CN103973591A - Solution method for intelligent network traffic congestion - Google Patents

Abstract

The invention provides a solution method for intelligent network traffic congestion, which relates to the field of network security. The solution method provided by the invention is embedded in a system kernel, and intelligent limit is carried out on processes and the bandwidth of IP (Internet protocol) by a strategy of adopting priorities on the processes and IP address; traffic management is carried out on networks with different Qos (quality of service) requirements by algorithms; the bandwidth is automatically adjusted when the networks go wrong or the traffics are abnormal; users are notified by means of alarm, graphical display and the like; the networks after intelligent control are superior to the previous networks; the problems of load and traffic are effectively solved; the Qos parameters of network application are effectively guaranteed.

Description

A kind of intelligent network flow congestion solution

technical field

the present invention relates to a kind of intelligent network flow congestion solution, adopt the method for IP address, process and applied business classification being given to different priorities authority.Network application business is done to control and management at the aspect such as flow and bandwidth.User management, by administrative center's distributing policy, obtains traffic statistics information and audit information.

Background technology

Be accompanied by rapid development of information technology, next generation network is to IPv4/IPv6 protocol stack compatibility.The mass data such as multimedia video, file service access application, impels the development of network flow management product.Network bandwidth management can effectively improve network service efficiency, and network traffics are to weigh the important parameter of the normal operation of network.Country network is more and more paid attention to, safety with the intelligence of network traffics is reliably controlled, can avoid occurring network congestion.Ensure the throughput of network and the health status of the whole network operation of reflection.Monitoring of tracking, adress analysis and IP agreement by the quantity to online link, session number etc., finds in time and reports to the police exception flow of network.Whether discovery has the exceptional communication of hacker's network sweep, discovery specific protocol etc.

For raising the efficiency, regular coupling is adopted to regular expression engine.To obtaining the performance parameter of agreement, IPv4/IPv6 protocol suite is done to exception monitoring in transport layer.Intelligent network flow need to do bandwidth and traffic monitoring management to user or IP address, in the time that network congestion is busy, associated user is dynamically controlled.The effective utilization guaranteeing network bandwidth.

Intelligent flow management system provides patterned data analysis for user.Application and flow bandwidth are done to effective control, with the method for content monitoring technology and active and passive detection network node data, network condition is made to effective statistics and analysis.

Flow management system generally adopts multicore architecture, monitoring and managing network flow.There is higher throughput and forward rate.As a rule, P2P application and Internet video flow have occupied most bandwidth.

Flow management system adopts based on snmp management agreement, and network traffics are measured.Adoption Network Driving technique is the monitoring of the traffic class based on application to server host.Along with the high request of country to information network security, network management comprises that intelligent monitoring of network traffics etc. also becomes more and more important.Cloud computing data center and distributed node are done to the control of network traffics, network traffics are done to monitoring and the model analysis based on communication data.

Based on developing rapidly of Internet Internet bandwidth and types of applications.In the time of the online IP of server and flow excess load, crowded, obstruction that network can occur.Qos (Qulity of Service service quality) parameter directly affects network performance.Network bandwidth shortage can cause packet loss to increase, and has a strong impact on network quality.

Summary of the invention

Reference of the present invention and according to the network traffics standard in ethernet test standard, national information safety product monitoring standards such as " information system security audit product technology require and test evaluation method ".To network traffics should be used as prioritization, the method comprises that the operation that system management end sends detection packet detection network server asks condition.Packet on collection network does analytic statistics.

Adopt the content detection technique to network traffics; Network flow is distinguished to its application type, comprise the application scenarioss such as P2P application, Internet video; Adopt the method for transport layer port and characteristic character pattern matching; Network package length, quantity forwarded etc. are monitored and analyzed; The parameters such as network flow forward rate, Mean Speed are obtained to network state.

The object of the present invention is to provide a kind of intelligent network flow congestion solution.For realizing this purpose, technical solution of the present invention is: adopt active data bag to send and measure and passive packet measuring technique, network condition is surveyed and analyzed.Adopt the precedence scheme based on application and network address node.Network application is served and according to priority determined bandwidth and application strategy as P2P, video and file etc.Network rate to uplink and downlink limits.Guarantee handling up and forward rate of network traffics, do not occur network congestion.

Particular content of the present invention is as follows:

Following ITU-T E.800 in the specification about service quality, network service quality (Qos) is done to function and performance provision.

Network flow data bag method of measurement is as follows:

A. operating system load networks driver module, to Modeling Network Traffic.User and protocal analysis are set up to rule;

B. adopt application layer and drive layer mutual, under driving, send instructions.Network-driven initiatively sends detection packet to network;

C.ping sends the parameters of ICMP class packet under given network, comprises throughput, forward rate and delay etc.;

D. obtain the network analysis result under abnormal conditions, obtain the parameters such as network performance.

E. passive measurement, by the function of packet sniffer, is analyzed network or multiple network segment network flow statistic.Obtain network condition.

F. passive measurement can be made application identification, identify the network that has threat; To congested effective processing.

Network traffics are not according to priority done up-downgoing restriction to application bandwidth and address etc., and guaranteeing has the parameters such as good network throughput and forward rate under variety of network environments:

A. when system loads drives layer, the priority policy of load application and the network address;

B. obtain title and the complete trails of communication process at the high level driving;

C. use NDIS to drive the communication flows statistical analysis to agreement and address;

D. when the application program of specifying and address communication flow are while exceeding requirement, change the parameter such as priority and window value of Transmission Control Protocol, communication speed is limited.

1), combine the traffic identification ability of network layer, transport layer and application layer, network traffics are analyzed and are monitored:

A. to the network application Break Link being illegally connected into, control and management also sends a warning message;

B. the traffic identification ability of network application;

C. network flow managing system network layer information, effectively reviews and examines to threaten to security threat and originate;

D. to disparate networks application identification as effective in dos such as P2P, video, download and network games and management and control.

2), the network bandwidth is done to orderly management, by tactful priority, network is done to management and control:

A. network packet stream is done to traffic behavior analysis, strengthened intellectual analysis ability;

B. rule base can real-time update, ensures the accuracy of flow analysis;

C. according to dimensions such as user, application process and times, to effectively management such as online link bandwidth;

D. system can be done assignment of traffic and control to every IP address.

The invention has the beneficial effects as follows:

Network application on server is adopted to the methods such as address and application type, network traffics and bandwidth are done to priority restriction.In the time there is the clear conditions such as network congestion, according to priority policy, network is done to intelligent management and control.Adopt the methods such as queue and priority management, alleviate network problem.Improve network performance.Network management is realized to Qos management and control.Accomplish to make rational planning for network and intelligent flow management function.Adopt tactful safe class technology to do intelligent flow management to the webserver.Effectively solve the problem of load and flow.Effectively ensure the Qos parameter of network application.

Brief description of the drawings

Fig. 1 is intelligent network flow congestion solution schematic diagram.

Embodiment

By specific embodiment and accompanying drawing, the present invention is described in detail below.

The present invention is a kind of intelligent network flow congestion solution, at network or multiple network segment.The method that adopts Active Networks monitoring and Passive Network Monitoring, sends probe data packet.To network monitor.Obtain performance data and parameter, data on flows and other data are performed an analysis.Obtain network safe state.In tuples such as server end application programs and IP addresses, the bandwidth value of network priority and up-downgoing is set according to network safe state and rule etc.Application this method can effectively manage and control intelligent network flow congestion.

Action of the present invention:

1.：

A. Active Networks monitoring and Passive Network Monitoring combine, and obtain throughput, packet loss and the time delay etc. of network;

B. the content of giving out a contract for a project comprises PING type i CMP package, the application layer data bags such as FTP;

C. passive network using, to network monitoring and the method for smelling spy, obtains the network information of the network segment and performs an analysis;

D. to the network traffic analysis based on agreement and address, obtain ASSOCIATE STATISTICS information and parameter.

2.：

A. the webserver loads monitoring software system, the corresponding priority of load networks and application program and bandwidth rule;

B. according to the security information of active and the acquisition of passive network, change the upstream and downstream bandwidth numerical value of network traffics rule;

C. obtain process and network application information at network-driven bottom, complete the traffic statistics based on process and IP address;

D. network traffics are analyzed, according to the upstream and downstream bandwidth and the network priority that arrange.Prevent network congestion.

Claims (3)

1. an intelligent network flow congestion solution, the application identification technology by network traffics of it is characterized in that is to flow control; According to protocol type, port and behavioural characteristic etc., do the control of classification priority; According to the parameter such as priority and process, arrange its network traffics.

2. a kind of intelligent network flow congestion solution according to claim 1, is characterized in that:

Adopt active data bag to send and measure and passive packet measuring technique, network condition is surveyed and analyzed; Adopt the precedence scheme based on application and network address node; Network application is served and according to priority determined bandwidth and application strategy as P2P, video and file etc.; Network rate to uplink and downlink limits.

3. a kind of intelligent network flow congestion solution as claimed in claim 2, is characterized in that:

Network flow data bag method of measurement is as follows:

A. operating system load networks driver module, to Modeling Network Traffic; User and protocal analysis are set up to rule;

B. adopt application layer and drive layer mutual, under driving, send instructions; Network-driven initiatively sends detection packet to network;

C.ping sends the parameters of ICMP class packet under given network, comprises throughput, forward rate and delay etc.;

D. obtain the network analysis result under abnormal conditions, obtain the parameters such as network performance;

E. passive measurement, by the function of packet sniffer, is analyzed network or multiple network segment network flow statistic, obtains network condition;

F. passive measurement can be made application identification, identify the network that has threat; To congested effective processing;

Network traffics are not according to priority done up-downgoing restriction to application bandwidth and address etc., and guaranteeing has the parameters such as good network throughput and forward rate under variety of network environments:

A. when system loads drives layer, the priority policy of load application and the network address;

B. obtain title and the complete trails of communication process at the high level driving;

C. use NDIS to drive the communication flows statistical analysis to agreement and address;

D. when the application program of specifying and address communication flow are while exceeding requirement, change the parameter such as priority and window value of Transmission Control Protocol, communication speed is limited.