KR20100041533A - Network management method - Google Patents

Abstract

PURPOSE: A network management method is provided to protect internal network equipment and a system by easily finding the reason of an attack to a network. CONSTITUTION: A traffic flowing from an external network into an internal network is collected through network equipment(202). Analysis for an IP(Internet Protocol) of the collected traffic and port is executed(204). When abnormal traffic is detected, the detail reason of the traffic is analyzed(206). A blocking solution due to the detail reason of the traffic is provided to the security device of the internal network(208).

Description

How to manage your network {NETWORK MANAGEMENT METHOD}

The present invention relates to a network management method, and more particularly, to a network management method for monitoring abnormal traffic in preparation for traffic information for each IP (information) and protocol (port) for the total traffic volume flowing from the external network to the internal network.

As computers and other computing devices interconnect more and more through various networks, such as the Internet, computer security becomes more important, especially from intrusions or attacks that are delivered through the network or through information streams. Those skilled in the art take many different forms such attacks include, but are not limited to, computer viruses, computer worms, system components, denial of system attacks, information stealing, and even misuse / abuse of legitimate computer system features. All of which unfairly exploit the vulnerabilities of one or more computer systems for illegal purposes.

In order to protect the internal network from such an attack, the traffic monitoring tool used in the prior art only uses the simple traffic monitoring function, and it is impossible to analyze specific traffic patterns in detail, and thus, there is a limit in analysis through fault detection. Therefore, it is impossible to analyze specific traffic patterns in detail, so it is impossible to identify the cause of the failure or prevent the failure.

In addition, since the conventional traffic monitoring tool uses a separate tool according to the work performed, it is impossible to monitor or analyze the entire network infrastructure in one screen, and thus it is impossible to expect fast analysis. Therefore, when sudden traffic increases, it is impossible to analyze the IP and protocols used in the traffic.

Accordingly, an object of the present invention is to protect network equipment and systems existing therein by making it easy to understand what causes an attack on a network.

The objects of the present invention are not limited to the above-mentioned objects, and other objects and advantages of the present invention which are not mentioned above can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. It will also be readily apparent that the objects and advantages of the invention may be realized and attained by means of the instrumentalities and combinations particularly pointed out in the appended claims.

In accordance with an aspect of the present invention, there is provided a network management method comprising: collecting traffic flowing from an external network into an internal network, performing analysis according to IP and ports on the collected traffic; And analyzing a detailed cause of the abnormal traffic when abnormal traffic is detected as a result of the analysis.

The performing of the analysis is preferably performed by quantifying the traffic details of the IP and the port for the total traffic volume in predetermined time units. In addition, the performing of the analysis, it is preferable to determine the source IP, destination IP, service port of the abnormal traffic. The method may further include providing a blocking solution according to the detailed cause of the abnormal traffic to the security equipment of the internal network.

According to the present invention, based on the traffic status included in the simple traffic monitoring function, all the traffic is classified into units (daily / minutes / seconds) and the data is made into a DB to display information on a specific time and minute basis for IP information and By showing quantified values of traffic volume by protocol (port), it is possible to analyze the traffic history for a particular increased analog. This makes it easy to identify where (Source_IP), where (Destination_IP), and what information (PORT) forms the attack on the network, and block the details from the firewall or other security devices to prevent the network equipment and systems existing inside. Can be effectively protected.

The above objects, features, and advantages will be described in detail with reference to the accompanying drawings, whereby those skilled in the art to which the present invention pertains may easily implement the technical idea of the present invention. In describing the present invention, when it is determined that the detailed description of the known technology related to the present invention may unnecessarily obscure the gist of the present invention, the detailed description will be omitted. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

1 is a diagram illustrating a configuration of a network to which a network management method according to an embodiment of the present invention is applied.

The external network 1020 is connected to the internal network via switches (or routers) 104a through 104d. Network management system 100 according to an embodiment of the present invention is configured to include a collection server 106, analysis server 108, database (DB) server 110.

2 is a flowchart of a network management method according to an embodiment of the present invention.

The collection server 106 collects all traffic flowing into the internal network from the external network through the switches 104a to 104d (202). The collection server 106 collects traffic data from network equipment in all sections in which traffic flows from the external network (or the Internet) 102 to the internal network.

The analysis server 108 performs analysis on the traffic data collected through the collection server 106 (204). The analysis server 108 analyzes the traffic data by dividing the details for each IP for the collected traffic, and then performs deep analysis on a specific port and a specific IP. In addition, the analysis server 108 performs a deep analysis of traffic for a particular server or server group.

When an abnormality is detected in the traffic flowing from the outside as a result of this analysis, the analysis server 108 analyzes the detailed cause of the abnormal traffic. (206) And using the analysis result, the analysis server 108 is an external attack It creates a solution for protecting internal services and performing recovery early on, and provides it to security equipment such as firewalls (208). The analysis server 108 may detect a TCP / UDP / ICMP flooding attack, an existing / new Internet worm virus, or an abnormality in comparison with normal traffic.

In addition, the analysis server 108 generates various reports through the report template function for the traffic analysis result, and stores the analysis result in the DB server 110.

3 is a view for explaining a process of early detection and corresponding to the failure sign for each line according to the present invention.

The "A" phase is an initial indication phase that detects traffic anomalies using variable thresholds. If the traffic suddenly increases in preparation for the usual traffic, the traffic is monitored in real time. The "B" stage is the cause analysis stage, and traffic that is significantly increased above the threshold is regarded as an abnormal symptom and detailed analysis of the traffic is performed. Traffic analysis is performed by IP history and service port by day / hour, so that network attack that causes traffic anomaly can be identified from where and through which route to the final destination, and problems and solutions can be presented simultaneously. have. The "C" step is to eliminate the cause of the traffic abnormality by preparing a countermeasure (or solution) according to the result of analyzing the detailed cause of the traffic abnormality and providing the security equipment such as a firewall. Step "D" is a reporting step. When the network reaches a normal state according to the action plan prepared, a report on the cause of the traffic abnormality and the content of the action plan is prepared.

4 illustrates a screen displaying a result of analyzing a detailed cause of an event due to an increase in traffic according to the present invention. Figure 4 (a) shows a sharp increase in outbounds traffic within the square indicated by a thick line, Figure 4 (b) is a screen that displays the result of analyzing the detailed cause of this increase in the external network Shows that the service using port 80 has increased as the number of traffic requests to the internal network increases.

FIG. 5 is a screen illustrating an improvement of the performance of a network service through detailed traffic analysis according to the present invention. As shown in the figure, by analyzing the traffic usage by service, IP_Block, and IP for the traffic flowing from the outside to the inside, it is possible to search in real time where the traffic is being transmitted from where to source.

6 shows a screen indicating automatic detection of abnormal traffic per line according to the present invention. For example, it automatically detects abnormal traffic per line such as cyber terrorism, DoS / DDoS attacks, and Internet worms. According to the present invention can automatically detect the attack pattern to protect the service performed through the internal network from the external attack. Table 1 summarizes the abnormal traffic detection function for each line according to the present invention.

7 is a screen displaying an analysis report generated according to the present invention. According to an embodiment of the present invention, the report may be generated in various forms using a template function. Periodic reports can be generated automatically and sent via email. The present invention can support the generation of reports such as web-based reports, MS-WORD-based reports, HWP format reports, and the like. There is no need for editing to create a separate report. Table 2 summarizes the report generation function according to the present invention.

As described above, the method of the present invention may be implemented as a program and stored in a recording medium (CD-ROM, RAM, ROM, floppy disk, hard disk, magneto-optical disk, etc.) in a computer-readable form. Since this process can be easily implemented by those skilled in the art will not be described in more detail.

The present invention described above is not limited to the above-described embodiments and the accompanying drawings, and various substitutions, modifications, and changes are possible in the art without departing from the technical spirit of the present invention. It will be clear to those of ordinary knowledge.

1 is a diagram illustrating a configuration of a network to which a network management method according to an embodiment of the present invention is applied.

2 is a flowchart of a network management method according to an embodiment of the present invention.

3 is a view for explaining the principle of early detection of failure signs for each line according to the present invention.

4 illustrates a screen displaying a result of analyzing a detailed cause of an event due to an increase in traffic according to the present invention.

FIG. 5 is a screen showing that improving performance of a network service through detailed traffic analysis according to the present invention.

6 shows a screen indicating automatic detection of abnormal traffic per line according to the present invention.

7 is a screen displaying an analysis report generated according to the present invention.

Claims (7)

In the network management method, Collecting traffic from the external network to the internal network, Performing analysis on the collected traffic according to IP and port; Analyzing the detailed cause of the abnormal traffic when abnormal traffic is detected as a result of the analysis; Network management method characterized in that it comprises. The method of claim 1, The analyzing step is performed by quantifying the traffic details of the IP and port for the total traffic volume in a predetermined time unit. The method according to claim 1 or 2, The traffic collecting step is a network management method, characterized in that for collecting the traffic through the network equipment for transmitting traffic from the external network to the internal network. The method according to claim 1 or 2, The performing of the analysis may include determining a source IP, a destination IP, and a service port of the abnormal traffic. The method according to claim 1 or 2, And detecting the traffic as abnormal traffic when the traffic details of the IP and the port increase above a predetermined threshold. The method according to claim 1 or 2, The performing of the analysis step is performed by contrasting with normal traffic. The method according to claim 1 or 2, And providing a blocking solution according to the detailed cause of the abnormal traffic to the security equipment of the internal network.

Images