KR100495086B1 - Analysis Apparatus and Method for Traffic Information of IP Network based on Passive Measurement - Google Patents

Abstract

The present invention relates to an IP (Internet Protocol) network traffic information analysis apparatus using a manual measurement method, and sets the generation configuration information and the collection configuration information to the router to collect, store the flow data and collect the flow data traffic A router for transmitting to an analysis server, a traffic collection and analysis server for collecting and analyzing flow data, and a database server for storing the collected flow data and analyzed flow data.

The present invention also relates to a method for analyzing IP network traffic information using a passive measurement method, comprising: setting generation and collection configuration information of flow data, collecting flow data, classifying flow data, and flow Recalculating the number of packets and the number of bytes on the basis of analysis unit time, and storing the flow data according to the sorted type.

Description

Analysis Apparatus and Method for Traffic Information of IP Network based on Passive Measurement}

The present invention relates to analysis of internet protocol network traffic information, and more specifically, traffic generated in an IP (Internet Protocol) network is collected by a manual measurement method from a router and then traffic information based on a data warehouse. It relates to a device and method that can be analyzed.

In general, there are two methods of collecting data in the network: active measurement and passive measurement.

Active measurement (AM) is a test packet that collects data for network engineering such as network design, traffic analysis, traffic condition and performance analysis.In the Internet Protocol (IP) network, NIMI (National Internet Measurement Infrastructure) and Surveyor Tools and the like.

On the other hand, passive measurement (PM) collects data generated from the network and calculates data for network engineering without using a separate test packet. Simple network management protocol (SNMP) and management information base (MIB) in an IP network ), Tcpdump running on UNIX, and NetFlow from CISCO.

By the way, in the case of the active measurement (AM), there is an advantage that can grasp the current state and state of the network in real time, it can increase the network load by generating a separate traffic for the measurement in addition to the data traffic to the network. In addition, active measurement is expensive because it requires separate measuring devices and analysis equipments to be installed in the network for traffic collection and analysis, and the amount of information collected is small compared to the cost. There is a matter.

Passive measurement (PM) is more cost effective than active measurement and can be advantageous when considering the accuracy of the analysis, as large data can be collected in a short time. Therefore, manual measurement is a suitable method for large network operators to perform network design, traffic analysis, network diagnosis and analysis. However, since manual measurement is equipment dependent, there is a problem in that it is necessary to clearly understand the property of data generated from a specific device for data collection and analysis.

When data is collected using Active and Passive Measurements (PM), parameter values and other characterization results can be derived, for example, by a data analyzer, depending on the purpose. Not only is it difficult to use as a basic data, but the result may not be useful depending on the user.

Accordingly, the present invention has been proposed to solve the above-mentioned problems, and is an apparatus for analyzing traffic information of an internet protocol network using a passive measurement method that can be configured to collect netflow data from any router of an IP network to analyze traffic. The purpose is to provide.

In addition, another object of the present invention is to provide an apparatus for analyzing Internet protocol network traffic information using a passive measurement method that can provide collected netflow data as data tailored to a query condition.

Furthermore, another object of the present invention is to provide an apparatus for analyzing network traffic information using a passive measurement method that can calculate and provide analysis information of netflow data required by a user.

According to a feature of the present invention proposed to achieve the above object, the network traffic information analysis apparatus using a passive measurement method transmits to the router to be collected so that the generation configuration information and the collection configuration information of the flow data is set, the set router A traffic collection and analysis server for collecting flow data generated from the data and analyzing the collected flow data; A router for storing the flow data generated based on the generated configuration information from the traffic collection and analysis server, and then transmitting the stored flow data to the traffic collection and analysis server based on the collection configuration information from the traffic collection and analysis server. ; And a database server for storing the flow data and the analyzed flow data collected in the traffic collection and analysis server.

In a preferred embodiment of this feature, the traffic collection and analysis server is characterized by dividing the collected flow data by a predetermined analysis unit time.

In a preferred embodiment of this feature, the database server is characterized by classifying the collected flow data by source IP address, destination IP address, source port number, destination port number, and protocol, respectively.

In addition, according to another aspect of the present invention, the network traffic information analysis method using a manual measurement method in the step of setting the generation configuration information and the collection configuration information of the flow data to the router to be analyzed, and in the step of setting the configuration information Collecting flow data generated from a router configured by the router; classifying the flow data collected in the flow data collection step by source IP address, destination IP address, source port number, destination port number, and protocol; Recalculating the number of packets and the number of bytes on the basis of the analysis unit time to analyze the classified data in the classifying step, and classifying the flow data recalculated in the recalculating step Characterized in that the step of storing.

In a preferred embodiment of the feature, the setting of the configuration information is characterized in that it comprises the step of setting the analysis unit time to analyze the flow data.

In a preferred embodiment of this feature, the step of recalculating includes separating the flow data proportionally based on the analysis unit time when the collected flow data is generated through the analysis unit time. do.

Hereinafter, embodiments of the present invention will be described in detail with reference to FIGS. 1 to 4.

1 is a diagram illustrating a connection state of a router and a collection server of a network according to an embodiment of the present invention. In the drawings, reference numerals 100 and 200 are autonomous systems, 110 and 210 are IP networks, 220 and 230 are routers, 240 are traffic collection and analysis servers, and 250 are database servers. Respectively.

Referring to the drawing, the IP network 210 belongs to the autonomous system 200 and the other IP network 110 belongs to the other autonomous system 100.

The network 210 of the present invention will be described using, for example, an IP network in which a router routing protocol (BGP) based on CISCO Corporation is operated.

The routers 220 and 230 of CISCO Corporation configured in the network 210 primarily store all generated flow traffic. In such a router, a switching mode for generating flow traffic may be set, and a device for collecting the generated traffic may be designated. Here, the traffic collection and analysis server 250 is set as a device for collecting the traffic generated from the router. Data generated by the router is generally referred to as NED (NewFlow Export Data).

Therefore, when the router is set to a switching mode for generating flow traffic, the NED generated by the router is periodically transmitted to the designated traffic collection and analysis server. Then, the traffic collection and analysis server 240 stores the collected NED in the database through the database server 250.

In the embodiment of the present invention, the change and setting of the setting state of the routers 230 and 220 for collecting the NED may be controlled by the traffic collection and analysis server 240.

FIG. 2 is a diagram illustrating the structure of a database collected from a router shown in FIG. 1 to a database server. 2 (A) shows header information of a database, and (B) shows a record.

The header includes Version, Count, Sysuptime, Unix_secs, Unix_nsecs, Flow_sequence, Engine Type, and Engine Identifier. Engine_ID).

Where version is the version number in NetFlow format, count is the number of flows registered in the UDP packet, and elapsed time (Sysuptime) is the router boot time, Unix_secs and Unix_nsecs. Is the router time, the total flow count (Flow_sequence) is the counter number of the flow sequence, the engine type (Engin_type) is the engine type of the router's netflow, and the engine identifier (Engine_ID) is the engine number of the router netflow.

On the other hand, the record includes the source IP address (Srcaddr), destination IP address (Dstaddr), next hop router IP address (NextHop), input interface SNMP index (Input), output interface SNMP index (Output), flow packet count (Dpkts), Flow3 layer bytes (Doctets), flow start elapsed time (First), flow end elapsed time (Last), source port number (Srcport), destination port number (Dstport), TCP flag (Tcp_flags), protocol type (Prot) , Service type (Tos), source autonomous system number (Src_as), target autonomous system number (Dst_as), source address prefix mask (Src_mask), and destination address prefix mask (Dst_mask).

The source IP address (Srcaddr) is the source IP (Internet Protocol) address, the destination IP address (Dstaddr) is the destination IP address, the next hop router IP address (NextHop) is the IP address of the Next HOP router, the input interface SNMP Index (Input) SNMP index number of input interface, output interface SNMP index number of output interface, number of flow packets (Dpkts) is the number of packets sent by the flow, number of bytes (flows) is the total bytes sent by the flow Number, flow start elapsed time (First) is flow start time, flow end elapsed time (Last) is flow end time, source port number (Srcport) is port number of originating IP, destination port number (Dstport) is destination IP Port number, source autonomous system number (Src_as) is the autonomous system number to which the originating IP belongs, destination autonomous system number (Dst_as) is the autonomous system number to which the destination IP belongs, source address prefix The mask (Src_mask) indicates network mask information of the source IP, and the destination address prefix mask (Dst_mask) indicates network mask information of the destination IP, respectively.

FIG. 3 is a diagram illustrating a database dimension model for analysis at a traffic collection and analysis server by a database query of the database server shown in FIG. 1.

As shown in the figure, the database dimension model according to an embodiment of the present invention includes a period table 250, a time table 260, a source area table 270, a destination area table 280, a source port table 290 ), The destination port table 300, and the protocol table 310. Each of the tables 250 to 310 is linked with the flow traffic analysis table 320.

The traffic analysis table 320 includes traffic analysis and statistical information, and the dimension tables 250 to 310 include a year, month, date code, time code, source IP address, destination IP address, source port number, and destination. Linked by port number and protocol type.

The period table 250 is composed of fields of year, month, day, month, day, day, month, and year. The time table 260 is composed of time codes and fields of time names.

The origination region table 270 is composed of source IP address, node, regional headquarters, source autonomous system, and originator type field. The destination area table 280 is composed of a destination IP address, a node, a regional headquarters, a destination autonomous system, and a destination subscriber type field.

The outgoing port table 290 is composed of a source port number and a service type field. The destination port table 300 includes a destination port number and a service type field. On the other hand, the protocol table 310 is composed of a protocol type and protocol name field.

4 is a flowchart showing in detail the operation of the traffic collection and analysis server shown in FIG.

First, the operator inputs the analysis unit time to analyze the traffic through the traffic collection and analysis server 240 (S110).

The traffic collection and analysis server 240 receives flow data generation configuration information and collection server configuration information for the router to be measured and sets configuration information of the selected router according to the input configuration information (S120).

The flow data generation configuration information includes a period of time (collection period) for transmitting data from the routers 220 and 230 to the collection and analysis server 240. The collection period is set to occur at different times for each router to minimize the effect of the collected data on the network. In addition, the collection server configuration information includes the IP address of the traffic collection and analysis server 240 for collecting flow data.

The traffic collection and analysis server 240 collects flow data transmitted from the router configured as described above (S130).

Subsequently, the traffic collection and analysis server 240 classifies the received flow data by source IP address, destination IP address, source port number, destination port number, and protocol (S140).

The traffic collection and analysis server 240 recalculates the received analysis unit time with the received flow data (S150). For example, the traffic collection and analysis server 240 calculates the number of flow packets and flow bytes included in the received flow data as the analysis unit time.

Here, an example in which the analysis unit time is input as 15 minutes in the analysis unit time input step (S110) will be described.

The original flow data collected is referred to as Flow1, and it is assumed that the flow occurrence time of Flow1 is 00:05 on January 1, 2001, and the flow end time of Flow1 is 00:20 on January 1, 2001. In addition, it is assumed that the number of flow packets of Flow1 is 100 and the number of flow bytes is 1000.

Then, the maintenance time (Activetime) of Flow1 becomes the time after the flow occurrence time minus the flow end time. Therefore, the holding time of Flow1 is 15 minutes (20 minutes-5 minutes).

However, since the set analysis unit time is input as 15 minutes, it is necessary to recalculate the flow data information according to the analysis unit time. Therefore, the traffic collection and analysis server 240 divides the received flow data Flow1 into Flow11 and Flow12 based on 15 minutes.

Therefore, the time of occurrence of Flow11 is 00:05 on January 1, 2001, and the end time is 00:15 on January 1, 2001. The occurrence time of Flow12 is 00:15 on January 1, 2001, and the end time is 00:20 on January 1, 2001. At this time, the holding time of Flow11 is 10 minutes, and the holding time of Flow12 is 5 minutes.

Subsequently, the traffic collection and analysis server 240 calculates the number of flow packets and the number of flow packets of Flow 11 and Flow 12 based on the maintenance time calculated as described above.

First, the flow packet count of Flow11 is calculated as shown in Equation 1.

[Equation 1]

Then, the number of flow packets in Flow12 is 30 (the number of flow packets in Flow1-the number of flow packets in Flow11).

Similarly, the flow byte count of Flow11 is calculated as shown in Equation 2.

[Equation 2]

Then, the number of flow bytes in Flow12 is 300 bytes (the number of flow bytes in Flow1-the number of flow bytes in Flow11).

The result calculated for each flow classified as described above is stored according to the data warehouse dimension model according to the embodiment of the present invention through the database server 25 (S160).

Finally, the traffic collection and analysis server 240 calculates the flow data stored in the database through the database server 250 as shown in Table 1 below.

[Table 1] Flow Traffic Statistics History

Analysis 1 Analysis 2 Analysis 3 parameter Justice Hourly, daily, monthly, yearly By autonomous system, region, ISP, specific site By protocol, by service bytecnt Total Bytes Sent (Traffic Volume) pktcnt Total Packets Transmitted flowcnt Number of flows generated bps Bytes sent (unit time) bps = bytecnt / UNIT_TIME flowsec Number of flows generated (unit time) flowsec = flowcnt / UNIT_TIME activetime Average of flow average holding time (flow end time-flow occurrence time) pktsec Number of packets sent (unit time) pktsec = pktcnt / UNIT_TIME pktperflow Average number of packets sent per flow.pktperflow = pktcnt / flowcnt Byteperpkt Average number of bytes sent per packet byteperpkt = bytecnt / flowcnt byteperflow Average number of bytes sent per flow byteperflow = bytecnt / flowcnt

The statistical data calculated as described above is stored in the flow traffic analysis table 320.

Since the present invention collects flow data in a passive measurement (PM) method, it does not need a measurement device for collecting traffic and is economical because a large amount of data can be collected in a short time. In addition, according to the present invention, since network traffic is analyzed based on large-scale data, the analysis result is reliable.

This invention can charge based on the use of the Internet protocol, and enables traffic related IP supplementary services such as QoS and SLA.

Furthermore, according to the present invention, the network operator can be provided with information for establishing an economical BGP peering policy.

In addition, according to the present invention, data collection and analysis can be performed quickly, and the unit time to be analyzed can be set freely, so that the burst traffic of the network can be analyzed, and the host estimated to be hacked can be immediately identified. .

1 is a view showing a connection state of a router and a collection server of a network according to an embodiment of the present invention.

2 is a view showing the structure of a database collected in a database server from the router shown in FIG.

FIG. 3 is a diagram illustrating a dimension model for analysis at a traffic collection and analysis server by a database query of the database server illustrated in FIG. 1.

4 is a flowchart detailing the operation of the traffic collection and analysis server shown in FIG. 1;

<Description of Symbols for Main Parts of Drawings>

100, 200: autonomous system 110, 210: network

220, 230: router 240: traffic collection and analysis server

250: database server

Claims (6)

An apparatus for collecting flow data generated from a router connected to an internet protocol network, the apparatus comprising: A traffic collection and analysis server for transmitting flow generation generation information and collection configuration information to a router to be collected, collecting flow data generated from the set router, and analyzing collected flow data; A router for storing the flow data generated based on the generated configuration information from the traffic collection and analysis server, and then transmitting the stored flow data to the traffic collection and analysis server based on the collection configuration information from the traffic collection and analysis server. ; And Internet protocol network traffic information analysis apparatus using a passive measurement method comprising a database server for storing the flow data and the analyzed flow data collected in the traffic collection and analysis server. The method of claim 1, The traffic collection and analysis server is an Internet protocol network traffic information analysis apparatus using a passive measurement method, characterized in that the divided flow data divided by a predetermined analysis unit time. The method of claim 1, The database server is an Internet protocol network traffic information analysis apparatus using a passive measurement method characterized in that the collected flow data is classified and stored by source IP address, destination IP address, source port number, destination port number, and protocol. A method for collecting flow data generated from a router connected to an internet protocol network, the method comprising: Setting generation configuration information and collection configuration information of flow data in a router to be analyzed; Collecting flow data generated from a router configured by setting the configuration information; Classifying the flow data collected in the step of collecting the flow data by source IP address, destination IP address, source port number, destination port number, and protocol; Recalculating the number of packets and the number of bytes on the basis of the analysis unit time to analyze the classified data in the classifying step; And And storing the recalculated flow data according to the sorted type in the classifying step, in the recalculating step. The method of claim 4, wherein The setting of the configuration information may include setting an analysis unit time for analyzing flow data. The method of claim 4, wherein The recalculating may include splitting the flow data proportionally based on the analysis unit time, when the collected flow data is generated through the analysis unit time. How to analyze traffic information.