visualization tool; and visualizing the captured packet based on the protocol tag and the visualization field to be visualized.

Description

[0001] Apparatus and method for visualizing the traffic situation of a financial network [0002]

The present invention relates to an apparatus and a method for visualizing a traffic situation of a financial network, and it relates to an apparatus and a method for visualizing a traffic situation of a financial network by analyzing a protocol used in a financial network, I would like to suggest a method that can be easily analyzed.

Financial networks for wired and wireless communication are increasing. In such an environment, the expansion of the physical bandwidth of the financial network can not cope with the demand of the user, and efficient distribution of the financial network resources is required. In recent years, there have been increasing instances of viruses or malicious intentions to access financial networks, causing abnormal traffic and damaging them.

Also, it is not easy for non-experts to know whether an attack is occurring on a financial network, and monitoring financial networks by hiring security experts to prevent financial accidents that cause serious harm results in an economically inefficient cost.

In networks where data is actively flowing, such as financial networks, security experts are also unable to analyze all network packets in real time and simply can not overlook suspicious packets to filter into the log system. As a countermeasure, technologies for monitoring the traffic of a financial network have been proposed.

BACKGROUND ART [0002] The background technology of the present application is disclosed in Korean Patent Laid-Open Publication No. 2000-0008416 (published on Feb. 2, 2000).

The present invention has been made to solve the above-mentioned problems of the prior art, and it is an object of the present invention to analyze a FIX (Finance Information eXchange) protocol used in a financial network and to define vital visualization tags, It is an object of the present invention to provide an apparatus and method for visualizing a traffic situation of a financial network that can be effectively and easily visualized and provided.

It is another object of the present invention to provide a method and apparatus for analyzing a FIX (Finance Information eXchange) protocol used in a financial network to define a visualization tag, to analyze the traffic of a financial network It is an object of the present invention to provide an apparatus and a method for visualizing a situation.

It should be understood, however, that the technical scope of the embodiments of the present invention is not limited to the above-described technical problems, and other technical problems may exist.

According to an aspect of the present invention, there is provided a method of visualizing a traffic situation of a financial network, the method comprising: receiving traffic of at least one financial network protocol among a plurality of financial network protocols used in the financial network; Analyzing a structure of the financial network protocol based on the captured packet, selecting a visualization field and a visualization tag among layers of the analyzed financial network protocol based on the captured packet, Converting the captured packet so that it can be applied to the visualization tool, and visualizing the captured packet based on the visualization target field and the visualization tag.

According to one embodiment of the present application, the step of converting the captured packet comprises dividing and capturing the captured packet into a plurality of sub-packet files, wherein visualizing the captured packet comprises: Can be repeatedly performed on the subpacket file.

According to another aspect of the present invention, there is provided a method of visualizing traffic in a financial network, the method further comprising: receiving a user input for setting an interval of a packet to be captured among packets transmitted and received through the financial network, And storing a packet captured in the pcap file so as to capture and analyze the packet of the predetermined interval based on the user input.

According to an embodiment of the present invention, the step of selecting the visualization target field and the visualization tag may include a step of, in association with the service tag of the financial network protocol, generating a source IP address, a destination IP address, The number can be selected as a visualization field.

According to an embodiment of the present invention, the step of selecting a visualization target field and a visualization tag may further include the steps of: selecting a message type, an order ID, a message serial number, and a sender ID of the financial network protocol, Tag can be selected.

According to one embodiment of the present invention, the step of analyzing the structure of the financial network protocol includes analyzing the number of services of the financial network protocol, the structure of packets per layer, the configuration of each tag field, Lt; / RTI >

According to one embodiment of the present application, the financial network protocol may be a Finance Information Exchange (FIX) protocol.

According to one embodiment of the present invention, an apparatus for visualizing a traffic situation of a financial network is provided for analyzing traffic of a financial network protocol, which is a Finance Information Exchange (FIX) protocol, which is at least one of a plurality of financial network protocols used in a financial network A packet capturing unit for capturing a packet of a predetermined section, a protocol analyzing unit for analyzing the structure of the financial network protocol based on the captured packet, and selecting a field to be visualized and a visualization tag among layers of the analyzed financial network protocol And a visualization unit for converting the captured packet so as to be applicable to the visualization tool and the visualization tool, and for visualizing the captured packet based on the visualization target field and the visualization tag.

According to an embodiment of the present invention, a traffic visualization apparatus of a financial network further includes a user input unit for receiving a user input for setting a segment of a packet to be captured among the packets transmitted and received through the financial network, A packet captured in the pcap file may be stored so that the packet of the predetermined interval can be captured and analyzed based on the user input.

According to an embodiment of the present invention, the protocol analyzing unit may select a source IP address, a destination IP address, and a port number of the IP layer as a visualization field in association with a service tag of the financial network protocol .

According to one embodiment of the present invention, the protocol analyzing unit may select a message type, an order ID, a message serial number, and a sender ID of the financial network protocol as tags of the visualization target.

According to an embodiment of the present invention, the protocol analyzing unit may analyze a difference in the number of services of the financial network protocol, a packet structure per layer, a configuration of each tag field, and a difference in field configuration of each service.

The above-described task solution is merely exemplary and should not be construed as limiting the present disclosure. In addition to the exemplary embodiments described above, there may be additional embodiments in the drawings and the detailed description of the invention.

According to the present invention, the FIX (Finance Information Exchange) protocol used in the financial network is analyzed, and the important visualization tag is defined to efficiently and understand the huge traffic existing on the financial network according to the user's request It is possible to provide an apparatus and a method for visualizing a traffic situation of a financial network that can be easily visualized and provided.

According to the present invention, there is provided a method of analyzing a FIX (Finance Information Exchange) protocol used in a financial network to define a visualization tag, visualize the traffic situation of a financial network, Apparatus and method.

In addition, according to the above-described task solution of the present invention, utilization in a major financial facility such as a financial system based on a network protocol, inefficient operation structure improvement, use for reducing security cost, and utilization for network forensic It is possible to provide an apparatus and method for visualizing the traffic situation of a possible financial network.

According to the above-mentioned problem solving means of the present invention, by visualizing and providing the main tag analysis about the FIX (Finance Information eXchange) protocol of the financial network environment, not only experts but also ordinary users can easily grasp the statistics generated in the financial network .

1 is a schematic system diagram of a traffic visualization apparatus for a financial network according to an embodiment of the present invention.
FIG. 2 is an exemplary diagram illustrating a FIX (Finance Information Exchange) protocol used in a financial network according to an embodiment of the present invention.
3 is a block diagram illustrating a schematic configuration of a traffic visualization apparatus for a financial network according to an embodiment of the present invention.
4 is a flowchart schematically illustrating a method of visualizing a traffic situation of a financial network according to an exemplary embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings so that those skilled in the art can easily carry out the present invention. It should be understood, however, that the present invention may be embodied in many different forms and should not be construed as limited to the embodiments set forth herein. In the drawings, the same reference numbers are used throughout the specification to refer to the same or like parts.

Throughout this specification, when a part is referred to as being "connected" to another part, it is not limited to a case where it is "directly connected" but also includes the case where it is "electrically connected" do.

It will be appreciated that throughout the specification it will be understood that when a member is located on another member "top", "top", "under", "bottom" But also the case where there is another member between the two members as well as the case where they are in contact with each other.

Throughout this specification, when an element is referred to as "including " an element, it is understood that the element may include other elements as well, without departing from the other elements unless specifically stated otherwise.

FIG. 1 is a schematic system diagram of a traffic visualization apparatus of a financial network according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a FIX (Finance Information Exchange) protocol used in a financial network according to an embodiment of the present invention. .

Referring to FIG. 1, a traffic visualization system of a financial network may include a traffic visualization apparatus 100 of a financial network, a financial server 200, and user terminals 11 to 13. The traffic visualization system of the financial network can analyze the traffic of the FIX (Finance Information eXchange) protocol used in the financial network to visualize the traffic situation and provide it to a terminal (not shown) of the financial network manager.

According to one embodiment of the present disclosure, the financial network may refer to a financial common network. The financial joint network is a payment settlement system established and operated by KFTC. It provides various financial transaction services and financial transaction information to financial customers by connecting various financial institutions and KFTC's computer systems. The financial joint network consists of a cash dispenser network, a cash dispenser network, an electronic financial joint network, and a common information network among banks, so that users of financial services can use various services without going to the bank. Unlike the general Internet network, the financial joint network operates physically.

The FIX (Finance Information eXchange) protocol is a standard protocol for trading various financial instruments such as stocks, futures options, and bonds. In other words, the FIX (Finance Information eXchange) protocol is a worldwide standard protocol for transmitting and receiving data between financial institutions. The FIX (Finance Information eXchange) protocol standardizes the communication between clients who place an order, a broker who makes an order, and exchanges that make a contract, And one system can easily be applied to multiple customers / securities firms / exchanges. Depending on the purpose of the financial institution using the FIX (Finance Information eXchange) protocol, various financial information can communicate based on the format defined in the standard in the application layer.

2, the FIX (Finance Information Exchange) protocol includes a session layer consisting of a series of rules for electronic message exchange and an application layer composed of information necessary for financial transactions Communication is possible based on the format defined by the standard, but is not limited thereto. The Session Layer can standardize the management of network sessions such as login, logout, and heartbeat messages. The Application Layer is a protocol used in the financial processor. It can standardize specifications of new, revised, canceled orders, order acceptance, and contract information.

According to one embodiment of the present invention, the message of the FIX (Finance Information Exchange) protocol may be listed in the form of &quot; <tag> = <value> &quot; A tag can be represented by an integer from 1 to 1139, and can mean a different field. The visualization tag in the FIX (Finance Information eXchange) protocol includes a message type (MsgType (35)), an order identifier (OrderID 37), a message serial number (MsgSeqNum 34), a sender identifier (SenderID 49) . For example, the tag 35 may be a string identifying the message type, a tag identifying the tag 37 an order identifier, and a tag 34 identifying a string identifying the message serial number. In other words, the tag may be an integer representing the meaning of the field. The value can be a byte array that has a specific meaning for a particular tag.

The field may be a Source Address, a Destination Address field, a Port Number field, or the like. The Source Address can be the Source IP address of the IP layer. In other words, it may be the sending / receiving host IP address. The Destination Address field may be the Destination IP address of the IP layer. In other words, it can be the receiving host IP address. In the present invention, a specific field of the IP layer is visualized as a visualization field, but the present invention is not limited thereto.

 According to an embodiment of the present invention, a traffic visualization apparatus 100 of a financial network can classify traffic conditions generated by financial information exchanged between a financial server 200 and user terminals 11 to 13, based on fields and tags of a visualization object And provide it to a user (for example, a financial network manager) terminal. In other words, the traffic visualization apparatus 100 of the financial network captures a packet of a predetermined interval in order to analyze a traffic situation occurring in a FIX (Finance Information Exchange) protocol used in a financial network at an application layer, (Finance Information eXchange) protocol, converts the visualization target field and visualization tag to be applicable to the visualization tool, visualizes the captured packet, and provides the visualization tag to the user (for example, a financial network manager) terminal can do. In addition, the traffic visualization apparatus 100 of the financial network stores the visualized analysis result information, and based on the request of the financial network administrator terminal (not shown) (for example, Analysis results can be provided.

According to one embodiment of the present invention, the traffic visualization apparatus 100 of the financial network receives user input information as to whether or not to take a temporary state action arbitrarily with respect to a traffic situation occurring in a financial network from a financial network administrator terminal (not shown) can do. The traffic visualization device 100 of the financial network may include manuals for interim measures associated with each financial network.

According to one embodiment of the present invention, the traffic visualization apparatus 100 of the financial network may provide visualization information (e.g., a graph or a table) generated through a visualization tool to a financial network administrator terminal (not shown). For example, a financial network manager terminal (not shown) displays the traffic situation of the financial network, and the financial network manager can grasp the traffic situation of the financial network and take necessary measures for each financial network.

According to an embodiment of the present invention, a traffic visualization apparatus 100 of a financial network may include a plurality of financial network nodes, each of the plurality of financial network nodes including at least one financial network node, It is possible to obtain the information of the traffic. For example, the traffic visualization apparatus 100 of the financial network may receive information of traffic only from a financial network node of the highest hierarchical level among a plurality of financial network nodes. The traffic information may include financial protocol information, a source IP address, a destination IP address, a port number, and the like.

According to one embodiment of the present invention, the traffic visualization apparatus 100, the financial server 200, and the user terminals 11 to 13 of the financial network can exchange information between respective nodes through a network. According to one embodiment of the present invention, an example of a network includes a 3rd Generation Partnership Project (3GPP) network, a Long Term Evolution (LTE) network, a 5G network, a World Interoperability for Microwave Access (WIMAX) network, (WLAN) network, a wireless LAN (Wide Area Network), a PAN (Personal Area Network), a Bluetooth network, a Wifi network, An analog broadcasting network, a DMB (Digital Multimedia Broadcasting) network, and the like.

According to one embodiment of the present invention, the financial server 200 may be a bank server, a financial institute, a Korea Exchange, a Korea Deposit Insurance Corporation, or the like (for example, BC card settlement, foreign currency funds transfer, But is not limited to, a server of a financial institution.

According to one embodiment of the present application, the user terminals 11 to 13 may be terminals of a user using a financial network. The financial network may be a financial community providing various financial transaction services, for example, cash withdrawal, account transfer, remittance, and the like. The user terminals 11 to 13 are devices for communicating with the financial server 200 via a network and include a smart phone, a smart pad, a tablet PC, a wearable device, and a PCS (Personal Communication System) (Personal Digital Assistant), PDA (Personal Digital Assistant), IMT (International Mobile Telecommunication) -2000, CDMA (Code Division Multiple Access) -2000, A W-CDMA (W-Code Division Multiple Access), a Wibro (Wireless Broadband Internet) terminal, a desktop computer, or a fixed terminal such as a smart TV.

3 is a block diagram illustrating a schematic configuration of a traffic visualization apparatus for a financial network according to an embodiment of the present invention.

3, the traffic visualization apparatus 100 of the financial network may include a packet capture unit 110, a user input unit 120, a protocol analysis unit 130, and a visualization unit 140.

The packet capture unit 110 may capture packets of a predetermined interval for analyzing traffic of a FIX (Finance Information Exchange) protocol, which is at least one of a plurality of financial network protocols used in a financial network. By way of example, packet capture (pcap) may be to configure the API for network traffic capture in the network management field.

The packet capture unit 110 can monitor packets existing on the financial network by capturing packets. The packet may be a unit of transmission of the cut data for easy transmission through the network. In other words, an aggregate that is handled and transmitted as one unit by a transmitter and a receiver in data transmission, and is composed of a header, data, and a tailer. The header includes an address and an order to which data is to be transferred, Can be recorded.

The user input unit 120 can set an interval of packets to be captured among the packets transmitted and received through the financial network. The user transmits the input information for setting a section (for example, a time interval designation, a financial transaction type designation, etc.) of a packet transmitted and received through the financial network to the packet capturing section 110 using the user terminals 11 to 13 . The user can be a user for visualizing and providing the traffic situation of the financial network such as the financial security manager, the financial network manager, and the like. The packet capture unit 110 may store a packet captured in a pcap file so as to capture and analyze a packet of a predetermined interval based on user input.

The protocol analyzing unit 130 can analyze the structure of the financial network protocol based on the captured packet. The protocol analyzer 130 can analyze the structure of the financial network protocol based on a format defined as a standard.

According to one embodiment of the present invention, the protocol analyzing unit 130 can analyze the number of services of the financial network protocol, the structure of packets per layer, the configuration of each tag-specific field, and the difference in the field configuration of each service. Illustratively, the number of services of the financial protocol may be the number of message types of the FIX (Finance Information eXchange) protocol. The structure of a layer-by-layer packet may be, for example, a structure of a packet in an application layer or a structure of a packet in a session layer. The packet may be a unit of transmission of the cut data to facilitate transmission through the financial network. The packet may consist of a header, data and a tailor. In the header of the packet, the address and the order to which data is to be transferred are recorded, and the error information can be recorded in the Taylor. The difference between the configuration of each tag-specific field and the configuration of each service-specific field is as follows. The service (message) is D (new order), F (full cancel order), G (correction / And the 9th field (denial of receipt of a correction / partial cancellation order), etc., may be used to analyze the difference between the configuration of each tag used field and the configuration of each service field, But is not limited thereto. A service or message may be one that includes information, requests, etc. transmitted and received via the FIX protocol in conjunction with a financial transaction.

According to one embodiment of the present invention, the protocol analyzing unit 130 can select a visualization target field and a visualization tag among layers of the analyzed financial network protocol. For example, the protocol analyzer 130 can select a source IP address, a destination IP address, and a port number of the IP layer as a visualization field in association with a service tag of a financial network protocol. Illustratively, the IP layer is a layer that carries and carries IP packets and may be a layer that defines the address (IP address) of the network. The source IP address of the IP layer is the source address and may be the sending host address. Also, the destination IP address of the IP layer may be a destination address as a destination address.

In addition, the protocol analyzer 130 may select a message type, an order identifier, a message serial number, and a sender ID of a financial network protocol as tags of the visualization target. For example, the main message types used in the financial network protocol are D: NewOrderSingle - Financial New Order, F: OrderCancelRequest - All Cancel Order, G: OrderCancelReplaceRequest - Correction / Part Cancel Order, 8: ExecutionReport - NewOrderSingle Order Receipt, , 9: OrderCancelReject - Message type such as rejection of OrderCancelRequest / OrderCancelReplaceRequest (refusal / partial cancellation order), but is not limited thereto. For example, the message type may be a message such as a login or a logout. The order identifier (OrderID) may be user-specific ID information. The message serial number can be a serial number that establishes a session, and can be initialized when a session is established.

The visualization unit 140 may convert the captured packets to be applicable to the visualization tool. For example, the visualization unit 140 may fragment a packet into a plurality of files. The visualization unit 140 may divide the captured packet into a plurality of subpackets and store the subpackets.

Further, the visualization unit 140 can visualize the captured packet based on the visualization target field and the visualization tag. For example, the visualization unit 140 may provide a traffic situation by visualizing a traffic occupation state of at least one of a plurality of visualization target fields and a plurality of visualization tags in a pie graph. The visualization graph can take various forms as well as a pie graph.

In addition, the visualization unit 140 can repeatedly perform a plurality of subpacket files. For example, the visualization unit 140 determines whether there are a plurality of subpackets remaining, and, based on the visualization target field and the visualization tag for a plurality of subpacket files, So that captured packets can be visualized.

Also, according to an embodiment of the present invention, the traffic visualization apparatus 100 of the financial network can visualize the traffic situation of the financial network by linking the visualization target tag and the visualization target field. For example, the traffic visualization apparatus 100 may include a source IP address of the IP layer for each message type, an order identifier (OrderID), a message serial number, a sender identifier (SenderID) of a financial network protocol, a destination IP Address, and port number, and visualize the collected data.

In addition, according to an embodiment of the present invention, the traffic visualization apparatus 100 of the financial network can capture packets for each of a plurality of detailed networks of the financial network and visualize traffic conditions for each detailed network. The traffic visualization apparatus 100 of the financial network selects a message type, an order identifier (ID), a message serial number, and a sender identifier (Sender ID) of the financial network protocol for each detailed network as the tag of the visualization target, The source IP address, the destination IP address, and the port number of the IP layer can be selected as the visualization field in association with the service tag of the financial network protocol. For example, the plurality of detailed networks may include a CD public network, a second round public network, an electronic financial public network, and a local bank public network. Thus, by visualizing the traffic for each detailed network, it is possible to more easily monitor a detailed network in which an accident occurs or traffic conditions are not smooth.

According to one embodiment of the present invention, the visualization unit 140 may visualize the traffic statistic value for a message type using a message type as a pie graph. In addition, the visualization unit 140 may provide the visualization unit 140 with a pie (circular graph) or a table based on the important visualization tag of the message according to time, but the present invention is not limited thereto. And a visualization graph that can be provided as a visualization graph.

4 is a flowchart illustrating a traffic visualization method of a financial network according to an embodiment of the present invention. The traffic visualization method of the financial network shown in FIG. 4 is performed by the traffic visualization apparatus 100 of the financial network described with reference to FIG. 1 to FIG. Therefore, even if the contents are omitted from the description, the contents described with respect to the traffic visualization apparatus 100 of the financial network through FIGS. 1 to 3 can also be applied to FIG.

In step S401, the traffic visualization apparatus 100 of the financial network can capture packets of a predetermined interval for analyzing traffic of at least one financial network protocol among a plurality of financial network protocols used in the financial network. According to one embodiment of the present invention, the traffic visualization apparatus 100 of the financial network may receive a user input for setting a segment of a packet to be captured among packets transmitted and received through a financial network. The traffic visualization apparatus 100 of the financial network can store packets captured in a pcap file so as to capture and analyze packets of a predetermined interval based on user input.

In step S402, the traffic visualization apparatus 100 of the financial network can analyze the structure of the financial network protocol based on the captured packet. The traffic visualization apparatus 100 of the financial network can analyze the number of services of the financial network protocol, the structure of packets per layer, the configuration of each tag-specific field, and the difference in the field configuration of each service.

In step S403, the traffic visualization apparatus 100 of the financial network can select a visualization target field and a visualization tag among layers of the analyzed financial network protocol. The traffic visualization apparatus 100 of the financial network can select a source IP address, a destination IP address, and a port number of the IP layer as a visualization field in association with a service tag of a financial network. Also, the traffic visualization apparatus 100 of the financial network can select a message type, an order identifier (ID), a message serial number, and a sender ID (SenderID) of a financial network protocol as protocol tags of a visualization target.

In step S404, the traffic visualization apparatus 100 of the financial network can convert the captured packet so that it can be applied to the visualization tool. The traffic visualization apparatus 100 of the financial network can divide the captured packet into a plurality of subpacket files and store the divided packets.

In step S405, the traffic visualization apparatus 100 of the financial network can visualize the captured file based on the visualization target field and the visualization tag. According to one embodiment of the present invention, the traffic visualization apparatus 100 of the financial network can visualize information of a captured file based on a field of a visualization target and a visualization tag in a shape of a pie (circular) graph. In addition, the traffic visualization apparatus 100 of the financial network can visualize the information of the captured file on a graph or table based on the important visualization tag of the message over time.

In step S406, the traffic visualization apparatus 100 of the financial network can repeatedly perform a plurality of subpacket files. According to one embodiment of the present invention, when there are a plurality of subpacket files, the traffic visualization apparatus 100 of the financial network returns to step S404 to convert a plurality of divided subpacket files into a plurality of subpacket files The remaining captured packets among a plurality of subpackets can be visualized.

In step S407, the traffic visualization apparatus 100 of the financial network may transmit the visualization analysis result information to the financial network administrator terminal when a plurality of subpackets are not left. In addition, the traffic visualization apparatus 100 of the financial network can store visualization analysis result information.

It will be understood by those of ordinary skill in the art that the foregoing description of the embodiments is for illustrative purposes and that those skilled in the art can easily modify the invention without departing from the spirit or essential characteristics thereof. It is therefore to be understood that the above-described embodiments are illustrative in all aspects and not restrictive. For example, each component described as a single entity may be distributed and implemented, and components described as being distributed may also be implemented in a combined form.

The scope of the present invention is defined by the appended claims rather than the detailed description, and all changes or modifications derived from the meaning and scope of the claims and their equivalents should be construed as being included within the scope of the present invention.

100: Traffic visualization device of financial network
110: packet capture unit
120: user input section
130: protocol analysis unit
140: Visualization section
200: financial server

Claims (12)

A method for visualizing a traffic situation of a financial network,
Capturing a packet of a predetermined interval for analyzing traffic of at least one financial network protocol among a plurality of financial network protocols used in a financial network;
Analyzing a structure of the financial network protocol based on the captured packet;
Selecting a visualization target field and a visualization tag among layers of the analyzed financial network protocol;
Converting the captured packets so that they can be applied to the visualization tool; And
Visualizing the captured packet based on the visualization target field and a visualization tag;
, &Lt; / RTI &
Wherein the analyzing the structure of the financial network protocol comprises:
The difference between the configuration of each tag and the field configuration of each service of the financial network protocol is analyzed. The difference of the configuration of each tag-specific field and the field configuration of each service includes a new order, a full order cancel order, The difference between the structure of the tag-specific field used in each financial service including the settlement information and rejection of the correction / partial cancel order, and the configuration of each service-
Wherein the step of selecting the visualization target field and the visualization tag comprises:
Wherein the message type includes a message type including a new transaction order, a financial transaction new order, a whole cancellation order, a correction / partial cancellation order, a contract information, and a rejection order for a correction / partial cancellation order as a tag of a visualization target. The method according to claim 1,
Wherein the step of converting the captured packet includes dividing the captured packet into a plurality of subpacket files and storing the divided packets,
Wherein visualizing the captured packet is performed iteratively for the plurality of subpacket files. The method according to claim 1,
Receiving a user input for setting an interval of a packet to be captured among packets transmitted and received through the financial network,
Further comprising:
Wherein capturing the packet includes storing a packet captured in a pcap file to capture and analyze the packet of the predetermined interval based on the user input. The method according to claim 1,
Wherein the step of selecting the visualization target field and the visualization tag comprises:
Wherein the source IP address, the destination IP address, and the port number of the IP layer are selected as visualization fields in association with the service tag of the financial network protocol. The method according to claim 1,
Wherein the step of selecting the visualization target field and the visualization tag comprises:
And selecting a message type, an order identifier (ID), a message serial number, and a sender identifier (SenderID) of the financial network protocol as tags of the visualization target. The method according to claim 1,
Wherein the analyzing the structure of the financial network protocol comprises:
And analyzing the difference between the number of services of the financial network protocol, the structure of packets per layer, the configuration of each tag, and the field configuration of each service. The method according to claim 1,
Wherein the financial network protocol is a Finance Information Exchange (FIX) protocol. An apparatus for visualizing a traffic situation of a financial network,
A packet capture unit for capturing packets of a predetermined interval for analyzing traffic of a financial network protocol, which is a Finance Information Exchange (FIX) protocol, which is at least one of a plurality of financial network protocols used in a financial network;
A protocol analyzing unit for analyzing a structure of the financial network protocol based on the captured packet, and selecting a field to be visualized and a visualization tag among layers of the analyzed financial network protocol; And
A visualization unit for converting the captured packet so as to be applicable to the visualization tool, visualizing the captured packet based on the visualization target field and the visualization tag,
, &Lt; / RTI &
Wherein the protocol analyzer comprises:
The difference between the configuration of each tag and the field configuration of each service of the financial network protocol is analyzed. The difference of the configuration of each tag-specific field and the field configuration of each service includes a new order, a full order cancel order, And the composition of each service-specific field used in each financial service, including rejection of settlement information and correction / partial cancellation order, A message type including a cancellation order, a contract information, and a rejection of acceptance of a correction / partial cancellation order is selected as a tag of a visualization target. 9. The method of claim 8,
A user input unit for receiving a user input for setting an interval of a packet to be captured among the packets transmitted and received through the financial network,
Further comprising:
Wherein the packet capturing unit stores a packet captured in a pcap file so as to capture and analyze the packet of the predetermined interval based on the user input. 9. The method of claim 8,
Wherein the protocol analyzing unit selects, as a visualization field, a source IP address, a destination IP address, and a port number of the IP layer in association with a service tag of the financial network protocol. 9. The method of claim 8,
Wherein the protocol analyzing unit selects a message type, an order ID, a message serial number, and a sender ID of the financial network protocol as tags of the visualization target. 9. The method of claim 8,
Wherein the protocol analyzing unit analyzes the difference between the number of services of the financial network protocol, the structure of packets per layer, the configuration of each tag, and the field configuration of each service.

Images