JP6764313B2 - Immediate traffic collection / analysis system and method - Google Patents

Description

The present invention relates to systems and methods of broadband network traffic collection and analysis, and in particular to immediate traffic collection and analysis methods in which software-defined network technology is achieved by network controllers and programmable network switches.

In contrast to the traffic collection monitoring and analysis methods managed by conventional networks, other network devices (for example, network packet probes, network traffic monitoring devices, etc.) are used to achieve traffic collection means, and these network devices are used to pre-classify or filter packets. There is a method of providing the traffic analysis software (for example, net flow, etc.) after performing the above.

When traffic is collected by other network devices, the collection of traffic information on the network device can be obtained by means including traffic mirror reflection by the network switch, or the traffic packets are implanted in the network switch by a method of pre-classifying and filtering. Reduces traffic collection devices from receiving too much unwanted data.
Normally, in traffic mirror reflection mode, the effectiveness of the network switch is depleted, not only is it not possible to obtain accurate traffic packet data, but it also affects the successful delivery of packets, when network devices collect traffic. , You may get a lot of unnecessary information. Also, when a traffic collection method is implanted in a network switch, it is usually not possible to perform complex prior traffic packet classification or filtration, which limits its applicability and incorporates the functions of traffic packet classification and filtration. The cost of network switches increases as the hardware needs of network switches increase accordingly.
Also, in general, such traffic collection methods have too long sampling intervals, so the traffic information obtained cannot show accurate data, and the analysis results show detailed traffic information, such as the effects of surges. It will not be possible to reflect it.

In view of the inability of conventional network switches to effectively obtain immediate traffic information, the inventor of the present application has conducted intensive research and improvement creation, and as a result, it can be programmed with a network controller using software-defined network technology. Immediate traffic collection and analysis methods achieved by network switches are submitted to improve the accuracy of traffic collection while avoiding the cost of building additional network traffic detection systems.

In the present invention, a system and a method for achieving network traffic collection and analysis by software-defined network technology are submitted, and network monitoring control can achieve immediate monitoring control of traffic flow and provide accurate analysis of traffic information. it can.

In the present invention, for the purpose of solving the problem that the conventional traffic collection system is usually not accurate, an immediate traffic collection method for accurately collecting traffic by software-defined network technology is submitted, and a flow-based traffic statistics method is used in advance. The traffic information to be classified and matched is obtained directly from the switch, and the cost of constructing an additional traffic detection system for the network is avoided.

The present application is an immediate traffic collection / analysis system and method capable of instantly obtaining traffic information from a programmable network switch.
Programmable switches belong to the data plane of software-defined networks and include flow-based traffic packet classification matching methods and traffic statistics methods, which flow-based traffic packet classification matching methods are packets after matching different types of packets. In addition to transmitting or modifying the packet, it may be a packet classification method for collecting traffic, and the classification means are media access control (Media Access Control, MAC), virtual local area network (Virtual Local Area Network, WLAN), and Internet protocol (VLAN). Includes many types of classification such as Internet Protocol (IP), Differentiated Services Code Point (DSP), Transmission Control Protocol (TCP), etc. After each type of packet classification, packet volume and total flow rate. , Equipped with a traffic statistics method that can stat the time label and the like. In this way, the effect of the immediate traffic collection module collecting traffic information can be improved.
The control plane of the software-defined network periodically obtains traffic information classified from the traffic statistics module by the controller application program interface module that forwards the traffic collection request message and the traffic information reply message, and the application program interface module of the network controller. It includes an immediate traffic collection module that is stored in the database and a traffic analysis module that analyzes usage conditions, abnormal behavior, etc. that indicate various traffic types based on traffic information in the database, and achieves immediate traffic collection and analysis.

The present invention is connected to a plurality of programmable network switches that process a plurality of packets and the programmable network switch by managing the network, and manages and monitors and controls the programmable network switch. An immediate traffic collection and analysis system that includes a network controller and an immediate traffic collection and analysis program that is connected to the network controller and collects and analyzes immediate traffic.

The programmable network switch includes a classification matching module that stores a plurality of classification matching rules to match each packet, a traffic statistics module that is linked to the classification matching module and generates traffic information, and a traffic statistics module that generates traffic information. It includes a data plane network interface module that forwards packets to a data plane network and a control plane network interface module that connects the classification matching module to the network controller.

The network controller includes an application program interface module that allows the application program to direct the network controller to manage, monitor and control the programmable network switch.

The immediate traffic collection and analysis module includes an immediate traffic collection module that immediately collects the traffic information in the programmable network switch by the network controller, a database module that stores the collected traffic information, and a database module. Includes a traffic analysis module that analyzes the traffic information stored in.

The immediate traffic collection / analysis system according to the present invention further includes an immediate traffic collection / analysis module that immediately collects and analyzes traffic in a network, and the traffic collection / analysis module can transmit traffic information needs and the network. An immediate traffic collection module that instantly collects traffic information for the programmable network switch by the controller, a database module that stores the collected traffic information, and a traffic analysis module that analyzes the traffic information stored in the database module. including.

The network controller and the programmable network switch have a one-to-one or one-to-many tangent relationship, that is, one network controller is connected to one or more programmable switches. The programmable switch is connected to one network controller.

The classification matching rules are stored in the classification matching module, and each classification matching rule includes at least one packet classification setting and at least one packet processing operation, and the packet classification setting is set by the classification matching module. It is the basis for classifying packets according to the contents of the headers from the second layer to the fourth layer of the network and the actual port number of the received packet. It transmits the packet, discards the packet, and the header from the second layer to the fourth layer. The packet processing operation, including changing the content, limits how the classification matching module processes network packets.

The traffic statistics module has a traffic statistics setting to generate traffic information, and the data packets statistic in the traffic statistics settings include the total amount of matching packets, the total traffic flow of matching packets, and the classification matching rule. Each time the classification matching module matches a packet, the amount of data corresponding to the traffic statistics setting in the traffic statistics module increases, and each packet is one of the packet classification matching methods. Match only one classification matching rule.

The immediate traffic collection module acquires the traffic information by transmitting the traffic collection needs to the programmable network switch by the application program interface module in the network controller, and the programmable network. The action of retrieving packet classification and traffic statistics from the classification matching module and traffic statistics module on the switch, and the programmable network switch generating traffic based on packet classification and traffic statistics. And the database module performs an operation of storing the traffic information.

The traffic information stored in the database module includes the traffic packet classification matching settings, the total amount of packets to be matched, the total traffic flow to match the packets, and the total time label in which the classification matching rules exist. Regains classified traffic information from the database module, presents immediate and accurate traffic statistics, and analyzes network usage and anomalous network activity.

From the above, with the technology of defining networks in software, the immediate traffic collection module obtains detailed and accurate traffic information in a flow-based traffic statistics method from a suite that can be programmed directly by the controller application program interface module. , The cost of constructing an additional network traffic detection system can be reduced. In addition, the traffic information that is classified and matched in advance is directly acquired, the effect of omitting the packet reading element and the effect of wearing the switch is avoided, and the time interval in which the traffic collection system samples the traffic information is effective so that the traffic information is shown more immediately. Can be reduced.

It is a frame chart of the conventional traffic monitoring control and analysis module. It is a frame chart of the immediate traffic collection / analysis system which concerns on this invention. It is a flowchart of establishment of the traffic classification matching rule which concerns on this invention. It is a flowchart of the immediate traffic collection and analysis method which concerns on this invention.

In order to clarify the object, claims, advantages and features of the present invention, the present invention will be described in more detail below together with the accompanying figures and examples. It is clear that the examples here merely interpret the present invention and do not limit the present invention.

FIG. 1 is a frame of a conventional traffic monitoring control and analysis system. In the conventional traffic monitoring control and analysis system frame, the means for mirror-reflecting the traffic to the traffic monitoring control and analysis system 110 by using the traffic mirror reflecting element 103 in the conventional network switch 101 is mainly the traffic in the network interface 102. The copy is mirror-reflected from the traffic mirror reflector 103, which mainly exchanges all mirror reflections in the data packets between the terminal device 104 and the data network 105, and the traffic monitoring control and analysis module 110 The traffic information mirror-reflected by the monitoring control network 106 is obtained, the mirror-reflected traffic is analyzed by the traffic collection and classification element 111, unnecessary traffic information is removed, and the remaining traffic data is classified.
The purpose of the traffic analysis element 112 is to obtain simplified traffic information from the traffic collection and classification element 111, analyze the traffic information, and provide analysis data such as network usage conditions and abnormal behavior of the network administrator. And. In the frame of the system of FIG. 1, the traffic mirror reflecting element 103 undermines the effect of the conventional network switch 101, and the traffic collecting and sorting element 111 needs to analyze all packets.

FIG. 2 is a frame of an immediate traffic collection and analysis system in which the network controller 207 establishes a control tangent with a network switch 201 programmable via the management network 206 by the control plane network interface module 203.
The classification matching module 211 in the programmable network switch 201 writes a traffic classification matching rule by the network controller 207, exchanges all data packets between the terminal device 204 and the data network 205 for classification matching, and sets the matching rule. After the packet is processed, the packet is further processed, for example, the packet is modified, and the packet is transferred by the data plane network interface module 202. The traffic statistics module 212 statistics information such as the number of packets and traffic that each rule matches against all classification matching rules, and the immediate traffic collection and analysis module 210 first starts with the immediate traffic collection module 213 to the network controller 207. Traffic collection needs are transmitted on time by the application program interface module 208 in the above, traffic information is immediately obtained from the traffic statistics module 212 after the network controller 207 receives the needs, and traffic information is immediately obtained by the application program interface module 208. It returns to the traffic collection module 213 again. Subsequently, the collected classified traffic information is stored in the database module 214, and finally, the traffic analysis module 215 acquires accurate and immediate network traffic data from the database module 214 to show the accurate network usage situation. It also immediately analyzes anomalous network behavior.

The flowchart of the establishment of the traffic classification matching rule and the flowchart of the immediate traffic collection and analysis method are as shown in FIGS. 3 and 4.
First, see FIG. Step S301 of the flow of establishing a traffic classification matching rule establishes a new tangent with a network switch programmable by the network controller, in which the network controller 207 connects the management network 206 with the control plane network interface module 203. Through, a control tangent is established with one or more programmable network switches 201, the process proceeds to step S302, and the programmable network switch checks whether a packet classification matching rule has already been established.

In step S302, which checks whether the programmable network switch has already established a packet classification matching rule, the network controller 207 first checks whether the programmable network switch 201 has already established a traffic classification matching rule. If the traffic classification matching rule has already been established, the packet is classified and matched after entering the programmable network switch 201, and if the matching is successful, the process proceeds to step S304, the packet is matched, and then the packet is forwarded. Statistics on the number of packets and traffic flow. On the other hand, the unmatched packet notifies the network controller 207 from the programmable network switch 201, informs that the classification matching rule is not established, proceeds to step S303, and is a network switch programmable by the network controller. Establish classification matching rules.

In step S303, where the network controller 201 programmable by the network controller establishes the classification matching rule, the network controller 207 determines the classification matching rule for the unmatched packets and writes the traffic to the programmable network switch 201. Determine classification matching rules. After that, the traffic classification matching rule is written to the programmable network switch 201, and the process returns to step S302 again to check whether the programmable network switch has already established the packet classification matching rule, and the classification matching rule has already been established. Check if it was written.

In step S304, which transfers packets after matching packets and stats the number of packets and traffic flow rate, after the packets enter the matching rule of the classification matching module 211, the packets are processed by the packet processing method defined in the classification matching rule. Process against. The processing method includes operations such as packet head modification, packet forwarding, and packet discard, and each matched packet is statisticized by the traffic statistics module 212 linked to the classification matching module, and the matched packet amount, It includes the total flow rate of traffic, etc., and then shifts to the flow of immediate traffic collection and analysis methods.

See FIG. In step S401 of the flowchart of the immediate traffic collection and analysis method, the immediate traffic collection module transmits the traffic information needs by the network controller application program interface module. In this step, the immediate traffic collection module 213 of the immediate traffic collection and analysis module 210 sends out specific traffic information needs on time by the application program interface module 208 in the network controller 207, and the time interval is based on the application program. The traffic information needs can be adjusted, and the time interval that can be created at the shortest is to send the needs every 5 seconds. After receiving the traffic needs, the network controller 207 transfers the needs to a programmable network switch to acquire the traffic information.

In the classification method of step S402 to check if the programmable network switch has a need, the programmable network switch 201 sets a classification matching rule based on the needs transmitted by the network controller 207. Inspect.
If the classification matching rule already exists, the process proceeds to step S404, and the network controller returns the immediate traffic statistics to the immediate traffic collection module. On the other hand, if the classification matching rule does not exist, the process proceeds to step S403. Establish packet classification matching rules on network switches that are programmable by the network controller.

Establishing a Packet Classification Matching Rule on a Network Switch Programmable by a Network Controller In step S403, the network controller 207 redefines a traffic classification matching rule that meets immediate traffic collection needs, and then programs the classification matching rule. Writing to the classification matching module 211 in the possible network switch 201 and returning to step S401, the immediate traffic collection module originates the traffic information needs by the network controller application program interface module.

In step S404, which returns immediate traffic statistics to the immediate traffic collection module by the network controller, the programmable network switch 201 acquires traffic information from the classification matching module 211 and the traffic statistics module 212. After that, the network controller 207 returns the traffic information such as the traffic classification matching rule, the matching packet amount, and the traffic flow rate to the immediate traffic collection and analysis module 210, and the immediate traffic collection module 213 in the network controller 207 receives the traffic information. And store traffic information in the database module.

In step S405 of storing the traffic information in the database module 214, the immediate traffic collection module 213 stores the traffic information in the database module 214 based on different traffic classification means, and the storage stores data such as packet volume, traffic flow rate, and time label. including. Subsequently, in the next time interval, the process returns to step S401, and the immediate traffic collection module transmits the traffic information needs by the network controller application program interface module, that is, continues to perform the next traffic collection operation. If there is a traffic analysis need, the process proceeds to step S406, and the traffic analysis module acquires and analyzes traffic information from the database module.

In step S406, where the traffic analysis module acquires and analyzes traffic information from the database module, the traffic analysis module 215 acquires each type of classified reply traffic information from the database module 214. Since the traffic information collected is shortly spaced, the traffic analysis module 215 should provide immediate and accurate traffic statistics and accurately analyze network usage and abnormal network behavior for reference by network administrators. Can be done.

The immediate traffic collection / analysis system and method provided by the present invention further have the following advantages as compared with other conventional techniques.

The present invention submits a classification matching means for collecting various types of traffic, for example, a classification matching means such as MAC, VLAN, IP, DCSP, TCP, etc., and a system used for traffic analysis shows more multidimensional traffic information.

The present invention can provide an accurate and immediate traffic collection means by omitting a packet reading element, acquiring traffic information that is pre-classified and matched by a flow-based traffic statistics method from a directly programmable switch, and from traffic statistics. Discover anomalous surges and instantly reflect anomalous traffic conditions.

The data plane of the present invention also belongs to the distributed plane, and the immediate traffic collection and analysis module can obtain a wide range of network traffic information by the centralized control plane.

Although the above detailed description specifically describes the most preferable embodiment of the present invention, the embodiment is not used to limit the scope of claims of the present invention and does not deviate from the technical spirit of the present invention. Any implementation or modification that has the same effect is covered by the claims of the present application.

From the above, the present invention is actually creative in the technical idea, has various effects beyond the prior art, and already fully meets the legal invention patent requirements of novelty and inventive step. Therefore, apply in accordance with the law.

101 Conventional network switch 102 Network interface 103 Traffic mirror reflector 104 Terminal device 105 Data network 106 Monitoring control network 110 Traffic monitoring control and analysis module 111 Traffic collection and classification element 112 Traffic analysis element 201 Programmable network switch 202 Data plane Network Interface 203 Control Plane Network Interface 204 Terminal Device 205 Data Network 206 Management Network 207 Network Controller 208 Application Program Interface Module 210 Immediate Traffic Collection and Analysis System 211 Classification Matching Module 212 Traffic Statistics Module 213 Immediate Traffic Collection Module 214 Database Module 215 Traffic Analysis Modules S301-S304 Method Flow S404-S406 Method Flow

Claims (4)

With multiple programmable network switches that handle multiple packets,
A network controller that is connected to the programmable network switch by managing the network and manages, monitors, and controls the programmable network switch.
An immediate traffic collection and analysis module that connects to the network controller and collects and analyzes immediate traffic,
An immediate traffic collection and analysis system that includes
The programmable network switch is
To match the corresponding packet, and classification matching module that stores a plurality of classification matching rule,
Is connected to those said classification matching module, based on each packet classified by those the classification matching module, a matching packet amount, and the total flow rate of the traffic matching packets, each said classification matching rule, each said classification A traffic statistics module that generates traffic information, including the total time label for which matching rules exist, and
A data plane network interface module that forwards each packet to the data plane network,
Thereby and a single control plane network interface module those the classification matching module is connected to the network controller,
The network controller includes an application program interface module that allows the application program to direct the network controller to manage and monitor the programmable network switch.
The immediate traffic collection and analysis module
An immediate traffic collection module that instantly collects the traffic information on the programmable network switch by the network controller.
A database module that stores the collected traffic information and
Look including a traffic analysis module for analyzing the traffic information stored in the database module,
The immediate traffic collection module in the immediate traffic collection and analysis module originates traffic information needs by the application program interface module in the network controller, and the network controller forwards the traffic information needs to a programmable network switch. Get traffic information and
The programmable network switch inspects whether there is a corresponding classification matching rule based on the traffic information needs originating by the network controller, and if so, the network controller delivers the traffic information immediately. Reply to the traffic collection module, or establish the classification matching rule on the programmable network switch by the network controller.
Immediate traffic collection and analysis system. Each the classification matching rule may include at least one packet classification set and at least one packet processing operation, those the classification matching module, the header content of the second layer of the network in the packet classification set to the fourth layer, and, based on the real port that receives the packet, and to classify each said packet, those the classification matching module, based on the packet processing operations, originated the packet, discarding the packet, the network The immediate traffic collection / analysis system according to claim 1, wherein the header contents from the second layer to the fourth layer are changed. Immediate traffic in which a programmable network switch with one control plane network interface module in the immediate traffic collection and analysis system is connected to the network controller in the immediate traffic collection and analysis system through the control plane network interface module. An immediate traffic collection and analysis method used in collection and analysis systems.
The immediate traffic collection module in the analysis module immediate traffic collection, and outbound traffic information need by the application program interface module in the network controller, the network controller transfers the traffic information need to the program-enabling network switch Steps to get traffic information and
The programmable network switch inspects whether there is a corresponding classification matching rule based on the traffic information needs originating by the network controller, and if so, the network controller delivers the traffic information immediately. The steps to reply to the traffic collection module, or to establish the classification matching rule on the programmable network switch by the network controller, and
The network controller writes the classification matching rule to classification matching module that put in the program-enabling network switch, the immediate traffic collection module by again the application program interface module of the network controller, the traffic information needs And the steps to send
Those the classification matching module includes the steps based on the classification matching rule, to classify packets in traffic,
The programmable network switch traffic statistics module has a total matching packet volume, the total flow rate of matching packet traffic, each relevant classification matching rule, and each relevant classification matching rule based on each classified packet. Steps to generate traffic information, including total time labels and
The programmability of the network switch, from those the classification matching module and traffic statistics module, after acquiring the traffic information, the traffic information replied to the analysis module with the immediate traffic collected by the network controller, the immediate The steps of receiving the traffic information by the traffic collection module and storing it in the database module,
The immediate traffic collection module has a step of retransmitting the traffic information needs by the application program interface module.
The traffic analysis module in the immediate traffic collection and analysis module includes steps to obtain the traffic information from the database module and analyze it immediately.
Immediate traffic collection and analysis methods. The immediate traffic collection module acquires the traffic information by transmitting the traffic collection needs to the programmable network switch by the application program interface module in the network controller, and the programmable network switch. from this the classification matching module and the traffic statistics module in, and to regain the traffic information, the database module, and performing a step comprising a storing the traffic information, in claim 3 The described immediate traffic collection and analysis method.

Images