KR100785446B1 - Policy control method of network system and network policy control system - Google Patents

Abstract

A policy control method of a network system and a network policy control system are provided to minimize driving of an unnecessary application program and excessive traffic generated from a client, and to leave history on network information, a process, and an application program driven by the client in a server, thereby easily finding a cause of problem in the network system. A client(10) has a monitoring program for monitoring driving information on a network usage rate, an application program, and a process driven by the client(10). The driving information is provided to a policy control server(100). The policy control server(100) limits driving of a target which does not satisfy preset driving standards among the process, the application program, and the network usage rate.

Description

Policy control method of network system, and network policy control system {Policy control method of network system and network policy control system}

1 is a view conceptually illustrating a policy control method of a network system according to an embodiment of the present invention;

2 is a block diagram of a network policy control system to which the network policy control method described with reference to FIG. 1 is applied;

3 is a diagram illustrating an example of a history file provided in an operating system;

4 is a view conceptually illustrating a policy control method of a network system according to another embodiment of the present invention; and

FIG. 5 is a block diagram of a network policy control system to which the policy control method described with reference to FIG. 4 is applied.

* Description of the symbols for the main parts of the drawings *

10: client 10a, 11: network manager

10b, 12: process manager 10c, 13: application manager

10d, 14: File Manager 10e: Interface Module

15, 120: policy judgment module 100: policy control server

110: acquisition module 130: database

131: policy information storage unit 132: reference information storage unit

The present invention relates to a policy control method and a network policy control system of a network system, and more particularly, to detect traffic caused by malicious codes or viruses, and clients running inappropriate programs, and to execute application programs of the clients and to spread harmful traffic. It relates to a policy control method and a policy control system of a network system to prevent.

As the network is deeply involved in life and work, many of the company's tasks are being processed through the network, and a large number of documented data and applications are transmitted over the network. Within a company, the network can be used for non-business purposes. For example, if someone downloads or shares mp3 files and video files using P2P or web hard over an in-house network, a specific person using P2P or web hard will consume a significant portion of the network resources, There is a problem that the network resources available to others as the network resources are reduced. Furthermore, when sharing files with an unspecified number using P2P, the file sharer's computer can act as a server for sharing files, which can cause the company's network to be almost paralyzed. In addition, many client terminals (such as computers) that are connected to the corporate network may be infected by viruses, malware, Trojans, and adware that enter the network, and some of the infected client terminals may be infected by viruses, Trojans, and It can be manipulated by adware and cause unnecessary network traffic. If an infected client terminal infects a neighboring client terminal connected to a company network in a secondary manner, it causes a company paralysis.

On the other hand, when an individual in a company runs and uses a non-working application, problems such as disruption of the work schedule of the individual and reduced work concentration occur. This type of work is difficult to clarify what causes the problem unless it is perceived by others and constantly observed.

Accordingly, an object of the present invention is to obtain driving information on an application program, a process, and a network utilization rate, which are operated in a client terminal connected to a network, and apply the same to a preset control policy for controlling each client to access the network of the client. And a policy control method and system for a network system that controls the running of an application program (or process). In addition, another object of the present invention is to DB the driving information such as the application, the process, and the network utilization rate of the client by the time running on the client to determine the usage of the client through this, as well as the problem of the client causing problems An object of the present invention is to provide a policy control method and system for a network system to identify a cause of occurrence.

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

delete

The present invention will be described in detail with reference to the drawings.

1 conceptually illustrates a policy control method of a network system according to an embodiment of the present invention.

In the illustrated embodiment, the information about the network utilization rate of the client 10, the process running on the client 10, the application program running on the client 10, and the network utilization rate of the client 10 (hereinafter, A monitoring program for collecting the driving information and providing the same to the policy control server 100 is provided in the client 10, and the policy control server 100 sets the driving information provided from the client 10 in advance to the driving reference. It is determined whether the client 10 violates the driving criteria in comparison with. The driving criteria provided in the policy control server 100 may include a network limit utilization rate of the client 10 connected to the network, a limit utilization rate of a processor of an application installed in the client 10, and the client 10. Refers to the standard of processor limit utilization of running process.

As one example, the driving criteria may apply as described below.

1) Processor utilization should be less than 98%.

2) The network utilization rate is less than 0.5%.

In addition, the driving criteria may be for an application and a process in which driving is limited at the client.

If the processor utilization of an application or process reaches 98%, it is very likely that it is caused by viruses and malware. In addition, if network utilization continues to increase by more than 0.5%, or more, this is also very likely to be caused by malware or viruses. The monitoring program notifies the policy control server 100 when the driving state of the client exceeds the driving criteria, and the policy control server 100 monitors the network connection of the client when the client continuously violates the driving criteria for a predetermined time. You can block or control the monitoring program to terminate the application (or process) that causes excessive processor utilization on the client. Here, the policy control server 100 notifies the network management server 200 of the client information causing excessive network traffic to block the network connection of the client 10, the network management server 200 is the network of the client The connection will be blocked. In addition, in the present embodiment, the monitoring program queries the history file in which the Internet connection history of the client 10, the driving history of the driving application, etc. are stored in the operating system installed in the client 10, and the result is displayed on the policy control server 100. You can notify by. The history file includes information on the IP or URL of the client 10 connected to the network, and has a list of files opened by the client 10.

FIG. 2 is a block diagram of a network policy control system to which the network policy control method described with reference to FIG. 1 is applied.

As shown, the monitoring program includes a network manager 10a, a process manager 10b, an application manager 10c, a file manager 10d, and an interface module 10e. In addition, the policy control server 100 includes a collection module 110, a policy determination module 120, and a database 130, and the database 130 includes a policy information storage unit 131 and a driving reference information storage unit. 132.

Process manager 10b monitors the processes that are performed on client 10. In general, a process may be automatically executed by an operating system installed in the client 10, an application program driven by the user, and loaded into a memory in association with the application program regardless of a user's intention to operate the client 10. If a virus or malicious code affects the operating system, malicious processes other than the processes loaded by the operating system and the user are loaded into the memory and consume memory resources or increase network traffic. The process manager 10b obtains a list of processes running in the client 10 and processor utilization (or occupancy) information of each process and provides them to the interface module 10e. The application program manager 10c obtains a list of application programs driven by the user in the client 10 and provides them to the interface module 10e. The network manager 10a monitors the information on the network utilization rate of the client 10 and provides it to the interface module 10e. The network manager 10a obtains port information used by the client 10 for network connection. To provide. In general, the port used by the client 10 for Internet connection is TCP port 80, and when using MSN Messenger, TCP 443 and 1863 ports are used. In case of a file sharing program such as PRUNA, TCP 4662 and UDP are used. 4762 port is used. In other words, the ports used by the respective applications are different, and in the case of widely used applications, almost fixed ports are used. If it is assumed that the user of the client 10 causes excessive traffic using the TCP 4662 UDP 4762 port, the user of the client 10 may determine that the file sharing operation is not related to a task. The file manager 10d inquires the history file of the operating system installed in the client 10 and provides the result to the interface module 10e. In the case of Windows XP among Microsoft's operating systems, a history file as shown in FIG. 3 is provided in the operating system. The illustrated history file shows the user's site access history and the functions performed on the connected site. When the "My Computer" item is selected, the user-driven application program or the data file called by the application program is displayed. A list of (eg HWP, DOC files, etc.) appears. The file manager 10d inquires the history file at regular intervals (e.g., one hour, one day, and the like) or, when an event (e.g., an application program is driven) from the user, inquires the user's driving history and displays the result. It may be provided to the interface module 10e. The interface module 10e stores the driving information collected from the file manager 10d, the network manager 10a, the process manager, and the application manager 10c, and the history file information with the policy control server 100 in a predetermined format. And convert it to the policy control server 100. At this time, the interface module 10e may of course encrypt the driving information (and history file information) and transmit it to the policy control server 100.

The policy control server 100 receives and analyzes driving information and history information from the monitoring program, and determines whether the client 10 complies with appropriate driving criteria according to the analysis result.

The collection module 110 acquires and parses driving information transmitted by the interface module 10e according to a predetermined format with the interface module 10e. The driving information and the history file information parsed by the collection module 110 are provided to the policy determination module 120. The policy determination module 120 includes a driving reference storage unit 132 having driving criteria, and policy information for controlling the client through the monitoring program or the network management server 200 when the driving criteria are violated. The storage unit 131 is provided. Here, the driving reference information storage unit 132 and the policy information storage unit 131 may be implemented in a form included in the database 130.

The policy determination module 120 compares driving information and history file information of the client 10 provided through the monitoring program with driving reference information to determine whether the client 10 violates the driving criteria. If the client 10 violates the driving criteria, the policy determination module 120 finds policy information corresponding to the driving criteria violation items of the client 10 and controls the monitoring program or the network management server 200 to control the client. Restrict (or block) the operation of the application and process of (10) or limit (or block) the network connection of the client 10. In this case, if it is determined that a virus or malicious code has invaded the client 10, the client 10 may be allocated to a virtual LAN (VLAN) area to isolate the entire network. The invasion of viruses and malware can be determined by referring to process information provided by a monitoring program. Viruses or malware can infiltrate the operating system and execute themselves for their own execution. At this time, the process manager 10b detects a process of executing a virus or malicious code and transmits it to the policy control server 100, and the policy control server 100 detects a suspicious process among processes executed in the client 10. If the manager program is controlled, the process (or application program) is stopped. To this end, the reference information storage unit 132 includes information on a process running in the operating system of the client 10 when a virus or malicious code is driven.

4 conceptually illustrates a policy control method of a network system according to another embodiment of the present invention.

Although the illustrated embodiment is similar to that shown in FIG. 1, the manager program further includes a policy determination module for determining a policy, and the policy determination module queries the driving information of the client to determine whether the client 10 violates the driving criteria. Judge and take action. Therefore, in the present embodiment, the policy control server 100 is notified of the driving information collected for the client 10 from the manager program, whether the driving criteria are violated, the violations, and the result of the actions against the violations, and records them in the database. do. Accordingly, the reference information storage unit 132 and the policy information storage unit 131 shown in the embodiment shown in FIG. 1 belong to a monitoring program, and the policy control server 100 controls the network management server 200. Only the function of blocking the network connection of the client 10, and the function of storing the driving information provided from the monitoring program, whether the driving criteria are violated, the violations, and the result of the action and calculates the statistics thereof.

FIG. 5 is a block diagram of a network policy control system to which the policy control method described with reference to FIG. 4 is applied.

The illustrated network policy control system is similar to that shown in FIG. 2 except that the policy decision module is provided in the monitoring program. Therefore, the descriptions of the network manager 11, the process manager 12, the application manager 13, and the file manager 14 described with reference to FIG. 2 shall apply to FIG. 2.

In the drawing, the policy determination module 15 refers to the client 10 with reference to driving information and history information collected by the network manager 11, the process manager 12, the application manager 13, and the file manager 14. ) To determine whether the driving criteria are violated. To this end, the policy determination module 15 includes driving criteria and policy information applied for each driving criteria. When the client 10 violates the driving criteria, the monitoring program takes a corresponding action, and notifies the policy control server 100 of the result along with the driving information.

The policy judging module 15 has the functions described below.

3) The function to force termination of unauthorized application when it is started. At this time, the policy determination module 15 includes a list of application programs whose driving is restricted.

4) Force the termination of the application that violates the driving criteria (for example, when the processor utilization is 98%).

5) Forcefully terminate the process that violates the driving criteria (for example, when the processor utilization is 98%).

6) When the network utilization exceeds the driving criterion, the process causing network traffic and the application are forcibly terminated.

7) If the network utilization rate of the client does not decrease despite the measures of 6), it is notified to the policy control server 100, and the policy control server 100 controls the network management server 200 to control the network of the client. Block access or assign to VLAN areas for isolation.

Accordingly, by minimizing excessive traffic generated from the client 10 and unnecessary application programs, the policy control server maintains a history of applications, processes, and network information driven by the client 10. When a problem occurs in the network system, it is easy to find the cause.

As described above, the present invention obtains driving information about an application program, a process, and a network utilization rate used in a client terminal connected to a network, and applies the same to a preset control policy to control each client. It is possible to control network connections and the running of applications (or processes). In addition, the present invention minimizes excessive traffic generated by the client and unnecessary application programs, as well as leaving a history of application, process, and network information driven by the client in the policy control server. When is occurred, the cause of the occurrence can be easily found.

Claims (19)

delete delete delete delete delete delete delete In the policy control method of a network system comprising a client, a policy control server, and a network management server for controlling a network connection of the client, The client is provided with a monitoring program for monitoring the driving information on the process (process), the application, and the network utilization rate running on the client, Acquiring, by the policy control server, driving information of the client through the monitoring program; Analyzing, by the policy control server, the driving information to determine whether a predetermined driving criterion is violated for the process, the application program, and the network utilization rate; And And notifying, by the policy control server, to the network management server whether the driving criteria are violated. The policy control server restricts the running of the process and the application program of the client according to whether the driving criterion of the client is violated, and controls the network management server when the network utilization rate violates the driving criterion. To limit the client's network access, The network management server isolates the client by allocating the client to a preset VLAN area when the network utilization rate of the client deviates from a preset reference value. The policy control server is to generate and store a driving history for the client based on the driving information. The monitoring program includes a network manager for monitoring the network utilization rate of the client; A process manager for monitoring the process utilization of the client; An application manager for monitoring the application program running on the client; An interface module for transmitting the driving information collected from the network manager, the process manager, and the application program manager to the policy control server; And a file manager for querying a history file including an internet access history of the client and a history of a driving application and providing the result to the policy control server through the interface module. The policy control server includes a collection module for acquiring and parsing the driving information transmitted from the interface module according to a format previously agreed with the interface module; And a policy determination module for receiving the driving information and the history file parsed by the collection module. The policy judging module includes a drive reference storage unit having the drive reference; And a policy information storage unit having policy information for controlling the client through the monitoring program or the network management server when the driving criterion is violated. delete delete delete The method of claim 8, The monitoring program, Further includes an antivirus program, The virus protection program provides a quarantine result of the virus protection program to the policy control server through the interface module. delete In the policy control system of a network system consisting of a client, a policy control server, and a network management server for controlling a network connection of the client, The policy control server may include: a collecting module collecting information on any one of a process performed by the client, an application program, and a network utilization rate of the client; And a driving criterion for a processor utilization rate by any one of the process of the client and the application program, and the network utilization rate. Policy decision module for determining; includes, The policy control server, when the processor utilization rate of the client violates the driving criterion, limits the operation of the process and the application program running on the client, and the network utilization rate of the client is driven. When the standard is violated, the network management server is controlled to limit the client's network access. The client includes a network manager for monitoring the network utilization of the client; A process manager for monitoring the process utilization of the client; An application manager for monitoring the application program running on the client; And a policy determination module that compares the driving information collected by the network manager, the process manager, and the application program manager with the driving criteria to determine whether a violation occurs, and provides the result to the policy control server. And a file manager for querying a history file including an internet access history of the client and a history of a driving application and providing the result to the policy control server through the interface module. When the network utilization rate of the client deviates from a preset reference value, the network management server allocates and isolates the client to a preset virtual LAN (VLAN) area. The policy control server includes: a collection module for acquiring and parsing the driving information transmitted from the interface module according to a format previously agreed with the interface module; And a policy determination module for receiving the driving information and the history file parsed by the collection module. The policy judging module includes a drive reference storage unit having the drive reference; And a policy information storage unit having policy information for controlling the client through the monitoring program or the network management server when the driving criterion is violated. delete delete delete delete delete

Images