JP2018067829A - Real time traffic collection/analysis system and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a flow-based traffic packet classification matching method by reducing a transmission quantity of acquired traffic information using a traffic statistic method.SOLUTION: A configuration includes: a control plane, in which software defines a network, including a real time traffic collection module for collecting a traffic type and a traffic analysis module for performing statistic analysis on the traffic type to provide an analyzed use situation on a network traffic type, uncommon act, and the like for reference for a network administrator; and a data plane including a flow-based traffic packet classification matching method for performing classification matching on respective types of table headers of a packet and a traffic statistic method for taking statistics on the basis of the traffic packet classification matching method.SELECTED DRAWING: Figure 2

Description

  The present invention relates to systems and methods for broadband network traffic collection and analysis, and more particularly to immediate traffic collection and analysis methods in which software-defined network technology is achieved by a network controller and programmable network switch.

  Compared to the traffic collection monitoring and analysis method managed by the conventional network, the traffic collection means is achieved by another network device (for example, network packet probe, network traffic monitoring device, etc.), and packet classification or filtering is performed in advance by this network device. There is a method of providing to traffic analysis software (for example, net flow) after performing the above.

When collecting traffic by other network devices, the collection of network device traffic information can be obtained by means including traffic mirror reflections by the network switch, or can be implanted in the network switch by a method of pre-classifying and filtering traffic packets, Reduces traffic collection devices from receiving too much unwanted data.
Usually, in the traffic mirror reflection mode, not only does the network switch lose its effectiveness and does not get accurate traffic packet data, but also affects the act of sending packets normally, when the network device collects traffic , You may get a lot of unnecessary information. Also, when implanting a traffic collection method into a network switch, it is usually impossible to perform packet classification or filtering of complex prior traffic, so the applicability is limited, and the function of traffic packet classification and filtering is implanted. As network switch hardware needs increase, network switch costs increase.
Also, in general, such traffic collection methods have too long sampling intervals, so the obtained traffic information cannot show accurate data, and the analysis results show detailed traffic information such as the effects of surges. It becomes impossible to reflect.

  In view of the fact that conventional network switches cannot effectively obtain immediate traffic information, the inventors of the present application have made extensive research and improvement creation, and as a result, can be programmed with a network controller using software-defined network technology. Immediate traffic collection and analysis methods achieved by the network switch are submitted to improve the accuracy of traffic collection while avoiding the cost of constructing additional network traffic detection systems.

  In the present invention, a system and method for achieving network traffic collection and analysis by software-defined network technology is submitted, and network monitoring control can achieve immediate monitoring control of traffic flow and provide accurate traffic information analysis. it can.

  The present invention aims to solve the problem that conventional traffic collection systems are usually inaccurate, and provides an immediate traffic collection method that accurately collects traffic using software-defined network technology. The traffic information to be classified and matched is obtained directly from the switch, thereby avoiding the cost of constructing an additional network traffic detection system.

The present application is an instant traffic collection and analysis system and method capable of immediately obtaining traffic information from a programmable network switch.
The programmable switch belongs to the data plane of the software-defined network, and includes a flow-based traffic packet classification matching method and a traffic statistics method, and the flow-based traffic packet classification matching method uses a packet after matching different types of packets. In addition to transmitting or modifying the packet, a packet classification method for collecting traffic may be used. The classification means includes media access control (Media Access Control (MAC)), virtual local area network (Virtual Local Area Network, VLAN), Internet protocol ( Internet Protocol (IP), Diffserved Services (Differential Services) It includes various types of classification such as Code Point (DSCP), Transmission Control Protocol (Transmission Control Protocol, TCP), etc., and has a traffic statistics method that can statistically analyze packet amount, total flow rate, time label, etc. after each type of packet classification . Thus, the effect that the traffic collection module collects traffic information can be improved.
The software-defined network control plane periodically obtains traffic information classified from the traffic statistics module by the controller application program interface module that forwards traffic collection request messages and traffic information return messages and the network controller application program interface module. A traffic collection module that stores data in a database, and a traffic analysis module that analyzes usage conditions indicating abnormal types of traffic according to the traffic information in the database, abnormal behavior, and the like, thereby achieving immediate traffic collection and analysis.

  The present invention relates to a plurality of programmable network switches for processing a plurality of packets, and is connected to the programmable network switch by managing the network, and manages and monitors and controls the programmable network switch. An immediate traffic collection and analysis system including a network controller and an immediate traffic collection and analysis module connected to the network controller and collecting and analyzing the immediate traffic.

  The programmable network switch includes a packet classification matching module that stores a plurality of classification matching rules to match each packet, a traffic statistics module that is coupled to the packet classification matching module and generates traffic information; A base plane network interface module that forwards each packet to the data plane network, and a control plane network interface module by which the packet classification matching module is connected to the network controller.

  The network controller includes an application program interface module whereby the application program commands the network controller to manage and monitor the programmable network switch.

  The immediate traffic collection and analysis module includes a traffic collection module that immediately collects the traffic information in the programmable network switch by the network controller, a database module that stores the collected traffic information, and a database module. A traffic analysis module for analyzing the stored traffic information.

  The instant traffic collection / analysis system according to the present invention further includes an instant traffic collection and analysis module that instantly collects and analyzes traffic in the network. The traffic collection and analysis module can transmit traffic information needs, and the network. A traffic collection module that immediately collects traffic information of the programmable network switch by the controller, a database module that stores the collected traffic information, and a traffic analysis module that analyzes the traffic information stored in the database module Including.

  The network controller and the programmable network switch have a one-to-one or one-to-multiple tangent relationship, that is, one network controller is connected to one or more programmable switches, and One such programmable switch is connected to one such network controller.

  A classification matching rule is stored in the packet classification matching module, and each classification matching rule includes at least one or more packet classification settings and at least one packet processing operation, and the packet classification setting includes the packet classification matching. This is the basis for the module to classify packets according to the header contents from the second layer to the fourth layer of the network and the actual port number of the received packet. The packet is transmitted, the packet is discarded, and the second layer to the fourth layer. The packet processing operation including changing the header content of the packet limits how the packet classification matching module processes the network packet.

  The traffic statistics module has traffic statistics settings to generate traffic information, and the data packets that are statistics in the traffic statistics settings have matching packet totals, total traffic of matching packets, and classification matching rules The packet classification matching module increases the quantity of data corresponding to the traffic statistics setting in the traffic statistics module each time a packet is matched, and each packet is used in the packet classification matching method each time. Match only one classification matching rule.

  The immediate traffic collection module includes the application program interface module in the network controller to acquire the traffic information by transmitting traffic collection needs to the programmable network switch, and the programmable network. An operation to retrieve packet classification information and traffic statistical information from the traffic classification matching module and traffic statistics module in the switch, and the programmable network switch performs traffic based on the packet classification information and traffic statistical information. The generation and transmission operation and the database module store the traffic information.

  The traffic information stored in the database module includes a traffic packet classification matching setting, a total amount for matching packets, a total traffic flow for matching packets and a total time label for which classification matching rules exist, and the traffic analysis module Retrieves classified traffic information from the database module, presents immediate and accurate traffic statistics, and analyzes network usage and abnormal network activity.

  From the above, with the technology to define the network in software, the traffic collection module obtains detailed and accurate traffic information with flow-based traffic statistics methods from the switches directly programmable by the controller application program interface module, The cost of constructing an additional network traffic detection system can be reduced. In addition, the traffic information to be classified and matched in advance is directly acquired, the effect of omitting the packet reading element and avoiding the effect of consuming the switch, and the time interval at which the traffic collection system samples the traffic information so as to show the traffic information more immediately is effective. Can be reduced.

It is the frame chart of the conventional traffic monitoring control and analysis module. 3 is a frame chart of an immediate traffic collection / analysis system according to the present invention. 4 is a flowchart of establishing a traffic classification matching rule according to the present invention. 3 is a flowchart of an immediate traffic collection and analysis method according to the present invention.

  In order to make the objects, claims, advantages and features of the present invention clearer, the present invention will be described in more detail below with reference to the accompanying drawings and examples. It will be appreciated that the examples herein are merely illustrative of the invention and are not intended to limit the invention.

FIG. 1 is a frame of a conventional traffic monitoring control and analysis system. In the conventional traffic monitoring control and analysis system frame, the means for mirror reflecting traffic to the traffic monitoring control and analysis system 110 using the traffic mirror reflecting element 103 in the conventional network switch 101 is mainly the traffic in the network interface 102. Mirror the copy from the traffic mirror reflector 103, which mainly exchanges all mirror reflections in the data packet between the terminal device 104 and the data network 105, and the traffic monitoring control and analysis module 110 Traffic information that is mirror-reflected by the supervisory control network 106 is obtained, and the mirror-reflected traffic is analyzed by the traffic collection and classification element 111 to obtain unnecessary traffic information. Remove classify the remaining traffic data.
The traffic analysis element 112 obtains simplified traffic information from the traffic collection and classification element 111, analyzes the traffic information, and provides analysis data such as a network administrator's network usage situation and abnormal behavior. And In the system frame of FIG. 1, the traffic mirror reflector 103 defeats the effects of the conventional network switch 101, and the traffic collection and classification element 111 needs to analyze all packets.

FIG. 2 is a frame of an immediate traffic collection and analysis system, in which the network controller 207 establishes control tangents with the network switch 201 that can be programmed via the management network 206 by the control plane network interface module 203.
The traffic classification matching module 211 in the programmable network switch 201 writes traffic classification matching rules by the network controller 207, exchanges and classifies all data packets between the terminal device 204 and the data network 205, and the matching rules. After the packet is processed, the packet is further processed, for example, the packet is corrected, and transferred by the base plane network interface module 202. The traffic statistics module 212 statistics information such as the number of packets that each rule matches, traffic, and the like for all classification matching rules. The immediate traffic collection and analysis module 210 starts with the immediate traffic collection module 213 to the network controller 207. The application program interface module 208 in the network transmits traffic collection needs on a timely basis, the traffic information is immediately obtained from the traffic statistics module 212 after the network controller 207 receives the needs, and the application program interface module 208 immediately obtains the traffic information. Reply to the traffic collection module 213 again. Subsequently, the collected classified traffic information is stored in the database module 214, and finally, the traffic analysis module 215 obtains accurate and immediate network traffic data from the database module 214 to indicate accurate network usage. Also, abnormal network behavior is analyzed immediately.

The flowchart for establishing traffic classification matching rules and the flowchart for the immediate traffic collection and analysis method are as shown in FIGS.
First, please refer to FIG. Step S301 of the traffic classification matching rule establishment flowchart establishes a new tangent with a network switch that can be programmed by the network controller, in which the network controller 207 establishes the management network 206 by the control plane network interface module 203. The control tangent is established with one or more programmable network switches 201 via step S302, and the programmable network switch checks whether a packet classification matching rule has already been established.

  In step S302, which checks whether the programmable network switch has already established a packet classification matching rule, the network controller 207 first checks whether the programmable network switch 201 has already established a traffic classification matching rule. If the traffic classification matching rule has already been established, the packet is classified and matched after entering the programmable network switch 201. If the matching is successful, the process proceeds to step S304, and the packet is transferred after matching the packet. Statistics on the number of packets and traffic flow. On the other hand, the non-matching packet notifies the network controller 207 from the programmable network switch 201 to inform that the classification matching rule is not established, and proceeds to step S303, where the network switch is programmable by the network controller. Establish classification matching rules.

  In step S303 in which the network switch 201 that can be programmed by the network controller establishes a classification matching rule, the network controller 207 determines a classification matching rule for a packet that does not match, and traffic that is written to the programmable network switch 201 Determine classification matching rules. Thereafter, the traffic classification matching rule is written to the programmable network switch 201, and the process returns to step S302 again to check whether the programmable network switch has already established the packet classification matching rule. Check if it was written.

  After the packets are matched, the packets are transferred, and the number of packets and the traffic flow are statistically measured. After the packets enter the matching rules of the traffic classification matching module 211 in step S304, the packets are processed by the packet processing defined in the classification matching rules. Process against the method. The processing method includes operations of packet head correction, packet forwarding, and packet discarding, and each matched packet is statistically analyzed by the traffic statistics module 212 connected to the classification matching module, and the amount of matched packets, Including the total traffic flow, etc., then move on to the flow of immediate traffic collection and analysis method.

  Please refer to FIG. In step S401 of the flowchart of the immediate traffic collection and analysis method, the traffic collection module transmits traffic information needs by the network controller application program interface module. In this step, the immediate traffic collection module 213 of the immediate traffic collection and analysis module 210 transmits specific traffic information needs on a regular basis by the application program interface module 208 in the network controller 207, and the regular time interval is based on the application program. The need for traffic information can be adjusted and the time interval that can be created at the very least will be transmitted every 5 seconds. After receiving the traffic needs, the network controller 207 transfers the needs to a programmable network switch to obtain traffic information.

In the classification method of step S402 for checking whether there is a need for a programmable network switch, the programmable network switch 201 sets a classification matching rule whether there is a need based on the needs transmitted by the network controller 207. Detect.
If there is already a classification matching rule, the process proceeds to step S404, and the immediate traffic statistics information is returned to the traffic collection module by the network controller. On the other hand, if there is no classification matching rule, the reply is transmitted, and the process proceeds to step S403. Establish packet classification matching rules with network switches programmable by the network controller.

  In step S403 of establishing a packet classification matching rule in a network switch that can be programmed by the network controller, the network controller 207 re-determines a traffic classification matching rule that meets the immediate traffic collection needs and programs the determined classification matching rule. Write to the traffic classification matching module 211 in the possible network switch 201 and return to step S401, where the traffic collection module originates traffic information needs through the network controller application program interface module.

  In step S <b> 404 in which the network controller returns immediate traffic statistics information to the traffic collection module, the programmable network switch 201 obtains traffic information from the traffic classification matching module 211 and the traffic statistics module 212. After that, traffic information such as traffic classification matching rule, matching packet amount and traffic flow is returned to the immediate traffic collection and analysis module 210 by the network controller 207, and the traffic information is received by the immediate traffic collection module 213 therein, step S405. The traffic information is stored in the database module.

  In step S405 of storing the traffic information in the database module 214, the immediate traffic collection module 213 stores the traffic information in the database module 214 based on different traffic classification means, and the storage is data such as packet amount, traffic flow rate, time label, etc. including. Subsequently, the next time interval is entered, and the process returns to step S401, and the traffic collection module transmits the traffic information needs by the network controller application program interface module, that is, continues the next traffic collection operation. If there is a traffic analysis need, the process proceeds to step S406, and the traffic analysis module acquires and analyzes the traffic information from the database module.

  In step S <b> 406, the traffic analysis module obtains and analyzes traffic information from the database module, and the traffic analysis module 215 obtains each type of classified reply traffic information from the database module 214. Since the collected traffic information has a short interval, the traffic analysis module 215 provides immediate and accurate traffic statistics information, and accurately analyzes the network usage and abnormal network behavior for the network administrator's reference. Can do.

  The instant traffic collection / analysis system and method provided by the present invention further have the following advantages as compared with other conventional techniques.

  The present invention provides classification matching means for collecting various types of traffic, for example, classification matching means such as MAC, VLAN, IP, DSCP, TCP, etc., and the system used for traffic analysis shows more multi-dimensional traffic information.

  The present invention eliminates the packet reading element, obtains traffic information to be classified and matched in advance by a flow-based traffic statistical method from a switch that can be directly programmed, and can provide an accurate and immediate traffic collecting means. Detect abnormal surges and immediately reflect abnormal traffic conditions.

  The data plane of the present invention also belongs to the distributed plane, and the immediate traffic collection and analysis module can obtain a wide range of network traffic information by the centralized control plane.

  Although the above detailed description specifically describes the most preferred embodiment of the present invention, the embodiment is not used to limit the patent scope of the present invention and does not depart from the spirit of the present invention. Any implementation or modification having the same effect as long as it is included in the patent scope of the present application.

  From the above, the present invention is actually creative in technical idea, has many kinds of effects that the conventional technology does not reach, and already sufficiently satisfies the legal invention patent requirements of novelty and inventive step So, apply based on the law.

DESCRIPTION OF SYMBOLS 101 Conventional network switch 102 Network interface 103 Traffic mirror reflective element 104 Terminal device 105 Data network 106 Monitoring control network 110 Traffic monitoring control and analysis module 111 Traffic collection and classification element 112 Traffic analysis element 201 Programmable network switch 202 Data plane Network interface 203 Control plane network interface 204 Terminal device 205 Data network 206 Management network 207 Network controller 208 Application program interface module 210 Immediate traffic collection and analysis system 211 Traffic classification matching module Module 212 traffic statistics module 213 traffic collection module 214 database module 215 traffic analysis module S301 to S304 method flow S404 to S406 method flow

Claims (5)

A plurality of programmable network switches for processing a plurality of packets;
A network controller connected to the programmable network switch by managing the network, and managing and monitoring the programmable network switch;
An immediate traffic collection and analysis module connected to the network controller for collecting and analyzing immediate traffic;
An immediate traffic collection and analysis system, including
The programmable network switch is
A packet classification matching module for storing a plurality of classification matching rules for matching each packet;
A traffic statistics module connected to the packet classification matching module to generate traffic information;
A base plane network interface module that forwards each packet to the data plane network;
The packet classification matching module thereby including a control plane network interface module connected to the network controller;
The network controller includes an application program interface module whereby the application program commands the network controller to manage and monitor the programmable network switch,
The instant traffic collection and analysis module
A traffic collection module that instantly collects the traffic information in the programmable network switch by the network controller;
A database module for storing the collected traffic information;
A traffic analysis module for analyzing the traffic information stored in the database module;
Instant traffic collection and analysis system.   Each of the classification matching rules includes at least one packet classification setting and at least one packet processing operation, and the packet classification matching module includes header contents from the second layer to the fourth layer of the network in the packet classification setting, and Classifying each packet based on the entity port number that receives the packet, and the packet classification matching module transmits the packet based on the packet processing operation, discards the packet, and 2. The immediate traffic collection / analysis system according to claim 1, wherein the header content from the first layer to the fourth layer is changed.   The traffic information includes a total amount of matching packets, a total flow of traffic of matching packets, each classification matching rule, and a total time label in which each classification matching rule exists. Immediate traffic collection and analysis system described in. The traffic collection module in the instant traffic collection and analysis module sends traffic information needs through the application program interface module in the network controller, and the network controller forwards the traffic information needs to a programmable network switch to obtain traffic information And steps to
The programmable network switch examines whether there is a corresponding classification matching rule based on the traffic information needs transmitted by the network controller, and if so, the network controller sends the traffic information to the traffic Reply to the collection module, if not, establishing the classification matching rule at the programmable network switch by the network controller;
The network controller writes the packet classification matching rules to the traffic classification matching module in the programmable network switch, and the traffic collection module transmits the traffic information needs again by the application program interface module of the network controller. And steps to
The programmable network switch obtains the traffic information from the traffic classification matching module and the traffic statistics module, and then returns the traffic information to the immediate traffic collection and analysis module by the network controller. Receiving the traffic information by the collection module and storing it in the database module;
The instant traffic collection module retransmits the traffic information needs by the application program interface module;
The traffic analysis module in the instant traffic collection and analysis module includes obtaining the traffic information from the database module and analyzing it immediately.
Instant traffic collection and analysis method.   The instant traffic collection module obtains the traffic information by transmitting the traffic collection needs to the programmable network switch by the application program interface module in the network controller, and the programmable network switch. 5. The method of claim 4, further comprising: retrieving the traffic information from the traffic classification matching module and the traffic statistic module, and the database module storing the traffic information. Instant traffic collection and analysis methods.

Images