KR102582663B1 - Method For Managing Network And Network Management System - Google Patents

Abstract

The network management method of the present disclosure is a method of managing a network using a network management system including at least one processor and at least one memory, wherein at least network log data loaded into the memory is stored by the network management system. Generating a plurality of group data by grouping them based on one criterion; extracting, by the network management system, a predetermined feature value from each of the plurality of group data; generating an image representation by visualizing the extracted characteristic values using a predetermined visualization technique, by the network management system; training an artificial intelligence model by causing the network management system to analyze the image representation; And a step of allowing the artificial intelligence model to determine a network state based on a learned result by the network management system.

Description

Network management method and network management system {Method For Managing Network And Network Management System}

This disclosure relates to a network management method and a network management system, and specifically to a method of easily and accurately managing a network by monitoring image representation by a user or an artificial intelligence model, and a network management system that performs the same.

In general, network management refers to monitoring the network status in real time to collect information on the configuration, performance, and failure of network elements, and operating and maintaining the network accordingly. The network management system stores management information such as configuration information and service information about network elements, and provides management information to the system manager in times of emergency.

In the field of network management, the elements that make up a network, such as exchanges, transmission devices, subscriber devices, telephone offices, buildings, and antennas, are called nodes. The network management system monitors the operating status of nodes and manages and controls traffic flowing through the network for smooth data communication between nodes. The system administrator checks the current status of the network through the monitoring screen that displays the network status of the network management system and takes countermeasures when necessary.

However, the network management system of the prior art only displays a two-dimensional dashboard and limited types of text information, and is limited to recognizing only a specific situation at a specific point in time. As a result, in the prior art, it is not possible to monitor rapid changes in network status over time in real time, it is difficult for system managers to intuitively understand the network status from the display of the monitoring screen of the system management system, and it is difficult to monitor specific traffic There were problems such as difficulty in intuitive analysis of the network status and not providing precise status diagnosis information on the network status.

Moreover, in the prior art, such problems have been solved through the experience and skill of the system administrator. However, recently the network environment has been rapidly expanding, and it has become very difficult to find an experienced and highly skilled system administrator. Therefore, checking and monitoring the network by a system administrator had great limitations in securing low management costs, accuracy, and speed. Furthermore, since human cognitive abilities tend to be inaccurate depending on conditions or emotions, there is an inherent risk that system administrators will make mistakes. Accordingly, there is a demand for network management methods and network management system technologies that are not dependent on system administrators.

Registered Patent Publication No. 10-1893475

The task of the present disclosure is to provide a new method by which a user or an artificial intelligence model can easily and accurately manage a network by monitoring image representation by providing a network management method and a network management system that performs the same.

According to one form of the present disclosure, the network method of the present disclosure is a method of managing a network using a network management system including at least one processor and at least one memory, wherein the network management system stores the memory extracting a predetermined feature value from the loaded network log data; generating an image representation by visualizing the extracted characteristic values using a predetermined visualization technique, by the network management system; training an artificial intelligence model by causing the network management system to analyze the image representation; And a step of allowing the artificial intelligence model to determine a network state based on a learned result by the network management system.

In another embodiment, the step of extracting a predetermined feature value from the network log data loaded into the memory includes grouping the network log data based on at least one criterion to generate a plurality of group data, It may include extracting a predetermined feature value from the generated plurality of group data.

In one embodiment, the at least one criterion may include at least one of a local machine's IP address, a time window, and a subnetwork.

In one embodiment, the visualization technique may include at least one of a hive plot and a parallel coordinates plot.

In one embodiment, the visualization technique is a hive plot, and the step of generating an image representation by visualizing the extracted feature values using a predetermined visualization technique includes displaying an image representation of the extracted feature values as a curved link in an analysis window. It may include the step of displaying .

In one embodiment, information for representing the hive plot may include time, protocol, source IP, source port, destination IP, destination port, frame length, TCP SYN flag, and TCP ACK flag.

In one embodiment, the step of extracting a predetermined feature value from the network log data loaded into the memory by the network management system includes converting the numeric feature value among the network log data into a total value or a packet size. It may include the step of reducing and converting to a fixed ratio by dividing by .

In one embodiment, the step of extracting a predetermined feature value from network log data loaded into the memory by a network management system includes converting a categorical feature value among the network log data into an integer value within a predetermined range. After conversion, the step of reducing the categorical characteristic value to a fixed ratio by dividing it by the number of valid values may be included.

In one embodiment, the step of extracting a predetermined feature value from the network log data loaded into the memory by a network management system includes randomizing the IP address from the network log data to an integer within a predetermined range. ), it may include the step of dividing by the number of valid values of the categorical characteristic value and reducing it to a fixed ratio.

In one embodiment, the artificial intelligence model may be based on at least one of a convolutional neural network (CNN), a transformer, and successive subspace learning (SSL).

In one embodiment, the step of having the artificial intelligence model determine a network state based on a learned result includes having the artificial intelligence model analyze network traffic; allowing the artificial intelligence model to define a user's or user's network usage pattern based on a result of analyzing traffic; And it may include having the artificial intelligence model monitor network status to detect abnormal changes in traffic.

In one embodiment, the step of having the artificial intelligence model determine a network state based on a learned result includes having the artificial intelligence model automatically detect a security threat from abnormal changes in the network; allowing the artificial intelligence model to evaluate risks from network abnormal changes; And it may include having the artificial intelligence model report the suspicious activity in response to detection of suspicious activity by hacking in an abnormal change in the network.

According to one form of the present disclosure, a network management system of the present disclosure is a network management system that manages a network, including at least one processor; at least one memory; and at least one non-volatile storage unit configured to store network log data, wherein the processor extracts a predetermined characteristic value from the network log data, and visualizes the extracted characteristic value using a predetermined visualization technique. It generates an image representation, trains the artificial intelligence model by having the artificial intelligence model analyze the image representation, and allows the artificial intelligence model to determine the network state based on the learned results.

In one embodiment, the processor may generate a plurality of group data by grouping the network log data based on at least one criterion, and extract a predetermined characteristic value from each of the generated plurality of group data.

In one embodiment, the visualization technique may include at least one of a hive plot and a parallel coordinates plot.

In one embodiment, the processor may be configured to generate an image representation representing the extracted characteristic values as a plurality of curves through the hive plot and display the generated image representation in an analysis window.

In one embodiment, information for representing the hive plot may include time, protocol, source IP, source port, destination IP, destination port, frame length, TCP SYN flag, and TCP ACK flag.

In one embodiment, the processor reduces and converts the numeric characteristic values in the network log data into a fixed ratio by dividing them by the packet size, converts the categorical characteristic values in the network log data into integer values within a predetermined range, and then converts the numerical characteristic values in the network log data into integer values within a predetermined range. The type characteristic value is divided by the number of valid values and converted to a fixed ratio, and the IP address in the network log data is randomly converted to an integer within a predetermined range, and then the categorical characteristic value is converted to a valid value. It can be configured to reduce and convert to a fixed ratio by dividing by the number of values.

According to an embodiment of the present disclosure, the network management method of the present disclosure visualizes network information and expresses it as an image representation, so that the user can intuitively check the network status with the visualized image representation and image representation that changes in real time. You can easily monitor network status by observing. In this way, the network management method of the present disclosure uses image representations that can be interpreted by humans, so that the artificial intelligence module can provide useful feedback to the network user or administrator, and conversely, the network user or administrator can provide feedback to the artificial intelligence module. can be provided.

Moreover, the network management method of the present disclosure can convert the address value of the source IP or destination IP into various values by randomly encoding overlapping IP addresses between a plurality of group data shown in the analysis window, a kind of You can see the effect of data augmentation. This encoding method effectively increases the amount of training data for artificial intelligence models and improves the generalizability of artificial intelligence models.

1 is a conceptual diagram showing the configuration of a network management system according to an embodiment of the present disclosure.
Figure 2 is a flowchart showing steps of a network management method according to an embodiment of the present disclosure.
FIG. 3 is a table showing raw characteristic values of network log data of a network management method according to an embodiment of the present disclosure.
FIG. 4 is a table showing a formula for converting raw characteristic values of network log data in a network management method according to an embodiment of the present disclosure.
Figure 5 is a table showing converted characteristic values of network log data of a network management method according to an embodiment of the present disclosure.
Figure 6 is a table showing the process of converting the raw characteristic value of the IP address of network log data in the network management method according to an embodiment of the present disclosure.
FIG. 7 is a table showing symbols of coordinates matching converted characteristic values of network log data of a network management method according to an embodiment of the present disclosure.
Figure 8 is a coordinate used in a hive plot of a network management method according to an embodiment of the present disclosure.
Figure 9 is coordinates showing the process of generating an image representation through a hive plot of a network management method according to an embodiment of the present disclosure.
Figure 10 shows coordinates generated through a parallel coordinate plot technique of the network management method according to an embodiment of the present disclosure.

The advantages and features of the present disclosure and methods for achieving them will become clear with reference to the embodiments described in detail below in conjunction with the accompanying drawings. However, the present disclosure is not limited to the embodiments disclosed below and will be implemented in various different forms, and the embodiments are merely intended to ensure that the disclosure of the present disclosure is complete and that those skilled in the art It is provided to fully inform the person of the scope of the invention, and the present disclosure is defined only by the scope of the claims.

The terminology used herein is only used to describe specific embodiments and is not intended to limit the disclosure. For example, a component expressed in the singular should be understood as a concept that includes plural components unless the context clearly indicates only the singular. In addition, in the specification of the present disclosure, terms such as 'include' or 'have' are only intended to designate the presence of features, numbers, steps, operations, components, parts, or combinations thereof described in the specification, and such The use of the term does not exclude the presence or addition of one or more other features, numbers, steps, operations, components, parts or combinations thereof.

Additionally, unless otherwise defined, all terms used herein, including technical or scientific terms, have the same meaning as commonly understood by a person of ordinary skill in the technical field to which this disclosure pertains.

Terms such as those defined in commonly used dictionaries should be interpreted as having a meaning consistent with the meaning in the context of the related technology, and unless clearly defined in the specification of the present disclosure, they shall be interpreted in an ideal or excessively formal sense. It doesn't work.

Hereinafter, embodiments of the present disclosure will be described in more detail with reference to the attached drawings. However, in the following description, detailed descriptions of well-known functions or configurations will be omitted if there is a risk of unnecessarily obscuring the gist of the present disclosure.

FIG. 1 is a conceptual diagram showing the configurations of a network management system 100 according to an embodiment of the present disclosure. And, Figure 2 is a flowchart showing steps of a network management method according to an embodiment of the present disclosure.

1 and 2, a network management method according to an embodiment of the present disclosure includes a network including at least one processor 111, at least one memory 112, and a non-volatile storage unit 113. This is a method of managing a network using the management system 100. Here, the network management system 100 includes a computing system, hardware on which a program is running, and software running on the hardware. Additionally, the network management system 100 may include hardware such as a communication unit (not shown), storage, or a database that is networked with each other or other servers through a network.

Here, the processor 111 may execute a program command stored in at least one of the memory 112 or the non-volatile storage unit 113. Here, the program command may include a command that causes the artificial intelligence model to analyze the image expression to learn or determine the network status based on the analyzed content.

Additionally, the processor 111 may be one or more of a central processing unit (CPU) and a graphics processing unit (GPU). The processor 111 may refer to a dedicated processor on which methods according to embodiments of the present invention are performed.

For example, the memory 112 may be comprised of at least one of read only memory (ROM) and random access memory (RAM).

For example, the non-volatile storage unit 113 stores a plurality of application programs or applications driven by the processor 111, data and instructions that the processor 111 can read. You can. For example, non-volatile storage unit 113 may be configured to store network log data. For example, the non-volatile storage unit 113 is a hard disk drive (HDD), solid state disk (SSD), silicon disk drive (SDD), ROM, RAM, EPROM, flash drive, hard drive, cloud using a network, etc. It can contain various storage spaces such as:

A network management method according to an embodiment of the present disclosure includes a step (M01) of extracting a predetermined feature value from network log data loaded into the memory 112 by the network management system 100. .

Specifically, network log data refers to records of activities such as traffic, devices, and applications on a network. For example, network log data includes time, protocol, source IP, source port, destination IP, destination port, frame length, TCP SYN flag, and TCP ACK flag. For example, network log data is network meta information and may include packet size, time information, etc. on a packet basis. For example, network log data is network meta information and may include a period of time based on a session, average packets per second, packet size, etc.

Network log data contains a variety of information that allows users to monitor network status. Additionally, this network information can be managed in the form of log records and stored in non-volatile storage units as text files for quick and easy retrieval.

Network log data in a method for managing a network according to an embodiment may be data collected from the network using a raw network capture (packet capture access point, PCAP) method. Network log data in a network management method according to another embodiment may be data collected from the network through a predetermined protocol of the application layer (upper layer). For example, a given protocol at the application layer may be Simple Network Management Protocol (SNMP). Here, SNMP can determine the structure of hosts on the network. Additionally, SNMP can collect network statistical information on usage, IP address, error rate, speed, and response time between network nodes.

The step (M01) of extracting a predetermined feature value from network log data loaded in the memory 112 of the method for managing a network according to another embodiment of the present disclosure includes at least one network log data. It includes the step of generating a plurality of group data by grouping based on a standard.

For example, by a network management system, network log data may be grouped by various criteria to enable multi-faceted detection of network attacks. For example, at least one criterion applied to group network log data may include at least one of the IP address of the local machine, time window, and subnetwork.

Additionally, a method for managing a network according to another embodiment of the present disclosure may extract a predetermined characteristic value from each of the plurality of generated group data.

FIG. 3 is a table showing raw characteristic values of network log data of a network management method according to an embodiment of the present disclosure.

Referring to FIG. 3 along with FIGS. 1 and 2 , the network management method of the present disclosure is to obtain, by the network management system 100, a predetermined raw feature value from network log data loaded into the memory 112. can be extracted. For example, as shown in the table of FIG. 3, the network management method of the present disclosure calculates the time, lower layer protocol, source IP, source port, and destination for each window from network log data by the network management system 100. Raw characteristic values corresponding to IP, destination port, frame length, TCP SYN flag, and TCP ACK flag information can be extracted.

In the table in Figure 3, raw characteristic values extracted from network log data are expressed as a relationship in the form of a two-dimensional table. For example, the lower layer protocol may be TCP or UDP. For example, TCP control flags include Congestion Window Reduced (CWR), ECN Echo (ECE), Urgent (URG), Acknowledgment (ACK), Push (PSH), Reset (RST), and Synchronize (SYN). ), may include control flag fields of FIN (Finish). Among these, the network management method of the present disclosure can extract raw characteristic values of each of the TCP SYN flag and TCP ACK flag from network log data. For example, the frame length may be the packet size.

FIG. 4 is a table showing a formula for converting raw characteristic values of network log data in a network management method according to an embodiment of the present disclosure. And, Figure 5 is a table showing converted characteristic values of network log data of the network management method according to an embodiment of the present disclosure.

Referring to FIGS. 4 and 5 along with FIGS. 1 to 3, the network management method according to an embodiment of the present disclosure is to configure the time, protocol, source IP, and source port for each window by the network management system 100. , destination IP, destination port, frame length, TCP SYN flag, and TCP ACK flag information, each raw characteristic value is calculated using a predetermined equation shown in each item of the table in FIG. 4 to obtain a value in a predetermined range as shown in the table in FIG. 5. It can be converted to numbers. For example, the predetermined range may be 0 to 1.

The step (M01) of extracting a predetermined feature value from the network log data loaded into the memory 112 by the network management system 100 involves extracting a numerical feature value from the network log data. It can be scaled by a fixed ratio to convert to a range of 0 to 1. For example, the step (M01) of extracting a predetermined feature value from the network log data loaded into the memory 112 by the network management system 100 includes a numeric feature value among the network log data ( It may include the step of reducing and converting numerical feature) to a fixed ratio by dividing it by the packet size.

For example, the numeric characteristic values in the table of FIG. 3 may correspond to time information. For example, the time information may be packet arrival time. Numeric characteristic values can be scaled down by a fixed ratio to convert to a range of 0 to 1. For example, as shown in the table of FIG. 5, when the packet size is set to 65535 bytes, a packet of 500 bytes can be converted into a packet size value of 500/65535 = 0.01526. Packet arrival time can be converted to T=600 seconds based on the starting point of the analysis window.

Here, the 'analysis window' refers to the data range that the artificial intelligence module analyzes at once among the numerous information in the network log data. For example, the analysis window of the artificial intelligence module may be configured to analyze 100 to 1000 rows of data at once from raw characteristic values in the form of a two-dimensional table.

For example, by the network management system 100, packet time information that arrived 120 seconds after the first packet in the window can be converted to 0.2 by dividing 120 by 600. If the reduction ratio used for conversion is treated as a system hyperparameter, it can be optimized during hyperparameter model tuning. Here, hyperparameters refer to the number of neurons in each layer in a neural network, batch size, learning rate and weight reduction when updating parameters.

The step (M01) of extracting a predetermined feature value from the network log data loaded into the memory 112 by the network management system 100 includes extracting a categorical feature value from the network log data as an integer within a predetermined range. After converting to a value, the step of reducing the value to a fixed ratio by dividing it by the number of valid values of the categorical characteristic value may be included.

For example, in the step M01 of extracting a predetermined feature value from the network log data loaded into the memory 112 by the network management system 100, the number of valid values (valid values) is N. It may include converting a categorical characteristic value into an integer value between 0 and (N-1), then dividing it by (N-1) to convert it into a range of 0 to 1. For example, the size of the port value packet is 65535 bytes, and the number (N) of integers in the range of 0 to 65535 is 65536. Therefore, the port value 443 is converted to 0.00676 by dividing 443 by 65535 because the number of valid values in the packet is 65536. For example, in the table of FIG. 3, categorical feature values may correspond to source port, destination port, and frame length. For example, since the number of valid values (N) for each characteristic value of source port, destination port, and frame length is 65536, they can be reduced and converted by dividing by 65535.

Figure 6 is a table showing the process of converting the raw characteristic value of the IP address of network log data in the network management method according to an embodiment of the present disclosure.

Referring to FIG. 6 along with FIGS. 3 and 5, the step (M01) of extracting a predetermined feature value from the network log data loaded into the memory 112 by the network management system 100 is, It includes the step of randomly converting IP addresses from network log data into integers within a predetermined range, then dividing them by the number of valid values of categorical characteristic values and reducing them to a fixed ratio.

The step of randomly converting IP addresses from network log data into integers within a predetermined range and then dividing them by the number of valid values of categorical characteristic values to reduce them to a fixed ratio is, in detail, the network management system 100. extracting a distinct value by removing duplicate IP addresses from network log data, randomly converting the IP address from the extracted distinct value into an integer within a predetermined range, and converting It may include the step of reducing the converted value by dividing it from the number of valid values (N) to (N-1), like the categorical characteristic value described above.

Meanwhile, because the number of valid values of the addresses of the source IP and destination IP is astronomically large, there was a limitation in the prior art that it was difficult to express it with a hive plot axis using general categorical transformation. Therefore, the network management method of the present disclosure includes the step of randomly converting an IP address into an integer within a predetermined range, so that data with a large number of valid values, such as an IP address, can be expressed on a hive plot axis. There is.

For example, as shown in the table of FIG. 6, the network management system 100 can extract the distinct values of five IP addresses by removing duplicate IP addresses from the raw characteristic values of the IP addresses. there is.

For example, as shown in the table of FIG. 6, since the number of valid values for the five IP addresses extracted by the network management system 100 is five, each of the five IP addresses It can be randomly specified as any integer from 0 to 4.

For example, as shown in the table of FIG. 6, by the network management system 100, a value randomly assigned as an integer from 0 to 4 for each of the five IP addresses is divided by a value of 4 (N-1) and finally 0. Characteristic values ranging from 1 to 1 can be extracted.

Additionally, to prevent overfitting of IP addresses in the learning data sets of the artificial intelligence module, information in the form of IP addresses is converted to a random integer within the range of 0 to (N-1). After encoding, it is reduced and converted to be the same as the general categorical feature value. Here, the number (N) of valid values of information in the form of an IP address may be the number of distinct values existing in the analysis window. Here, 'distinct value' refers to IP address values excluding duplicate values among all IP address values in the analysis window. For example, as shown in Figure 6, when overlapping IP address values are excluded among the source IP and destination IP address values of the raw characteristic values in the analysis window, five types of different address values can be collected. Therefore, the number of valid values can be said to be 5. And, an integer from 0 to 4 is randomly assigned to each of the five types of address values collected. Then, each of the address values of the source IP or destination IP of the network log data is converted into an integer assigned to the address of the IP of the corresponding type, and the converted integer values are again divided by 4 (N-1) to reduce the conversion.

The network management method of the present disclosure can convert the address value of the source IP or destination IP into various values by randomly encoding overlapping IP addresses between the raw characteristic values shown in the analysis window, a type of data augmentation (data augmentation effect can be seen. This encoding method effectively increases the amount of training data for artificial intelligence models and improves the generalizability of artificial intelligence models.

FIG. 7 is a table showing symbols of coordinates matching converted characteristic values of network log data of a network management method according to an embodiment of the present disclosure. Figure 8 is a coordinate used in a hive plot of a network management method according to an embodiment of the present disclosure. And, Figure 9 is coordinates showing the process of creating an image representation through a hive plot of the network management method according to an embodiment of the present disclosure.

Referring to FIGS. 7 to 9, the network management method of the present disclosure visualizes the extracted characteristic value (reduced value) using a predetermined visualization technique by the network management system 100 and represents it as an image. ) includes a step (M02) of generating.

Therefore, the network management method of the present disclosure visualizes network information and expresses it in an image representation, so that users can intuitively check the network status with the visualized image representation, and easily check the network status by observing the image representation that changes in real time. It can be monitored. In this way, the network management method of the present disclosure uses image representations that can be interpreted by humans, so that the artificial intelligence module can provide useful feedback to the network user or administrator, and conversely, the network user or administrator can provide feedback to the artificial intelligence module. can be provided.

The network management method of the present disclosure can visualize characteristic values extracted by the network management system 100 using a visualization technique. For example, you can compare network log data sets to each other, track data changes over time, or display data distribution.

For example, the visualization technique may include at least one of a hive plot and a parallel coordinates plot. Here, the image representation processed using the hive plot technique displays each item of characteristic values at coordinates set as axes, and is expressed as a curved link connecting the characteristic values with a single line. For example, in the method of generating an image representation using the high plot technique of the present disclosure, each row item of a table can be set as a plurality of axes of the graph rotated at a predetermined angle, as shown in FIG. 8. For example, Time in column 1 of FIG. 5 corresponds to A1 in FIG. 7 and can be displayed on the 3 o'clock coordinate axis (approximately 90 degrees when 12 o'clock is viewed as 0 degrees). In this way, the Protocol can be displayed at the 1:20 direction (approximately 40 degrees angle) in the coordinates of Figure 8 as the B item, and the Source IP can be displayed at the 12 o'clock direction (approximately 0 degrees) in the coordinates of Figure 8 as the C item. degree angle), the Source Port can be displayed on the direction axis at 10:40 (approximately 320 degrees angle) in the coordinates of Figure 8 as the D item, and the Destination IP can be displayed in the coordinates of Figure 8 as the E item. It can be displayed on the 9 o'clock (approximately 270 degree angle) direction axis, Destination Port can be displayed on the 7:20 (approximately 220 degree angle) direction axis in the coordinates of Figure 8 as the F item, and Frame Length is the G item. It can be displayed on the 6 o'clock (about 180 degree angle) direction axis in the coordinates of Figure 8, and the TCP ACK flag can be displayed on the 5 o'clock (about 150 degree angle) direction axis in the coordinates of Figure 8 as an I item.

Then, after displaying the characteristic values of each of the row items (A1 to I1) corresponding to each column shown in the table of FIG. 5 on a plurality of axis items, the characteristics are displayed on the plurality of axis items as shown in FIG. 9. This can be done by connecting the values (A1 to I1) to create a curved link.

For example, the network management method of the present disclosure visualizes each of the converted characteristic values (A1 to I1, A2 to I2, A3 to I3, and A4 to I4) in columns 1 to 4 of the table in FIG. 5 using a hive plot technique. After expressing with curved links, an image representation can be created by overlapping four curved links.

Figure 10 shows coordinates generated through a parallel coordinate plot technique of the network management method according to an embodiment of the present disclosure.

Referring to Figure 10, parallel coordinate plots are useful for visualizing tabular or matrix data with multiple columns. For example, as shown in Figure 10, an image representation can be created by making each row item of a table an axis item of a graph and connecting the values in each row of columns 1 to 4 with straight lines. Since the parallel coordinate plot is an already known technique, detailed description will be omitted here.

Meanwhile, the network management method of the present disclosure includes a step (M03) of training an artificial intelligence model by having the network management system 100 analyze the image representation. For example, the artificial intelligence model may be based on at least one of a convolutional neural network (CNN), a transformer, and successive subspace learning (SSL).

For example, an artificial intelligence model may be based on a convolutional neural network algorithm. Convolutional neural network (CNN) is a type of multi-layer feed-forward artificial neural network used to analyze visual images. Convolutional Neural Network (CNN) is a deep neural network technique that can effectively process images by applying it to artificial neural networks. It is a technique that classifies images through a process in which each element of the filter expressed in a matrix is automatically learned to be suitable for data processing. .

For example, an artificial intelligence model may be based on the Successive Subspace Learning (SSL) algorithm. Here, the continuous subspace learning (SSL) algorithm refers to an algorithm that learns with a lightweight unsupervised function based on the unique statistical properties of data units. In particular, continuous subspace learning algorithms demonstrate good performance on small-sized data sets. This continuous subspace learning enables unsupervised function learning, the number of parameters is smaller than that of DNN and CNN, calculation is possible without backpropagation, so computational efficiency is high, complex model optimization is unnecessary, and CPU-based learning and services are provided. It has advantages such as greatly reducing computational complexity and requiring low memory.

Therefore, the network management method of the present disclosure trains the artificial intelligence model by having the Successive Subspace Learning (SSL) artificial intelligence model analyze the image expression, enabling the implementation of excellent reliability and high performance in real time. It has the advantage of low power consumption.

For example, an artificial intelligence model may be based on a transformer algorithm. Here, the transformer is capable of “self-supervised learning.” Additionally, Transformer eliminates the need to train neural networks on large labeled data sets. In other words, Transformers can mathematically find patterns between elements, without necessarily having to be trained on large labeled data sets. Therefore, Transformers can use trillions of unlabeled image data as training data.

The network management method of the present disclosure includes a step (M04) of having the network management system 100 determine the network state based on the results learned by the artificial intelligence model.

In addition, the step (M04) of having the artificial intelligence model determine the network state based on the learned result includes the step of having the artificial intelligence model analyze network traffic.

The step (M04) of having the artificial intelligence model determine the network status based on the learned results is the step of having the artificial intelligence model define the user's or user's network usage pattern based on the results of analyzing the traffic. may include.

The step of having the artificial intelligence model determine the network status based on the learned results (M04) may include having the artificial intelligence model monitor the network status to detect abnormal changes in traffic.

Meanwhile, the step (M04) of having the artificial intelligence model determine the network state based on the learned results may include having the artificial intelligence model automatically detect security threats from abnormal changes in the network.

The step (M04) of having the artificial intelligence model determine the network state based on the learned result may include having the artificial intelligence model evaluate the risk from abnormal changes in the network.

The step (M04) of having the artificial intelligence model determine the network status based on the learned results causes the artificial intelligence model to detect the suspicious activity by hacking in abnormal changes in the network. It may include steps to report.

Meanwhile, the network management system 100 of the present disclosure may be configured to manage a network according to the network management method described above. The network management system 100 of the present disclosure includes at least one processor 111, at least one memory 112, and at least one non-volatile storage unit 113 configured to store network log data. Since the processor 111, memory 112, and non-volatile storage unit 113 of the network management system 100 have been described above, detailed description thereof will be omitted.

The processor 111 of the network management system 100 of the present disclosure is configured to extract a predetermined characteristic value from network log data. The processor 111 is configured to generate an image representation by visualizing the extracted feature values using a predetermined visualization technique. The processor 111 is configured to train the artificial intelligence model by causing the artificial intelligence model to analyze the image representation. The processor 111 is configured to determine the network status based on the results learned by the artificial intelligence model.

A network management system according to another embodiment of the present disclosure may be configured to generate a plurality of group data by grouping network log data based on at least one criterion and extract a predetermined characteristic value from the generated plurality of group data. .

The visualization technique may include at least one of a hive plot and a parallel coordinates plot.

For example, as shown in FIG. 9, the processor 111 is configured to generate an image representation expressing the extracted characteristic values as a plurality of curves through the hive plot technique and display the generated image representation in the analysis window. It can be.

Information for expressing the hive plot may include time, protocol, source IP, source port, destination IP, destination port, frame length, TCP SYN flag, and TCP ACK flag.

The processor 111 may be configured to reduce and convert a numerical characteristic value among network log data into a fixed ratio by dividing it by the packet size.

The processor 111 may be configured to convert a categorical characteristic value in network log data into an integer value within a predetermined range, then divide the categorical characteristic value by the number of valid values and reduce the conversion to a fixed ratio.

The processor 111 may be configured to randomly convert an IP address in network log data into an integer within a predetermined range and then divide it by the number of valid values of the categorical characteristic value to reduce the conversion to a fixed ratio.

Although the embodiments have been described with limited drawings as described above, those skilled in the art can apply various technical modifications and variations based on the above. For example, the described techniques are performed in a different order than the described method, and/or components of the described system, structure, device, circuit, etc. are combined or combined in a different form than the described method, or other components are used. Alternatively, appropriate results may be achieved even if substituted or substituted by an equivalent.

Therefore, other implementations, other embodiments, and equivalents of the claims also fall within the scope of the claims described below.

100: Network management system
111: processor
112: memory
113: Non-volatile storage device

Claims (18)

A method of managing a network using a network management system including at least one processor and at least one memory, comprising:
extracting, by the network management system, a predetermined feature value from network log data loaded into the memory;
generating an image representation by visualizing the extracted characteristic values using a predetermined visualization technique, by the network management system;
training an artificial intelligence model by causing the network management system to analyze the image representation; and
A step of having the artificial intelligence model determine a network state based on a learned result by the network management system,
The step of extracting a predetermined characteristic value from the network log data loaded into the memory generates a plurality of group data by grouping the network log data based on at least one criterion, and extracts a predetermined characteristic value from the generated plurality of group data. Including the step of extracting,
The step of extracting a predetermined characteristic value from the generated plurality of group data includes,
A step of reducing and converting numerical characteristic values of the network log data into a fixed ratio by dividing them by the total value or packet size;
Converting categorical characteristic values among the network log data into integer values within a predetermined range and then dividing them by the number of valid values of the categorical characteristic values to reduce and convert them to a fixed ratio;
Comprising the step of randomly converting IP addresses among the network log data into integers within a predetermined range, and then dividing them by the number of valid values of categorical characteristic values and reducing them to a fixed ratio.
How to manage your network. delete According to paragraph 1,
At least one of the above criteria is,
Containing at least one of the IP address of the local machine, a time window, and a subnetwork,
How to manage your network. According to paragraph 1,
The visualization technique is
Containing at least one of a hive plot and a parallel coordinates plot,
How to manage your network. According to paragraph 4,
The visualization technique is Hive Plot,
The step of generating an image representation by visualizing the extracted feature values using a predetermined visualization technique,
Including displaying an image representation of the extracted characteristic value as a curved link in an analysis window,
How to manage your network. According to clause 5,
Information for expressing the hive plot is:
Including time, protocol, source IP, source port, destination IP, destination port, frame length, TCP SYN flag, and TCP ACK flag,
How to manage your network. delete delete delete According to paragraph 1,
The artificial intelligence model is,
Based on at least one of CNN (convolutional neural network), Transformer, and SSL (Successive Subspace Learning),
How to manage your network. According to paragraph 1,
The step of having the artificial intelligence model determine the network state based on the learned result is,
allowing the artificial intelligence model to analyze network traffic;
allowing the artificial intelligence model to define a user's or user's network usage pattern based on a result of analyzing traffic; and
Including having the artificial intelligence model monitor network status to detect abnormal changes in traffic,
How to manage your network. According to paragraph 1,
The step of having the artificial intelligence model determine the network state based on the learned result is,
allowing the artificial intelligence model to automatically detect security threats from network abnormal changes;
allowing the artificial intelligence model to evaluate risks from network abnormal changes; and
Including the step of causing the artificial intelligence model to report suspicious activity in response to detection of suspicious activity by hacking in an abnormal change in the network,
How to manage your network. As a network management system that manages a network,
at least one processor;
at least one memory; and
At least one non-volatile storage unit configured to store network log data,
The processor,
Extracting predetermined characteristic values from the network log data,
Visualize the extracted feature values using a predetermined visualization technique to create an image representation,
Trains the artificial intelligence model by having the artificial intelligence model analyze the image representation, and also trains the artificial intelligence model.
It is configured to determine the network status based on the results learned by the artificial intelligence model,
Extracting a predetermined characteristic value from the network log data includes generating a plurality of group data by grouping the network log data based on at least one criterion and extracting a predetermined characteristic value from each of the plurality of group data. Includes,
Extracting a predetermined characteristic value from each of the plurality of group data includes:
Numeric characteristic values among the network log data are reduced and converted to a fixed ratio by dividing them by the packet size,
Converting the categorical characteristic value in the network log data to an integer value within a predetermined range and then dividing it by the number of valid values of the categorical characteristic value to reduce and convert it to a fixed ratio,
Including randomly converting IP addresses in the network log data into integers within a predetermined range, and then dividing them by the number of valid values of the categorical characteristic values and reducing them to a fixed ratio.
Network management system. delete According to clause 13,
The visualization technique is
Containing at least one of a hive plot and a parallel coordinates plot,
Network management system. According to clause 15,
The processor,
Configured to generate an image representation expressing the extracted characteristic values as a plurality of curves through the hive plot and display the generated image representation in an analysis window,
Network management system. According to clause 16,
Information for expressing the hive plot is:
Including time, protocol, source IP, source port, destination IP, destination port, frame length, TCP SYN flag, TCP ACK flag,
Network management system. delete

Images