KR102391342B1 - Optical cable hacking surveilance system and hacking surveilance method using the same - Google Patents

Abstract

The present invention relates to an optical cable hacking monitoring system and a hacking monitoring method using the optical cable hacking monitoring system including: at least one network switch connected with an optical cable to configure a communication network; an optical cable hacking monitoring unit measuring the optical signal transmission loss of the optical cable connected to the network switch and outputting a transmission loss pattern based on the measured transmission loss; a packet data collecting unit mirroring and collecting packet data transmitted and received through the network switch; and a monitoring unit analyzing the transmission loss pattern received from the optical cable hacking monitoring unit to monitor the occurrence of non-occurrence of an abnormal optical cable event. In a case where the abnormal event is identified as a hacking attempt, the monitoring unit receives from the packet data collecting unit and stores data transmitted and received through the network switch connected to the optical cable for a certain amount of time (t) preceding and following the occurrence of the event.

Description

Optical cable hacking monitoring system and hacking monitoring method using the same

The present invention relates to an optical cable hacking monitoring system and a hacking monitoring method using the same, and more particularly, an optical cable hacking monitoring system capable of automatically storing data before and after a hacking attempt event occurs by monitoring whether an optical cable is hacked or not, and using the same It is about hacking monitoring method.

Most wired communication networks are connected with optical cables, and various infrastructure facilities in the industrial field provide various services in connection with optical communication networks. Various hacking attempts are taking place on optical cables by taking advantage of the fact that it is not easy to manage optical cables connected over a wide area.

For example, hacking of data being transmitted by illegally bending an optical cable to detect only a part of an optical signal, or optical cable hacking in which a hacking wavelength is incident on an optical cable to disturb communication, etc. is being performed.

Optical cable hacking detects and demodulates optical signals transmitted/received through optical cables, thereby leaking data on optical signals, disrupting optical signals transmitted and receiving via optical cables, causing communication service failure, illegal use of FTTH services, etc. cause the problems of

In the case of hacking on servers, computers, and network devices, communication data for each unit is hacked, whereas hacking on optical cables detects optical signals transmitted and received through optical cables, so there is a problem in that a lot of communication data is hacked at once.

Republic of Korea Patent Publication No. 10-2019-0047278 (2019.05.08)

The present invention provides an optical cable hacking monitoring system capable of automatically storing data before and after a hacking attempt event occurs by monitoring whether an optical cable is hacked, and a hacking monitoring method using the same.

The present invention provides an optical cable hacking monitoring system capable of adaptively adjusting a data storage period according to the amount of data traffic, and a hacking monitoring method using the same.

The present invention provides an optical cable hacking monitoring system capable of automatically storing data before and after a hacking attempt event occurs by blindly processing sensitive data and a hacking monitoring method using the same.

The optical cable hacking monitoring system according to the present invention is at least one network switch connected with an optical cable to configure a communication network, and measures the optical signal transmission loss of the optical cable connected to the network switch, and a transmission loss pattern based on the measured transmission loss An optical cable hacking monitoring unit that outputs, a packet data collection unit that mirrors and collects packet data transmitted and received through the network switch, and analyzes the transmission loss pattern received from the optical cable hacking monitoring unit to monitor whether an abnormal event occurs in the optical cable And, when the abnormal event is identified as a hacking attempt, a monitoring unit for receiving and storing data transmitted and received through a network switch connected to the optical cable for a predetermined time (t) before and after the occurrence of the corresponding event from the packet data collection unit. .

In one embodiment, the optical cable hacking monitoring unit is connected to one end of the optical cable, and generates and outputs a reflection filter that reflects a line monitoring optical signal of a first wavelength among the received optical signals, a line monitoring optical signal of a first wavelength, In the optical time domain reflectometer module (OTDR), the optical time domain reflectometer module receives the line monitoring optical signal of the first wavelength reflected by the reflection filter through the optical cable and measures the transmission loss. A wavelength division multiplexing module (WDM) that multiplexes the received first wavelength line monitoring optical signal and the second wavelength data transmission optical signal and transmits it through the optical cable, and transmission received from the optical time domain reflectometer module and a processing module for calculating a transmission loss pattern based on the loss.

In one embodiment, the reflection filter comprises a high reflection boundary filter (FBG HRD Filter).

In an embodiment, the first wavelength may correspond to a line monitoring wavelength of 1610 nm to 1650 nm.

In an embodiment, the second wavelength may correspond to a data transmission wavelength of a 1550 nm band.

In an embodiment, the packet data collection unit may store the mirrored packet data in real time, but classify sensitive data included in the corresponding packet data and perform blind processing.

In one embodiment, the packet data collection unit deletes the corresponding packet data when a preset time has elapsed based on the time at which the packet data is stored, but does not delete the data for a predetermined time before and after the abnormal event occurs in the optical cable. can keep

In an embodiment, the monitoring unit may monitor whether the abnormal event occurs by comparing the transmission loss pattern with a pre-input pattern or a pattern learned through machine learning.

In one embodiment, the abnormal event may include a hacking attempt and abnormal state occurrence in the optical cable.

In an embodiment, the monitoring unit may store packet data and log records received from the packet data collection unit in a data storage server.

In one embodiment, the monitoring unit transmits abnormal event information to a previously registered terminal when the abnormal event occurs, wherein the abnormal event information includes at least one of an event occurrence time, an event occurrence location, and packet data transmitted and received at the event occurrence time. may include

In an embodiment, the monitoring unit may display the abnormal event information on a screen when the hacking attempt occurs, but visualize and display the abnormal event information on a GIS-based map.

In an embodiment, the monitoring unit may set the predetermined time t variably according to the amount of data traffic of the optical cable in which the hacking attempt has occurred.

In an embodiment, the monitoring unit may set the predetermined time t based on the data traffic amount and the duration of the pattern corresponding to the hacking attempt.

In an embodiment, the monitoring unit may set the predetermined time t through Equation 1 below.

[Equation 1]

t = P(1+B _pattern ) + αf(T _threshold - ∑)

Here, P is the duration of the pattern, B _pattern is the buffer time ratio for each pattern, α is the traffic compensation coefficient, f() is the time matching function according to the traffic volume section, T _threshold is the data traffic volume threshold, and ∑ is the current It is the sum of data traffic volume up to n (preset values) in the past based on .

The optical cable hacking monitoring method according to the present invention comprises the steps of: an optical cable hacking monitoring unit measuring an optical signal transmission loss of an optical cable connected to a network switch, and outputting a transmission loss pattern based on the measured transmission loss; Mirroring and collecting packet data transmitted and received through the monitoring unit, analyzing the transmission loss pattern received from the optical cable hacking monitoring unit to monitor whether an abnormal event occurs in the optical cable, and the abnormal event is identified as a hacking attempt In this case, the monitoring unit receives and stores data transmitted/received through a network switch connected to the corresponding optical cable from the packet data collection unit for a predetermined time (t) before and after the occurrence of the corresponding event.

In an embodiment, the optical cable hacking monitoring method may further include transmitting, by the monitoring unit, abnormal event information to a previously registered terminal when the abnormal event occurs.

As described above, the optical cable hacking monitoring system and the hacking monitoring method using the optical cable hacking monitoring system according to the present invention can monitor whether an optical cable is hacked and automatically store data before and after the hacking attempt event occurs.

The optical cable hacking monitoring system and the hacking monitoring method using the same according to the present invention can adaptively adjust the data storage period according to the amount of data traffic.

When the optical cable hacking monitoring system and the hacking monitoring method using the optical cable hacking monitoring system according to the present invention automatically store data before and after the hacking attempt event occurs, sensitive data can be blindly processed and stored.

1 is a diagram showing a self-communication network built through an optical cable and a network switch;
2 is a configuration diagram schematically showing an optical cable hacking monitoring system according to an embodiment of the present invention;
3 is a configuration diagram schematically showing the configuration of the optical cable hacking monitoring unit of FIG.
4 is a configuration diagram schematically showing the configuration of the packet data collection unit of FIG.
5 is a configuration diagram schematically showing the configuration of the monitoring unit of FIG.
6 is a flowchart illustrating a method for monitoring optical cable hacking according to an embodiment of the present invention;
7 is a flowchart illustrating in detail an optical cable hacking monitoring method according to an embodiment of the present invention;

Hereinafter, specific details for implementing the optical cable hacking monitoring system and the hacking monitoring method using the same according to the present invention will be described as follows.

1 is a diagram showing a self-communication network established through an optical cable and a network switch.

Referring to FIG. 1 , a separate communication network may be formed between a main office and a branch office by using a self-communication network established through an optical cable and a network switch. The self-contained communication network may be composed of at least one or more network switches 110 and an optical cable 120 connecting between the network switches 110. The self-contained communication network does not use a communication network provided by a communication service provider, but is a service for implementing services. It refers to a communication network built by the main body directly at the cost of construction.

The self-communication network of FIG. 1 is a self-communication network configured through five network switches 110a, 110b, 110c, 110d, and 110e and an optical cable. Optical cables may have abnormal conditions due to physical errors, and optical cable hacking by unauthorized third parties may occur. Therefore, an operator who manages their own network must monitor the status of optical cables. In particular, optical cable hacking may cause serious damage to business or services because it may leak data transmitted/received through an optical cable or disrupt optical signals transmitted/received through an optical cable, thereby disrupting communication services.

2 is a configuration diagram schematically showing an optical cable hacking monitoring system according to an embodiment of the present invention.

Referring to FIG. 2 , the optical cable hacking monitoring system 200 includes an optical cable hacking monitoring unit 210 , a packet data collecting unit 220 , and a monitoring unit 230 .

The optical cable hacking monitoring system 200 monitors the optical cable 120 connecting between the network switches 110 , and monitors whether an abnormal event occurs in the optical cable 120 . The optical cable hacking monitoring system 200 may monitor the optical cable 120 between each network switch 110 .

The optical cable hacking monitoring unit 210 measures the optical signal transmission loss of the optical cable connected between the network switches 110c and 110d, and outputs a transmission loss pattern based on the measured transmission loss. Optical cable hacking monitoring unit 210 includes a reflection filter 212, a wavelength division multiplexing module (WDM, Wavelength Division Multiplexing) 214, an optical time domain reflectometer module (OTDR, Optical Time Domain Reflectometer) 216 and a processing module ( 218).

The reflection filter 212 is connected to one end of the optical cable and reflects the line monitoring optical signal of the first wavelength among the received optical signals. In one embodiment, the reflection filter 212 may be a high reflection boundary filter (FBG (Fiber Bragg Grating) HRD Filter) that reflects only an optical signal of a specific band and transmits an optical signal of the other band. For example, reflection The filter 212 may reflect only the line monitoring optical signal of the first wavelength and transmit the data transmission optical signal.

The wavelength division multiplexing module (WDM, Wavelength Division Multiplexing) 214 multiplexes the data transmission optical signal of the second wavelength and the line monitoring optical signal of the first wavelength received from the optical time domain reflectometer module 216 and transmits it through an optical cable. do. In an embodiment, the first wavelength may be a line monitoring wavelength of 1610 nm to 1650 nm, and the second wavelength may be a data transmission wavelength of a 1550 nm band. The corresponding wavelength is an embodiment, and other wavelengths may be used according to embodiments can In one embodiment, the wavelength division multiplexing module 214 may be located at one end of the optical cable, and the reflection filter 212 may be located at the other end opposite to the optical cable.

The optical time domain reflectometer module 216 generates and outputs a line monitoring optical signal of a first wavelength, and receives the line monitoring optical signal of the first wavelength reflected and received by the reflection filter 212 through an optical cable, resulting in transmission loss measure

The processing module 218 calculates a transmission loss pattern based on the transmission loss received at the optical time domain reflectometer module 216 . In an embodiment, the processing module 218 converts the measured transmission loss pattern based on the reflected and returned optical signal into data and transmits the data to the monitoring unit 230 .

The packet data collection unit 220 stores packet data by mirroring packet data transmitted and received through the network switch 110c. The packet data collection unit 220 stores the mirrored packet data in real time, but classifies sensitive data included in the corresponding packet data and performs blind processing. The packet data collection unit 220 deletes the packet data when a preset time has elapsed based on the time at which the packet data is stored. For example, the packet data collection unit 220 stores packet data for 30 days, and packet data stored 30 days before the current point in time may be deleted from the oldest data according to the storage capacity. In an embodiment, the packet data collection unit 220 may not delete data for a predetermined time before and after the abnormal event occurs in the optical cable even after a preset time has elapsed.

The packet data collection unit 220 includes a packet data processing module 222 and a packet data server 224 . The packet data processing module 222 classifies packet data according to a predetermined rule, and stores the classified data in the packet data server 224 . For example, the packet data processing module 222 includes a preset pattern (eg, personal information (resident number, phone number, address, etc.) pattern, financial information (account number, public authentication, etc.) pattern, confidential information (public Sensitive data including public documents, etc.) patterns, etc.) can be classified, and the sensitive data can be blindly processed so that only authenticated users can check it.

The packet data processing module 222 stores packet data received from the packet data processing module 222 .

The monitoring unit 230 analyzes the transmission loss pattern received from the optical cable hacking monitoring unit 210 to monitor whether an abnormal event occurs in the optical cable. In one embodiment, the abnormal event includes a hacking attempt in the optical cable and the occurrence of an abnormal state.

When the abnormal event is identified as a hacking attempt, the monitoring unit 230 collects data transmitted and received through the network switch 110c connected to the optical cable for a predetermined time (t) before and after the occurrence of the corresponding event, the packet data collection unit 220 and stores the data received from the packet data collection unit 220 .

In an embodiment, the monitoring unit 230 may monitor whether an abnormal event occurs by comparing a stored pattern input by an operator or a designer in advance or a stored pattern received from a system of a security company and a transmission loss pattern. In another embodiment, the monitoring unit 230 may monitor whether an abnormal event occurs by comparing the pattern learned through machine learning with the transmission loss pattern.

The monitoring unit 230 stores packet data and log (lob) data received from the packet data collection unit 220 in a data storage server.

The monitoring unit 230 may transmit abnormal event information to the previously registered terminal 236 when an abnormal event occurs. In an embodiment, the abnormal event information may include at least one of an event occurrence time, an event occurrence location, and packet data transmitted/received at an event occurrence time.

When the abnormal event is identified as a hacking attempt, the monitoring unit 230 may display abnormal event information corresponding to the identified hacking attempt on the screen. In an embodiment, the monitoring unit 230 may visualize and display the corresponding abnormal event information on a Geographic Information System (GIS)-based map.

The monitoring unit 230 includes a monitoring processing module 232 and a data storage server 234 . The monitoring processing module 232 analyzes the transmission loss pattern received from the optical cable hacking monitoring unit 210 to monitor whether an abnormal event occurs in the optical cable, and the data storage server 234 is received from the packet data collection unit 220 . Stored packet data and log (lob) data in the data storage server.

3 is a configuration diagram schematically showing the configuration of the optical cable hacking monitoring unit of FIG.

Referring to FIG. 3, FIG. 3 is an example showing the configuration of the optical cable hacking monitoring unit 210 composed of 4 channels. The number of channels may be extended according to implementation examples. For example, it is possible to implement the 12-channel optical table hacking monitoring unit 210 in a 19-inch 2U Rack type. Hereinafter, for convenience of explanation, the optical cable hacking monitoring unit 210 composed of 4 channels will be described as an example.

The optical cable hacking monitoring unit 210 consisting of 4 channels is a reflection filter (212a, 212b, 212c, 212d), a wavelength division multiplexing (WDM) module (4 channels) 214, an optical time domain reflectometer (OTDR) module 216a , 216b, 216c, 216d) and a processing module 218 . The processing module 218 includes a power supply module 310 , a first networking module 312 , a data logging module 314 , and a second networking module 316 .

The optical cable hacking monitoring unit 210 measures the optical signal transmission loss of the optical cable in 4 channels, and outputs a transmission loss pattern of each channel based on the measured transmission loss. In one embodiment, the optical cable hacking monitoring unit 210 may measure the optical signal transmission loss for one optical cable by using all four channels, and by allocating one channel for each optical cable, optical signal transmission for a total of four optical cables Loss can also be measured.

The reflection filters 212a, 212b, 212c, and 212d correspond to each channel and are installed at one end of the optical cable. The reflection filters 212a, 212b, 212c, and 212d reflect only the line monitoring optical signal and transmit the data transmission optical signal. In an embodiment, a reflection filter that reflects an optical signal of the same wavelength may be used for the reflection filters 212a, 212b, 212c, and 212d. In another embodiment, each of the reflection filters 212a, 212b, 212c, and 212d may be a reflection filter that reflects optical signals of different wavelengths. For example, the first reflection filter 212a reflects the optical signal of the third wavelength, the second reflection filter 212b reflects the optical signal of the fourth wavelength, and the third reflection filter 212c reflects the optical signal of the fifth wavelength. The optical signal of the wavelength may be reflected, and the fourth reflective filter 212d may reflect the optical signal of the sixth wavelength.

The wavelength division multiplexing (WDM) module 214 multiplexes the data transmission optical signal and the line monitoring optical signal received from the optical time domain reflectometer module (OTDR) 216a, 216b, 216c, and 216d, and transmits it through an optical cable. The wavelength division multiplexing module 214 may be located at one end of the optical cable, and the reflection filters 212a, 212b, 212c, and 212d may be located at the other end opposite to the optical cable.

The 4-channel wavelength division multiplexing module 214 may transmit the multiplexed optical signal through 4 channels. In one embodiment, the wavelength division multiplexing module 214 multiplexes the data transmission optical signal of the line monitoring optical signal of the same wavelength and transmits it through four optical cables. For example, the wavelength division multiplexing module 214 multiplexes the line monitoring optical signal of the first wavelength and the data transmission optical signal of the second wavelength received from the first optical time-domain reflectometer module 216a, and transmits it through the first optical cable. and multiplexing the line monitoring optical signal of the first wavelength and the data transmission optical signal of the second wavelength received from the second optical time-domain reflectometer module 216b and transmitting it through a second optical cable, and the third optical time-domain reflectometer The line monitoring optical signal of the first wavelength received by the module 216c and the data transmission optical signal of the second wavelength are multiplexed and transmitted through a third optical cable, and the first optical signal received by the fourth optical time domain reflectometer module 216d is multiplexed. The line monitoring optical signal of the wavelength and the data transmission optical signal of the second wavelength may be multiplexed and transmitted through the fourth optical cable.

In another embodiment, the wavelength division multiplexing module 214 multiplexes the data transmission optical signal of the line monitoring optical signal of each different wavelength and transmits the data through the same optical cable or a different optical cable. For example, the wavelength division multiplexing module 214 multiplexes the line monitoring optical signal of the third wavelength and the data transmission optical signal of the second wavelength received from the first optical time domain reflectometer module 216a, and transmits it through an optical cable. , multiplexes the line monitoring optical signal of the fourth wavelength and the data transmission optical signal of the second wavelength received from the second optical time-domain reflectometer module 216b and transmits it through an optical cable, and the third optical time-domain reflectometer module 216c ) multiplexes the line monitoring optical signal of the fifth wavelength and the data transmission optical signal of the second wavelength, and transmits it through an optical cable, and the line monitoring light of the sixth wavelength received by the fourth optical time domain reflectometer module 216d The signal and the data transmission optical signal of the second wavelength can be multiplexed and transmitted through an optical cable.

In addition, the wavelength division multiplexing module 214 transmits the received line monitoring optical signal reflected by the reflection filters 212a, 212b, 212c, and 212d to the optical time domain reflectometer modules 216a, 216b, 216c, 216d. . In one embodiment, the wavelength division multiplexing module 214 divides the wavelength of the reflected and received line monitoring optical signal and transmits it to the optical time domain reflectometer modules 216a, 216b, 216c, and 216d corresponding to the wavelength. . In another embodiment, when the multiplexed optical signal is transmitted by time division, the wavelength division multiplexing module 214 divides the time at which the reflected line monitoring optical signal is received, and reflects the optical time domain corresponding to the reception time. It can be transmitted to the system module (216a, 216b, 216c, 216d).

Optical time domain reflectometer module (OTDR) 216a, 216b, 216c, 216d generates and outputs a line monitoring optical signal, and receives the received line monitoring optical signal reflected from a reflection filter through an optical cable to measure transmission loss do. For example, the first optical time domain reflectometer module 216a measures the transmission loss using the line monitoring optical signal transmitted through the first channel and the line monitoring optical signal reflected from the first reflection filter 212a and received. and the second optical time domain reflectometer module 216b measures the transmission loss using the line monitoring optical signal transmitted to the second channel and the line monitoring optical signal reflected and received by the second reflection filter 212b, The third optical time domain reflectometer module 216c measures the transmission loss using the line monitoring optical signal transmitted to the third channel and the line monitoring optical signal reflected and received by the third reflection filter 212c, and the fourth The optical time domain reflectometer module 216d measures the transmission loss using the line monitoring optical signal transmitted through the fourth channel and the line monitoring optical signal reflected and received by the fourth reflection filter 212d.

The power supply module 310 supplies power to the components of the optical cable hacking monitoring unit 210 . For example, the power supply module 310 includes a wavelength division multiplexing module 214 , an optical time domain reflectometer module (OTDR) 216a , 216b , 216c , 216d , a first networking module 312 , and a data logging module 314 . ) and the second networking module 316 may be supplied with power.

The first networking module 312 transmits the transmission loss pattern calculated based on the measured transmission loss to the monitoring processing module 232 of the monitoring unit 230, and the second networking module 316 transmits the calculated transmission loss pattern. is transmitted to the data storage server 234 of the monitoring unit 230 . The data logging module 314 generates and manages log data for the generated transmission loss pattern data.

4 is a configuration diagram schematically illustrating the configuration of the packet data collection unit of FIG. 2 .

Referring to FIG. 4 , the packet data collection unit 220 includes a packet data processing module 222 , and the packet data processing module 222 includes a packet collection module 410 , a data classification module 420 , and a data storage module. 422 , a memory management module 424 and a data transfer module 426 .

The packet data collection unit 220 mirrors and collects packet data transmitted and received through the network switch 110c. The packet data processing module 222 classifies packet data according to a predetermined rule, and stores the classified data in the packet data server 224 .

The packet collection module 410 mirrors and collects packet data transmitted and received through the network switch 110c. The data classification module 420 classifies the collected packet data according to a predetermined rule and post-processes the classified packet data according to a predetermined rule. For example, the data classification module 420 may include a preset pattern (eg, personal information (resident number, phone number, address, etc.) pattern, financial information (account number, public authentication, etc.) pattern, confidential information (public institution). Sensitive data including public documents, etc.) patterns, etc.) can be classified, and the sensitive data can be blinded so that only authenticated users can check it.

The data storage module 422 stores the classified data in the packet data server 224 . The memory management module 424 classifies data in the packet data processing module 222 and manages a memory for temporarily storing the packet data for processing.

The data transmission module 426 may transmit packet data to the monitoring processing module 232 according to the request of the monitoring unit 230 . For example, when the monitoring unit 230 requests data transmitted and received through the network switch connected to the optical cable where the event occurred for a predetermined time (t) before and after the occurrence of the event identified as hacking attempt, the data transmission module 426 ) may transmit packet data for the corresponding time to the monitoring processing module 232 .

FIG. 5 is a configuration diagram schematically illustrating the configuration of the monitoring unit of FIG. 2 .

Referring to FIG. 5 , the monitoring unit 230 includes a data parsing module 510 , an optical cable condition diagnosis module 520 , a display module 530 , a packet storage module 540 , and a data storage server 550 . include

The data parsing module 510 parses the transmission loss pattern data received from the optical cable hacking monitoring unit 210 . The optical cable condition diagnosis module 520 analyzes the received transmission loss pattern and monitors whether an abnormal event occurs in the optical cable. In an embodiment, the optical cable condition diagnosis module 520 may analyze a transmission loss pattern to monitor whether a hacking attempt and an abnormal state have occurred in the optical cable. For example, the optical cable condition diagnosis module 520 may monitor whether an abnormal event occurs in the optical cable by comparing the transmission loss pattern with a pre-input pattern or a pattern learned through machine learning.

When an abnormal event is identified as a hacking attempt, the optical cable condition diagnosis module 520 transmits and receives data transmitted and received through the network switch 110c connected to the optical cable for a predetermined time (or data storage time) (t) before and after the occurrence of the corresponding event. The data is requested from the packet data collection unit 220 , and the packet storage module 540 stores the data received from the packet data collection unit 220 in the data storage server 550 . In an embodiment, the data storage server 550 may store packet data and log data received from the packet data collection unit 220 and transmission loss pattern data received from the optical cable hacking monitoring unit 210 . The data stored in the storage server 550 may be always accessed and the corresponding data may be analyzed.

In one embodiment, the data storage time (t) may be set and input by an operator or a designer. For example, when a value between 1 minute and 10 minutes is input as the data storage time (t), the optical cable state The diagnosis module 520 may request the packet data collection unit 220 for data during the data storage time t before and after the hacking attempt occurs.

In another embodiment, when identified as a hacking attempt, the optical cable condition diagnosis module 520 may variably set the data storage time t according to the amount of data traffic of the optical cable in which the hacking attempt has occurred. For example, hacking attempt If the current data traffic volume of the optical cable where the error occurs is greater than the preset value (V _{Threshold 1} ), the short time (t ₁ ) is set as the data storage time (t), and when the data traffic volume is less than the preset value (V _{Threshold 2} ) A long time (t ₂ ) can be set as the data storage time (t).

In another embodiment, the optical cable condition diagnosis module 520 may set the data storage time t based on the amount of data traffic of the optical cable in which the hacking attempt has occurred and the duration of the pattern corresponding to the hacking attempt. For example, the optical cable condition diagnosis module 520 may set the data storage time t by reflecting the duration of the hacking attempt pattern and the amount of data traffic transmitted and received through the optical cable through Equation 1 below.

[Equation 1]

t = P(1+B _pattern ) + αf(T _threshold - ∑)

Here, P is the duration of the pattern, B _pattern is the buffer time ratio for each pattern, α is the traffic compensation coefficient, f() is the time matching function according to the traffic volume section, T _threshold is the data traffic volume threshold, and ∑ is the current It represents the sum of the data traffic volume up to n (preset values) in the past based on .

The buffering time ratio for each pattern indicates the buffering time ratio that requires additional storage according to the hacking attempt pattern, and can be set and entered by an operator or designer. The traffic compensation coefficient is a compensated value determined according to the amount of traffic. The traffic compensation coefficient, time matching function, and data traffic volume threshold may be set and input by an operator or designer.

The display module 530 may display abnormal event information on the screen. In an embodiment, the display module 530 may visualize and display abnormal event information on a Geographic Information System (GIS)-based map. The abnormal event information may include at least one of an event occurrence time, an event occurrence location, and packet data transmitted/received at an event occurrence time.

For example, when a hacking attempt occurs, the display module 530 may display the location of the hacking attempt on the GIS-based map, the corresponding hacking attempt occurrence time, and information on packet data transmitted and received at the hacking attempt occurrence time.

In an embodiment, the monitoring unit 230 may further include a wireless communication module (not shown), and may transmit abnormal event information to a previously registered terminal through the wireless communication module when an abnormal event occurs. The abnormal event information includes at least one of an event occurrence time, an event occurrence location, and information about packet data transmitted and received at the event occurrence time (eg, packet data amount, data source, destination, data type, etc.).

6 is a flowchart illustrating a method for monitoring optical cable hacking according to an embodiment of the present invention.

6, the optical cable hacking monitoring unit 210 measures the optical signal transmission loss of the optical cable connected to the network switch 110, and outputs a transmission loss pattern based on the measured transmission loss (step S610). The packet data collection unit 220 mirrors and collects packet data transmitted and received through the network switch 110 (step S620).

The monitoring unit 230 analyzes the transmission loss pattern received from the optical cable hacking monitoring unit 210 to monitor whether an abnormal event occurs in the optical cable (step S630), and when the abnormal event is identified as a hacking attempt, the monitoring unit ( 230 receives and stores data transmitted/received from the packet data collection unit 220 through the network switch 110 connected to the optical cable for a predetermined time (or data storage time) t before and after the occurrence of the corresponding event.

In an embodiment, the data storage time t may be set and input by an operator or a designer. In another embodiment, when identified as a hacking attempt, the monitoring unit 230 may variably set the data storage time (t) according to the amount of data traffic of the optical cable in which the hacking attempt has occurred. For example, if the current data traffic volume of the optical cable where the hacking attempt occurred is greater than the preset value (V _{Threshold 1} ), the short time (t ₁ ) is set as the data storage time (t), and the data traffic volume is set to the preset value (V Threshold 1 ). If less than _{Threshold 2} ), a long time (t ₂ ) may be set as the data storage time (t).

In another embodiment, the monitoring unit 230 may set the data storage time (t) based on the amount of data traffic of the optical cable in which the hacking attempt has occurred and the duration of the pattern corresponding to the hacking attempt. For example, the optical cable condition diagnosis module 520 may set the data storage time t by reflecting the duration of the hacking attempt pattern and the amount of data traffic transmitted and received through the optical cable through Equation 1 below.

[Equation 1]

t = P(1+B _pattern ) + αf(T _threshold - ∑)

Here, P is the duration of the pattern, B _pattern is the buffer time ratio for each pattern, α is the traffic compensation coefficient, f() is the time matching function according to the traffic volume section, T _threshold is the data traffic volume threshold, and ∑ is the current It represents the sum of the data traffic volume up to n (preset values) in the past based on .

7 is a flowchart illustrating in detail an optical cable hacking monitoring method according to an embodiment of the present invention.

The optical cable hacking monitoring unit 210 calculates a transmission loss pattern by measuring the optical cable transmission loss (step S710), and the monitoring unit 230 detects whether an abnormal event occurs using the received transmission loss pattern (step S720) . When an abnormal event occurs, the monitoring unit 230 checks the location of the abnormal event occurrence point (step S714), and stores log data for the abnormal event (step S716). In one embodiment, the monitoring unit 230 determines the abnormality It is possible to identify the optical cable hacking monitoring unit 210 that has transmitted the transmission loss pattern in which the event has occurred, and the optical cable for which the optical cable hacking monitoring unit 210 measures transmission loss. The monitoring unit 230 may check the location of the optical cable where the abnormal event has occurred by using the network components such as network switches and optical cables and the network map in which the positions of the corresponding components are recorded.

When an abnormal event occurs, the monitoring unit 230 transmits abnormal event information to a previously registered terminal (step S718).

The packet data collection unit 220 mirrors and collects packet data transmitted and received through the network switch 110 connected to the optical cable (step S720). The packet data collection unit 220 classifies the collected packet data (step S722), and if the packet data contains sensitive data (step S724), blinds the sensitive data (step S726) and stores the packet data (step S726) ( step S728). If sensitive data is not included in the corresponding packet data (step S724), the packet data collection unit 220 stores the packet data without blind processing (step S728). The process of classifying the packet data or the blind processing of sensitive data is the same as described with reference to FIGS. 2 to 4 .

When the occurrence of an abnormal event is identified as a hacking attempt (step S730), the monitoring unit 230 transmits and receives data transmitted and received through the network switch connected to the optical cable for a predetermined time (or data storage time) (t) before and after the occurrence of the event Data is received and stored from the packet data collection unit 220 (step S732). The description of the data storage time t is the same as that described in FIG. 5 .

The monitoring unit 230 displays information about the corresponding event on the GIS-based map (step S734). For example, the monitoring unit 230 may visualize and display information on a location of a hacking attempt occurrence, a corresponding hacking attempt occurrence time, and packet data transmitted/received at a hacking attempt occurrence time point on a map.

The optical cable hacking monitoring system and the hacking monitoring method using the same described with reference to FIGS. 1 to 7 may also be implemented in the form of a recording medium including instructions executable by a computer, such as an application or module executed by a computer.

Computer-readable media can be any available media that can be accessed by a computer and includes both volatile and nonvolatile media, removable and non-removable media. Also, computer-readable media may include both computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, modules, or other data. Communication media typically includes computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave, or other transport mechanism, and includes any information delivery media.

A module may mean hardware capable of performing functions and operations according to each name described in the specification, or may mean computer program code capable of performing specific functions and operations, In addition, it may refer to an electronic recording medium, for example, a processor on which a computer program code capable of performing a specific function and operation is loaded.

Although the embodiment of the present invention has been described above, the technical idea of the present invention is not limited to the above embodiment, and various optical cable hacking monitoring systems and hacking monitoring methods using the same can be implemented without departing from the technical spirit of the present invention.

200: optical cable hacking monitoring system
210: optical cable hacking monitoring unit
220: packet data collection unit
230: monitoring unit

Claims (16)

at least one or more network switches connected by optical cables to configure a communication network;
an optical cable hacking monitoring unit that measures the optical signal transmission loss of the optical cable connected to the network switch and outputs a transmission loss pattern based on the measured transmission loss;
a packet data collection unit for mirroring and collecting packet data transmitted and received through the network switch; and
Analyzes the transmission loss pattern received from the optical cable hacking monitoring unit to monitor whether an abnormal event occurs in the optical cable, and if the abnormal event is identified as a hacking attempt, for a predetermined time (t) before and after the occurrence of the event And a monitoring unit for receiving and storing data transmitted and received through a network switch connected to the packet data collection unit,
The monitoring unit
Optical cable hacking monitoring system, characterized in that the predetermined time (t) is variably set through Equation 1 below based on the amount of data traffic of the optical cable in which the hacking attempt has occurred and the duration of the pattern corresponding to the hacking attempt .
[Equation 1]
t = P(1+B _pattern ) + αf(T _threshold - ∑)
Here, P is the duration of the pattern, B _pattern is the buffer time ratio for each pattern, α is the traffic compensation coefficient, f() is the time matching function according to the traffic volume section, T _threshold is the data traffic volume threshold, and ∑ is the current Sum of data traffic volume up to n (preset values) in the past based on According to claim 1, wherein the optical cable hacking monitoring unit
a reflection filter connected to one end of the optical cable and reflecting a line monitoring optical signal of a first wavelength among the received optical signals;
An optical time-domain reflectometer module (OTDR; Optical Time Domain Reflectometer);
a wavelength division multiplexing module (WDM) for multiplexing a line monitoring optical signal of a first wavelength and a data transmission optical signal of a second wavelength received by the optical time-domain reflectometer module and transmitting it through the optical cable; and
Optical cable hacking monitoring system, characterized in that it comprises a processing module for calculating a transmission loss pattern based on the transmission loss received from the optical time-domain reflectometer module.
The method of claim 2, wherein the reflective filter is
Optical cable hacking monitoring system, characterized in that it is a high reflection boundary filter (FBG HRD Filter).
3. The method of claim 2,
The first wavelength is a line monitoring wavelength of 1610 nm to 1650 nm,
The second wavelength is an optical cable hacking monitoring system, characterized in that the data transmission wavelength of the 1550nm band.
The method of claim 1, wherein the packet data collection unit
An optical cable hacking monitoring system, characterized in that the mirrored packet data is stored in real time, but sensitive data included in the corresponding packet data is classified and processed blindly.
The method of claim 5, wherein the packet data collection unit
Optical cable hacking monitoring system, characterized in that when a preset time has elapsed based on the time at which the packet data is stored, the corresponding packet data is deleted, but data for a predetermined time before and after the abnormal event occurs in the optical cable is not deleted.
According to claim 1, wherein the monitoring unit
An optical cable hacking monitoring system, characterized in that it monitors whether the abnormal event occurs by comparing the transmission loss pattern with a previously input pattern or a pattern learned through machine learning.
The method of claim 7, wherein the abnormal event is
Optical cable hacking monitoring system, characterized in that it includes a hacking attempt and abnormal state occurrence in the optical cable.
The method of claim 7, wherein the monitoring unit
Optical cable hacking monitoring system, characterized in that the packet data and log records received from the packet data collection unit are stored in a data storage server.
The method of claim 7, wherein the monitoring unit
When the abnormal event occurs, the abnormal event information is transmitted to the registered terminal,
The abnormal event information includes at least one of an event occurrence time, an event occurrence location, and packet data transmitted and received at the event occurrence time.
The method of claim 10, wherein the monitoring unit
When the hacking attempt occurs, the abnormal event information is displayed on the screen,
Optical cable hacking monitoring system, characterized in that it visualizes and displays the abnormal event information on a GIS-based map.
delete delete delete delete delete

Images