KR20050003557A - A customer network management service System and Method by monitoring traffic of the customer's network and controlling illegal or abnormal traffic - Google Patents

Abstract

PURPOSE: A customer's network management service system through traffic congestion and illegal traffic monitoring control, and a method thereof are provided to prevent the performance of a customer's network from being degraded by controlling elements impeding network performance at a backbone end. CONSTITUTION: A traffic monitoring element(105) is placed at a front end of a customer's network for monitoring traffic flowed into and out of the customer's network in real time. A traffic analyzing element(106) analyzes abnormal traffic proceeding to the customer's network for interrupting illegal traffic and adjusting overload traffic. A customer management server farm(107) manages the traffic monitoring element(105) and the traffic analyzing element(106) for executing a management service to the customer's network by selectively executing routing path adjustment, traffic analyzing command, and traffic control.

Description

A customer network management service system and method by monitoring traffic of the customer's network and controlling illegal or abnormal traffic}

The present invention relates to a system for managing a customer network through traffic congestion and illegal traffic monitoring control, and a method and a computer readable recording medium recording a program for realizing the method, and more particularly, to an Internet backbone network. Internet Service Provider (ISP), which owns a network and provides Internet services, monitors traffic flowing into and out of the customer's network from the Internet backbone network to detect abnormal traffic and block illegal traffic. The present invention relates to a customer network management service system that protects the flow of traffic, and a method and a computer readable recording medium storing a program for realizing the method.

In order to ensure the availability and performance of the Internet, ISPs have a network management system that performs failures, performances, and configuration management. Configuration management has been performed by adding / removing network components. However, ISP's Network Management System did not provide specific traffic management to customers by its nature.

On the other hand, in order to manage their own network, they have been managed by small scale self-managed or outsourcing companies for network management.

The problem with this method is the small network management of the own network, which has a limitation of local network management that can be managed at the point where the traffic flows into the local network because the traffic status of the Internet backbone cannot be grasped. Therefore, in case of massive traffic occurrence or cyber attack, after all illegal traffic is transferred from ISP's Internet backbone network to customer network, the illegal traffic blocking device is operated in customer network, so the attack exceeds the limit of client side network equipment. In case of, network degradation or in severe cases, there is a problem of availability destruction.

The present invention has been made to solve the problems described above, before monitoring the incoming / outgoing traffic from the Internet backbone network to the customer network to the customer end of the elements that hinder the network performance of the customer backend An object of the present invention is to provide a system for managing a customer network through traffic congestion and illegal traffic monitoring control, and a computer readable recording medium recording the program for implementing the method.

1 is a configuration diagram of a customer network management service system through traffic congestion and illegal traffic monitoring control according to the present invention;

Figure 2 is a detailed configuration diagram of an embodiment of a customer network management service server farm (CNMS-farm) in the customer network management service system according to the present invention.

3 is a diagram illustrating an embodiment of network configuration management for a subscriber and non-subscriber in a network management service system according to the present invention;

4 is a diagram illustrating an embodiment of traffic flow in a customer network management service system according to the present invention;

5 is a diagram illustrating an embodiment of traffic path management in a customer network management service server farm (CNMS-farm) in the customer network management service system according to the present invention;

6a and 6b is a flow chart of an embodiment of a customer network management service method through traffic congestion and illegal traffic monitoring control according to the present invention.

* Explanation of symbols for the main parts of the drawings

101 edge network 102 backbone network

103: network of subscribers of the customer network management service

104: network of non-subscriber network management service

105: traffic monitoring device 106: traffic analysis device

107: customer network management service server farm (CNMS-farm)

108: Internet user

109 Cyber Attacker

A system of the present invention for achieving the above object is a network system for providing an Internet service to a customer's network through an internet backbone network, located in the front of the customer network to the customer network Traffic monitoring means for monitoring incoming / outgoing traffic in real time; Traffic analysis means for analyzing abnormal traffic destined for the customer network to adjust traffic traffic for blocking and overload traffic for illegal traffic; And managing the traffic monitoring means and the traffic analysis means to report an abnormal situation of traffic destined for the customer network, and selectively perform routing path adjustment, traffic analysis command, and traffic communication control for the customer network. It characterized in that it comprises a customer network management service processing means for processing so that the management service is made.

In addition, the method of the present invention, the customer network through the traffic congestion and illegal traffic monitoring control applied to the customer network management service system of the network providing the Internet service to the customer's network through the Internet backbone network (backbone network) A management service method, comprising: a first step of performing monitoring for traffic flowing into or out of the customer network; A second step of detecting an abnormality of traffic flowing into or out of the customer network; A third step of changing a routing path for traffic flowing into or out of the customer network to analyze the traffic; A fourth step of analyzing the traffic flowing into or out of the customer network where the abnormal traffic is detected; A fifth step of blocking the illegal traffic when illegal traffic is inflow / outflow as a result of the analysis of the fourth step; And a sixth step of performing traffic traffic control according to a given traffic control policy if overload traffic is flowing in / out as a result of the analysis of the fourth step.

In addition, the present invention, the customer network management service system having a processor, a first function for performing monitoring for traffic flowing into / out of the customer network; A second function of detecting an abnormality of traffic flowing into / out of the customer network; A third function of changing a routing path for traffic flowing into or out of the customer network to enable analysis of the traffic; A fourth function of performing analysis on traffic flowing into / out of the customer network where the abnormal traffic is detected; A fifth function of blocking the illegal traffic when illegal traffic is inflowed / outflowed as a result of the analysis of the fourth function; And a computer-readable recording medium having recorded thereon a program for realizing a sixth function of performing traffic traffic control in accordance with a given traffic control policy as a result of the analysis of the fourth function.

The present invention provides an integrated customer network management system in which an ISP provider having an Internet backbone network and providing Internet services protects a customer network exposed from various cyber attacks due to the openness of the Internet. It is designed to provide a service.

In particular, the present invention is to detect the traffic routing management functions of switches and routers, which are network elements of the Internet provided by the ISP, and to detect illegal and abnormal traffic flowing into or out of the customer network in the ISP backbone network. Integrated management of network such as traffic traffic and routing path change This is to effectively provide a customer network management service by allowing traffic control to be integrated to the entire network by a customer network management server farm (hereinafter referred to as CNMS-farm). In particular, the traffic routing is adjusted at the Internet backbone network level by CNMS-farm, so that traffic control is possible at the edge and backbone networks connected to the cyber attackers, rather than at the client end. In addition, the performance of the Internet backbone network can be improved.

That is, the present invention monitors traffic flowing into and out of a customer's network from an Internet backbone network by an ISP having an Internet backbone network and providing an Internet service, thereby detecting abnormal traffic and controlling traffic. The present invention relates to a customer network management service system and a method for protecting a customer network where important application servers are located from the open Internet by providing a network management service that protects a normal traffic flow and blocks illegal traffic.

The above objects, features and advantages will become more apparent from the following detailed description taken in conjunction with the accompanying drawings. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a configuration diagram of a customer network management service system through traffic congestion and illegal traffic monitoring control according to the present invention.

1 is an exemplary diagram showing subjects involved in providing a customer network management service according to the present invention.

The ISP's network that provides Internet service is divided into two layers so that the edge of the ISP Internet where the systems or networks of the Internet users 103, 104, 108, and 109 are connected. the network 101, the traffic flowing through the edge 101, and a service system of an edge 101 or a content provider belonging to another Internet user, or an overseas network; or Use the backbone network 102 for forwarding traffic to another ISP's network, the network 103 of the customer network management service subscribers who have subscribed to the customer network management service of the present invention, and the Internet service of the ISP operator. A traffic monitoring device 105 connected to the network 104 of the non-subscriber of the network management service who does not subscribe to the customer network management service of the present invention and the edge stage 101 to monitor the traffic of the customer in real time. With traffic monitoring The abnormal traffic by analyzing the client network management server farm (CNMS-farm) 107 that reports the abnormal traffic from the device 105 and the traffic and configuration management commands of the CNMS-farm 107. It includes a traffic analysis device 106 to block only illegal traffic from the traffic to be delivered and to control traffic traffic for overload traffic such as traffic congestion and normal traffic.

In brief, the present invention is as follows.

The present invention divides a network of an ISP that provides an Internet service into a layer of a backbone network 102 that delivers a large amount of traffic, and a layer of an edge stage 101 that is a point of contact between a system and a network of customers. The customer network 103 is provided with a traffic monitoring device 105 at a network element (network element, router or switch device) of the edge 101, which is a contact point to which a network 103 of a customer who wants a network service is connected. Real time monitoring of incoming and outgoing traffic.

At this time, the configuration information of the edge (101) and the backbone network 102 to which the network of the customer subscribed to the customer network management service is registered in the customer network management service server farm (CNMS-farm, 107) Only traffic of the customer is managed separately so that the traffic of the customer network management service subscriber network 104 and discrimination management.

While monitoring the traffic of the customer subscribed to the service in real time, when traffic congestion or illegal traffic is detected, it reports to the customer network management service server farm 107 installed in the backbone 102.

The CNMS-farm 107 installed in the backbone 102 is responsible for traffic to the customer backbone network and the respective edge facilities in order to analyze the abnormality reported from the traffic monitoring device 105. Routing information is changed between the facilities of the Internet through configuration management to be sent to the analysis device 106.

The network components change the traffic path in real time according to a command received from the CNMS-farm 107 and deliver only specific traffic to the traffic analysis device 106.

The traffic analysis device 106 analyzes abnormal traffic and blocks traffic in the case of illegal traffic, thereby preventing the inflow of illegal traffic to the customer. In the case of overload traffic, the CNMS-farm 107 notifies the traffic congestion so that the CNMS-farm 107 performs traffic traffic control.

In addition, there is a device that informs the operator of the status of anomalous situation that hinders network performance from CNMS-farm (107). Based on the customer network management guidelines, specific abnormalities and network management measures are reported to the network manager of the customer network. The network manager of the customer network can effectively control the internal network.

Figure 2 is a detailed configuration diagram of an embodiment of a customer network management service server farm (CNMS-farm) in the customer network management service system according to the present invention.

2 shows the components of CNMS-farm 107 according to the present invention.

CNMS-farm (107) refers to a group of servers related to the provision of customer network management services. Looking at this, the CNMS-farm (107) controls each component of the CNMS-farm (107), and the customer network management service operator manages the overall status of the customer network management services. A console device 201 for identifying and performing comprehensive control such as traffic and configuration management, an output device 202 for outputting the status of customer network management service control to an operator of the customer network management service control center, and an ISP operator. A network topology database (206) containing the Internet network configuration information of the subscriber, a subscriber information database (DB: Database) 205 having a current state of service use such as service subscription / suspension / cancellation of a service subscriber, When receiving a report on the occurrence of abnormal traffic from the traffic monitoring device 105 to determine that the traffic congestion, the backbone and edge (101, 102) If the traffic reported from the traffic monitoring system 105 and the traffic monitoring device 105 is determined to be illegal traffic, the traffic management system 203, which issues a traffic traffic control command to the network component, is sent to the customer network subscribed to the service. And a configuration management system 204 for performing configuration management to change routing paths between network components so that traffic destined or exiting from the customer network is delivered to the traffic analysis device 106.

The network topology DB 206 has preliminary routing path information to be used for changing the real-time routing path connected to the ISP network basic configuration information and the network of the customer subscribed to the customer network management service. That is, the traffic routing path to be applied to the network components of the backbone and edge stages 101 and 102 is set in advance and used as a preliminary routing path.

FIG. 3 is a diagram illustrating an embodiment of network configuration management for a subscriber and a subscriber in a network management service system according to the present invention.

The traffic monitoring device 105 of the present invention is connected to an edge network element 301 connected to the network 103 of the service subscriber, and is connected to the edge network element 301. Monitor all traffic passing through it. If traffic monitoring apparatus 105 detects abnormal traffic such as illegal traffic or congestion, it reports to CNMS-farm 107 for traffic analysis and control.

For illegal traffic, the CNMS-farm 107 changes the routing information of the components of the backbone network 102 by referring to the subscriber information DB and the network topology information, and transmits the traffic destined for the corresponding customer network to the traffic analysis device 106. To send).

The network 104 of the unsubscribed customer network management service is configured according to the ISP network configuration basic policy without being connected to the traffic monitoring device 105 and the traffic analysis device 106.

4 is a diagram illustrating an embodiment of traffic flow in a customer network management service system according to the present invention.

If the traffic of the customer network management service subscriber is normal traffic (401), the traffic is normally transferred from the Internet backbone network component to the customer network 103 via the edge end network component 301.

The traffic monitoring apparatus 105 monitors the traffic in real time and reports abnormal traffic such as traffic congestion or illegal traffic to the customer network management server farm (CNMS-farm) 107 installed at the backbone.

The CNMS-farm 107 installed in the backbone 102 is an edge network component when the type of abnormal traffic reported from the traffic monitoring device 105 is a factor that hinders network performance such as simple traffic overload. Traffic traffic management is performed by adjusting the traffic bandwidth of 301.

However, in case of suspected illegal traffic such as a cyber attack or a virus, traffic to the traffic analysis device 106 is sent to the Internet backbone and each edge facility to the traffic network for precise analysis of the traffic.

At this time, the routing information of each component of the Internet is changed by using the preliminary routing path registered in the network topology DB 206 in advance.

The network components change the traffic path in real time in the backbone network 102 according to a command received from the CNMS-farm 107 so that only the specific traffic 402 of the customer who is subscribed to the service goes to the traffic analysis device 106. To pass.

The traffic analyzing apparatus 106 analyzes the traffic flowing into the apparatus to block traffic in case of illegal traffic, and performs traffic filtering to allow traffic in the case of normal traffic 403 to the client stage 103. Prevent illegal traffic from entering As a result of the analysis in the traffic analysis device 106, if the traffic is not illegal traffic but is overloaded traffic such as a traffic congestion, the traffic traffic control is performed so that the traffic traffic rate falls below a certain level according to the traffic control policy.

5 is a diagram illustrating an embodiment of traffic path management in a customer network management service server farm (CNMS-farm) in the customer network management service system according to the present invention.

FIG. 5 is an exemplary view illustrating path management for delivering traffic of a subscriber to a traffic analyzing apparatus for analyzing traffic of a service subscriber of the present invention.

If the service status of the customer changes, such as joining / terminating / stopping the service / stopping the customer network management service, the subscriber management unit 501 of the console device 201 makes the subscriber information DB 205 current, It transmits the service status of the subscriber to the configuration management system 204 to register, delete, or modify a routing entry.

The routing information management unit 502 of the configuration management system 204 delivers network basic topology data 503 containing network basic configuration information and traffic of the corresponding subscriber for each service subscriber to the traffic analysis device 106. The flow path for storing is stored in customer routing entry data 504. When the traffic of the subscriber is to be forwarded to the traffic analysis device 106 for traffic analysis, the configuration management system 204 may register a route entry registered in the customer routing entry data 504 instead of the default routing path. Inquiry to deliver to the network components (301, 302) to start traffic rerouting (rerouting).

When the subscriber traffic returns to normal traffic, the configuration management system 204 routes the customer's routing in the entry of the network table's routing table in the network basic topology data 503. Return to the routing path.

6A and 6B are flowcharts illustrating an embodiment of a method for managing a customer network through traffic congestion and illegal traffic monitoring control according to the present invention.

First, the traffic monitoring device 105 monitors the traffic destined for the network 103 of the service subscriber in the network provided by the ISP (601).

The traffic monitoring apparatus 602 detects abnormal traffic (602). Abnormal traffic refers to overload traffic, illegal traffic, and the like.

Traffic monitoring device 105 notifies the occurrence of abnormal traffic to the customer network management service server farm (CNMS-farm, 107) (603), in the CNMS-farm (107), the traffic monitoring device 105 reports a simple traffic congestion Check whether it is determined to be (604).

As a result of the check, if it is determined that the traffic congestion is simple, the CNMS-farm 107 transmits a traffic traffic control command to the network components of the backbone and the edge, and processes the simple traffic congestion (605).

If it is determined that the traffic is not a simple traffic congestion, the CNMS-farm 107 adjusts the routing path of the traffic through the traffic analyzer 106 (606).

The traffic analysis device 106 analyzes (607) traffic destined for the service subscriber's network via itself and checks (608) whether illegal traffic flows.

As a result of the check, if illegal traffic is introduced, the traffic is blocked (609), and the traffic analyzing apparatus 106 repeats the process (607) of analyzing the traffic destined for the service subscriber's network.

As a result of the check, if illegal traffic does not flow, it is checked whether overload traffic flows (610).

As a result of the inspection, if the overload traffic is flowing, the traffic analysis device 106 performs traffic traffic control so that the traffic traffic rate drops below a certain level according to a given traffic control policy (611), and the traffic analysis device 106 The process is repeated from step 607 of performing analysis on traffic destined for the service subscriber's network.

If the overload traffic is not flowing in as a result of the inspection, the traffic analysis device 106 checks whether the inflow of abnormal traffic is released (612).

If it is determined that the inflow of abnormal traffic is not released, the traffic analyzing apparatus 106 repeats the process 607 of performing analysis on the traffic destined for the service subscriber's network.

As a result of the check, if it is determined that the inflow of the abnormal traffic is released, the traffic analysis device 106 notifies the CNMS-farm 107 that the inflow of the abnormal traffic is released (613), and the CNMS-farm (107) notified of the abnormal traffic is notified. The routing path of the traffic is readjusted to the normal routing path (614). Subsequently, the process of performing the service subscriber network 103 in the traffic monitoring apparatus 105 is performed again (601).

The present invention as described above is summarized as follows.

The present invention is a customer network management service system and method for real-time monitoring of traffic flowing into a customer network to detect abnormal traffic such as traffic congestion or illegal traffic and to control the traffic.

Customer network management system according to the present invention is a traffic monitoring device for real-time monitoring of traffic flowing into / out of the customer network located in the front end of the customer network and ISP network providing the Internet service, traffic abnormality situation ( It consists of a customer network management service server farm (CNMS-farm) that reports and receives abnormal traffic, and a traffic analysis device that controls abnormal traffic and adjusts traffic traffic by analyzing abnormal traffic.

Here, CNMS-farm is a console device for controlling each component of the CNMS-farm, an output device for outputting the current status of the customer network management service control to the operator of the customer network management service control center, the Internet network of the ISP operator The network topology DB containing the configuration information, the subscriber information DB with the current status of service subscription / stop / termination of the service subscriber, and the command to control traffic traffic to the backbone and edge network components. Traffic management system for performing traffic management, such as lowering the traffic flow, and a configuration management system for changing the routing path between the network components to deliver specific traffic to the traffic analysis device.

In addition, the traffic monitoring device is connected to the edge end component, which is a contact point connected to the ISP's Internet network, and monitors traffic flowing into and out of the customer end. It is characterized by performing a function of reporting to CNMS-farm.

In addition, the traffic analysis device is connected to the backbone network component of the ISP and analyzes the traffic transmitted from the backbone network component to perform the traffic filtering and defense in the case of illegal traffic, the traffic analysis result is a simple traffic congestion In this case, the traffic traffic control may further include a function of performing specific traffic blocking so that traffic is delivered at a predetermined level or less.

The network topology DB includes routing path setting information according to ISP's network basic configuration information and basic routing policy, and dynamic routing path setting information to be used to deliver traffic to a traffic analysis device for providing a service of the present invention. It is characterized by.

In addition, the console device controls the traffic management system, configuration management system, output device and network topology DB information so that the customer network management operator can perform integrated control of the customer network management service. It has a general operation management input / output device that can input / modify.

In addition, the output device shows the configuration of the ISP network and the traffic flow situation, and outputs the abnormal traffic occurs in a form that the operator can recognize. In addition, with the permission of the operator, it has a function to deliver the control matters for the customer network in the form of SMS, mail, report, etc. to the network operator of the customer network.

The console device receives a report on the occurrence of abnormal traffic from the traffic monitoring device and controls the traffic management system to perform traffic management such as traffic traffic control in case of simple traffic congestion.

The traffic management system issues a traffic control command for the traffic from the backbone and the edge network components so that the traffic directed to the edge network component to which the customer subscribed to the service is adjusted. Perform management.

The configuration management system performs a routing path change between network components such that traffic destined for or coming from the customer network subscribed to the service is delivered to the traffic analysis device.

The method of the present invention as described above may be implemented as a program and stored in a computer-readable recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.).

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes can be made in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

The present invention as described above, the ISP having an Internet backbone network (internet backbone network) to provide an Internet service to monitor the traffic flowing into the customer's network from the Internet backbone network (customer's network) to detect abnormal traffic and control traffic By providing network management service that protects normal traffic flow and blocks illegal traffic, it is effective to protect customer network where important application servers are located from open Internet.

In addition, the present invention, the traffic routing is adjusted at the Internet backbone network level by CNMS-farm, so that traffic control is possible at the edge and backbone network where cyber attackers are connected, rather than traffic control at the customer end. In addition to the protection of the network, there is an effect that can improve the performance of the Internet backbone network.

In other words, the present invention blocks the illegal traffic flowing into the customer network, delivers normal traffic, prevents the performance of the customer's network from degrading through traffic congestion control, and further improves the performance of the network by smoothing the overall traffic communication of the Internet. It can increase the effect.

In addition, the present invention, by providing a network environment in which these application servers can be reliably connected by protecting a network in which important application servers such as IDC (Internet Data Center), financial institutions, and important large portals are installed from cyber attacks. There is.

Claims (16)

In a network system that provides Internet services to a customer's network through an internet backbone network, Traffic monitoring means for monitoring the traffic flowing into / out of the customer network located at the front end of the customer network; Traffic analysis means for analyzing abnormal traffic destined for the customer network to adjust traffic traffic for blocking and overload traffic for illegal traffic; And Manage the traffic network by managing the traffic monitoring means and the traffic analysis means to receive an abnormal situation of traffic destined for the customer network, and selectively perform routing path adjustment, traffic analysis command, traffic traffic control, etc. Customer network management service processing means for processing service Customer network management service system through traffic congestion and illegal traffic monitoring control comprising a. The method of claim 1, The traffic monitoring means, When the traffic network or illegal traffic is detected by monitoring the traffic flowing into and out of the customer network connected to an edge end component which is the contact point connected to the network of the network system, the fact is that the customer network Customer network management service system through traffic congestion and illegal traffic monitoring control, characterized in that to perform the function of reporting to the management service processing means. The method of claim 1, The traffic analysis means, It is connected to the backbone network component of the network system, analyzes the traffic delivered from the backbone network component, performs filtering and defense against illegal traffic, and controls traffic congestion through specific traffic blocking for traffic congestion. Customer network management service system through traffic congestion and illegal traffic monitoring control, characterized in that the traffic to be delivered below. The method according to any one of claims 1 to 3, The customer network management service processing means, Information providing means for calculating and providing information relating to management of the customer network according to an operator's request or specified requirements; Network topology storage means for storing network configuration information of the network system; Subscriber information storage means having service usage information such as service subscription / stop / termination of the service subscriber; Traffic management means for performing traffic management such as giving a traffic communication control command to a network component of the network system; Configuration management means for performing a routing path change between network components so that specific traffic is delivered to said traffic analysis means; And Control means for performing control management for each component of the customer network management service processing means as described above Customer network management service system through traffic congestion and illegal traffic monitoring control comprising a. The method of claim 4, wherein The network topology storage means, Routing path setting information according to network basic configuration information and a basic routing policy of the network system; And Dynamic routing path setting information to be used to deliver traffic to the traffic analysis means for providing management service for the customer network Customer network management service system through traffic congestion and illegal traffic monitoring control, comprising a. The method of claim 4, wherein The control means, An operator operating the management service for the customer network processes the control for the traffic management means, the configuration management means, and the information providing means so as to perform integrated control for the customer network management service and store the network topology. General management input / output means for inputting / modifying information of the means Customer network management service system through traffic congestion and illegal traffic monitoring control, characterized in that it comprises a. The method of claim 4, wherein The information providing means, Customer network management through traffic congestion and illegal traffic monitoring control, which shows the configuration of the network and the traffic flow on the network system and provides output information in a form that an operator can recognize when abnormal traffic occurs. Service system. The method of claim 4, wherein The information providing means, Customer network management service system through the traffic congestion and illegal traffic monitoring control, characterized in that it has a function to deliver the control information for the customer network in the form of a message to the network management system of the customer network based on a given requirement. The method of claim 4, wherein The control means, Receiving and confirming an abnormal traffic occurrence report for the customer network from the traffic monitoring means and delivering a traffic management command to the traffic management means to perform traffic management such as traffic traffic control for simple traffic congestion; Customer network management service system through traffic congestion and illegal traffic monitoring control. The method of claim 4, wherein The traffic management means, Traffic management such as transmitting a traffic control command for the traffic from the network component of the backbone and the edge so that traffic directed to the network component of the edge connected to the customer network is adjusted. Customer network management service system through traffic congestion and illegal traffic monitoring control, characterized in that for performing. The method of claim 4, wherein The configuration management means, Client network management through traffic congestion and illegal traffic monitoring control, characterized in that the routing paths between network components are changed so that traffic to or from the customer network is delivered to the traffic analysis means according to a given condition. Service system. In the customer network management service method through the traffic congestion and illegal traffic monitoring control applied to the customer network management service system of the network providing the Internet service to the customer's network through the Internet backbone network, A first step of monitoring traffic flowing into or out of the customer network; A second step of detecting an abnormality of traffic flowing into or out of the customer network; A third step of changing a routing path for traffic flowing into or out of the customer network to analyze the traffic; A fourth step of performing analysis on traffic flowing into / out of the customer network where the abnormal traffic is detected; A fifth step of blocking the illegal traffic when illegal traffic is inflow / outflow as a result of the analysis of the fourth step; And A sixth step of performing traffic traffic control according to a given traffic control policy if the overload traffic is inflow / outflow as a result of the analysis of the fourth step Customer network management service method through traffic congestion and illegal traffic monitoring control comprising a. The method of claim 12, As a result of the analysis of the fourth step, when it is determined that abnormal traffic flowing into / out of the customer network is released, the abnormal traffic inflow / outflow is released and recorded, and a routing path for traffic flowing into / out of the customer network is recorded. Seventh Step to Reorient to Normal Path Customer network management service method through traffic congestion and illegal traffic monitoring control further comprising. The method according to claim 12 or 13, The third step, An eighth step of checking whether the traffic is flowing into or out of the customer network in which an abnormality is detected; A ninth step of processing traffic congestion by transmitting a traffic communication control command to a network component of a backbone and an edge of the network if the traffic congestion results in the eighth step; And As a result of the check in the eighth step, if the traffic is not a simple traffic congestion, the tenth step of changing the routing path for the traffic flowing into or out of the customer network to analyze the traffic is possible. Customer network management service method through traffic congestion and illegal traffic monitoring control including In a customer network management service system having a processor, A first function of monitoring traffic flowing into or out of the customer network; A second function of detecting an abnormality of traffic flowing into / out of the customer network; A third function of changing a routing path for traffic flowing into or out of the customer network to enable analysis of the traffic; A fourth function of performing analysis on traffic flowing into / out of the customer network where the abnormal traffic is detected; A fifth function of blocking the illegal traffic when the illegal traffic is inflowed / outflowed as a result of the analysis of the fourth function; And A sixth function for performing traffic traffic control according to a given traffic control policy if overload traffic is flowing / inflowing as a result of the analysis of the fourth function A computer-readable recording medium having recorded thereon a program for realizing this. The method of claim 15, As a result of the analysis of the fourth function, if it is determined that abnormal traffic flowing into / out of the customer network is released, the abnormal traffic inflow / outflow is released and recorded, and a routing path for traffic flowing into / out of the customer network is recorded. 7th function to readjust to normal path A computer-readable recording medium that records a program for further realization.