KR101230001B1 - Apparatus for detecting the servers of file sharing solution provider based on flow information analysis and method thereof - Google Patents

Abstract

Disclosed are a flow analysis based file sharing operator server detection apparatus and a method thereof. The apparatus for detecting a file sharing service provider server according to an embodiment of the present invention transmits a file sharing service request message to at least one preset detection target service provider when the server detection instruction command is received, and receives a file sharing service response message thereto. At least one detection for generating flow information by capturing the message data transmitted and received, and generating and transmitting flow analysis-based server detection analysis information including file sharing server information based on the generated flow information Measuring unit; And a central controller configured to generate the server detection instruction command and transmit the command to the detection measurement unit, receive the server detection analysis information from the detection measurement unit, and detect a file sharing service provider server based on the received server detection analysis information. By including the above, it is possible to technically detect the index sharing server and the file sharing content server of the file sharing service provider generating a large amount of upstream traffic using the home access line.

Description

Flow analysis based file sharing service server detection device and its method {APPARATUS FOR DETECTING THE SERVERS OF FILE SHARING SOLUTION PROVIDER BASED ON FLOW INFORMATION ANALYSIS AND METHOD THEREOF}

The present invention relates to detecting a file sharing service provider server. More specifically, the present invention relates to an index server and a file sharing content server of a file sharing service provider, in which a file sharing service operator generates a large amount of upstream traffic using a home access line of a network service provider network. The present invention relates to a server analysis apparatus for detecting a flow file based on a file sharing operator that can be detected technically using an analysis technique, and a method thereof.

Due to the indiscriminate inflow of packets due to the recent increase in peer-to-peer (P2P) users, the threat to network bandwidth is increasing day by day. This is a natural result of the limitations of IP technology, in which packets generated by a user are designed to make the best use of available resources without special control. A small number of P2P users take up a large portion of the total traffic. The situation led to discomfort. In other words, it is causing unsatisfactory problems such as deterioration of normal service quality due to uncontrollable resource management such as P2P traffic and increase of investment cost for network construction.

In addition, as the distributed computing environment expands and various network-based applications are developed, network traffic is on the rise, and figuring out which type of traffic is originating from which host is very effective in utilizing limited network resources. It became important. However, current network management systems only provide simple planar information such as providing statistics according to traffic monitoring, and are insufficient to analyze the network and prepare countermeasures accordingly.

In particular, as the P2P technology is extended to the content delivery area, P2P-based Content Delivery Network (CDN) solutions have been released and are rapidly expanding. Some file-sharing operators lease their content delivery servers by leasing individual customer subscriber networks, not corporate customer subscriber networks, and using the virtualization-based P2P CDN technology to provide content delivery infrastructure. By doing so, it provides a virtual distributed IDC business.

Recently, as content providers (CPs) operators that use the P2P CDN-based solution to increase their content delivery infrastructure have increased, the network operators have been threatened with the overall network stability and delayed recovery of the network investment. Impacts are a trend that is occurring.

Therefore, in the case of a network operator, when a file sharing provider leases and distributes its content delivery server by using the network provider's personal customer subscriber network, and utilizes the content server as a content delivery infrastructure using a virtualization-based P2P CDN technology, It is practically necessary to secure a function for detecting the corresponding content servers.

Conventional techniques for detecting and controlling P2P traffic include deep packet inspection (DPI) techniques, which detect and detect well-known port numbers and signatures of packet payloads used by P2P clients, and control the detected packets. The method is adopted.

However, DPI technology has three disadvantages.

First, the processing overhead is too large because the payload of every packet to be transmitted must be checked.

Second, if the payload is an encrypted packet, there is no way to detect encryption, so there is no way to detect P2P traffic.

Third, there is a legal problem because it can invade the privacy of network users due to the inspection of packet payload.

In order to collect traffic for analysis that can detect a P2P CDN server group, a multi-cooperative platform technology must be devised to control the downloading of related traffic by simultaneously downloading the same content from a plurality of spatially distributed systems. In order to collect efficient analysis traffic on the platform, real-time flow processing that can convert packets constituting traffic in real time into flow-based traffic information should be applicable.

In order to cope with the dynamically changing P2P CDN server group, a technology implementation for detecting P2P CDN server groups must be implemented on the collected traffic, and based on this, periodic P2P CDN server group detection must be accompanied. To improve their capabilities, an environment in which these tasks can be automatically repeated must be implemented on the platform.

In order to efficiently detect and respond to P2P CDN server groups, it is necessary to secure a consistent integrated device function that can continuously support P2P CDN service provider's content selection, traffic collection and analysis automation, and P2P CDN server information cleaning. Is required.

An object according to an embodiment of the present invention, which was created to solve the above problems, is that a file sharing service, such as a P2P-based CDN service provider, uses a home access line of a network operator network to cause a large amount of uplink traffic. In the process of providing a service, an apparatus for detecting a flow sharing-based file sharing provider server capable of technically detecting an index server and a file sharing content server generating a large amount of upstream traffic by using a flow analysis technique and the same To provide a way.

In addition, another object according to an embodiment of the present invention is to secure the overall network stability by detecting the index server and file sharing content server of the file sharing service provider leasing the personal customer subscriber network generating a large amount of upstream traffic, In addition, the present invention provides a flow analysis-based file sharing service provider server detecting apparatus and method for quickly recovering network investment cost.

In order to achieve the above object, the apparatus for detecting a file sharing service provider server according to an aspect of the present invention transmits a file sharing service request message to at least one or more detection target service providers preset when a server detection instruction command is received. Receives a response message, captures the message data transmitted and received to generate flow information, and generates and sends flow analysis based server detection analysis information including file sharing server information based on the generated flow information At least one detection measuring unit; And a central controller configured to generate the server detection instruction command and transmit the command to the detection measurement unit, receive the server detection analysis information from the detection measurement unit, and detect a file sharing service provider server based on the received server detection analysis information. It is characterized by including.

Preferably, the central control unit calculates the number of detection frequency for each file sharing server of the detection target operator based on the server detection analysis information, and if the number of detection frequency is greater than a preset threshold, the file sharing server for the file sharing server. Can be determined by the server.

Preferably, the central control unit may collect the server detection analysis information, and provide statistical information including the detection frequency or traffic information of each file sharing server of the detection target operator based on the collected server detection analysis information. .

Preferably, the central control unit may automatically generate the server detection instruction command in a predetermined period unit or at a predetermined time and transmit the generated command to the detection measurement unit.

Preferably, the central control unit provides an automatic function providing unit for automatically generating the server detection instruction command and transmits it to the detection measurement unit; A report information processing unit which collects the server detection analysis information from the detection measuring unit and processes the server detection analysis information into a predetermined format; A statistical information processing unit for providing statistical information including detection frequency or traffic information of each file-sharing server of the detection target operator for each period based on the information processed by the report information processing unit; And an operator server determination unit determining whether a file sharing operator server is based on the information processed by the report information processor.

Preferably, when the server detection instruction command is received, the detection measuring unit transmits a file sharing service request message to the detection target operator to receive a file sharing service response message, and generates the server detection analysis information to generate the server detection analysis information. A detection function performing unit for transmitting to the terminal; And a flow information measuring unit for capturing the message data, extracting header information of the data to generate the flow information table, and providing the generated flow information table to the detection function performing unit when the server detection instruction command is received. It may include.

Preferably, the flow information may include flow start time / end time, source IP / Destination IP, source port / destination port, protocol number, flow total amount, total number of packets, flow average rate, flow duration, average packet size. Can be.

According to an aspect of the present invention, a method of detecting a file sharing service provider server may include: receiving a file sharing service response message by transmitting a file sharing service request message to at least one preset detection target service provider when a server detection instruction command is received; Generating flow information by capturing the message data transmitted and received; Generating flow analysis based server detection analysis information including file sharing server information based on the generated flow information; And detecting a file sharing service provider server based on the generated server detection analysis information.

Preferably, the detecting may include calculating a frequency of detection for each file sharing server of the detection target operator based on the server detection analysis information; And determining the corresponding file sharing server as a file sharing operator server when the number of detection frequencies is greater than a preset threshold.

According to the present invention, when a file sharing service using a P2P-based CDN technology provides a file sharing service that causes a large amount of upstream traffic using a home access line of a network operator network, a file sharing that generates a large amount of upstream traffic As it can detect the index server and file sharing content server of the operator technically, it provides the stable operation method of the home access line due to the explosion of P2P CDN file sharing traffic, secures the technology to cope with the overall network stability threat, and invests in the network operator network. It can provide countermeasures for delays and impacts of cost recovery.

1 is a block diagram of a flow analysis-based file sharing operator server detection environment network to which the present invention is applied.
2 shows a detailed configuration of the apparatus for detecting a file sharing service provider server according to the present invention.
3 illustrates a detailed configuration of the flow information measuring unit illustrated in FIG. 2.
4 illustrates an example of a flow information table.
5 illustrates a detailed configuration of the detection function performing unit shown in FIG. 2.
6 is an exemplary diagram for describing a detailed operation of the central controller shown in FIG. 2.
7 is a flowchart illustrating a method of detecting a file sharing service provider server according to an exemplary embodiment of the present invention.

Other objects and features of the present invention will become apparent from the following description of embodiments with reference to the accompanying drawings.

The terminology used herein is for the purpose of describing particular example embodiments only and is not intended to be limiting of the present invention. Singular expressions include plural expressions unless the context clearly indicates otherwise. In this application, the terms "comprise" or "have" are intended to indicate that there is a feature, number, step, operation, component, part, or combination thereof described in the specification, and one or more other features. It is to be understood that the present invention does not exclude the possibility of the presence or the addition of numbers, steps, operations, components, components, or a combination thereof.

Unless defined otherwise, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the relevant art and are to be interpreted in an ideal or overly formal sense unless explicitly defined in the present application Do not.

Preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description of the present invention, a detailed description of known functions and configurations incorporated herein will be omitted when it may make the subject matter of the present invention rather unclear.

Hereinafter, a flow analysis based file sharing service provider server detecting apparatus and method thereof according to an embodiment of the present invention will be described in detail with reference to FIGS. 1 to 7.

1 is a block diagram of a flow analysis based file sharing operator server detection environment network to which the present invention is applied, and illustrates only the main functional configuration for explaining the present invention.

Referring to FIG. 1, the apparatus for detecting a file sharing operator server includes a central control unit 100 and a plurality of detection measuring units (first to Nth detection measuring units) 200.

The central controller 100 transmits a server detection instruction command for remote detection instruction to a plurality of detection measurement units 2100 distributed and accommodated in each local node of the Internet, and analyzes the flow received from the plurality of detection measurement units 200. Detects the file sharing provider server based on the server detection analysis information based on the detection.

Of course, the central control unit 100 issues a server detection instruction command for a predetermined number of times, for example, 10 times, 20 times, or 100 times for a predetermined period, for example, a server collected for a predetermined number of times. The file sharing service provider server may be detected based on the detection analysis information. The period and the number of times for collecting the server detection analysis information may be determined by the network service provider.

Here, the server detection command command may mean only a start command command for starting server detection, but may also include an end command command for terminating server detection. When the central control unit 100 transmits an end command command, the start command is started. It is preferable that a predetermined time elapses after delivering the instruction command, and the predetermined time can be determined by the network operator, and the predetermined time can be changed according to the situation.

Of course, the detection end may be determined by the detection measuring unit 200, which will be described with reference to FIGS. 3 and 5.

The detection measuring unit 200 receives a server detection instruction command of the central control unit 100 and detects an index server and a file sharing content server of a file sharing operator based on the flow analysis, and is a file sharing, which is a message used for an actual service. The service request message is generated and transmitted to the detection target operators (first to Lth detection target operators) 300 to be detected, and the file sharing service response message is received from the detection target operators 3100.

Here, the detection target provider 300 may include at least one index server and a plurality of content servers (first to Mth content servers).

In addition, the detection measuring unit 200 captures data generated during a message transmission and reception with the detection target operator, extracts header information of the message data to form a flow information table, and then uses the flow analysis based server detection analysis using the same. Generates information and delivers it to the central controller 200.

Here, each of the plurality of detection measuring units 200 has a detection target carrier list as a detection target carrier list, but it is preferable that the list of detection target companies included in each of the plurality of detection measurement unit 200 is the same. It may be different as needed. Of course, even if the detection target operators list is different, the plurality of detection measuring units 200 are set to a plurality of groups, and the detection measuring units included in the group have the same detection target operators list, but the different detection target companies list is different between the groups. It is preferable to set to have.

In addition, the detection target operator 300 may include all the operators or users who use the corporate customer subscriber network, the operators or users who use the individual customer subscriber network, or the operators or users who use the individual customer subscriber network according to the situation. It may include only, which may be determined by the network operators applying the present invention, it is preferable to set only the operator or the user using the personal customer subscriber network as the detection target operator.

FIG. 2 shows a detailed configuration of the apparatus for detecting a file sharing service provider server according to the present invention, and briefly illustrates only a process with a first detection measuring unit among a plurality of detection measuring units (first to Nth detection measuring units). In the plurality of detection measuring units (first to Nth detection measuring units), the same process is performed.

Referring to FIG. 2, the central control unit 100 includes an automation function providing unit 110, a report information processing unit 120, an operator server determining unit 130, and a statistical information providing unit 140, and a detection measuring unit. 200 includes a detection function performing unit 210 and a flow information measuring unit 220. The detailed configuration and operation of the flow information measuring unit 220, the detailed configuration and operation of the detecting function performing unit 210, and the center thereof are shown in FIG. Detailed functions of the components constituting the controller 100 will be described in detail with reference to FIGS. 3, 4, and 6.

In the present invention, the message flow of the file sharing service provider server detection process will be briefly described with reference to FIG. 2. Transfer to the detection measuring unit 200.

The detection function performing unit 210 of the first detection measuring unit 200 selects one detection target operator from a pre-stored detection target carrier list, selects the first detection target operator 300, and performs the actual file sharing service. A content search request message identical to the request message is generated, and the generated content search request message is transmitted to the index server 310 of the first detection target operator to query the content search.

The detection function performing unit 210 receives a content search response message including content server information from the index server 310 of the first detection target operator, generates a content download request message, and generates corresponding content of the first detection target operator. Server Here, the content download response message is received from the first content server 320 by transmitting to the first content server 320.

Of course, the detection function performing unit 210 sequentially performs the above-described message generation, transmission, and reception of the response message for all the detection target operators in the pre-stored detection target operator list.

The flow information measuring unit 220 captures various messages transmitted and received between the detection function performing unit 210 and the detection target operator, generates a flow information table for analyzing flow information, and detects the corresponding flow information. To send).

The detection function performing unit 210 analyzes flow information generated by the flow information measuring unit 220 to perform flow analysis-based server detection analysis information including index server information and file sharing content server information of a detection target operator. The report information processing unit 110 of the central control unit 100 transmits the data.

The report information processing unit 110 processes the server detection analysis information received from the detection measuring unit 200 in a predetermined format, and provides the report information processing unit to the operator server determining unit 130 and the statistical information providing unit 140, thereby providing the operator server determining unit. The file sharing service provider server may be detected based on the processed information at 130, and the statistical information generated based on the processed information at the statistical information providing unit 140 may be provided through a user interface.

3 illustrates a detailed configuration of the flow information measuring unit illustrated in FIG. 2.

Referring to FIG. 3, the flow information measuring unit 220 includes a remote control interworking unit 221, a packet capturing unit 223, a PCAP file converter 227, a PCAP file storage unit 228, and a header information extractor ( 224, a flow information table generating unit 225, a flow information data management unit 226, and a flow information sending unit 229.

The remote control interworking unit 221 receives a server detection instruction command (detection instruction) transmitted from the central controller 100 through the network connection unit 222 to generate a flow information command, for example, a packet capture start command packet. The data is transferred to the capture unit 223, the header information extractor 224, the flow information table generator 225, and the flow information data manager 226.

The packet capture unit 223 captures message data transmitted and received between the detection measurement unit and the target detection business through a command of the central control unit transmitted through the remote control interworking unit 221, and the captured message data is captured by a packet capture (PCAP). The file converting unit 227 converts the file into a PCAP file, and the converted PCAP files are stored in the PCAP file storage unit 228.

Here, the packet capture unit 223 captures the message data until the time point at which the end command for terminating the packet capture is received. The end command may be transmitted from the central control unit 100, but is detected by the detection function performing unit 210. It may be delivered.

For example, if a detection start instruction command is received from the central control unit 100 and a termination instruction command is received after a predetermined time has elapsed, the packet capturing may be terminated. After the start, when the end command is received from the detection function performing unit 210, the packet capturing may be terminated. It is preferable that the service providers receive all of the selected and the response message for the content download request from the last selected detection target service provider. Of course, the detection function performing unit 210 should be provided with a function for delivering the end command to the flow information measuring unit 220 after selecting all detection target operators.

The header information extractor 224 extracts header information of the message data captured by the packet capture unit 223.

The flow information table generator 225 generates a flow information table based on the header information extracted by the header information extractor 224. The flow information table generated at this time is a flow start time as shown in FIG. It may include / end time, Source IP / Destination IP, Source Port / Destination Port, protocol number, flow total amount, total packet count, flow average rate, flow duration, average packet size.

The flow information data managing unit 226 stores the generated flow information, that is, the flow information table, and the flow information transmitting unit 229 transfers the flow information stored in the flow information data managing unit 226 to the detection function performing unit 210. do.

Here, the flow information data manager 226 may provide the flow information stored at the request of the central controller 100 to the central controller 100.

The flow information measuring unit having such a configuration is performed on all messages transmitted and received to and from the detection target operators sequentially selected by the detection function execution unit, so as to perform flow detection functions for all detection target operators included in the detection target carrier list. It is obvious that the flow information is not generated in the case of the detection target service provider which does not transmit or receive a message among the detection service providers.

5 illustrates a detailed configuration of the detection function performing unit shown in FIG. 2.

Referring to FIG. 5, the detection function performing unit 210 may include a remote control linkage unit 211, a detection target operator selection unit 213, a content search request message generator 214, and a content download request message generator 215. , A flow information processing unit 216, a server detection unit 217, an analysis information data management unit 218, and an analysis report information sending unit 219.

The remote control interworking unit 211 receives the server detection instruction command (detection instruction) sent from the central control unit 100 through the network connection unit 212 to detect the operator selection unit 213 and the flow information processing unit 216. To pass.

The detection target company selection unit 213 selects one detection target company from a pre-stored detection target company list.

Here, the detection target operator selection unit 213 may select a detection target operator according to a preset priority in the detection target operator list, randomly select a detection target operator, or select sequentially in the order listed. For example, a method of selecting a detection target operator may be variously applied.

The content retrieval request message generator 214 generates a content retrieval request message for requesting a content retrieval to the selected detection target operator and transmits the content search request message to the index server of the selected detection target operator.

When the response message according to the content search request is received from the index server of the selected detection target operator, the content download request message generator 215 generates a content download request message requesting the content download and includes the response target provider of the detection target operator included in the response message. By delivering to the content server, a response message to the content download request is received from the content server.

When the detection target provider selection unit 213 receives a response message for the content download request from the selected detection target carrier's content server, the detection target provider selection unit 213 selects the next detection target carrier from the detection target carrier list. Repeat until all providers involved are selected.

In addition, the detection target provider selection unit 213 may transfer all capture instructions to the flow information measuring unit 220 when all operators included in the detection target carrier list are selected and a response message for the content download request is received. In this case, the function in the detection function performing unit 210 may also be terminated.

The flow information processing unit 216 processes the flow information table received from the flow information measuring unit 220, that is, the flow information in a predetermined format.

Here, the flow information processing unit 216 may process the flow information in various ways, but is preferably processed to easily generate the server detection analysis information.

The server detector 217 extracts the index server information and the file sharing content server information from the flow information processed by the flow information processing unit 216, and analyzes the server detection including the extracted index server information and the file sharing content server information. Generate information.

The analysis information data management unit 218 stores the server detection analysis information generated by the server detection unit 217, and the analysis report information transmitting unit 219 stores the server detection analysis information stored in the analysis information data management unit 218, that is, the analysis. The report information is sent to the central control unit 100.

Here, the analysis information data management unit 218 may provide the server detection analysis information stored at the request of the central control unit 100 to the central control unit 100.

6 is an exemplary diagram for describing a detailed operation of the central controller shown in FIG. 2.

As shown in FIG. 6, the central control unit 100 includes an automation function providing unit 110, a report information processing unit 120, a operator server determining unit 130, and a statistical information providing unit 140.

The automation function providing unit 110 generates a server detection instruction command for detecting a file sharing service provider server and transmits the generated command to the plurality of detection measuring units 200.

In this case, the automation function providing unit 110 may automatically generate a server detection instruction command in a predetermined cycle unit or a predetermined time and deliver it to the detection measurement unit 200. The predetermined cycle or the predetermined time may be determined by an operator. When the operator server detection is set to repeat a predetermined number of times for a predetermined period, a predetermined period or time may be determined based on the set information.

Of course, the automation function providing unit 110 may generate not only a server detection start command but also a server detection end command and transmit the generated server detection end command to the detection measurement unit 200. It is desirable to allow delivery after this time.

The report information processing unit 120 collects server detection analysis information transmitted from the plurality of detection measuring units 200 distributed in each local node, processes the information into a predetermined format, and processes the processed information into the operator server determination unit 130. And statistical information processing unit 140.

The operator server determining unit 130 determines whether the file sharing operator is based on the information processed by the report information processing unit 120, and calculates the frequency of detection for each file sharing server of the detection target operators based on the processed information. If the number of detection frequencies is greater than the threshold N [%], which is a preset reference value, the corresponding file sharing server is determined to be a file sharing provider server, and if not, the corresponding file sharing server is determined as a personal computer.

Here, the file sharing server may include an index server and a file sharing content server.

The statistical information processing unit 140 may provide statistical information for a certain period of time based on the information processed by the report information processing unit 120, for example, daily analysis information, weekly analysis information, monthly analysis information, and the like. UI).

Here, the statistical information provided by the statistical information processing unit 140 may include detection frequency or traffic information for each file sharing server of the detection target operators, but is not limited thereto.

That is, the statistical information processing unit 140 collects detection frequency or traffic information for each file sharing server of the target operators based on the server detection analysis information of the file sharing servers which are collected a certain number of times or collected in real time for a certain period of time. Can be provided as

As described above, the apparatus for detecting a file sharing provider server according to an exemplary embodiment of the present invention captures a packet transmitted and received with a file sharing server of a predetermined detection target operator by remotely controlling a detection measuring unit distributed in each local node, An index server of a file sharing service provider generating a flow information using header information and detecting a file sharing service provider server using server detection analysis information based on flow analysis based on the generated flow information, thereby generating a large amount of upstream traffic; It can detect file sharing content server technically, and provide stable operation plan of home access line due to explosion of P2P CDN file sharing traffic, secure technology to cope with overall network stability threat, and recover network investment network investment cost. Provide a response to delays and impacts. Can be.

7 is a flowchart illustrating a method of detecting a file sharing service provider server according to an exemplary embodiment of the present invention.

Referring to FIG. 7, in the method of detecting a file sharing service provider server, when a server detection instruction command for starting to detect a file sharing service provider server of a detection target service provider is received, that is, a detection measurement unit distributed to each local node shown in FIG. 1. Receives a server detection instruction command transmitted from the central control unit, selects one detection target provider from a preset detection target provider list, sends a file sharing service request message to the selected detection target carrier, and receives a response message. (S710 to S720).

Here, the file sharing service request message sent to the detection target operator may be a content search request message and a content download request message, and the file sharing service response message received from the detection target operator may be a content search response message and a content download response message. have.

The message data generated in the transmission and reception process of step S720 is captured, and header information of the captured message data is extracted (S725 and S730).

Flow start time / end time, source IP / Destination IP, source port / destination port, protocol number, flow total amount, total number of packets, flow average rate, flow duration, average packet size using extracted header information Generate flow information table (flow information), generate server detection analysis information including index server information and file sharing content server information using the generated flow information table, and save the generated server detection analysis information Means for detecting the shared operator server, that is, provided to the central control unit of FIG. 1 (S735 and S740).

It is determined whether there is a detection target operator to select from the preset detection target provider list, and if there is a detection target operator to select, the next detection target operator is selected and the above steps S720 to S740 are performed again. Repeatedly performed for all the included detection target operators (S745, S750).

The server detection analysis information of the file sharing servers provided by the above steps is collected to calculate the number of detection frequencies for each file sharing server of the detection target operator (S755 and S760).

Here, the collected server detection analysis information includes all server detection analysis information provided by all detection measuring units distributed in each local node, and processes the server detection analysis information into a predetermined format, thereby allowing the file sharing server of the detection target operator The number of detection frequencies can be calculated for each star.

Of course, the server detection analysis information may be collected in real time until there is a server detection end command. This operation may be set differently according to the situation.

When the number of detection frequencies is calculated for each file sharing server, the calculated detection frequency is compared with a preset threshold. If the detection frequency is greater than the threshold, the file sharing server is determined as a file sharing provider server. Judging by the PC (S765 to S775).

That is, the file sharing provider server generating a large amount of upstream traffic can be detected by using the home access line of the network operator network by comparing the detection frequency and the threshold value.

In addition, the method of detecting the file sharing service provider server of the present invention may provide statistical information including the frequency of detection for each file sharing server and the traffic information for each predetermined period in addition to the function of detecting the file sharing service provider server.

Of course, the statistical information may also process the server detection analysis information in a predetermined format, and provide statistical information based on the processed information.

The flow analysis-based file sharing service provider server detection apparatus and method thereof according to the present invention can be modified and applied in various forms within the scope of the technical idea of the present invention, and are not limited to the above embodiments. In addition, the embodiments and drawings are merely for the purpose of describing the contents of the invention in detail, not intended to limit the scope of the technical idea of the invention, the present invention described above is common knowledge in the technical field to which the present invention belongs As those skilled in the art can have various substitutions, modifications, and changes without departing from the spirit of the present invention, it is not limited to the embodiments and the accompanying drawings. And should be judged to include equality.

100: central control unit
200: detection measurement unit
110: automation function provider
120: Report information processing unit
130: operator server determination unit
140: statistical information processing unit
210: detection function execution unit
220: flow information measuring unit

Claims (14)

When a server detection instruction command is received, a file sharing service request message is sent to at least one preset detection target operator to receive a file sharing service response message, and the flow rate is generated by capturing the transmitted and received message data. At least one detection measuring unit configured to generate and transmit flow analysis-based server detection analysis information including file sharing server information based on the generated flow information; And
A central control unit generating the server detection instruction command and transmitting the command to the detection measurement unit, receiving the server detection analysis information from the detection measurement unit, and detecting a file sharing service provider server based on the received server detection analysis information;
File sharing service provider server detection apparatus comprising a. The method of claim 1,
The central control unit
The number of detection frequencies for each file sharing server of the detection target operator is calculated based on the server detection analysis information. When the number of detection frequencies is greater than a preset threshold, the corresponding file sharing server is determined as a file sharing operator server. File sharing service provider server detection device. The method according to claim 1 or 2,
The central control unit
Collecting the server detection analysis information, and based on the collected server detection analysis information, the file sharing provider server detection, characterized in that providing statistical information including the detection frequency or traffic information for each file sharing server of the detection target operator Device. The method according to claim 1 or 2,
The central control unit
The apparatus of claim 1, wherein the server detection instruction command is automatically generated in a predetermined period unit or at a predetermined time and transmitted to the detection measuring unit. The method according to claim 1 or 2,
The central control unit
An automation function provider for automatically generating the server detection instruction command and transmitting the generated command to the detection measurement unit;
A report information processing unit which collects the server detection analysis information from the detection measuring unit and processes the server detection analysis information into a predetermined format;
A statistical information processing unit for providing statistical information including detection frequency or traffic information of each file-sharing server of the detection target operator for each period based on the information processed by the report information processing unit; And
An operator server determination unit that determines whether a file sharing operator server is based on the information processed by the report information processor.
File sharing service provider server detection apparatus comprising a. The method according to claim 1 or 2,
The detection measuring unit
When the server detection instruction command is received, a detection function performing unit for transmitting a file sharing service request message to the detection target operator to receive a file sharing service response message, and generating and transmitting the server detection analysis information to the central control unit. ; And
A flow information measuring unit configured to capture the message data, extract the header information of the data, generate the flow information table, and provide the generated flow information table to the detection function performing unit when the server detection instruction command is received;
File sharing service provider server detection apparatus comprising a. The method according to claim 6,
The detection function performing unit
When the server detection instruction command is received, a content search request message is transmitted to the detection target operator; when a response message is received, a content download request message is transmitted and a response message is received, and the flow information measurement unit receives the response message. And receiving the information table, extracting index server information and file sharing content server information from the flow information table to generate the server detection analysis information based on the flow analysis. The method according to claim 1 or 2,
The detection measuring unit
When there are a plurality of detection target providers, one of the detection target providers is selected to transmit the file sharing service request message and receive the file sharing service response message, and the server detection analysis information about the selected detection target providers is stored in the central location. Transmitting to the control unit, and performing this process sequentially for each of the plurality of detection target providers. The method according to claim 1 or 2,
The flow information is
File sharing service provider including flow start time / end time, Source IP / Destination IP, Source Port / Destination Port, protocol number, flow total amount, total packet count, flow average speed, flow duration, average packet size Server detection device. The method according to claim 1 or 2,
Each of the at least one detection measuring unit
File sharing operator server detection device, characterized in that distributed to each local node. Receiving a file sharing service response message by transmitting a file sharing service request message to at least one preset detection target operator when a server detection instruction command is received;
Generating flow information by capturing the message data transmitted and received;
Generating flow analysis based server detection analysis information including file sharing server information based on the generated flow information; And
Detecting a file sharing service provider server based on the generated server detection analysis information;
File sharing service provider server detection method comprising a. The method of claim 11,
The detecting step
Calculating a frequency of detection for each file sharing server of the detection target operator based on the server detection analysis information; And
Determining the corresponding file sharing server as a file sharing operator server when the number of detection frequencies is greater than a preset threshold.
File sharing service provider server detection method comprising a. The method of claim 11,
The detecting step
Collecting the generated server detection analysis information;
Processing the collected server detection analysis information into a predetermined format;
Providing statistical information including detection frequency or traffic information of each file-sharing server of the detection target operator for each period based on the processed information; And
Detecting a file sharing service provider server among the file sharing servers based on the processed information;
File sharing service provider server detection method comprising a. 13. The method according to claim 11 or 12,
Generating the flow information
And extracting the message data header information and generating the flow information using the extracted header information.

Images