KR20100072975A - Apparatus and method for managing network traffic based on flow and session - Google Patents

Abstract

PURPOSE: A network traffic management apparatus and a method thereof are provided to control flows generated from each application based on a traffic control policy. CONSTITUTION: A flow processing unit(110) controls a network traffic for each flow according to a traffic control policy. A flow controller(120) extracts a flow parameter about a flow set related from extracted discrete flow information. The flow controller analyzes a flow pattern. The flow controller recognizes the session which the flow set belongs by using the analyzed result and the saved flow pattern for each session. The flow controller decides the traffic control policy on the basis of the recognized session.

Description

Flow traffic and session based network traffic management apparatus and method thereof {APPARATUS AND METHOD FOR MANAGING NETWORK TRAFFIC BASED ON FLOW AND SESSION}

The present invention relates to an apparatus and method for managing network traffic based on flows and sessions, and more particularly, to correlations between flows as well as basic flow information (for example, the number of flows of a host and a heavy flow). Session-based by recognizing in real time what sessions (applications) are occurring (flow patterns) and controlling flows from each application based on traffic control policies. The present invention relates to a flow and session based network traffic management apparatus and method for managing bandwidth of a network.

Recently, distributed computing environment has been expanded due to computerization and various network-based applications have been developed. Accordingly, network traffic is on the rise. In addition, finding out how much traffic and what type of traffic is generated from which host has become very important for efficiently utilizing limited network resources.

However, current network management systems only provide simple planar information such as providing statistics according to traffic monitoring, and are insufficient to analyze the network and prepare countermeasures accordingly. Therefore, the network management system must analyze the network traffic in detail. In addition, the network management system needs to develop a system capable of analyzing and diagnosing traffic by network layer, region, host, and traffic flow. This is for efficient network resource utilization.

Conventional network control and management equipment controls or manages the network based on packet information of TCP / UDP or IP. The devices are being studied to achieve specific unit goals such as routing, QoS, and DDoS prevention.

However, this packet-based approach ignores the information based on the communication relationship of the upper applications. In addition, this approach simply relies on the information contained in each separate packet, which is a temporary information transfer unit. As such, packet-based access systems are being provided in the form of a single system for independent goals due to the limited processing speed and largely the applicability. Here, a single system for an independent target may include a router for packet routing, a dedicated system for defending DDoS attacks, or a DPI system for traffic control.

In addition, the best effort (best effort) method of transmission and operation, which is the essence of the IP network, is characterized by DDoS attacks and network bandwidth (network bandwidth) due to the explosion of user traffic and the increase of malicious users due to the generalization of Internet technology. As the number of attacks increases, it causes many problems in the management and maintenance of the network.

The conventional best effort transmission and operation method has various current IP network problems for DDoS attack, bandwidth attack, P2P, and the like. Such conventional transmission and operation methods do not protect mission-critical traffic (eg, TV, SoIP, e-learning, etc.) and do not maximize the quality of service on the Internet. There is a problem. There are also problems with the network centric warfare (NCW) and the defense broadband and national telecommunications networks in pursuit of e-government.

The recent situation is that the threat to network bandwidth is increasing due to the indiscriminate inflow of unpredictable packets such as P2P and DDoS attacks. This is a natural result of the nature of IP designed to maximize the available resources of the user's packets without special control. The consequences of this are unforeseen problems such as interruption of services due to attacks, deterioration of normal services due to uncontrollable resource management, and increased investment costs for network construction.

On the other hand, flow technology and session aware network technology are technical fields at an early stage of research and development. Research and development is being done little by little for network operators to use the technology to monitor and protect mission critical traffic in real time on IP networks. In addition, research and development have been attempted to develop flow-based network control equipment by fusing software technologies such as flow router and hardware equipment and flow control technology. In addition, large network equipment companies are being researched as a core technology of network traffic analysis. In addition, the development of high-speed flow routing equipment is in progress.

However, since these technologies are used as an offline analysis or high-speed routing technology of network traffic, the technology level for controlling real-time network traffic is not secured. In other words, the flow generation technique is dependent on the sampling of the packet, and thus the level of information extraction for the real time control is not accurate.

Currently, a representative network traffic detection and control system is a deep packet inspection (DPI) system that inspects a packet's payload. The DPI system has three fatal drawbacks. First, the overhead of processing is too great because the payload of all the packets being sent must be examined. Second, if the payload is an encrypted packet, there is no way to decrypt it. Therefore, there is no way to detect network traffic. Third, because the inspection of the packet payload may damage the privacy of the network user, there is a legal problem. Three problems are limiting the practical application of DPI systems. However, there are still no system solutions or conventional techniques that can solve and cope with the problems of the DPI system.

Therefore, the prior art as described above detects network traffic by inspecting the payload of the packet, so that the overhead of processing the payload is large, and the traffic cannot be detected when the payload is encrypted. There is a problem that the privacy of the user may be compromised due to the problem, it is an object of the present invention to solve this problem.

Therefore, the present invention is generated by operating a session (application) based on not only basic flow information but also correlations between flows (for example, the number of flows of a host or a heavy flow). Flow and session based network traffic management device, which can manage the bandwidth of the network on a session basis by recognizing the flow pattern) in real time and controlling flows generated from each application based on the traffic control policy. And a method thereof.

The objects of the present invention are not limited to the above-mentioned objects, and other objects and advantages of the present invention which are not mentioned can be understood by the following description, and will be more clearly understood by the embodiments of the present invention. Also, it will be readily appreciated that the objects and advantages of the present invention may be realized by the means and combinations thereof indicated in the claims.

In order to solve the above problem, in order to solve the above problem, a session (application) is established based on not only basic flow information but also correlations between flows (for example, the number of flows of a host and a heavy flow). It is characterized in that it recognizes in real time whether it is generated by the operation (flow pattern), and controls flows generated from each application program based on the traffic control policy.

More specifically, the apparatus of the present invention is a network traffic management apparatus, comprising: flow pattern storage means for storing a flow pattern for each session; Flow processing means for generating a flow by extracting individual flow information from packets transmitted through a data link of network traffic, and controlling network traffic for each flow according to a traffic control policy; And extracting a flow parameter for an associated flow set from the extracted individual flow information to analyze a flow pattern, and using the analyzed result and the stored session-specific flow pattern, recognizes a session to which the flow set belongs, and recognizes the flow pattern. Flow control means for determining the traffic control policy based on the established session.

In addition, the apparatus of the present invention further comprises a flow pattern analysis means for updating the stored flow pattern list for each session by analyzing the flow pattern for the flow not processed by the flow control means in the background.

On the other hand, the method of the present invention, a network traffic management method, comprising: a flow generating step of generating a flow by extracting individual flow information from packets transmitted through a data link of a network traffic; A flow analysis step of analyzing a flow pattern by extracting flow parameters for an associated flow set from the extracted individual flow information; A session recognizing step of recognizing a session to which the flow set belongs by using the analyzed result and prestored flow patterns for each session; And a flow control step of determining a traffic control policy based on the recognized session and controlling network traffic for each session according to the determined traffic control policy.

In addition, the method of the present invention further includes a list updating step of updating a flow pattern list for each session by analyzing a flow pattern for a flow not processed in the flow analysis step in the background.

As described above, the present invention is generated by operating a session (application) based on not only basic flow information but also correlations between flows (for example, the number of flows of a host, a heavy flow, etc.). By recognizing whether or not to perform (flow pattern) in real time, and controlling the flows generated from each application based on the traffic control policy, it is effective to manage the bandwidth of the network on a session basis.

That is, the present invention proposes a session-based IP network technology based on a flow-based session recognition technology, thereby providing a problem of various current IP networks such as DDoS attacks, bandwidth attacks, and P2P. There is an effect that can solve them.

In addition, the present invention can maximize the service quality of the Internet by protecting the mission-critical traffic such as IPTV, SoIP, e-learning.

Furthermore, the present invention can solve the problems existing in the defense broadband communication network and the national information communication network pursuing network-centered warfare and e-government using session-based IP network technology. The present invention has the effect that the development of intelligent routers and switches, wide area network (WAN) accelerator, network security equipment such as DDoS or FireWare, and network QOS related equipment can be further activated.

BRIEF DESCRIPTION OF THE DRAWINGS The above and other objects, features and advantages of the present invention will become more apparent from the following detailed description of the present invention when taken in conjunction with the accompanying drawings, It can be easily carried out. In the following description, well-known functions or constructions are not described in detail since they would obscure the invention in unnecessary detail. Hereinafter, exemplary embodiments of the present invention will be described in detail with reference to the accompanying drawings.

Before describing the present invention, terms are as follows.

Flow is a set of IP packets that are delivered continuously within a limited time. Deep Packet Inspection (DPI) system is a packet filtering method that inspects the payload of a packet. Asynchronous Transfer Mode (ATM) is a transmission method that transmits data in a fixed size. Distributed Denial-of-Service Attack (DDoS) is a distributed denial-of-service attack that attacks a specific site by operating multiple computers simultaneously. Peer to Peer (P2P) is a network of peer nodes that play the role of server and client.

1 is a configuration diagram of an apparatus for managing flow and session based network traffic according to the present invention.

As shown in FIG. 1, the network traffic management apparatus 100 includes a flow processor 110, a flow controller 120, a flow pattern analyzer 130, and a flow pattern database 140.

The network traffic management apparatus 100 uses a hybrid technology that combines the ATM control concept with the best effort IP network technology for real time network bandwidth control and protection. The network traffic management apparatus 100 relates to a session-based IP network traffic management apparatus using a flow-based technique and a session recognition technique.

For example, the network traffic management apparatus 100 attempts to solve the inherent problems of the best effort based Ethernet and TCP / IP technologies in a commercial network. Here, the best effort-based Ethernet and TCP / IP technologies are used to solve the above-mentioned vulnerabilities such as DDoS attacks and bandwidth attacks, LAN (Local Area Network) and MAN (Metropolitan Area Network). It is to build. In addition, the network traffic management apparatus 100 protects mission-critical traffic such as IPTV, SoIP, and e-learning, and uses flow-based session recognition technology to maximize the service quality of the Internet. It relates to a session-based IP network traffic management device based.

Hereinafter, each component of the network traffic management apparatus 100 and the network traffic management method will be described.

The flow processor 110 extracts flow information from successive packets and controls traffic for each flow. That is, the flow processor 110 generates and manages a flow which is a unit for session recognition in a packet-based IP network. In addition, the flow processor 110 performs a process on the flow based on the flow control rule. The flow processing unit 110 may provide high-speed routing even in low-performance equipment by performing routing in flow units instead of packet units.

The flow controller 120 analyzes network traffic based on the flow and generates a traffic control policy based on the analyzed result. That is, the flow controller 120 analyzes a flow pattern based on flow information transmitted from the flow processor 110 in real time and flow parameters of respective flows. Thereafter, the flow controller 120 determines a control policy for the analyzed traffic and transfers the determined control policy to the flow processor 110. This is to enable flow-based network bandwidth management and control in real time. In addition, the flow controller 120 performs a real time session recognition function, which is a main technology of the session-based IP network system.

The flow pattern analyzer 130 performs pattern analysis on pattern information of flows that the flow controller 120 does not process in real time, and applies the flow pattern information, which is a result thereof, to the flow controller 120. That is, the pattern analysis is performed on the pattern information of flows that cannot be processed in real time by the flow control unit 120, and the flow pattern information which is a result thereof is transmitted to the flow control unit 120 to enable network bandwidth control in real time.

The flow pattern database 140 analyzes flow patterns of various application services necessary for session-based and stores the analysis results. That is, the flow pattern database 140 is a database that analyzes and stores flow patterns of various application services necessary for session recognition, and continuously reflects the analysis result of the flow pattern analyzer 130 in real time in the flow controller 120. Reference to flow pattern analysis.

On the other hand, the network traffic management apparatus 100 according to the present invention performs the following three main functions.

First, the flow processor 110 recognizes a flow using a flow recognition function. Here, the flow means a set of data packets that are continuously associated with each other, away from the individual packet-oriented data processing scheme. For example, a flow consists of 4, 5, and 7-tuples based on the information in the TCP / IP header. The flow processing unit 110 recognizes such a flow and processes data on the network based on the flow. The flow processor 110 selects tuples that can best express the correlation of data packets according to the characteristics of the field to be applied.

Second, the flow controller 120 recognizes a session by using a session recognition function. The flow processor 110 recognizes a flow of network traffic. The flow controller 120 extracts the delivery characteristic (for example, flow parameter) information of each of the flows recognized by the flow processor 110 and recognizes a session to which each flow belongs based on the extracted information. Here, the flow parameter indicates information on what delivery pattern the recognized flow represents. For example, the most basic flow parameters are the packet count up to the point when the flow is created and finished, the sum of the sizes of the packets, the survival time of the flow, and the like. In addition to this basic information, flow parameters have various flow parameters that can distinguish a session. The flow controller 120 recognizes a session to which a flow having a pattern of flows belongs based on the flow control unit 120.

Third, the flow processor 110 manages and controls the session-based network by using a session-based network function. This is to solve the management and control problems caused by the best effort method which is the basic characteristic of the IP network. That is, the flow processor 110 applies the VC concept used in ATM to the IP network. The flow controller 120 analyzes the characteristics of the network traffic based on the flow, and recognizes sessions that constitute each flow. Then, the flow processing unit 110 manages and controls the IP network using the session recognition result.

On the other hand, the flow processing unit 110 processes the flow in real-time. Here, the real-time processing means a case in which processing for the flow can be performed at the time when the flow is generated.

In addition, the flow control unit 120 controls the flow during runtime. Here, the execution time control refers to a case in which control on the flow may be applied after the flow is generated and before the flow is terminated.

The flow pattern analyzer 130 analyzes the flow pattern in the background. Here, the background processing means processing when it is not related to the life-time of the flow. Background processes are relevant to most analyzes except for real-time analysis.

2 is a block diagram of an embodiment of a network when the apparatus for managing network traffic according to the present invention is actually applied.

As shown in FIG. 2, the flow processing unit 110 and the flow control unit 120 correspond to one-to-one (1: 1) and are located at an interface end of each network.

The flow pattern analyzer 130 corresponds to the flow controller 120 one-to-many (1: N) and is installed at a server farm. Here, a server farm refers to a web hosting service using a website or multiple servers with one or more servers.

In addition to the general network link, the flow controller 120, the flow pattern analyzer 130, and the flow pattern database 140 have separate signaling links for mutual information exchange. Each link is divided into a data link 201 through which consecutive packets are transmitted and a signal link 211 through 214 through which control packets between session-based network components are transmitted.

For example, referring to each of the signal links 211 to 214, the signal link 211 is a link between the flow processor 110 and the flow controller 120 through which the flow information and the control policy control packet are transmitted. The signal link 212 is a link 107 between the flow controller 120 and the flow pattern analyzer 130 that transmits flow information that cannot be processed in real time and a result that is analyzed in the background. The signal link 213 is a link 213 that transmits flow information analyzed by the flow controller 120 or the flow pattern analyzer 130 to the flow pattern database 140. The signal link 214 is a link sharing the flow information analyzed by the flow controller 120 between the flow controllers 120.

3 is a flowchart illustrating an embodiment of a flow and session based network traffic management method according to the present invention.

The flow processor 110 generates a flow by extracting individual flow information from the packets transmitted through the data link 201 of the network traffic (302). The flow processor 110 recognizes a set of data packets associated with each other continuously, and generates a predetermined number of tuples that are correlated using TCP / IP header information.

The flow controller 120 extracts a flow parameter for the associated flow set from the extracted individual flow information (304).

Next, the flow controller 120 analyzes the flow pattern using the extracted flow parameter (306). The flow controller 120 analyzes the flow pattern using the packet count from the flow generation to the end time, the sum of the sizes of the packets, and the survival time of the flow as flow parameters for the associated flow set.

Thereafter, the flow controller 120 recognizes the session to which the flow set belongs by using the analyzed result and the prestored flow pattern for each session (308). The flow controller 120 recognizes the session in real time based on the behavior information extracted from the correlation for the associated flow set. The flow controller 120 recognizes in real time that a specific flow pattern occurs by using the analyzed result and the flow pattern for each session pre-stored in the flow pattern database 140 and confirms the type of session at runtime.

In operation 310, the flow controller 120 determines a traffic control policy based on the recognized session.

Subsequently, the flow processor 110 controls 312 network traffic for each session according to the determined traffic control policy.

Thereafter, the flow pattern analyzer 130 analyzes the flow pattern of the unprocessed flow in the background to update the session-specific flow pattern list (314). Here, the flow pattern analyzer 130 updates the flow pattern list for each session by analyzing a flow pattern of the unprocessed flow in the background. As a result of analyzing the background, the flow pattern analyzer 130 generates a new session-specific flow pattern list corresponding to the newly analyzed flow pattern if the flow pattern is newly analyzed.

In other words, the apparatus 100 for managing network traffic according to the present invention divides a session of a network into a narrowband session and a broadband session to manage network traffic. That is, the apparatus 100 for managing network traffic is to process a narrowband session in a packet-based IP manner and to process a wideband session in controllable session switching. That is, the network traffic management apparatus 100 combines the ATM control technology with the technology of scheduling in the controllable session unit, not in the packet unit scheduling.

In addition, the network traffic management apparatus 100 according to the present invention uses a session-based IP network technology based on a flow-based session recognition technology, such as a DDoS attack, a bandwidth attack, and a peer-to-peer (P2P). To solve various problems of the current IP network. In addition, the network traffic management apparatus 100 attempts to maximize service quality of the Internet by protecting mission-critical traffic such as IPTV, SoIP, and e-learning. In addition, this paper aims to solve the problems existing in the national defense network and the defense broadband network that pursues Network Centric Warfare (NCW) and e-government using session-based IP network technology.

On the other hand, the method of the present invention as described above can be written in a computer program. And the code and code segments constituting the program can be easily inferred by a computer programmer in the art. In addition, the written program is stored in a computer-readable recording medium (information storage medium), and read and executed by a computer to implement the method of the present invention. The recording medium may include any type of computer readable recording medium.

The present invention described above is capable of various substitutions, modifications, and changes without departing from the technical spirit of the present invention for those skilled in the art to which the present invention pertains. It is not limited by the drawings.

1 is a configuration diagram of an apparatus for managing flow and session based network traffic according to the present invention;

2 is a configuration diagram of an embodiment of a network when the apparatus for managing network traffic according to the present invention is actually applied;

3 is a flowchart illustrating an embodiment of a flow and session based network traffic management method according to the present invention.

* Explanation of symbols for the main parts of the drawings

110: flow processing unit 120: flow control unit

130: flow pattern analysis unit 140: flow pattern database

Claims (14)

In the network traffic management apparatus, Flow pattern storage means for storing a flow pattern for each session; Flow processing means for generating a flow by extracting individual flow information from packets transmitted through a data link of network traffic, and controlling network traffic for each flow according to a traffic control policy; And From the extracted individual flow information, a flow parameter of an associated flow set is extracted to analyze a flow pattern, and the session to which the flow set belongs is recognized using the analyzed result and the stored session-specific flow pattern, and the recognized Flow control means for determining the traffic control policy based on a session Network traffic management device comprising a. The method of claim 1, Flow pattern analysis means for updating the stored flow pattern list for each session by analyzing a flow pattern for a flow not processed by the flow control means in the background Network traffic management device further comprising. The method of claim 2, The flow pattern analysis means, The network traffic management apparatus for generating a new session-specific flow pattern list corresponding to the newly analyzed flow pattern as a result of the analysis on the background. 4. The method according to any one of claims 1 to 3, The flow processing means, A network traffic management apparatus for recognizing a set of consecutively related data packets, and generating a predetermined number of tuples that are correlated using TCP / IP header information. The method of claim 4, wherein The flow control means, And analyzing a flow pattern using a packet count from a flow generation to an end time, a sum of sizes of packets, and a survival time of the flow as flow parameters for the associated flow set. The method of claim 5, The flow control means, Network traffic management apparatus for real-time session recognition based on the behavior information extracted from the correlation for the associated flow set. The method of claim 6, The flow control means, A network traffic management apparatus for recognizing in real time that a specific flow pattern occurs using the analyzed result and the stored flow pattern for each session, confirming the type of session at runtime. In the network traffic management method, A flow generating step of generating a flow by extracting individual flow information from packets transmitted through a data link of network traffic; A flow analysis step of analyzing a flow pattern by extracting flow parameters for an associated flow set from the extracted individual flow information; A session recognizing step of recognizing a session to which the flow set belongs by using the analyzed result and prestored flow patterns for each session; And A flow control step of determining a traffic control policy based on the recognized session and controlling network traffic for each session according to the determined traffic control policy Network traffic management method comprising a. The method of claim 8, List update step of updating the flow pattern list for each session by analyzing the flow pattern for the flow not processed in the flow analysis step in the background Network traffic management method further comprising. The method of claim 9, The flow pattern analysis step, And if the flow pattern is newly analyzed, as a result of the analysis on the background, generating a new session-specific flow pattern list corresponding to the newly analyzed flow pattern. The method according to any one of claims 8 to 10, The flow processing step, A method for managing network traffic that recognizes a set of consecutively related data packets, but generates a predetermined number of tuples that are correlated using TCP / IP header information. The method of claim 11, The flow control step, And analyzing a flow pattern using a packet count from a flow generation to an end point, a sum of sizes of packets, and a survival time of the flow as flow parameters for the associated flow set. 13. The method of claim 12, The flow control step, And recognizing the session in real time based on the behavior information extracted from the correlation for the associated flow set. The method of claim 13, The flow control step, And recognizing the type of the session in real time using a result of the analysis and the stored flow pattern for each session in real time.

Images