JP2012109905A - Traffic monitoring device and traffic monitoring method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a function of automatically executing the band control of traffic and cancellation with the detection and non-detection of abnormal traffic as a trigger, in a traffic monitoring device connected to a network to which network devices represented by a router and a switch are connected.SOLUTION: The problem can be solved by the traffic monitoring device connected to the network devices including a function of continuously monitoring the network in real time, determining whether or not it is already detected abnormal traffic by referring to abnormal traffic information inside a present device memory when abnormal traffic is detected, and giving an instruction to automatically control the band to the network device when it is not already detected, and including a function of giving an instruction to automatically cancel the control to the network device on the basis of controlled information after the lapse of prescribed time after the abnormal traffic is not detected anymore in the monitoring device.

Description

  The present invention relates to a traffic monitoring device and a traffic monitoring method, and more particularly to a traffic monitoring device and a traffic monitoring method for performing bandwidth control from detected to abnormal traffic from setting to canceling.

  In cloud computing where a large number of users share computer resources via a network, burst traffic that instantaneously uses an overloaded bandwidth, illegal traffic that is illegal due to scanning of a port by a specific user, P2P communication, etc. Is a serious problem in maintaining stable service. For this reason, technologies such as snmp and NetFlow are known for the purpose of network monitoring.

  Patent Document 1 discloses a system that analyzes traffic flowing in a network, detects traffic determined to be abnormal traffic, and controls a bandwidth.

JP 2006-314077 A JP 2008-113409 A

  Patent Document 1 can provide a system that efficiently detects inappropriate traffic from a large amount of traffic and controls transfer of the traffic. However, traffic whose transfer is controlled must be released manually. For this reason, there has been a problem that the network control device continues to control the transfer of traffic that is temporarily determined to be inappropriate.

  Japanese Patent Application Laid-Open No. 2004-133830 can control a terminal infected with a computer virus or worm for each user. However, after the problem of the terminal is solved, there is a problem in that the communication of the user who uses the terminal in the relay device continues to be controlled even when reconnected to the network.

  The present invention provides a traffic monitoring device having a function of controlling a bandwidth even for traffic that seems to be temporary abnormal traffic, and detecting the abnormal traffic, and canceling the bandwidth control when the abnormal state is canceled. provide. Provided in a traffic monitoring apparatus connected to a network to which a network device represented by a router or a switch is connected, a function for automatically instructing the bandwidth control and release of the traffic when an abnormal traffic is detected or not detected .

  The present application includes a plurality of means for solving the above problems. If the traffic monitoring device connected to the network device continues to monitor the network in real time and detects abnormal traffic, refer to the abnormal traffic information in its own memory to determine whether it is detected abnormal traffic. If there is not, the network device has a function to automatically give instructions to control the bandwidth. When the abnormal traffic is no longer detected by the monitoring device and the abnormal state is released, the control is automatically released based on the controlled information. It has a function of giving instructions to network devices.

  The above-described problem is that a traffic monitoring apparatus that includes an input / output device, a traffic analysis unit, an abnormal traffic detection unit, a memory, and a control unit and is connected to a network device, the abnormal traffic detection unit performs traffic analysis. When the traffic determined to be abnormal is detected among the packets analyzed by the control unit, the control unit determines whether the information has already been detected, and when detected, the control unit detects the abnormal traffic of the memory. When the timer value stored in the information is updated and not detected, the control unit transmits a bandwidth control instruction to the network device, records the implemented bandwidth control information in the memory, and stores the abnormal traffic information. When recording in the memory and the timer value of the abnormal traffic information becomes zero, the control unit, Serial transmits the release of the bandwidth control the network device, by the traffic monitoring device deletes the abnormal traffic information can be achieved.

  In addition, a step of detecting abnormal traffic, a step of determining whether or not the abnormal traffic has been detected within a certain period, a step of transmitting a bandwidth control instruction to the network device when not detected, and the executed bandwidth control information This can be achieved by a traffic monitoring method comprising the steps of recording and updating abnormal traffic information.

  According to the present invention, it is possible to detect abnormal traffic flowing through a network device, control the bandwidth of the traffic, and cancel the bandwidth control when the abnormal state is canceled.

It is a hardware block diagram of a band control system. It is a hardware block diagram of a traffic monitoring device. It is a figure explaining an abnormal traffic information table. It is a figure explaining a band control information table. It is a flowchart explaining the process of a zone | band control instruction | indication part. It is a flowchart explaining the process which cancels | releases band control. It is a flowchart explaining the process which detects the difference of an abnormal traffic information table and a bandwidth control information table.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings using examples. The same reference numerals are assigned to substantially the same parts, and the description will not be repeated.

  First, the configuration of the bandwidth control system will be described with reference to FIG. In FIG. 1, the bandwidth control system 1000 includes a traffic monitor device 100 and a network device 700. The network device 700 includes a CPU 730, a memory 740, an input / output device 760, a flow control unit 750, and an input / output device 770. The traffic monitor device 100 includes an input / output device 160. A network 500-1 is connected to the input / output device 760. The input / output device 770 is connected to a network 500-2. The traffic monitor device 100 and the network device 700 are also connected by a control line (not shown).

  The traffic monitoring device 100 monitors the traffic received from the network 500-1 and transmitted to the network 500-2 between the input / output device 760 and the flow control unit 750. When the traffic monitoring apparatus 100 detects an abnormality in the above-described flow, the traffic monitoring apparatus 100 controls the flow control unit to limit the bandwidth. Therefore, the traffic monitoring device 100 monitors between the input / output device 770 and the flow control unit 750 for traffic received from the network 500-2 and transmitted to the network 500-1.

  With reference to FIG. 2, a traffic monitoring apparatus 100 having a function of instructing control and release of bandwidth when a network is monitored and abnormal traffic is detected will be described. In FIG. 2, the traffic monitoring device 100 includes a CPU 150 connected to an internal communication line, an input / output device 160, a traffic analysis unit 140, an abnormal traffic detection unit 130 connected to the traffic analysis unit 140, and an abnormal traffic detection. The memory 120 is connected to the unit 130, and the control unit 110 is connected to the memory 120. Control unit 110 includes a band control instruction unit 111 and a band control determination unit 112. The memory 120 stores an abnormal traffic information table 300 and a bandwidth control information table 400.

  The bandwidth control instruction unit 111 controls the network device 700 by the traffic monitor device 100. The bandwidth control instruction unit 111 instructs bandwidth control to the connected network device. The bandwidth control determination unit 112 determines bandwidth control and release based on information in the memory 120. The input / output device 160 is connected to the external network device 700 and receives traffic to be monitored. The input / output device 160 transmits the bandwidth control / release information instructed by the control unit 110 to the network device 700.

  The bandwidth control determination unit 112 compares information in the abnormal traffic information table 300 with a packet detected as abnormal traffic. The bandwidth control determination unit 112 compares the abnormal traffic information table 300 and the bandwidth control information table 400, and determines whether or not to perform bandwidth control and release to the bandwidth control instruction unit 111. The bandwidth control instructing unit 111 instructs the network device 700 to set the instructed bandwidth control / release information through the input / output device 160.

  The abnormal traffic detection unit 130 detects traffic that is determined to be abnormal, such as excess bandwidth, traffic from a plurality of addresses to a specific port, among the packets analyzed by the traffic analysis unit 140. The abnormal traffic detection unit 130 stores information on the target packet in the abnormal traffic information table 300.

  The traffic analysis unit 140 analyzes the analysis target traffic received by the input / output device 160 in real time. The traffic analysis unit 140 transmits the result to the abnormal traffic detection unit 130.

  The traffic monitoring device 100 stores the traffic received by the input / output device 160 in the abnormal traffic information table 300 for the traffic determined by the abnormal traffic detection unit 130 as a result of the analysis by the traffic analysis unit 140. The traffic monitoring device 100 stores information for performing bandwidth control for controlling the corresponding traffic in the bandwidth control information table 400. The control unit 110 determines whether to perform bandwidth control on the stored abnormal traffic. The control unit 110 performs bandwidth control and release on the network device 700 as necessary.

  The abnormal traffic information table 300 will be described with reference to FIG. In FIG. 3, the abnormal traffic information table 300 includes No. 302, a transmission source IP address (transmission IP) 303, a transmission destination IP address (destination IP) 304, a transmission source MAC address (transmission MAC) 305, and a transmission. A destination MAC address (destination MAC) 306, a VLAN ID 307, and a timer value (Timer) 308 are configured. The source IP address 303 to VLAN ID 307 of the abnormal traffic information table 300 specify traffic. The Timer value 308 is continuously subtracted from the set initial value until it reaches zero. When the Timer value 308 becomes zero, the CPU 150 clears the transmission source IP address 303 to the Timer value 308 of the corresponding record. Other information specifying the traffic will be described later.

  The bandwidth control information table 400 will be described with reference to FIG. 4, the bandwidth control information table 400 includes No. 402 and bandwidth control information 403. The bandwidth control information 403 is a bandwidth control instruction content to the network device 700.

  The operation of the traffic monitoring device 100 will be described with reference to FIG. In FIG. 5, the traffic analysis unit 140 analyzes the traffic received by the input / output device 160.

  The abnormal traffic detection unit 130 waits for detection of abnormal traffic (S201). When the abnormal traffic is detected, the bandwidth control determination unit 112 determines whether the traffic information has been stored in the abnormal traffic information table 300 (S202). When abnormal traffic is not stored in the abnormal traffic information table 300 (NO), in order to control the traffic, the bandwidth control instructing unit 111 instructs the network device 700 to perform bandwidth control through the input / output device 160 (S203). ). The control unit 110 stores the bandwidth control information instructed to the network device 700 by the bandwidth control instruction unit 111 in the bandwidth control information table 400 (S204). The control unit 110 stores the data in the abnormal traffic information table 300 by using, as an initial value, a Timer value 308 that decreases with the elapse of time together with information that can be acquired from the header portion of the packet such as an IP address, a MAC address, and a VLAN (S205). ), Transition to step 201.

  Here, the Timer value 308 may be a uniform numerical value for all abnormal traffic, but is arbitrarily set depending on the type of abnormal traffic (instantaneous maximum bandwidth use, scanning by a specific user, P2P communication, etc.). May be.

  When YES in step 202, the bandwidth control determination unit 112 transitions to step 205. At this time, the control unit 110 performs processing for updating the traffic information in the abnormal traffic information table 300. The processing at this time is updating the initial value of the Timer value 308, and other information is not updated.

  It should be noted that the information for determining whether or not it has been detected does not necessarily need to completely match the information below the L3 header such as the IP address, MAC address, and VLAN. That is, the key information can be limited according to the characteristics of the connected network device. Furthermore, the information is not limited to information below the L3 header, and an attack on a specific port can be detected using information above the L4 header as a key. Further, a specified number of bytes from the head of the detected packet (specifically, 24 bytes to 36 bytes from the head) can be used as a key.

  Here, the update process of the abnormal traffic information table 300 will be described. The abnormal traffic information table 300 includes a timer value 308 that decreases with time for each stored abnormal traffic. When abnormal traffic is detected and the abnormal traffic has already been registered as abnormal traffic information, it is determined that the abnormal traffic has been treated. That is, the traffic monitoring apparatus 100 skips the step of performing bandwidth control and the step of storing the abnormal traffic information in the bandwidth control information table 400. In step 205, the traffic monitoring apparatus 100 does not add new abnormal traffic information, but only updates the timer value 308 to a value set as a default.

  As long as the detected abnormal traffic continues to be detected by the abnormal traffic detection unit 130 of the traffic monitoring apparatus 100, the Timer value 308 is continuously updated. However, when the abnormal traffic is not detected and the Timer value 308 decreases with time and becomes 0, the traffic monitoring device 100 deletes the abnormal traffic information from the abnormal traffic information table 300.

  With reference to FIG. 6, the cancellation of the band control by the band control determination unit 112 will be described. In FIG. 6, the bandwidth control determination unit 112 compares the abnormal traffic information table 300 and the bandwidth control information table 400 to see if there is a difference at regular intervals (S501). This interval can be freely set by the user. When there is a difference, the bandwidth control determination unit 112 performs release based on the bandwidth control information of the difference (S502). The bandwidth control determination unit 112 deletes the target record in the target bandwidth control information table 400 (S503), and the process ends. If NO in step 501, the bandwidth control determination unit 112 ends as it is.

  Note that the difference occurs in step 501 when the Timer value 308 of the abnormal traffic information table 300 decreases with time and becomes 0, the traffic monitoring apparatus 100 determines that the abnormal traffic information is in the abnormal traffic information table. This is because it is deleted from 300.

  With reference to FIG. 7, the update process of the abnormal traffic information table 300 and the bandwidth control information table 400 will be described. In FIG. 7, the bandwidth control determination unit 112 counts the total number of abnormal traffic information stored in the abnormal traffic information table 300 and the total number of bandwidth control information stored in the bandwidth control information table 400 (S601). The bandwidth control determination unit 112 checks whether there is a difference between the total number and the No number (S602). When there is a difference (YES), the bandwidth control determination unit 112 compares the data Nos. 302 and 402 stored in each table and compares them, and extracts a blank record (S603). The bandwidth control determination unit 112 updates the respective No information in order to maintain the order of Nos. 302 and 402 in the abnormal traffic information table 300 and the bandwidth control information table 400, and a blank record is placed at the end of the tables 300 and 400. (S604) and the process ends. When NO in step 602, the bandwidth control determination unit 112 ends as it is.

  In addition, when newly storing abnormal traffic, No. 1 is added to the oldest number of the current abnormal traffic information table 300, and the bandwidth control information table 400 is associated with No. 302 of the abnormal traffic table 300. A value that can be attached is assigned and stored.

  Note that No. 402 stored in the bandwidth control information table 400 may be the same numerical value as No. 302 assigned to the abnormal traffic information table 300. There is no need to limit the number as long as it can be linked.

  According to the present embodiment, the bandwidth can be controlled in real time with respect to abnormal traffic detected by the network device 700, and can be canceled if it is not detected. According to the traffic monitoring apparatus of the present embodiment, the stability of the entire network can be ensured and the resources of the network device 700 can be effectively utilized.

  According to the present embodiment, it is possible to reduce the burden on network management that has been performed manually. In addition, since unauthorized access can be blocked, the safety and reliability of the entire network can be improved. Furthermore, it is possible to expect improvement in accommodation efficiency in the network device without wasting the limited resources of the network device.

  DESCRIPTION OF SYMBOLS 100 ... Traffic monitoring apparatus, 110 ... Control part, 111 ... Band control instruction part, 112 ... Band control judgment part, 120 ... Memory, 130 ... Abnormal traffic detection part, 140 ... Traffic analysis part, 150 ... CPU, 160 ... Input / output 300, abnormal traffic information table, 400, bandwidth control information table, 1000, bandwidth control system.

Claims (6)

In a traffic monitoring device that includes an input / output device, a traffic analysis unit, an abnormal traffic detection unit, a memory, and a control unit and is connected to a network device,
When the abnormal traffic detection unit detects traffic determined to be abnormal among the packets analyzed by the traffic analysis unit, the control unit determines whether the information has already been detected,
When detected, the control unit updates the timer value stored in the abnormal traffic information of the memory,
When not detected, the control unit transmits a bandwidth control instruction to the network device, records the implemented bandwidth control information in the memory, records the abnormal traffic information in the memory,
When the timer value of the abnormal traffic information becomes zero, the control unit transmits cancellation of bandwidth control to the network device and deletes the abnormal traffic information. The traffic monitoring device according to claim 1,
The traffic monitoring apparatus, wherein the abnormal traffic information includes a source IP address, a destination IP address, a source MAC address, a destination MAC address, and the timer value of abnormal traffic. The traffic monitoring device according to claim 1,
When the abnormal traffic information is deleted, the control unit deletes the corresponding implemented bandwidth control information. Detecting anomalous traffic;
Determining whether this abnormal traffic has been detected within a certain period of time;
When not detected
Sending a bandwidth control instruction to the network device;
Recording performed bandwidth control information;
A method of monitoring traffic, comprising the step of updating abnormal traffic information. The traffic monitoring method according to claim 4, comprising:
The traffic monitoring method, wherein, when detected, the updating step is a successor of a timer value. The traffic monitoring method according to claim 5, comprising:
When the timer value becomes zero,
Sending a release of bandwidth control to the network device;
And a step of deleting the abnormal traffic information.

Images