KR102362077B1 - Method and apparatus for automatic detection of traffic leakage - Google Patents

Abstract

A method and apparatus for automatically detecting a traffic leak are provided. This method is a method in which an automatic traffic leak detection device operated by at least one processor automatically detects a traffic leak, based on traffic information, system log information, and status information from network devices connected to both ends of a plurality of links to be monitored. generating a learning model by learning a plurality of traffic leak causes; collecting traffic information, system log information, and status information for each of the plurality of links from at least one network device connected to the plurality of links; and and inputting the traffic information, the system log information, and the state information into the learning model to determine whether a traffic leak occurs among the plurality of links.

Description

Method and device for automatic traffic leak detection

The present invention relates to a method and apparatus for automatically detecting a traffic leak, and to a technology for automatically detecting a traffic leak in a service network in which network devices are connected by a plurality of links.

Traffic leakage refers to a phenomenon in which traffic is dropped even though the traffic transmitted and received between two network devices connected to each other is coming within the available bandwidth.

If there is a traffic leak, a service failure occurs in the end user terminal connected to the network devices, such as a voice cut off during a call or a lag occurring during a mobile game. When more traffic than bandwidth within the network equipment is concentrated on one link, the router generates a 'Q-DROP' alarm. make it recognizable

However, since the failure continues without leaving any alarm or syslog when a traffic leak occurs, the severity of the situation is important.

It is more difficult to detect a traffic leak in an ECMP (Equal Cost Multi-Path) or UCMP (Unequal Cost Multi-Path) network structure that load balances traffic between two devices through multiple links. This is because, although traffic between two network devices is communicated, no alarm or syslog is generated in a situation in which traffic of some specific link is leaking, so it is difficult for an operator to directly recognize it.

Therefore, the traffic leak phenomenon must be determined by integrating real-time traffic information, router status information, syslog information, and the like. However, it is practically difficult for an operator to check the link status information of numerous monitoring targets, IGP (Interior Gateway Protocol) or IDRP (Intra-domain Routing Protocol) status information one by one to detect a traffic leak in real time.

An object of the present invention is to provide a method and an apparatus for detecting a traffic stuck phenomenon in real time in a section in which network devices are connected by a plurality of links.

According to one aspect of the present invention, a traffic leak detection method is a method in which an automatic traffic leak detection apparatus operated by at least one processor automatically detects a traffic leak, from network devices connected to both ends of a plurality of links to be monitored. generating a learning model by learning a plurality of traffic leak causes based on traffic information, system log information, and status information; traffic information for each of the plurality of links from at least one network device connected to a plurality of links; collecting log information and status information; and inputting the traffic information, the system log information, and the status information to the learning model to determine whether a traffic leak occurs among the plurality of links.

The generating may include monitoring a real-time change rate of traffic of the plurality of links to be monitored based on the traffic information. Searching for a link, determining whether one end of both ends of the specific link is in a link up state based on status information collected from network devices connected to both ends of the specific link, and one end of the specific link If the link connection (Up) state, determining the specific link as a traffic leak, and learning the learning model using the system log information and status information collected from network devices connected to both ends of the specific link may include

The determining of the traffic leak may include determining whether a traffic difference between both ends of the specific link is greater than or equal to a threshold, determining whether the traffic difference is greater than or equal to a threshold, determining a traffic leak, and if the traffic difference is less than a threshold, traffic Comprising the step of determining a water leak warning, the step of learning, traffic information, system log information and status information in the case of a traffic leak, and traffic information, system log information, and status information in the case of a traffic leak warning by distinguishing In the learning and determining whether the traffic leak occurs, a link in which a traffic leak occurs among the plurality of links and a traffic leak type may be determined using the learning model.

In the learning step, extracting a cause of a traffic leak based on system log information and status information collected from network devices connected to both ends of the specific link, and determining whether the traffic leak occurs, the learning model It can be used to determine a link in which a traffic leak occurs among the plurality of links and a cause of the traffic leak.

After determining whether the one end is in a link connection (Up) state, if both ends of the specific link are in a link down state, determining the specific link as a normal state, and collecting data collected from both ends of the specific link The method further includes the step of discriminating a type of link down based on the status information, wherein the learning includes traffic information, system log information, and status information in a normal state for each type of link down. The step of learning and determining may include inputting the traffic information, the system log information, and the state information into the learning model to determine a link-down normal state and a link-down type. .

After the collecting, monitoring a real-time rate of change in traffic of the plurality of links based on the traffic information collected from the at least one network device, and if the real-time rate of change in traffic is equal to or greater than a threshold, traffic among the plurality of links The method further includes the step of searching for a specific link whose amount is less than or equal to a threshold, wherein the determining step includes inputting traffic information, system log information, and status information collected from the discovered specific link into a learning model to determine whether or not traffic leaks. can

The determining may include determining whether a traffic leak exists and a traffic leak type, and after the determining step, a work command for resolving a traffic leak defined in the traffic leak type is generated and connected to a specific link in which the traffic leak is detected. The method may further include transmitting to at least one network device.

After the determining, the method may further include outputting a result of determining whether the traffic leak is present and the traffic leak type as a visual alarm or an audible alarm through a user interface.

According to another feature of the present invention, the automatic traffic leak detection apparatus configures a service network, is connected to at least one network device connected by a plurality of links, and includes a communication device and a learning model for transmitting and receiving information with the at least one network device. a memory storing a program for detecting whether traffic loss occurs in the plurality of links by using the memory; and at least one processor executing the program, wherein the program comprises: traffic information collected from the at least one network device; It may include instructions for determining whether traffic loss occurs in the plurality of links and a cause of traffic loss by inputting system log information and status information to the learning model.

The program learns traffic information, system log information and status information collected from network devices connected to both ends of a plurality of links selected as monitoring targets when a triggering event that specifies a plurality of traffic leak causes input by an operator occurs, It determines traffic leaks based on traffic information, system log information, and status information collected from network devices connected to both ends of a plurality of links selected for monitoring in real time or periodically, and traffic information collected from the link where the traffic leak is detected. , commands for learning the cause of traffic leakage using system log information and status information.

The program monitors a real-time change rate of traffic based on the real-time or periodically collected traffic information, and if the real-time rate of change is greater than or equal to a threshold, searches for a specific link lower than the average value of the traffic share of the plurality of links, If both ends of the link are in a down state, the specific link is determined as a normal state. Thus, if the threshold value or more, the specific link is determined as a traffic leak state, if it is less than the threshold value, the specific link is determined as a traffic leak warning state, and the specific link determined as the normal state, the traffic leak state, and the traffic leak warning state It may include instructions for learning the learning model by using the collected traffic information, system log information, and state information.

The apparatus further includes a user interface unit that visually or aurally outputs information according to the operation of the program, wherein the program displays traffic information, system log information, and status information collected from the at least one network device. It is input to the learning model to determine which of the normal state, traffic leak state, and traffic leak warning state corresponds to, and if it is a traffic leak state, determines the cause of traffic leak, outputs the determination result to the user interface unit, and traffic leak Alternatively, when it is determined as a traffic warning, it may include commands for transmitting a traffic leak determination result and a work command according to the cause of the traffic leak to at least one network device connected to a specific link.

According to the present invention, since it is possible to detect a traffic leak phenomenon in real time and take immediate action, it is possible to fundamentally solve the problem of large Internet service failure.

In addition, based on the learning data accumulated through various cases such as the traffic leak detection result and the occurrence of artificial traffic leak by the operator, a learning model for traffic leak detection is created and used to detect the traffic leak, so the reliability of traffic leak detection can improve

In addition, as a real-time control and operable solution, network operation costs can be reduced, and it can operate independently of equipment manufacturer types and equipment commands.

1 illustrates a network environment to which an automatic traffic leak detection apparatus according to an embodiment of the present invention is applied.
2 is a view for explaining a multi-path section according to an embodiment of the present invention.
3 is a block diagram illustrating a detailed configuration of an apparatus for detecting a traffic leak according to an embodiment of the present invention.
4 shows traffic statistics according to an embodiment of the present invention.
5 is a flowchart illustrating a traffic leak detection learning operation according to an embodiment of the present invention.
6 is an exemplary diagram of a learning model for detecting a traffic leak according to an embodiment of the present invention.
7 is a flowchart illustrating a traffic leak detection learning operation according to another embodiment of the present invention.
8 is a flowchart illustrating a traffic leak detection operation according to another embodiment of the present invention.
9 is a flowchart illustrating a traffic leak detection operation according to another embodiment of the present invention.
10 is a hardware block diagram of an apparatus for detecting a traffic leak according to another embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings, the embodiments of the present invention will be described in detail so that those of ordinary skill in the art to which the present invention pertains can easily implement them. However, the present invention may be embodied in various different forms and is not limited to the embodiments described herein. And in order to clearly explain the present invention in the drawings, parts irrelevant to the description are omitted, and similar reference numerals are attached to similar parts throughout the specification.

Throughout the specification, when a part "includes" a certain element, it means that other elements may be further included, rather than excluding other elements, unless otherwise stated.

Now, a method and apparatus for automatically detecting a traffic leak according to an embodiment of the present invention will be described with reference to the drawings.

1 shows a network environment to which an automatic traffic leak detection apparatus according to an embodiment of the present invention is applied, and FIG. 2 is a diagram for explaining a multi-path section according to an embodiment of the present invention.

Referring to FIG. 1 , the automatic traffic leak detection apparatus 100 performs traffic in at least one link connecting the network devices 200 to each other based on information collected from the network devices 200 constituting the service network. Detect leaks. Here, the network equipment 200 is connected to the end equipment, that is, the terminal 300, and includes, for example, a router, a switch, and the like.

Referring to FIG. 2 , two network devices 201 and 203 are connected by a plurality of links. As such, a structure connected by a plurality of links is a multiple path, and may be referred to as an Equal Cost Multi-Path (ECMP) or an Unequal Cost Multi-Path (UCMP).

For example, if it is assumed that the network device 1 201 and the network device 2 203 are connected by five links, traffic is transmitted/received through each link. At this time, if there is a significant difference in traffic between the network device 1 (201) and the network device 2 (203) connected to the link 5 (⑤), traffic is lost in the link 5 (⑤), that is, a traffic leak occurs. said to have done As such, the traffic leak corresponds to a case in which traffic is transmitted from the network device 1 201 connected to one end of the link, but the traffic is not normally received from the network device 2 203 connected to the other end of the link. Of course, vice versa.

Although a traffic leak means that a traffic difference occurs at both ends of a link, it is difficult to detect a traffic leak simply by comparing the amount of traffic at both ends of the link. Due to the real-time nature of traffic and burst traffic characteristics, if traffic leaks are determined because they are different from each other by simply comparing the traffic volumes at both ends of the link, an error is highly likely.

In addition, when a harmful traffic blocking system such as an Intrusion Prevention System (IPS) or Deep Packet Inspection (DPI) system is connected in the middle of the link, traffic throughputs at both ends of the link are different. In addition, although it is necessary to collect traffic from network devices connected to both ends of the link, there are cases in which traffic can only be collected from one end of the link due to device performance or security issues. In addition, there are cases where the subjects that manage the network devices connected to both ends of the link are different from each other. In this case, too, traffic can only be collected from one end of the link.

Therefore, in order to detect a traffic leak in the multi-path section, it is necessary to collect various information and make a complex judgment, and the configuration will be described.

3 is a block diagram showing a detailed configuration of a traffic leak detection apparatus according to an embodiment of the present invention, FIG. 4 shows traffic statistics according to an embodiment of the present invention, and FIG. 5 is a block diagram according to an embodiment of the present invention It is a flowchart illustrating a traffic leak detection learning operation, FIG. 6 is an exemplary diagram of a learning model for traffic leak detection according to an embodiment of the present invention, and FIG. 7 is a traffic leak detection learning operation according to another embodiment of the present invention It is a flowchart.

Referring to FIG. 3 , the automatic traffic leak detection apparatus 100 includes a traffic information collection unit 101 , a system log information collection unit 103 , a state information collection unit 105 , a traffic leak detection unit 107 , and a learning unit. 109 , a learning model DB 111 , a network equipment control unit 113 , and a user interface unit 115 .

Here, the traffic leak detection unit 101 performs a detection operation for generating a traffic leak learning model and a traffic leak detection operation using the learning model.

In the case of a detection operation for generating a traffic leak learning model, the traffic leak detection unit 101 must be able to collect information from all network devices (200 in FIG. 1 and 201 and 203 in FIG. 2 ) connected to both ends of the link. do. That is, the traffic leak detection unit 101 uses information collected from both ends of the link.

On the other hand, in the case of the traffic leak detection operation using the learning model, it does not matter if information can be collected only from both ends of the link as well as from one end of the link. That is, the traffic leak detection unit 101 includes not only the network devices connected to both ends of the link (200 in FIG. 1 , 201 and 203 in FIG. 2 ), but also the network devices connected to one end of the link (200 in FIG. 1 and FIG. 2 ). 201 or 203) may use information collected only.

The traffic information collection unit 101 , the system log information collection unit 103 , and the equipment state information collection unit 105 collect information from network devices ( 200 in FIG. 1 , 201 and 203 in FIG. 2 ).

The traffic information collecting unit 101 collects traffic information from network devices (200 in FIG. 1 and 201 and 203 in FIG. 2 ). According to an embodiment, the traffic information may include the traffic throughput for each link of each network device (200 in FIG. 1 and 201 and 203 in FIG. 2 ) for a unit time (eg, in units of 5 minutes). The traffic throughput means the amount of traffic processed by the network equipment for a unit time. The traffic information collection unit 101 calculates a traffic share (%) for each link based on the collected traffic throughput. The traffic share (%) for each link is expressed as the ratio of the bandwidth of the link to the traffic throughput in the link.

According to another embodiment, the traffic share (%) may be calculated in each network device (200 in FIG. 1 and 201 and 203 in FIG. 2). In addition, the traffic information collection unit 101 may receive the traffic share (%) for a unit time (eg, in units of 5 minutes) from each network device (200 in FIG. 1 and 201 and 203 in FIG. 2 ).

Such a traffic share (%) is displayed in units of time, that is, 5 minutes, as shown in A in FIG. 4 .

The system log information collecting unit 103 collects each system log information from the network devices (200 in FIG. 1, 201 and 203 in FIG. 2), for example, the system log information is syslog information. can The system log information may include a restart log of a routing protocol (eg, IS-IS), a cyclic redundancy check (CRC) value, and CRC count information information.

The status information collecting unit 105 collects link status information of each network device (200 in FIG. 1 and 201 and 203 in FIG. 2 ) from the network devices ( 200 in FIG. 1 and 201 and 203 in FIG. 2 ). Link state information includes equipment state and routing protocol state.

The equipment state includes the power state of the network equipment (200 in Fig. 1, 201, 203 in Fig. 2) itself, and activation/deactivation of interface modules, ports, etc. mounted in the network equipment (200 in Fig. 1, 201, 203 in Fig. 2). As a state, it is expressed as connected (UP) or disconnected (DOWN). For example, the connection (UP) corresponds to ① when all of the network devices 201 and 203 connected to both ends of the link are in the power-on state or the interface module or port to which the link is connected is in the active state. Disconnection (DOWN) ① corresponds to a case in which all of the network devices 201 and 203 connected to both ends of the link are in the power-off state, or the interface module or port to which the link is connected is in an inactive state.

The state of the routing protocol may be an Interior Gateway Protocol (IGP) state. IGP is a protocol distributed within the same Autonomous System (AS) network and is used to efficiently transmit a BGP (Border Gateway Protocol)/Routing table to another router (or network equipment). All routers (or network equipment) constituting the same AS network share the same link state database to find an optimal route and calculate routing. IGP has protocols such as IS-IS and OSPF (Open Shortest Path First), and can take values such as 'on', 'down', and 'initialization' as logical values.

'on' means, for example, in FIG. 2 , the network device 201 receives the 'IGP hello message' from the neighboring network device 203 and the IGP routing protocol operates normally.

'down' refers to a state in which the IGP routing protocol does not operate because the network device (201 in FIG. 2) does not receive the 'IGP hello message' from the neighboring network device (203 in FIG. 2).

In 'initialization', the network equipment (201 in FIG. 2) receives the 'IGP hello message' from the neighboring network equipment (203 in FIG. 2) and is ready to operate the IGP, but the neighboring network equipment 203 determines that it is 'IGP hello' It is in a waiting state because it has not received confirmation that it has received a 'message'. That is, the IGP routing protocol does not operate in the down state, but in the standby state.

The state information collecting unit 107 determines the link connection state based on the equipment state and the routing protocol state. The link connection state is expressed as connected (UP) or disconnected (DOWN). The link connection state includes a state of a physical path of the link based on an equipment state and a state of a logical path of the link based on a state of a routing protocol.

Accordingly, when a traffic leak occurs in a specific link, the traffic leak type may include a link shutdown type and an IGP shutdown type. Link shutdown occurs when the link is physically broken, such as by replacing an interface module. An IGP shutdown occurs as a result of a logical break in a link, such as a transmission line down (or interrupt).

In addition, status information of individual links constituting a multi-path is distinguished by a link identifier.

The traffic leak detection unit 101 detects a traffic leak based on information collected from each of the traffic information collection unit 103 , the system log information collection unit 105 , and the state information collection unit 107 .

First, referring to FIG. 5 , the traffic leak detection unit 101 detects traffic information, system log information, and status information from network devices ( 200 in FIG. 1 , 201 and 203 in FIG. 2 ) connected to both ends of a monitoring target link. It is collected in real time or periodically (S101). Then, the traffic leak detection unit 101 monitors the real-time change rate of traffic for each link based on the collected traffic information (S101) (S103).

Referring to FIG. 2 , the traffic leak detection unit 101 includes traffic throughput or traffic share for each of the five links from the network device 1 201 and the network device 2 203 , system log information, and status information. to collect

In this case, the traffic leak detection is based on information obtained from one end of the link. Taking the link ① of FIG. 2 as an example, the network devices 201 and 203 connected to the link ① operate as a transmission-side network device for transmitting traffic or as a reception-side network device for receiving traffic. Accordingly, the traffic leak detection apparatus 100 selects one network device 201 or 203 from among the network devices 201 and 203 connected to the link ① as the receiving-side network device 201 or 203 . And, based on the traffic information collected from the selected network device 201 or 203, the real-time rate of change is monitored.

Referring to FIG. 4 , the traffic information collecting unit 103 collects or calculates the traffic share P1 of each link in units of unit time, for example, 5 minutes.

The traffic leak detection unit 101 calculates a standard deviation (a) between links based on the traffic share (P1). Then, the real-time change rate of traffic per unit time is calculated using the standard deviation (a) between links. In this case, the real-time traffic change rate is an absolute value of a value calculated as shown in Equation 1 below. The real-time rate of change is calculated as in Equation 1.

Here, a is the traffic standard deviation per unit time of a plurality of links, and b is the moving average of the critical time of the standard deviation.

For example, in Equation 1, the unit time may be 5 minutes and the threshold time may be set to 15 minutes.

The traffic leak detection unit 101 determines whether the monitored real-time rate of change (S103) is equal to or greater than a threshold (S105).

As for the threshold of the traffic time change rate, the traffic time change rate in the same time zone one week ago may be set, or 100% may be set as a default value. Assuming that the threshold is set to 100%, since the real-time rate of change a-b in the section '01:00 to 01:25' of FIG. 4 is greater than or equal to the threshold, it is detected that a traffic leak has occurred. Here, since the real-time rate of change (a-b) is a value of a continuous time interval, it is included in the traffic leak detection interval even if it is less than 100% at a specific time.

If the traffic leak detection unit 101 is less than the threshold, it starts again from step S101. On the other hand, if it is equal to or greater than the threshold, a link whose traffic amount is equal to or less than the average traffic of the plurality of links from among the plurality of links is searched for (S107). It can be seen that in the section '01:00 to 01:25' in which the traffic leak is detected, the traffic share P1 of Link 1 is significantly lower than that of other links. Accordingly, link 1 is searched.

The traffic average may be changed according to the number of multi-links, load balancing characteristics, link bandwidth, and the like.

The traffic leak detection unit 101 checks the connection state of the searched link (S107) (S109). As described above, the link state includes a physical link state and a logical link state of the link.

The traffic leak detection unit 101 determines whether the physical connection states of both ends of the link are all down (S111). The traffic leak detection unit 101 determines whether the interface modules of the network devices (200 in FIG. 1, 201, 203 in FIG. 2) connected to both ends of the link are all down (S111).

If the traffic leak detection unit 101 is in the down state in step S111, since it is in the link down state, it is determined that the traffic leak is not in the normal state (S113).

On the other hand, if the traffic leak detection unit 101 is not in the down state in step S111, it is determined whether the routing protocol states of both ends of the link are all down (S115).

If the traffic leak detection unit 101 is all down in step S115, since the link found in step S107 is in a down state, it determines that the link is in a normal state rather than a traffic leak (S113).

On the other hand, if all are not in the Down state in step S115, since one end is in the Up state, the network equipment in the Up state (200 in FIG. 1, 201 or 203 in FIG. 2) has a valid link (Alive). ) and transmits the traffic to the other side. However, the opposite network device (200 in FIG. 1 , 201 or 203 in FIG. 2 ) cannot receive traffic because the link is down. That is, traffic continues to be lost on that link. Therefore, it is necessary to determine whether both ends of the link are in a down state or one end is connected.

When it is determined that one end of the link is in a connected state, the traffic leak detection unit 101 determines whether a traffic difference between both ends of the link is equal to or greater than a threshold (S119).

If it is not higher than the threshold in step S119, that is, less than the threshold, the traffic leak detection unit 101 determines that the link, that is, the link discovered in step S107, is not a traffic leak but in a traffic leak warning (dangerous) state (S121) ). On the other hand, if it is greater than or equal to the threshold in step S119, the traffic leak detection unit 101 determines that the link found in step S107 is a traffic leak (S123).

The traffic leak detection unit 101 transmits the determination result of steps S113, S121, and S123 and the information collected in step S101 to the learning unit 109 to request learning (S125).

As mentioned above, in FIG. 5, the automated learning process of the cause of traffic leakage has been described.

In addition, in another embodiment, it is also possible to manually learn the cause of the traffic leak.

Referring to FIG. 7 , when a triggering event specifying a plurality of traffic leak causes input by an operator occurs ( S201 ), the traffic leak detection unit 101 is selected as a monitoring target through the collection units 103 , 105 , and 107 . Traffic information, system log information, and status information are collected from network devices ( 200 in FIG. 1 and 201 and 203 in FIG. 2 ) connected to both ends of a plurality of links ( S203 ). Then, the collected information and the triggering event are transferred to the learning unit 109 to request learning (S205).

That is, the operator can create various causes of traffic leakage and create a learning model based on the traffic information, system log information, and status information at that time.

Again, referring to FIG. 3 , the learning unit 109 generates a learning model for traffic leak detection and stores it in the learning model DB 111 .

The learning unit 109 trains the learning model by using the link state information, equipment state information, and traffic information collected from the receiving-side network equipment 200 connected to the link in which the traffic leak is detected in the same manner as in FIG. 5 .

In addition, the learning unit 109 learns the cause of the traffic leak in the same manner as in FIG. 7 . For example, when an operator arbitrarily induces link disconnection, link state information, equipment state information, and traffic information collected from network devices (200 in FIG. 1, 201 and 203 in FIG. 2) connected to both ends of the broken link to train the learning model. The learning algorithm uses a deep learning algorithm, and as an example of the deep learning algorithm, classification techniques such as support vector machine (SVM) and naive Bayes classification may be used. However, the present invention is not limited thereto, and various deep learning algorithms may be used.

The learning model generated by the learning unit 109 includes a plurality of feature vectors for each type of traffic leak. The traffic leak detection unit 107 determines a traffic leak type corresponding to a traffic leak state by using the learning model. For example, traffic leak types can be divided into link shutdown (Shutdown) and IGP shutdown. In addition, it can be divided into detailed cases within link shutdown and IGP shutdown.

The traffic leak detection unit 107 inputs information collected from each of the traffic information collection unit 101, the system log information collection unit 103, and the equipment state information collection unit 105 into the learning model to classify or decide

Here, the learning model is shown in FIG. 6 . Referring to FIG. 6 , in the learning model, feature vectors (F) for each classification (C) are recorded for each index (I) representing various cases.

Classification (C) includes a steady state (w1) and a traffic leak (w2). The steady state w1 is subdivided into normal types, such as module replacement, transmission path passing, and general. Normal indicates that the connection is valid. Module replacement and transmission line traversal may correspond to cases in which the operator arbitrarily cuts off a specific link or changes the transmission line.

The traffic leak w2 is subdivided into a traffic leak and a traffic leak alert.

Feature vector (F) is CRC (F1), Syslog ISIS restarted (F2), Interface status (F3), ISIS status (F4), CRC count increase/decrease (F5), ECMP section traffic share (F6), CRC/ISIS syslog generation It may include at least one of a link traffic share (F7) and a traffic change rate (F8). This feature vector (F) includes values corresponding to each type of classification (C).

The traffic change rate F8 may include the traffic standard deviation (a), moving average (b), real-time rate of change (a-b), etc. described with reference to FIG. 4 .

It is possible to detect a change in standard deviation on multi-links due to intentional interface module down, IGP shutdown, transmission path failure, etc., that is, an abnormality in traffic real-time change rate. However, it is not reliable enough to take immediate automatic action based on this.

Therefore, an operator can arbitrarily create such a case to perform a traffic leak detection operation and train a learning model using the traffic information, system log information, and status information at that time. That is, the learning unit 109 may generate a learning model that secures reliability for each exact case intended by the operator. In addition, if a large amount of data over a long period of time is learned, not only automatic diagnosis when a traffic leak occurs, but also an automatic action can be taken immediately without waiting for the operator's judgment.

Referring again to FIG. 3 , when a traffic leak is detected, the network device controller 113 leaks traffic to at least one network device ( 200 in FIG. 1 and 201 and 203 in FIG. 2 ) connected to the link in which the traffic leak is detected. Sends the action action command defined in the type. The network equipment (200 in FIG. 1, 201, 203 in FIG. 2) that has received the action action command automatically performs device settings such as network setup according to the action action command, or action action commands that the operator can check on the display screen to output

The user interface unit 115 includes means for outputting an audible notification such as a speaker and a means for outputting a visual notification such as a display screen. The user interface unit 115 notifies the operator by aurally or visually outputting the detection result of the traffic leak detection unit 101 .

8 is a flowchart illustrating a traffic leak detection operation according to another embodiment of the present invention, and illustrates a traffic leak detection operation using the learning model of the traffic leak detection unit 101 of FIG. 3 .

Referring to FIG. 8 , the traffic leak detection unit 101 receives traffic information, system log information, and status from network devices ( 200 in FIG. 1 , 201 and 203 in FIG. 2 ) through the collection units 103 , 105 , and 107 . Information is collected in real time or periodically (S301). In this case, the network devices 200 in FIG. 1 and 201 and 203 in FIG. 2 are not limited to both ends of the link, and may be network devices connected to one end of the link.

The traffic leak detection unit 101 inputs the information collected in step S301 to the learning model stored in the learning model DB 111 to determine whether or not to leak traffic and the type of traffic leak (S303). The traffic leak detection unit 101 outputs the result determined in step S303 to the user interface unit 115 (S305).

The traffic leak detection unit 101 determines whether it is determined as a traffic leak in step S303 (S307). As a result of determining that the normal state is not a traffic leak, step S301 is restarted.

On the other hand, if it is determined as a traffic leak, the operation command defined in the traffic leak type determined in step S303 is transmitted to at least one network device (200 in FIG. 1, 201, 203 in FIG. 2) connected to the link in which the traffic leak is detected. do (S309).

In addition, the learning unit 109 updates the learning model together with the determination result of step S303 with the information collected in step S301 to increase the reliability of the learning model.

Here, before applying the learning model to all collected information, the traffic leak detection unit 101 may use a method of selectively applying the learning model only when an abnormality is detected in the traffic change rate. This embodiment is shown in FIG. 9 .

9 is a flowchart illustrating a traffic leak detection operation according to another embodiment of the present invention, and shows another embodiment of steps S301 and S303 in the traffic leak detection operation of FIG. 8 .

Referring to FIG. 9 , the traffic leak detection unit 101 monitors the real-time rate of change of traffic for each link based on the traffic information, system log information, and status information collected ( S401 ) through the collection units 103 , 105 , and 107 . do (S403).

The traffic leak detection unit 101 determines whether the real-time change rate of the monitored traffic is equal to or greater than a threshold (S405).

If the real-time change rate is less than the threshold, the traffic leak detection unit 101 restarts step S401. On the other hand, if the real-time rate of change is equal to or greater than the threshold, a link whose traffic deviation is equal to or greater than the threshold and whose traffic occupancy is equal to or less than the average is searched among links having a real-time rate of change equal to or greater than the threshold (S407). Steps S405 and S407 are the same as steps S105 and S107 of FIG. 5 , and thus a detailed description thereof will be omitted.

The traffic leak detection unit 101 determines whether or not traffic leaks by inputting the system log information and state information of the link discovered in step S407 to the learning model (S409).

Meanwhile, FIG. 10 is a hardware block diagram of a traffic leak detection apparatus according to another embodiment of the present invention, and shows the hardware configuration of the traffic leak detection apparatus 100 described with reference to FIGS. 1 to 9 .

Referring to FIG. 10 , the traffic leak detection device 400 includes a communication device 401 , a memory 403 , a storage device 405 , and at least one processor 407 . The communication device 401 is connected to at least one processor 407 to transmit/receive data. The memory 403 is connected to the at least one processor 407 and stores a program including instructions for executing the configuration and/or method according to the embodiments described with reference to FIGS. 1 to 9 . The program implements the present invention in combination with hardware such as a memory 403 , a storage device 405 and at least one processor 407 .

Although the embodiments of the present invention have been described in detail above, the scope of the present invention is not limited thereto, and various modifications and improvements by those skilled in the art using the basic concept of the present invention as defined in the following claims are also provided. is within the scope of the right.

Claims (12)

A method for automatically detecting a traffic leak by an automatic traffic leak detection device operated by at least one processor, the method comprising:
At least one of a normal state, a traffic leak state, and a traffic leak warning state corresponding to the learning data is determined by using the traffic difference between the network devices connected to both ends of the plurality of links to be monitored and the link connection state of the network devices as learning data. creating a learning model that
collecting a traffic difference and link connection status for each of the plurality of links from network devices connected to the plurality of links; and
determining whether a traffic leak occurs among the plurality of links by inputting the collected traffic difference and link connection state to the learning model
A traffic leak detection method comprising a. In claim 1,
The generating step is
Among the links in which the real-time change rate of traffic is greater than or equal to the threshold, if one end of a specific link whose traffic deviation is equal to or greater than the threshold and whose traffic share is less than or equal to the average, the particular link is determined to be a traffic leak, and both ends of the link If the down state, generating a learning model that determines the specific link as a normal state, traffic leak detection method. In claim 2,
The generating step is
If one end of both ends of the specific link is in a link-connected state and the traffic difference between both ends of the specific link is greater than or equal to a threshold, it is determined as a traffic leak;
If the traffic difference is less than a threshold, create a learning model to determine a traffic leak warning,
The determining step is
A traffic leak detection method for determining a link in which a traffic leak occurs and a traffic leak type among the plurality of links by using the learning model. In claim 1,
The generating step is
When a traffic leak occurs according to the cause of the traffic leak by various traffic leak causes, a learning model is created using the traffic difference, system log information, and link connection status collected from network devices connected to both ends of a plurality of links as training data, and ,
The determining step is
A traffic leak detection method for determining a link in which a traffic leak occurs among the plurality of links and a cause of the traffic leak by using the learning model. In claim 3,
The link connection state is
including network equipment status and routing protocol status;
The generating step is
If both ends of the specific link are in a link-down state, it is determined that the specific link is in a normal state,
By using the network equipment state and routing protocol state in the normal state for each type of link down as training data, the learning model is generated,
The determining step is
A traffic leak detection method for determining a link-down normal state and a link-down type by inputting the network equipment state and routing protocol state collected from the network equipment into the learning model. delete In claim 1,
After the determining step,
generating a work command for resolving a traffic leak defined in the traffic leak type and transmitting it to at least one network device connected to a specific link in which a traffic leak is detected;
Further comprising, a traffic leak detection method. In claim 7,
After the determining step,
Outputting a result of determining whether the traffic leak exists and the traffic leak type as a visual alarm or an audible alarm through a user interface
Further comprising, a traffic leak detection method. A communication device constituting a service network and connected to a plurality of network devices connected by a plurality of links to transmit/receive information to and from the plurality of network devices;
a memory for storing a program for detecting whether a traffic leak occurs in the plurality of links using a learning model; and
at least one processor executing the program;
The program is
Using the traffic difference and link connection state of the plurality of network devices as training data to generate a learning model that determines at least one traffic leak type of a normal state, a traffic leak state, and a traffic leak warning state corresponding to the learning data, and ,
Includes instructions for determining whether traffic leakage occurs in the plurality of links by inputting the traffic difference and link connection state collected for each of the plurality of links from network devices connected to the plurality of links into the learning model which, an automatic traffic leak detection device. In claim 9,
The program is
When a traffic leak occurs according to a plurality of traffic leak causes input by an operator, the traffic difference, system log information, and link connection status collected from network devices connected to both ends of a plurality of links are displayed as learning data for each cause of the plurality of traffic leaks. to create a training model using
A traffic leak automatic detection device comprising instructions for determining the source of a traffic leak based on the traffic difference, system log information, and link connection status collected from network devices connected to both ends of a plurality of links selected as monitoring targets in real time or periodically . In claim 10,
The program is
The real-time change rate of traffic at both ends of the plurality of links is monitored, and if the real-time rate of change is equal to or greater than a threshold, if both ends of a specific link lower than the average value of the traffic occupancy of the plurality of links are both down, the specific link is set to a normal state. to be determined,
If one end of both ends of the specific link is in an up state, it is determined whether the traffic difference between both ends of the specific link is equal to or greater than a threshold, and if it is equal to or greater than the threshold, the specific link is determined to be in a traffic leak state; Containing instructions for generating a learning model to determine the traffic leak warning state, traffic leak automatic detection device. In claim 9,
Further comprising a user interface for outputting information according to the operation of the program visually or audibly,
The program is
Outputs the traffic leak type determined using the learning model to the user interface unit,
and instructions for transmitting an operation command according to the traffic leak type to at least one network device connected to a corresponding link when the traffic leak type is determined to be a traffic leak state or a traffic leak warning state.

Images