KR100736914B1 - Method for application service identification in broadband convergence network - Google Patents

Abstract

A method for identifying an application service in a BcN(Broadband convergence Network) is provided to be utilized for designing a BcN, analyzing a failure, and creating an application service weather map, and effectively manage the BcN. Transmitted packets are collected, start and destination IP address and port information of each collected packet are obtained, and packets having the common start and destination IP address and port information are grouped(S100,S200,S300). The pre-set number of packets having the same start or destination IP address and port information are sampled in the respective groups, payload data of the sampled packets is obtained, and application services are primarily identified according to a signature or a protocol mapping by using the payload data(S400,S500,S600). Each different weight value is applied to the primarily identified application services, and an application service having the largest value is identified as the final application service in a corresponding group(S700).

Description

Application service identification in broadband convergence network {METHOD FOR APPLICATION SERVICE IDENTIFICATION IN BROADBAND CONVERGENCE NETWORK}

1 is a conceptual diagram illustrating an example of a group configured through an application service identification method in a broadband integrated network according to an embodiment of the present invention.

2 is a diagram for explaining the structure of a format of a real-time transport protocol (RTP) header.

3 is a diagram illustrating a basic algorithm for concretely implementing an application service identification method in a broadband integrated network according to an embodiment of the present invention.

4 is a flowchart illustrating an application service identification method in an integrated broadband network according to an embodiment of the present invention.

*** Explanation of symbols on main parts of drawing ***

100: server, 200a to 200c: client

The present invention relates to a method for identifying an application service in a broadband integrated network. More specifically, the present invention can identify an application service more accurately and quickly, and can be used for designing a broadband integrated network, analyzing an error, and creating an application service meteorological map. In addition, the present invention relates to a method for identifying application services in a broadband integrated network that enables efficient management of a broadband integrated network.

In general, broadband convergence network (BcN) overcomes the limitations of current individual networks and provides broadband multimedia services that combine high quality voice, data, and broadcasting in various wired / wireless connection environments. It is a next-generation integrated network that can be used anytime, anywhere.

 The Broadband Integrated Network (BcN) is defined as "a next-generation integrated network that can safely and securely use broadband quality multimedia services combined with communication, broadcasting, and the Internet anytime, anywhere without interruptions."

First, by integrating voice and data, it provides an economical voice and multimedia service based on the Internet Protocol (hereinafter referred to as 'IP').

Second, it is possible to provide seamless broadband multimedia service with optimal connection conditions between wired and wireless networks through a single identification number, authentication, and integrated terminal through the integration of wired and wireless.

Third, it is possible to provide a personalized and customized high quality interactive broadcasting service based on the next generation broadband communication network (eg, FTTH, 4G, etc.) by the convergence of communication and broadcasting.

Fourth, quality of service (QoS) is guaranteed to provide end-to-end high-quality service, and customer service quality can be differentiated according to service level agreement (SLA). Security is guaranteed at the network-wide layer.

Fifth, the introduction of the standard Open API (Application Program Interface) allows the third party who does not own the network to use the open and secure broadband multimedia service that can easily create and provide new services.

Sixth, the wireless Internet protocol (IPv6) is applied to the entire network, from the subscriber environment to the integrated delivery network, in order to meet a wide range of IP address demands such as home networks and information appliances.

Seventh, it supports a ubiquitous service environment that can be used safely anytime and anywhere without being restricted by time and space through multifunctional integrated terminals in various connection environments without being dependent on a specific network or terminal type.

As a method of identifying a typical application service in a broadband converged network having such various characteristics, there are a packet-based identification and a flow-based identification method.

Here, the flow-based identification method is a method of defining packets having the same characteristics as one flow and identifying the packets by using a predetermined calculation rule around the flow.

For example, a flow may be defined as a flow of a packet having the same source IP address, destination IP address, protocol, source port number, and destination port number.

However, the conventional packet-based application service identification method is more accurate than the flow-based application service identification method, but there is a problem in that a considerable time is spent in identifying the application service.

SUMMARY OF THE INVENTION The present invention has been made to solve the above problems, and an object of the present invention is to identify a method for identifying an application service in a broadband integrated network, which can more accurately and quickly identify an application service in a broadband integrated network (BcN). To provide.

Another object of the present invention is to provide a method for identifying an application service in a broadband integrated network that can be used for designing a broadband integrated network, analyzing an error, and preparing an application service meteorological map, and efficiently managing the broadband integrated network.

In order to achieve the above object, an aspect of the present invention, (a) after collecting the transmitted packets, the source and destination IP address and port information for each of the collected packets to obtain a common source or destination IP Constructing a group of packets having address and port information; (b) after sampling a predetermined number of packets having the same source or destination IP address and port information for each configured group, obtaining payload data of the sampled packets, and using the signature or protocol Identifying the primary application service by mapping; And (c) applying different weights to the application services identified primarily through the signature or protocol mapping to identify the application service having the largest value as the final application service for the group. It is to provide an application service identification method in an integrated network.

At this time, in step (b), the payload data of the sampled packets is obtained by measuring the units of the sampled packets, and then capturing data of 16 to 32 bytes of each measured packet. This is preferred.

Preferably, in step (b), if signature application is first performed by using payload data of the obtained packets, and then an application service is not identified, protocol mapping is performed to identify the application service.

Advantageously, in step (c), an application service identified primarily through the signature mapping applies a greater weight than an application service identified primarily through the protocol mapping.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. However, embodiments of the present invention illustrated below may be modified in various other forms, and the scope of the present invention is not limited to the embodiments described below. The embodiments of the present invention are provided to more completely explain the present invention to those skilled in the art.

1 is a conceptual diagram illustrating an example of a group configured through a method for identifying an application service in a broadband integrated network according to an embodiment of the present invention, and FIG. 2 illustrates a structure of a format of a general real time transport protocol (RTP) header. 3 is a diagram illustrating a basic algorithm for concretely implementing a method for identifying an application service in a broadband integrated network according to an embodiment of the present invention, and FIG. 4 is a diagram for explaining an embodiment of the present invention. The overall flow chart for explaining the application service identification in the broadband converged network.

1 to 4, an application service identification method of a broadband convergence network (BcN) according to an embodiment of the present invention first collects packets transmitted from a broadband convergence network (BcN). In operation S200, two elements of a source IP address and port information and a destination IP address and port information are obtained for each of the collected packets.

In this case, each packet collected is typically In (download) / Out (upload), source IP address and port number, destination IP address and port number, protocol and byte ( Bytes) include items such as information.

Next, packets having a common source IP address and port or destination IP address and port information are grouped using two elements of the obtained source IP address and port information, and destination IP address and port information. Configure (S300).

That is, as shown in FIG. 1, a plurality of first to third clients 200a to 200c are connected to one server 100, and the server 100 may be configured to have first to third clients 200a to. 200c) In case of serving with one port for all, one group is configured.

In this case, an element that does not match is added when it matches an element of the first group among two elements for another packet, and when two elements match, no element is added.

Subsequently, after sampling a predetermined number of packets having the same source IP address and port or destination IP address and port information for each group configured in step S300 (S400), Payload data is acquired (S500).

For example, in the group configured as shown in FIG. 1, when the server 100 and the first client 200a have about 5000 packets, sampling is performed by a predetermined number (about 100), which is smaller than the number of 5000 packets. Thus, the time for identifying the application service of the packet can be shortened effectively.

On the other hand, payload data of the sampled packets, for the purpose of identifying an application service, after measuring the unit of the sampled packets, the payload data of each measured packet of about 16 to 32 bytes (bytes) It is desirable to capture and capture the data.

That is, in the case of a general TCP / UDP packet, payload data is located within about 16 to 32 bytes, so if only 16 to 32 bytes of data are captured for each measured packet, You don't need to examine the full length of, so you can get the payload data you want quickly and accurately, and you can save a lot of time.

Next, the primary application service is identified through signature mapping or protocol mapping using the payload data of the packets obtained in step S500 (S600).

Here, the signature mapping method is a method of identifying an application service using a text or hexadecimal code of a specific pattern used in a specific application service. For example, in the case of an HTTP service, POST, Text such as GET and HTTP will appear in the payload data.

Such signature mapping methods are typically represented by (1) S. Sen, O. Spatscheck and D. Wang, "Accurate, Scalable In-Network Identification of P2P Traffic Using Application Signatures", World Wide Web conference 2004 proceedings. (2) Andrew W. Moore and Konstantina Papagiannaki, "Toward the Accurate Identification of Network Application", Passive and Active Measurement workshop 2005.

The protocol mapping method is a conventional method of analyzing and mapping a protocol specification, for example, as shown in FIG. 2, for example, a real-time transport protocol (hereinafter, referred to as 'RTP'). In the case of "," the format of the header is configured as follows.

The V (Version) field is a 2-bit field that defines the version of the RTP, the P (Padding) field is a 1-bit field that defines whether the padding octets are included, and the X (eXtension) field is the presence of a header extension. CC (CSRC count) field is a 4-bit field containing the number of CSRC (Contributing SouRCe) identifier that is the ID of each sound source, M (Marker) field is a 1-bit field defined by the profile to be.

In addition, the PT (Payload Type) field is a 7-bit field that defines the format of the RTP payload, and the Seq # (Sequence number) field is a 16-bit field that is increased by one for each RTP data packet transmission. Used to detect loss and recover packet sequences, the timestamp field is a 32-bit field that defines timestamp information that periodically samples the reference timer, and the SSRC (Synchronization SouRCe) identifier field is a 32-bit field that defines the synchronization source. The CSRC identifier field is a 32-bit field that defines the sound source for the payload included in the packet, and can define 0 to 15 items, and 32 bits are allocated to each item.

Details of the RTP header described above are described in the RFC 1889, 1890 specification book (Internet homepage http://sunsite.auc.dk/RFC/rfc/rfc1889.html, http://sunsite.auc.dk /RFC/rfc/rfc1899.html).

On the other hand, in step S600, if signature application is first performed using payload data of the obtained packets, and then an application service is not identified, it is preferable to identify the application service by performing protocol mapping.

Subsequently, different weights are applied to the application services primarily identified through the signature mapping or the protocol mapping to identify the application service having the largest weight as the final application service for the group (S700). .

In this case, it is preferable that the application service primarily identified through the signature mapping applies a greater weight than the application service primarily identified through the protocol mapping.

For example, if the group configured as shown in FIG. 1 is identified as two application services, that is, eDonkey (5) and Http (3) through the step S600, the application services recognized by the signature mapping and protocol mapping methods are different. Calculate by applying weights.

That is, since the signature mapping method has a considerably higher accuracy than the protocol mapping method, an application service primarily identified through the signature mapping method is applied to a weight greater than the application service primarily identified through the protocol mapping method. Calculate

For example, when the weight is 10 for an application service identified first through the signature mapping method and the weight is 1 for an application service primarily identified through the protocol mapping method, the weight of the eDonkey is 5 × 1 = 5, and the weight of the Http is calculated as 3 × 10 = 30. Therefore, the final application service of the group configured as shown in FIG. 1 is identified by HTTP.

Although a preferred embodiment of the method for identifying an application service in a broadband integrated network according to the present invention has been described above, the present invention is not limited thereto, and the scope of the claims and the detailed description of the invention and the accompanying drawings are various. It is possible to carry out the transformation to this also belongs to the present invention.

According to the method for identifying an application service in the broadband converged network of the present invention as described above, a common source or destination IP address and port are obtained by obtaining source and destination IP address and port information about packets collected for performance improvement. Packets with information form a group, sample packets belonging to this group by a preset number, and identify primary application services by signature or protocol mapping using payload data of the sampled packets, and then identify them. By applying different weights to each application service, each application service is identified as the final application service for the group, so that the application service in the broadband integrated network (BcN) can be identified more accurately and quickly. It can be used for design, failure analysis, application service meteorological map, etc. There is an advantage that can manage hapmang efficiently.

Claims (4)

(a) after collecting the transmitted packets, obtaining source and destination IP address and port information for each of the collected packets to form a group of packets having common source or destination IP address and port information; ; (b) after sampling a predetermined number of packets having the same source or destination IP address and port information for each configured group, obtaining payload data of the sampled packets, and using the signature or protocol Identifying the primary application service by mapping; And (c) applying different weights to the application services identified primarily through the signature or protocol mapping to identify the application service having the largest value as the final application service for the group; Application service identification method in network. The method of claim 1, wherein in step (b), the payload data of the sampled packets is measured after measuring the unit of the sampled packets, and storing 16 to 32 bytes of data of each measured packet. Application service identification method in a broadband integrated network, characterized in that the capture by obtaining. The method of claim 1, wherein in step (b), after performing signature mapping using the payload data of the obtained packets, if an application service is not identified, protocol mapping is performed to identify the application service. Application service identification method in a broadband integrated network, characterized in that. 2. The broadband convergence network of claim 1, wherein in step (c), an application service identified primarily through the signature mapping applies a greater weight than an application service identified primarily through the protocol mapping. Application Service Identification in.

Images