KR20120067528A - Method for self studying of rule and lte system for the same - Google Patents

Abstract

PURPOSE: A rule self studying method and an LTE(long term evolution) system thereof are provided to analyze information of received traffics for setting rules for classifying service, and to periodically update the rules using at least one intelligent classifier. CONSTITUTION: An LTE(long term evolution) system comprises the following: a traffic collection module(210) collecting information of various traffics, and transferring the collected information to a DPI(deep packet inspection) module(220) and DFI(deep flow inspection) module(230); the DPI module inspecting the user domain of all network traffics, and collecting and analyzing the statistical features of the traffics; and an inspection module(250) classifying learning patterns, and generating a new learning pattern.

Description

METHOD FOR SELF STUDYING OF RULE AND LTE SYSTEM FOR THE SAME

TECHNICAL FIELD The present invention relates to the field of networks, and more particularly, to a method capable of self-learning deep packet inspection (DPI) and deep flow inspection (DFI) rules, and a long term evolution (LTE) system therefor.

Recently, with the development of wireless networks, security threats such as unauthorized authentication, packet interception, and IP spoofing have increased. In addition, distributed denial of service (DDoS) attacks can cause catastrophic damage to wireless networks. Deep packet inspection (DPI) and deep flow inspection (DFI) technologies are being added to wireless networks to prevent these threats or to reduce network loss.

DPI and DFI technology is a method of classifying traffic for effective network management and effective use of network resources by analyzing packets.

1 is an exemplary view showing the configuration of a general traffic analysis model. The general traffic analysis model includes a traffic collection module 110, a DPI module 120, a DFI module 130, a matching module 140 and an inspection module 150.

DPI module 120 examines the user area of all network traffic that is forwarded. Each traffic has a distinctive signature for each protocol exchanged. Such features may include keywords, commands, options, distinguishable patterns, and the like. These patterns may be known in general and are constantly changing or adding to them. This rule is called "Rule". An inspector (not shown) of the DPI module 120 analyzes a rule string of traffic in the user domain and delivers the rule string to the matching module 140.

The DFI module 130 collects and analyzes statistical characteristics of all network traffic delivered. The DFI module 130 may store statistical characteristics of traffic, such as average packet size, maximum packet size, packet rate, and bit rate, as DFI rules. . The statistical characteristics of the traffic actually used have a significant effect on the traffic analysis, and some statistical characteristics do not have a significant effect on the cost of the analysis.

The matching module 140 transmits the analysis results of the DPI module 120 and the DFI module 130 to the inspection module 150 to the service application (blocking, charging, etc.) application layer.

Rules stored in the DPI module 120 and the DFI module 130 must be defined in advance, and in order to define these rules in advance, there are many costs and time corresponding to new services and changes to avoid blocking and billing. There is a problem that is consumed.

The present invention provides a method for learning the deep packet inspection (DPI) and deep flow inspection (DFI) rules on its own, and an LTE system therefor.

The LTE system of the present invention analyzes the information on the received traffic, forms a rule for classifying services, and periodically updates the rule using at least one intelligent classifier.

In addition, rule self-learning method of the present invention, a) analyzing the information on the received traffic (traffic) to form a rule that can classify the service; And b) periodically updating the rule using at least one intelligent classifier.

The traffic management technology of the packet-switched devices will continue to require and develop technologies that can significantly reduce maintenance costs to improve service accuracy and add additional types of managed services that are required in response to the requirements of packet service providers. It is foreseen that the present invention can fundamentally reduce accuracy and maintenance costs.

1 is an exemplary view showing the configuration of a general traffic analysis model.
2 is an exemplary view showing the configuration of a traffic analysis model according to an embodiment of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the accompanying drawings. In the following description, well-known functions or constructions will not be described in detail if they obscure the subject matter of the present invention.

2 is an exemplary view showing the configuration of a traffic analysis model according to an embodiment of the present invention. In one embodiment, the traffic analysis model of the present invention may serve as a traffic analyzer of the LTE system packet switching apparatus.

Referring to FIG. 2, the traffic analysis model includes a traffic collection module 210, a DPI module 220, a DFI module 230, a matching module 240, an inspection module 250, and a pattern learner 260. .

The traffic collection module 210 collects information about various traffic input from the network and delivers the information to the DPI module 220 and the DFI module 230.

DPI module 220 examines the user area of all network traffic that is forwarded. The DPI module 220 may store the result of checking the user area as a DPI rule as shown in Table 1. For example, the DPI module 220 may calculate the DPI rule for each service using static information, such as the port number of a well-known protocol. Using the DPI rule obtained through the traffic analysis model, the packet switching apparatus may classify which service corresponds to the corresponding service.

service DPI rules Skype "{&} GET, HTTP, ui \ .skype \ .com edonkek_tcp "\ xe3"; offset: 0; depth: 1 http tcp / 80, udp / 80, tcp / 8080, udp / 8080 Facebook "{&} GET, HTTP, facebook \ .com | fbcdn \ .net Youtube "{&} GET, HTTP, youtube \ .com

The DFI module 230 collects and analyzes statistical characteristics of all network traffic received from the traffic collection module 210. The DFI module 230 displays statistical characteristics of traffic such as average packet size, maximum packet size, packet rate, and bit rate. Can be stored as The DFI rules stored by the DFI module 230 may be periodically changed by the learning of the pattern learner 260. The DFI module 230 may calculate each DFI rule as shown in Table 2 by analyzing each network traffic. Using the DFI rule obtained through the traffic analysis model, the packet switching apparatus may classify which service corresponds to the corresponding service.

service DFI Rules Skype pkt_size_avg: 180-230
pkt_rate_avg: 49-51;
bit_rate_avg: 70000-90000 edonkek_tcp pkt_size_avg: 29-35;
pkt_rate_avg: 47-51;
bit_rate_avg: 11600-14000; http pkt_size_avg: 105-125;
pkt_rate_avg: 29-34;
bit_rate_avg: 29500-30500;
pkt_size_max: 1-299; Facebook pkt_size_avg: 200-300;
pkt_rate_avg: 32-48;
bit_rate_avg: 48000-110000; Youtube pkt_size_avg: 400-500;
pkt_rate_avg: 42-48;
bit_rate_avg: 50000-80000

In addition, the DFI module 230 may include at least one intelligent classifier to form a DFI rule. Table 3 shows the types of intelligent classifiers as examples.

classifier Explanation SVM Support Vector Machines (SVM) algorithms are based on statistical learning techniques and hyperplanes and are suitable for nonlinear models. MLP MLP (Multi Layer Perceptron) Algorithm is a learning classifier developed from the internal connection structure of human neural network, and it is a structure that aggregates the information transmitted to the whole network. K-NN The K-NN (k-nearest neighbor) algorithm is an algorithm that judges the composition of the nearest recognized points around the target point based on the existing data.

In addition, the intelligent classifier included in the DFI module 230 may update the intelligent classifier using the new DFI rule received from the pattern learner 260.

The matching module 240 may receive the traffic analysis results of the DPI module 220 and the DFI module 230 to perform weighted voting to improve the accuracy of the rule. As an example, Table 4 shows an example of weighted voting according to an embodiment of the present invention.

weight score Total score DPI 7 One 1 * 7 = 7 SVM 5 2 2 * 5 = 10 MLP 3 3 3 * 3 = 9 K-NN One 4 4 * 1 = 4

In one embodiment, in weighted voting, the DPI rule may be given a high weight because it uses static information, and each intelligent classifier may be weighted differently according to its characteristics. The score according to each intelligent classifier may be preset by the system administrator in consideration of the characteristics of the classifier. The matching module 240 may perform weighted voting using the total score multiplied by the weight of each classifier and the score as the weight of each classifier. By the weighted voting as described above, the matching module 240 may form a learning pattern.

The inspection module 250 classifies the learning pattern generated by the matching module 240 to form a new learning pattern. The inspection module 250 transmits the formed learning pattern to the service application (blocking, charging, etc.) application layer and the pattern learning unit 260.

The pattern learner 260 performs self-learning using the learning pattern received from the inspection module 250 to form a new DFI rule, and transmits the new DFI rule to the DFI module 230.

Although the present invention has been described in connection with some embodiments thereof, it should be understood that various changes and modifications may be made therein without departing from the spirit and scope of the invention as understood by those skilled in the art. something to do. It is also contemplated that such variations and modifications are within the scope of the claims appended hereto.

110,210: Traffic Acquisition Module 120,220: DPI Module
130,230: DFI module 140,240: matching module
150, 250: inspection module 260: pattern learning unit

Claims (7)

As an LTE system,
LTE system for analyzing the information on the received traffic (traffic) to form a rule that can classify the service, and periodically updating the rule using at least one intelligent classifier. The method of claim 1,
The rule includes a deep packet inspection (DPI) and deep flow inspection (DFI) rule. The method of claim 1,
The intelligent classifier includes support vector machines (SVMs), multi layer perceptrons (MLPs), and k-nearest neighbors (K-NNs). The method of claim 1,
LTE system for periodically updating the rule by giving a weight according to the characteristics of the intelligent classifier. As a rule self learning method,
a) forming a rule for classifying services by analyzing information on received traffic; And
b) periodically updating the rule using at least one intelligent classifier. The method of claim 5,
The rule includes a deep packet inspection (DPI) and deep flow inspection (DFI) rule,
The intelligent classifier includes support vector machines (SVMs), multi-layer perceptrons (MLPs), and k-nearest neighbors (K-NNs). The method of claim 5,
The step b) is a self-learning method of periodically updating the rule by giving a weight according to the characteristics of the intelligent classifier.

Images