KR101886526B1 - Method and system for specifying payload signature for elaborate application traffic classification - Google Patents

Abstract

A sophisticated payload signature generation method and system for application traffic classification is disclosed. A payload signature generation method includes collecting traffic associated with a plurality of applications, extracting a common string for collected traffic, generating a content signature set including a content signature, Generating a packet signature matching a plurality of content signatures of the content signatures included in the set of content signatures with respect to the traffic of the plurality of packet signatures matching the plurality of packet signatures with respect to the flow based on the collected traffic; To generate a flow signature.

Description

[0001] METHOD AND SYSTEM FOR SPECIFIED PAYLOAD SIGNATURE FOR ELABORATE APPLICATION TRAFFIC CLASSIFICATION [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a payload signature generation method and system that is sophisticated in application traffic classification and is a technology for generating or defining payload signatures for managing a network through accurate traffic classification for various applications based on network policies .

Today, with the increasing speed of networks and the widespread use of smart devices capable of connecting to the Internet, the use of Internet-based applications is increasing rapidly. In order to efficiently use limited network resources and provide stable services to users, researches have been made on techniques for accurately classifying various kinds of application level traffic.

Since the traffic of the application that extracts the payload can be analyzed accurately, the payload signature based analysis method among the various methods for classifying the traffic is widely used.

Non-patent document [1] H.-A. Kim and B. Karp , " Autograph: Toward automated, distributed worm signature detection, & quot ; in USENIX Security Symp ., Vol. 286, 2004. [2] B.-C. Park, YJ Won, M.-S. Kim, and JW Hong, "Towards Automated Application Signature Generation for Traffic Identification," IEEE Network Operations and Management Symp . (NOMS 2008), pp. 160-167, 2008. Non-Patent Document [3] C. MU, X.-h. HUANG , X. TIAN , Y. MA, and J.-l. Qi, " Automatic traffic signature extraction based on fixed offset algorithm for traffic classification ", The J. Chinese Universities of Posts and Telecommun., Vol. 18, pp. 79-85, 2011. This paper presents the structure of payload signatures. The structure of the payload signature is based on a common string in the payload, which is the data portion of the packet. Accordingly, there is a high possibility that payload signatures that are not unique to a specific application program and overlap with other application programs are extracted. In this way, when a payload signature corresponding to a specific application analyzes another application (that is, identifies another application), reliability in network management is lowered, and it is difficult to accurately perform network policy, trouble diagnosis, and capacity planning. Particularly, in the field of network security, when a signature of a specific application analyzes another application, malicious traffic is caused to be false positive or false negative, resulting in a great loss.

For example, when a string (GET, Accept, HTTP / 1.1, 201, User-Agent, Content-Type, Referrer, etc.) used as metadata in a specific protocol is extracted as a signature, The same signature can be extracted. In other words, there is a possibility that the HTTP Request and Response commands are extracted as signatures, and in the case of the signature, other applications using HTTP can be identified in addition to the specific application, so there is no value as a signature for identifying the application. In addition, even when a character string having a dictionary meaning such as an album (Album), an image (Image), or a music (Music) is extracted as a signature, the reliability as a signature may be low. For example, when music is extracted as a signature, it is difficult to distinguish exactly which one of the applications providing various music services is a signature for identifying a music application program. In other words, since various music applications such as a soundbada and a melon are intended to provide a sound source, the payload includes music. When the music is a signature, the corresponding signature identifies both the soundblower and the melon, It is difficult to specify which application to identify. That is, the signature of a specific application identifies other applications and degrades the reliability of the network.

Thus, in a rapidly increasing application traffic, a more sophisticated payload signature specific to a particular application is required in a network administrator to manually identify a payload and automatically define or generate a signature without manually verifying the signature. Korean Patent Registration No. 10-1270339 relates to a signature checking method. When there is an index matching the contents of a network packet, a signature check is performed on a signature included in the group for the index. If there is no matching index, A signature check technique for excluding a signature belonging to the index group from a signature check is not disclosed since it is not necessary to check it later.

[1] H.-A. Kim and B. Karp, " Autograph: Toward automated, distributed worm signature detection, " in USENIX Security Symp., Vol. 286, 2004. [2] B.-C. Park, Y. J. Won, M.-S. Kim, and J. W. Hong, "Towards Automated Application Signature Generation for Traffic Identification," IEEE Network Operations and Management Symp. (NOMS 2008), pp. 160-167, 2008. [3] C. MU, X.-h. HUANG, X. TIAN, Y. MA, and J.-l. Qi, " Automatic traffic signature extraction based on fixed offset algorithm for traffic classification ", The J. Chinese Universities of Posts and Telecommun., Vol. 18, pp. 79-85, 2011. [4] R. Agrawal and R. Srikant, " Fast algorithms for mining association rules, " in Proc. 20th Int. Conf. VLDB, pp. 487-499, 1994 [5] R. Agrawal and R. Srikant, " Mining sequential patterns, " in Proc. Eleventh Int. Conf. Data Eng., Pp. 3-14, 1995.

In order to solve the problems of the related art as described above, the present invention proposes a technique for defining a structure of a more elaborate payload signature specialized for a specific application program without overlapping with other application programs.

According to another aspect of the present invention, there is provided a method for generating payload signature, the method comprising: collecting traffic related to a plurality of applications; extracting a common character string for collected traffic to generate a content signature set including a content signature; Generating a packet signature matching a plurality of content signatures among the content signatures included in the set of content signatures with respect to any one of the collected traffic, To generate a flow signature that matches a plurality of packet signatures.

According to an aspect of the present invention, the method may further include generating a payload signature having a low level of the content signature, a medium level of the packet signature, and a high level of the flow signature as a signature for identifying a specific application.

According to another aspect of the present invention, the step of generating the flow signature includes extracting packets having the same 5-tuple information among the headers of the packets for the packets included in the collected traffic, As a flow.

According to another aspect, generating the flow signature may further include defining a flow signature that matches a plurality of packet signatures within the same flow for the entire traffic.

According to another aspect, the 5-tuple information may include source IP address information, destination IP address information, source port number, destination port number, and 4-layer protocol information included in the header of the packet.

According to another aspect of the present invention, the step of generating the packet signatures may generate a plurality of sets of content signatures matching the predetermined number of frequencies with respect to any one of the traffic, using the packet signatures.

According to yet another aspect, there is provided a method of transmitting traffic information, the method comprising: calculating an amount of traffic matching at least one content signature corresponding to one packet signature for total traffic; And calculating an analysis rate of the payload signature based on the analysis result.

The payload signature generation system includes a traffic collector for collecting traffic related to a plurality of applications, a common character string extraction unit for generating a content signature set including a content signature by extracting a common character string for the collected traffic, A plurality of packet signatures matching a plurality of content signatures included in the content signatures included in the set of content signatures are generated, and a plurality of packet signatures are generated for a flow based on the collected traffic And a signature generation unit for generating a matching flow signature.

According to an aspect of the present invention, the signature generation unit may generate a payload signature having a structure of a lower level of the content signatures, an intermediate level of the packet signatures, and a higher level of the flow signatures, as a signature for identifying a specific application.

According to another aspect of the present invention, the signature generation unit extracts packets having the same 5-tuple information among the headers of the packets for the packets included in the collected traffic, defines each of the extracted packets as the flow, A flow signature that matches a plurality of packet signatures in the same flow with respect to traffic can be defined.

According to another aspect of the present invention, there is provided a method of calculating traffic amount, comprising the steps of: calculating an amount of traffic matching at least one content signature corresponding to one packet signature with respect to total traffic; And an analysis rate calculation unit for calculating an analysis rate of the payload signature.

According to the present invention, by defining a payload signature structure composed of a plurality of levels from a low level to a high level, the payload signature using the common character string can be more specialized than that for a specific application program. That is, a new structured payload signature can generate a sophisticated payload signature that lowers the probability of identifying or analyzing other applications (i. E., Reduces false positives) and identifies or analyzes particular applications.

In addition, as the application program is analyzed or identified using the new structure payload signature, the accuracy of traffic analysis is improved due to a decrease in false positives, and the reliability of analysis results is improved, thereby increasing the efficiency of network management. That is, when analyzing traffic using the payload signature of the new structure, the value of FP (false positive) can be reduced while maintaining the value of TP (True Positive).

1 is a diagram illustrating a network configuration of a payload signature generation system according to an embodiment of the present invention.
2 is a block diagram illustrating an internal configuration of a payload signature generation system according to an embodiment of the present invention.
3 is a flowchart illustrating a payload signature generation method according to an embodiment of the present invention.
4 is a diagram illustrating the structure of a payload signature according to an exemplary embodiment of the present invention.
5 is a flowchart illustrating a method of calculating an analysis rate of traffic using a payload signature having a plurality of level structures, according to an embodiment of the present invention.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings. In order to facilitate a thorough understanding of the present invention, the same reference numerals are used for the same means regardless of the number of the drawings.

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a technique for defining a structure of a payload signature uniquely specific to a specific application program, To a technique for defining or generating a payload signature consisting of < RTI ID = 0.0 > a < / RTI > To a technique for defining or generating a payload signature having a structure of, for example, lower-level content signatures, intermediate-level packet signatures, and higher-level flow signatures .

In these embodiments, the 'content signature' corresponds to the lower level of the payload signature and may represent a common string in the payload, which is the data portion of the traffic . That is, the content signature may represent a contiguous string that is commonly contained in the traffic. Here, the payload signature is used to identify whether a particular traffic among the plurality of traffic that is introduced or collected into the system is traffic that is flowed into or collected from a certain application (e.g., next, Google, Naver, Yahoo, etc.) Quot; key " Traffic may represent a set of packets including a header and data. The payload means data traffic which is a data part of a packet, and the content signatures can be defined or generated based on a common character string extracted for different packets.

In the present embodiments, a 'packet signature' may be a set of content signatures in the same packet, which may mean a combination of content signatures that occur in the same packet. That is, when at least two of the plurality of signatures included in the set of the content signatures are included in one packet, the combination of at least two of the content signatures may be a packet signature. As described above, the packet signature can represent a combination of a plurality of content signatures matching in one packet.

In the present embodiments, a 'flow signature' is a set of packet signatures that occur in the same flow, and is a set of packet signatures that satisfy a predetermined fixed frequency number among the set of packet signatures extracted in the same flow It can mean a set.

In the present embodiments, the correct answer traffic may refer to pure traffic generated only by the application, that is, traffic not mixed with other applications. For example, Naver 's right - hand traffic means only traffic from Naver, and Google' s right - hand traffic means only traffic from Google.

1 is a diagram illustrating a network configuration of a payload signature generation system according to an embodiment of the present invention.

In FIG. 1, the payload signature generation system 100 may collect traffic, or packets, from at least one host 110. Although FIG. 1 shows three hosts, this corresponds to the embodiment, and the number of hosts may be less than three, or three or more. For example, the host may include various electronic devices using a wired / wireless Internet such as a desktop PC, a notebook, a smart phone, a tablet, and the like.

1, the payload signature generation system 100 collects traffic (i. E., Packets 120) occurring on a plurality of hosts 110 over a network, such as the Internet 101, for a predetermined period of time . At this time, the payload signature generation system 100 can collect traffic 120 from each host using a traffic measurement agent (TMA). Then, the payload signature generation system 100 can generate the ground traffic (GT Traffic) on the collected traffic 120. Here, the traffic of the correct answer may be pure traffic generated only by the application, that is, traffic not mixed with other applications. For example, naver's right-hand traffic can only refer to traffic generated by naver.

For example, a TMA may be installed and run or run in each of the hosts 111, 112, and 113, and log data (140) may be generated when the TMA is executed in each host. Then, the payload signature generation system 100 may collect log data 140 corresponding to the traffic from each host 111, 112, and 113. Here, the log data 140 may include process name information, IP address information, port number information, state information, protocol information, and the like. Each host can send log data to the TMA server at regular intervals. Then, the TMA server 130 may integrate and store the log data received from each of the hosts 111, 112, and 113 in the time zone. For example, it is possible to match and store the received time of log data, the identifier information of the host that transmitted the log data, and the corresponding log data. Then, the payload signature generation system 100 can request and receive the log data of the host from the TMA server 130 based on the identifier information of the host corresponding to the collected traffic. In this way, when the traffic and the log data are collected, the payload signature generation system 100 can generate the correct-answer traffic for each application based on the log data, and the collected traffic (i.e., packets) Lt; RTI ID = 0.0 > a < / RTI > payload signature.

FIG. 2 is a block diagram illustrating an internal configuration of a payload signature generation system according to an exemplary embodiment of the present invention. FIG. 3 is a flowchart illustrating a payload signature generation method according to an exemplary embodiment of the present invention.

2, a traffic collecting unit 210, a signature generating unit 220, an analysis rate calculating unit 230, and a control unit 240 may be included. The control unit 240 includes a traffic collecting unit 210, a signature generating unit 220, an analysis rate calculating unit 230, Can be controlled in general. For example, the control unit 240 may be configured to process a command of a computer program in the traffic collecting unit 210, the signature generating unit 220, and the analysis rate calculating unit 230, The signature generation unit 220, and the analysis rate calculation unit 230 so as to perform basic arithmetic, logic, and input / output operations according to the received information.

3 are performed by the traffic collecting unit 210, the signature generating unit 220, the analysis rate calculating unit 230, and the control unit 240, which are components of FIG. 2 .

In step 310, the traffic collecting unit 210 may collect packets (i.e., traffic) generated in a plurality of hosts for a predetermined period of time through a network such as the Internet. At this time, the traffic collecting unit 210 may collect traffic from each host using a traffic measurement agent (TMA).

For example, when each host accesses an application such as Naver, Daum, Google, Yahoo, etc., the traffic collecting unit 210 accesses a specific one of the applications from each host to download data, And may collect traffic including packets that occur due to service utilization (e.g., music, Internet TV viewing, etc.). Here, the packet may be composed of a header and data payload, and the header of the packet may include 5-tuple information. The 5-tuple information may include the source IP address information, the destination IP address information, the source port number, the destination port number, and the 4th layer protocol information of the corresponding packet.

In step 320, the signature generator 220 may generate a content signature (i.e., define a content signature) by extracting a common string for the collected packets.

For example, when 100 packets from the packet 1 to the packet 100 are collected, the signature generation unit 220 can extract a common character string from the payload of 100 packets. For example, in step 321. Signature generator 220 is a non-patent document of the above [4] R. Agrawal and R. Srikant , " Fast algorithms for mining association rules, " in Proc . 20th Int. Conf . VLDB , pp. 487-499, 1994., [5] R . Agrawal and R. Srikant , " Mining sequential patterns, " in Proc . Eleventh Int . Conf . Data Eng ., Pp. 3-14, 1995. It is possible to extract a common string from a plurality of packets using the sequential pattern algorithm.

In step 322, the signature generation unit 220 may generate (i.e., define) a common character string extracted from the extracted common strings by a content signature.

For example, if there are 30 common strings extracted from 100 packets, the signature generation unit 220 may define a common character string extracted at least twice from 30 common characters as a content signature. Here, the case where the predetermined frequency is two times is described as an example, but this corresponds to the embodiment, and the predetermined frequency can be defined in advance such as three times, four times or more in addition to the second frequency. For example, if there are 10 common strings extracted twice or more out of 30 common strings, ten content signatures can be generated.

In step 323, the signature generator 220 may generate a set of content signatures including the generated content signatures. For example, if ten content signatures are generated that satisfy a certain frequency among the 30 common strings, a set of content signatures may be generated that includes ten common strings that are duplicated (i.e., corresponding to ten content signatures) .

Table 1 below shows examples of content signatures.

Signature _id Content Signature One <GET /> 2 <HTTP / 1.1> 3 <MUSIC> 4 <CACHE-CONTROL> 5 <NO> 6 <FACEBOOK> 7 <IMAGE> 8 <ALBUM> 9 <32>

According to Table 1, nine common strings can be defined as content signatures, respectively. For example, <GET />, <HTTP / 1.1>, <MUSIC>, <CACHE-CONTROL>, <NO>, <FACEBOOK>, and <IMAGE>, which are common strings extracted twice or more among 100 packets, HTTP / 1.1>, <MUSIC>, and <CACHE-CONTROL> may be generated (ie, defined) as the content signatures, , <NO>, <FACEBOOK>, <IMAGE>, <ALBUM>, and <32>.

In step 330, the signature generator 220 may generate a packet signature based on the content signature. At this time, the signature generation unit 220 may generate packet signatures matching at least one content signature of the content signatures included in the content signature set for any one of the collected traffic.

For example, the signature generation unit 220 may generate at least one of the signatures included in the content signature set in at least one of the 100 packets, or at least two or more of the signatures included in the set of content signatures, (I.e., define) a combination of extracted and matched content signatures as a packet signature. At this time, the signature generation unit 220 may perform a process of defining a packet signature for each of the 100 packets. For example, when three content signatures <GET />, <MUSIC>, and <32> among the nine signatures included in the content signature set are included in one packet, that is, when the three content signatures are matched, the signature generator 220 ) Can define (i.e., generate) the set of three matching content signatures with a packet signature (<GET /> <MUSIC> <32>). Specifically, the signature generation unit 220 generates all possible combinations (for example, two, three, ..., n combinations) of the content signatures included in the content signature set using a sequential pattern algorithm After generating the packet signature (that is, the packet sequence), a combination that matches more than a certain predetermined number of frequencies of the generated candidate packet signatures may be generated as the packet signature. For example, four packet signatures can be generated in the same packet for the entire traffic as shown in Table 2 below. Table 2 shows a set of packet signatures including extracted packet signatures. For example, when the predetermined frequency is set to 95% or more of the total packets, the signature generator 220 can define a combination of the content signatures, which are found in 95% or more of all the packet among the candidate packet signatures, as the packet signature have.

According to Table 2, four packet signatures are included, and a packet signature can be generated for all packets. The packet signature is always a set of content signatures that are generated in packets of a certain frequency or more (a frequency of the default in the entire packet, for example 95%), so that it can always be generated for all packets. Here, the set of content signatures is a set of signatures that coexist in the same packet. The set can be found in other packets. If a certain number of packets are found, Signature can be generated.

In the case of Packet Signature 3, in Table 2, a set of a plurality of content signatures combining 9 content signatures out of 9 content signatures included in the content signature set can be generated. A set of content signatures (for example, a collection of two content signatures) matched with a certain frequency or more among the content signatures included in the generated set of content signatures may be defined as the packet signature 3. And, like the packet signature 4, a set of content signatures including one content signature < FACEBOOK > may be generated as a packet signature.

In step 340, the signature generator 220 may generate a flow signature based on a packet signature, which is a set of content signatures matched by more than a certain frequency among sets of content signatures.

In step 341, the signature generator 220 may classify the packets corresponding to the flow based on the header information of each of the packets included in the traffic for the collected traffic.

For example, the signature generation unit 220 may classify 100 packets included in the collected traffic, and classify packets corresponding to the same group based on the 5-tuple information included in the header of each packet . Here, the source IP address information, the destination IP address information, the source port number, the destination port number, and the 4th layer protocol information included in the header of the packet may be included. That is, the signature generation unit 220 classifies the source IP address information, the destination IP address information, the source port number, the destination port number, and the 4th layer protocol information of each of the 100 packets into one flow . For example, 40 packets having the same 5-tuple information included in the header information among the 100 packets are referred to as Flow 1, 30 packets having the same 5-tuple information as Flow 2, 20 packets having the same 5-tuple information Flow 3, and 10 packets having the same 5-tuple information can be classified into Flow 4.

In step 342, the signature generator 220 may generate a flow signature matching a plurality of packet signatures in one flow. At this time, the signature generator 220 extracts a packet signature extracted from a plurality of packet signatures included in the packet signature set for a single flow, extracts a packet signature extracted from the packet signatures, and defines a combination of the extracted packet signatures as a flow signature (I.e., generated).

For example, Table 3 below may indicate flow signatures.

According to Table 3 above, two flow signatures can be generated within the entire traffic. That is, since the flow signature is a set of packet signatures that occur in the same flow, a set of packet signatures found above a predetermined certain frequency (e.g., 95% of a flow) of all possible combinations of packet signatures is defined as a flow signature . For example, a set of packet signatures matching a certain frequency or more in a flow of one of the packet signature 1, the packet signature 2, the packet signature 3, and the packet signature 4 included in the packet signature set of Table 2 is included in one flow signature <GET /> <MUSIC> <32> <ALBUM> <CASHE-CONROL>). As shown in Table 3, two flow signatures can be generated in the entire traffic. At this time, when the flows are classified into four, the signature generation unit 220 can generate a flow signature for each of the four flows.

In step 350, the signature generator 220 may generate a payload signature having a plurality of levels of the generated content signatures, packet signatures, and flow signatures as a signature corresponding to a specific application. Here, the content signatures may correspond to a lower level, the packet signatures may correspond to an intermediate level, and the flow signatures may correspond to a higher level. As such, the payload signature may have a signature structure of three levels, and a particular application may be analyzed, i.e., identified, based on the payload signature generated.

4 is a diagram illustrating the structure of a payload signature according to an exemplary embodiment of the present invention.

4, the payload signature may have a structure consisting of three levels: a content signature 410, a packet signature 420, and a flow signature 430.

Referring to FIG. 4, the signature generator 220 can primarily extract a common character string for a payload 411 corresponding to four packets. Then, the common character string extracted from the extracted common strings by a predetermined frequency or more (for example, two or more times) can be generated (i.e., defined) by the content signatures 412, 413, and 414. A collection of the content signatures 412, 413, and 414 may correspond to the content signature set 410.

Secondarily, the signature generator 220 can check whether the content signatures included in the specific content signature set 410 among the plurality of content signature sets are matched by more than a certain frequency in one packet. The signature generator 220 may generate (i.e., define) at least one set of content signatures matching a certain frequency or more with a packet signature. For example, if a set of content signatures including content signature 1 412 and content signature 2 413 in one packet includes more than a certain predetermined number of frequencies (i.e., matches), the signature generation unit 220 A content signature set consisting of content signature 1 412 and content signature 2 413 can be generated (i.e., defined) with packet signature 1 421. In this case, if the content signature 3 413 matches more than a certain frequency in the one packet, the signature generation unit 220 generates (i.e., defines) the content signature 3 413 as the packet signature 2 422 . As described above, since packet signatures must match a plurality of content signatures in one packet (i.e., data traffic), it is possible to improve the accuracy of traffic analysis due to low false positives. Accordingly, the packet signature may correspond to a more sophisticated signature for the application than the content signature.

Thirdly, the signature generator 220 generates (i. E., Defines) at least one packet signature that matches at least a certain frequency among the packet signatures included in the packet signature set 420 in the same flow )can do. For example, if the packet signature 1 421 and the packet signature 2 422 are included in the same flow more than a certain predetermined frequency (that is, matching), the signature generation unit 220 generates the packet signature 1 421 and The packet signatures 2 422 may be generated (i.e., defined) by the flow signature 1 431. As such, the flow signature can be a more sophisticated signature with less false positives in the analysis of the application than the packet signature, since multiple packet signatures must be matched within the same flow.

The structure of the payload signature having the content signatures, the packet signatures and the flow signatures as levels can be expressed in a mathematical form as shown in Table 4 below.

와 같이 표현될 수 있다. 그리고, 동일 패킷 내에 존재하는 콘텐츠 시그니쳐 집합 중 일정 빈도 수가 넘는 패킷 시그니쳐가 4개인 경우를 가정하면, 패킷 시그니쳐 집합 P는

와 같이 표현될 수 있다. 도 4에서는 플로우 시그니쳐가 1개인 경우를 도시하였으나, 하나의 플로우 내에서 플로우 시그니쳐가 2개 이상 추출될 수 있으며, 플로우 시그니쳐가 2개 추출된 경우,

로 표현될 수 있으며,

를 나타낼 수 있다. 여기서, c₁ 내지 c₉, p₁ 내지 p₄, f₁ 내지 f₂는 위의 표 1 내지 표 3의 시그니쳐 ID(signature_id)를 나타낼 수 있다. 위의 표 1 내지 표 3과 위에서 설명한 상기 집합 C, P, F를 참고하면, 콘텐츠 시그니쳐 6(C₆), 패킷 시그니쳐 4(P₄), 플로우 시그니쳐 2(f₂)는 모두 문자열 <FACEBOOK> 문자열을 나타내는 시그니쳐에 해당할 수 있다. 이때, 응용에 대한 분석률이 모두 같을지라도 콘텐츠 시그니쳐 6(C₆)보다 패킷 시그니쳐 4(P₄)가 해당 응용에 보다 정교하고, 패킷 시그니쳐 4(P₄)보다 플로우 시그니쳐 2(f₂)가 해당 응용에 보다 정교한 시그니쳐에 해당할 수 있다.In Table 4, assuming that nine pieces of content signatures that are equal to or more than a certain frequency among the common strings for a specific application are extracted, the content signature set C

Can be expressed as Assuming that there are four packet signatures having a certain frequency number among the set of content signatures existing in the same packet, the packet signature set P is

Can be expressed as Although FIG. 4 shows a case where one flow signature is 1, two or more flow signatures may be extracted in one flow, and when two flow signatures are extracted,

, &Lt; / RTI >

Lt; / RTI &gt; Here, c ₁ to c _9, p ₁ to p _4, f ₁ to f ₂ may indicate an ID signature (signature _id) in the previous table 1 to Table 3. The contents signature 6 (C ₆ ), the packet signature 4 (P ₄ ), and the flow signature 2 (f ₂ ) all have the string &lt; FACEBOOK &gt;, as shown in the above Tables 1 to 3 and the above- It may correspond to a signature representing a string. At this time, even if the same both the analysis rate of the application content signature ₆ (C 6) than the packet signature ₄ (P 4) is a more sophisticated, and the packet signature ₄ (P 4) than the flow signature ₂ (f 2) to the application It may correspond to more sophisticated signatures for the application.

On the other hand, when traffic is analyzed using a payload signature having a plurality of level structures such as a content signature, a packet signature, and a flow signature, there is a limit to the analysis rate by analyzing traffic using a packet signature or a flow signature have. For example, if a packet signature is used, at least one content signature used to generate the packet signature may have to be matched in order for one packet signature to be matched. That is, when one packet signature is generated based on three content signatures, all three content signatures must be matched so that packet signatures are matched to analyze the traffic. Thus, an analysis rate calculation that matches the new payload signature structure can be performed.

5 is a flowchart illustrating a method of calculating an analysis rate of traffic using a payload signature having a plurality of level structures, according to an embodiment of the present invention.

In FIG. 5, the steps (steps 510 to 520) may be performed by the analysis rate calculation unit 230 of FIG.

In step 510, the analysis rate calculator 230 calculates the amount of traffic (i.e., the number of traffic) matching the at least one content signature corresponding to one packet signature, for the entire traffic (i.e., packet) .

In step 520, the analysis rate calculation unit 230 may calculate the analysis rate of the payload signature based on the amount of the calculated traffic (i.e., the number of traffic) and the amount of the entire traffic (i.e., the total number of traffic) . That is, the analysis rate calculation unit 230 can calculate the analysis rate when analyzing the traffic that has flowed through the specific application with the payload signature having a plurality of level structures.

For example, the analysis rate calculation unit 230 may calculate the analysis rate based on the following equation (1).

[Equation 1]

If the payload signature has a structure that is not just a content signature but a higher level signature than a content signature, such as a packet signature and a flow signature, the higher-level signature is generated as a lower-level set of signatures, One traffic can also analyze high level signatures.

For example, in Equation (1), when three content signatures A, B, and C are used to generate one packet signature, the analysis rate of the packet signature is determined by the content signatures A, B, C The analysis rate calculator 230 does not simply add the amount of matched traffic but the traffic analyzed by the content signatures A, B, and C (i.e., the traffic analyzed by the packet signatures) constituting one packet signature, Can be calculated by calculating the percentage of the sum of the union of the traffic and the total amount of traffic. That is, since the traffic analyzed by the content signatures A, B, and C may overlap each other, the amount of union of A, B, and C can be divided by the amount of total traffic. Accordingly, when analyzing application traffic using signatures of higher level than the content signatures (packet signatures and flow signatures), it is possible to maintain the analysis rate when using lower level signatures and reduce the false positives, It can be analyzed accurately. When a higher level signature structure is used, more sophisticated signatures are generated in a specific application while reducing the number of signatures. Therefore, when a large number of signatures are stored at a high level, a large amount of traffic is used for signatures at lower levels such as content signatures You can analyze it faster than before.

Table 5 below shows the experimental environment when applied to specific application traffic using payload signatures having a plurality of level structures.

First, the collected traffic can be generated using Traffic Measurement Agent (TMA). Then, the content signatures and the packet signatures of the respective applications can be extracted based on the application 1 (for example, Naver) and the application 2 (for example, Yahoo). (2) and (3) of Table 5 can be calculated by applying the content signatures and packet signatures corresponding to the two extracted applications in reverse. For example, the application 2 traffic is analyzed using the packet signatures and the content signatures of the application 1, and the traffic of the application 1 is analyzed using the packet signatures and the content signatures of the application 2, ) Can be calculated. Table 5 (1) and (4) show the analysis rate when the GTT of the application is analyzed with the signatures of two applications. That is, the analysis rate calculation unit 230 can compare and analyze the analysis rate and the false rate of the content signatures and the packet signatures based on the values of (1), (2), (3), and (4) .

In Table 5, GTT indicates the correct traffic and Sig indicates the signature. (1) represents the analysis rate applied to the right-hand side traffic of application 1, which is equivalent to TP (True Positive) for application 1 analysis. (2) represents the analysis rate applied to the application of the application 2's signature to the right-hand traffic of application 1, which can represent false positives (FP) for the analysis of application 2, that is, false positives. (3) represents the analysis rate applied by the application of the right-hand side traffic of the application 1, and corresponds to the FP (false positives) of the application 2, that is, the false rate. (4) is the signature of the application 2, which represents the analysis rate of the traffic of the application 2 and corresponds to TP (True Positive) for Application 2.

Table 6 below shows the false positives of Application 1 and Application 2 as a result of the experiment according to the experimental condition of Table 5 above. In Table 6, all values corresponding to the experimental result may correspond to a flow unit of traffic.

Referring to FP in Table 6, it can be seen that the false positives of the packet signatures are lower than the false positives of the content signatures in the applications 1 and 2. Also, referring to the TP in Table 6, it can be seen that the analysis rate of the packet signature is less changed than that of the content signature in both Application 1 and Application 2.

As described above, since the structure of the payload signature for a specific application is defined such that the content signatures, the packet signatures, and the flow signatures are composed of a plurality of levels, signature redundancy is reduced or prevented at the time of extracting signatures for each application, It is possible to improve the reliability by reducing the false positive rate in the analysis. That is, efficient network management can be achieved. As a result of the numerical analysis of TP and FP as the payload signature has a plurality of level structures as shown in the experiments of Tables 5 and 6, the analysis rate TP for analyzing the corresponding application with the corresponding signature is maintained It can be seen that the value of FP which is the false rate decreases.

The software may be distributed over a networked computer system and stored or executed in a distributed manner. The software and data may be stored on one or more computer readable recording media.

The method according to an embodiment may be implemented in the form of a program command that can be executed through various computer means and recorded in a computer-readable medium. The computer-readable medium may include program instructions, data files, data structures, and the like, alone or in combination. The program instructions to be recorded on the medium may be those specially designed and configured for the embodiments or may be available to those skilled in the art of computer software. Examples of computer-readable media include magnetic media such as hard disks, floppy disks and magnetic tape; optical media such as CD-ROMs and DVDs; magnetic media such as floppy disks; Magneto-optical media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those produced by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the disclosed exemplary embodiments. For example, it is to be understood that the techniques described may be performed in a different order than the described methods, and / or that components of the described systems, structures, devices, circuits, Lt; / RTI &gt; or equivalents, even if it is replaced or replaced.

Therefore, other implementations, other embodiments, and equivalents to the claims are also within the scope of the following claims.

Claims (11)

Collecting traffic associated with a plurality of applications;
Extracting a common string for the collected traffic to generate a content signature set including a content signature;
Generating a packet signature matching a plurality of content signatures among content signatures included in the content signature set for any one of the collected traffic; And
Generating a flow signature matching a plurality of packet signatures for a flow based on the collected traffic;
/ RTI &gt; The method according to claim 1,
Generating a payload signature having a structure of a lower level of the content signatures, a middle level of the packet signatures, and a higher level of the flow signatures as a signature for identifying a specific application
And generating a payload signature. The method according to claim 1,
Wherein the step of generating the flow signature comprises:
Extracting packets having the same 5-tuple information among the headers of the packets with respect to the packets included in the collected traffic; And
Defining each of the extracted packets as the flow
/ RTI &gt; The method of claim 3,
Wherein the step of generating the flow signature comprises:
Defining a flow signature that matches a plurality of packet signatures in the same flow with respect to the entire traffic;
And generating a payload signature. The method of claim 3,
The 5-tuple information includes the source IP address information, the destination IP address information, the source port number, the destination port number, and the 4-layer protocol information included in the header of the packet
And generating a payload signature. The method according to claim 1,
Wherein generating the packet signature comprises:
And generating a set of a plurality of content signatures matching the predetermined number of frequencies with respect to any one of the traffic with the packet signature
And generating a payload signature. The method according to claim 1,
Calculating an amount of traffic matching at least one content signature corresponding to one packet signature with respect to total traffic; And
Calculating an analysis rate of the payload signature based on the amount of the calculated traffic and the amount of the total traffic
And generating a payload signature. A traffic collector for collecting traffic related to a plurality of applications; And
Extracting a common character string for the collected traffic to generate a content signature set including a content signature, and generating a plurality of content signatures included in the content signature set for any one of the collected traffic A signature generation unit for generating a packet signature matched by the content signature and generating a flow signature matching a plurality of packet signatures for a flow based on the collected traffic,
The payload signature generation system comprising: 9. The method of claim 8,
Wherein the signature generator comprises:
Generating a payload signature having a structure of a lower level of the content signatures, a middle level of the packet signatures, and a higher level of the flow signatures as a signature for identifying a specific application
The payload signature generation system comprising: 9. The method of claim 8,
Wherein the signature generator comprises:
Extracting packets having the same 5-tuple information among the headers of the packets for the packets included in the collected traffic, defining each of the extracted packets as the flow, Define the flow signature that the packet signature matches.
The payload signature generation system comprising: 9. The method of claim 8,
Calculating an amount of traffic matching at least one content signature corresponding to one packet signature with respect to total traffic, calculating an analysis rate of the payload signature based on the amount of the calculated traffic and the amount of the total traffic, And an analysis-
The payload signature generation system further comprising:

Images