KR20220067834A - Intelligent server health check device based on machine learning of network packets - Google Patents

Abstract

The present invention relates to a network packet machine learning-based intelligent server health check device. According to the present invention, the network packet machine learning-based intelligent server health check device comprises: a packet classification unit which classifies network packets flowing in or out between external Internet and an internal server into a packet flow for each service; a packet learning unit which learns normal traffic using the inflow and outflow of traffic as input characteristics and stores the trained model; and an intelligent server health inspection unit which temporarily stores the network packets classified as the packet flows for each service according to a time window, inputs flow information for the temporarily stored time window as an input characteristic to an abnormal flow detection model for which the learning has been completed, and determines whether the traffic is normal in real time. The present invention can increase the accuracy of the abnormal flow detection model.

Description

Intelligent server health check device based on machine learning of network packets}

The present invention relates to a method and apparatus for determining the health status of Internet servers.

With the development of IoT and the Internet, the types and scale of services are getting more complex. One integrated service is merged with a large-scale microservice, and each microservice is managed as a physical server cluster.

Therefore, for smooth service, the failure of individual microservices and server clusters constituting the integrated service will have to be checked frequently.

The conventional failure check, that is, server health check method, uses ICMP (Internet Control Message Protocol) to check the off and network failure of the server device itself, a method to check for service session disconnection, and a direct request message to a specific service port. There is a heartbeat method for sending a message and receiving a response message.

Since the first method checks the active state of the server device, there is a disadvantage in that the active state of a specific service cannot be checked.

In the second method, since the health check device must maintain and manage sessions with servers, additional costs for session maintenance may occur as the number of services increases.

In the third method, network overhead for checking the server status may occur, and there is also a problem that as the number of services increases, costs for message transmission/reception may occur.

The present invention is to solve the conventional problems, and machine learning of network packets that check the health of individual microservices and individual servers without generating additional network overhead such as heartbeat packets in microservices and server cluster-based integrated services We want to provide a base intelligent server health check device.

The object of the present invention is not limited to the object mentioned above, and other objects not mentioned will be clearly understood by those skilled in the art from the following description.

In order to achieve the above object, a machine learning-based intelligent server health check device for network packets according to an embodiment of the present invention classifies and stores network packets flowing in or out between the external Internet and an internal server into packet flows for each service, and traffic a packet learning unit that learns whether traffic is normal by using the inflow and outflow amounts as input characteristics, and stores the learned model; and

Network packets classified into packet flows for each service are temporarily stored according to a time window, and flow information corresponding to the temporarily stored time window is input as an input feature to the abnormal flow detection model for which the learning is completed, and whether traffic is normal in real time It includes an intelligent server health inspection unit to determine.

According to an embodiment of the present invention, in an integrated service based on microservices and server clusters, there is an effect of predicting the health status of individual microservices and individual servers without incurring additional network overhead primarily.

And, according to an embodiment of the present invention, secondarily, when the network packet-based intelligent server health check method presented in the present invention is used in combination with the existing periodic, explicit and active server health check method, more efficiently You can check the health of the server.

That is, if an abnormal server is discovered according to the present invention and the status is checked only for the corresponding server by the existing method, the following benefits can be obtained. First, it is possible to reduce the network overhead used for heartbeat compared to the case where the existing method is used from the beginning, secondly, it is possible to increase the accuracy of abnormal server detection, and finally, the result of the existing method is inputted by the packet learning unit. In addition to this, there is an effect of increasing the accuracy of the abnormal flow detection model.

1 is a conceptual diagram of a server cluster and network to which an intelligent server health check device based on machine learning of network packets is to be applied according to an embodiment of the present invention.
2 is a block diagram illustrating a machine learning-based intelligent server health check device of a network packet according to the present invention.
FIG. 3 is a block diagram illustrating the configuration of a packet classifier of the packet learning unit shown in FIG. 2 ;
4 is a flowchart illustrating a method for a flow classification module to classify network packets into flow units in a machine learning-based intelligent server health check device of network packets according to an embodiment of the present invention;
5 is a reference diagram for explaining information stored in the flow information storage of FIG.
6 is a reference diagram for explaining a conceptual diagram of machine learning performed by the flow learner of FIG. 2 based on a deep neural network and a cyclic neural network.
7 is a reference diagram for explaining the flow information stored in the flow information temporary storage of FIG.
FIG. 8 is a reference diagram for explaining the operation of the abnormal flow detector of the intelligent server health inspection unit shown in FIG. 2 .

Advantages and features of the present invention and methods of achieving them will become apparent with reference to the embodiments described below in detail in conjunction with the accompanying drawings. However, the present invention is not limited to the embodiments disclosed below, but will be implemented in a variety of different forms, and only these embodiments allow the disclosure of the present invention to be complete, and common knowledge in the technical field to which the present invention belongs It is provided to fully inform the possessor of the scope of the invention, and the present invention is only defined by the scope of the claims. On the other hand, the terms used herein are for the purpose of describing the embodiments and are not intended to limit the present invention. In this specification, the singular also includes the plural unless specifically stated otherwise in the phrase. As used herein, "comprises" and/or "comprising" refers to the presence of one or more other components, steps, operations and/or elements mentioned. or addition is not excluded.

1 is a conceptual diagram of a server cluster and network to which an intelligent server health check device based on machine learning of a network packet is to be applied according to an embodiment of the present invention.

1, the machine learning-based intelligent server health check apparatus 100 of network packets according to an embodiment of the present invention is a front-end server 3-1, a middle server 3- 2), it can be applied to servers classified into backend servers 3-3, and the like.

Depending on the scale of the integrated service, each server may be composed of a single server or a cluster or a set of microservice replicas. Depending on the scale expansion policy of the cluster (or replicaset), it may flow in from or out to the Internet (1). The resulting traffic may be load balanced.

The machine learning-based intelligent server health check device of network packets according to an embodiment of the present invention flows into and out of a service (FS, MS, or BS in FIG. 1) constituting a server cluster (or replica set) The health status of a server (service or microservice) can be checked through machine learning of network packets.

Through this, unnecessary overload that may occur in the existing periodic, explicit, and active server health check methods, for example, unnecessary check packets periodically sent to a server (service or microservice) can be reduced.

2 is a block diagram illustrating a machine learning-based intelligent server health check device of a network packet according to the present invention.

As shown in FIG. 2 , the machine learning-based intelligent server health check device for network packets according to an embodiment of the present invention includes a packet classification unit 110 , a packet learning unit 120 , and an intelligent server health check unit 130 . include

The packet classifier 110 includes a packet classifier 111 and an abnormal flow detection model storage 122 .

The packet classifier 111 classifies network packets flowing into an internal server (service or microservice) from the external Internet 1 through the network equipment 2 or flowing out from the inside into packet flows for each service, and classified The network packet is stored in the flow information storage number 122 and the flow information temporary storage 131 .

The packet learning unit 120 includes a flow information storage 121 and a flow learner 122 .

The flow information storage 121 stores information on the classified packet flow.

The flow learner 122 uses the inflow and outflow of traffic as input characteristics to learn whether the traffic is normal or not, and stores it in the abnormal flow detection model storage 122 .

The abnormal flow detection model storage 122 stores the trained model.

3 is a block diagram illustrating the configuration of the packet classifier 111 of the packet learning unit 120 of FIG. 2 .

The packet classifier 111 first uses the packet capture module 1211 to capture traffic flowing in from the external Internet from the local network device or outgoing from the local network device to the external Internet, and each captured packet includes a protocol type and packet size, etc. It is input to the flow classification module 1212 to classify the information of .

4 is a flowchart illustrating a method for the flow classification module 1212 to classify network packets into flow units in the machine learning-based intelligent server health check device of network packets according to an embodiment of the present invention.

First, when a network packet is introduced or leaked (S410), by the packet capture module 1211, which is a packet capture tool, basic information of a network packet from the input network packet, that is, time, source IP address, destination IP address, source PORT, A destination PORT is acquired (S420).

Thereafter, it is determined whether a flow table corresponding to the acquired basic information of the network packet exists in the flow information storage 121 (S430).

If the flow table corresponding to the basic information of the network packet obtained in the determination step S430 already exists in the flow information storage 121 (YES), the time, direction, and packet size of the corresponding packet are stored in the flow table. (S440).

On the other hand, if the flow table corresponding to the basic information of the network packet obtained in the determination step S430 does not exist (NO), a new flow table is first created, and then the time, direction, and packet size of the packet are stored in the flow table. Save (S450).

FIG. 5 is a reference diagram for explaining information stored in the flow information storage of FIG. 2 .

The flow information classified by the flow classification module 1212 is stored in one of tables having a name in the form of “server address: port: transport layer_protocol”.

The creation time of the flow table is when a packet of a new server address, port, and transport layer protocol set is captured and first classified by the flow classification algorithm.

After the flow table is created, the time, direction, and size of flows with the same server address, port, and transport layer protocol are stored in the same table.

As shown in FIG. 5 , three flow tables are created and maintained in the flow information storage 121 according to an embodiment of the present invention.

The first table with the table name 10.0.0.1:5684:UDP has an IP address of 10.0.0.1, uses port 5683, and uses the UDP transport protocol to flow into or out of a server (service or microservice). It stores the time, direction, and size of the flow.

And, in the second table whose table name is 10.0.0.2:8080:TCP, the IP address is 10.0.0.2, port 8080 is used, and the server (service or microservice) that uses the TCP transport protocol flows into or the server (service or microservice) It stores the time, direction, and size of the flow outflow.

Finally, a table with the table name 10.0.0.2:1883:TCP has an IP address of 10.0.0.3, uses port 1883, and uses the TCP transport protocol to either ingress to or from a server (service or microservice). It stores the time, direction, and size of the outgoing flow.

6 is a reference diagram for explaining a conceptual diagram of machine learning performed by the flow learner 122 of FIG. 2 based on a deep neural network and a cyclic neural network.

The flow learner 122 learns by using the flow information stored in the flow information storage 121 .

The flow learner 122 first extracts a pair of inflow and outflow in an arbitrary time window unit by utilizing flow information stored in the flow table of the flow information storage 121 .

The extracted inflow/outflow pair is used as an input feature of a deep neural network or a recurrent neural network. In the embodiment of the present invention, the inflow/outflow pair array [[1350, 0], [0, 42], [1350, 0], [0, 42]] is used as an input feature of a deep neural network or a recurrent neural network model. is the case

The deep neural network model and the recurrent neural network model can be trained separately, and two or more models can be trained simultaneously to increase the learning accuracy.

The learning process is preferably performed when the integrated service mentioned in the present invention is running normally.

Therefore, when the integrated service is normally operated, after sufficiently learning the normal flow for a certain period of time using actual network traffic, each model that has been trained is stored separately as an abnormal flow detection model to be used in the abnormal flow detector 132 in the future.

The learning model in an embodiment of the present invention uses a deep neural network and a recurrent neural network, but is not limited thereto, and various machine learning algorithms such as linear regression, LSTM, and random forest can be applied.

The abnormal flow detection model may be learned for each flow table or all flow tables may be learned at once. In the former, a prediction model is generated as many as the number of flow tables, and in the latter, one prediction model is generated.

FIG. 7 is a reference diagram for explaining flow information stored in the flow information temporary storage 131 of FIG. 2 .

Each table in the flow information temporary storage 131 has the same name as the flow information storage 121 used by the packet learning unit 120 .

Since the flow information temporary storage 131 is a temporary storage such as a cache, only real-time packet flow information of an arbitrarily determined time window size is maintained.

The maintained information is used as an input feature of the abnormal flow detection model that has been learned by the intelligent server health inspection unit 130 through the abnormal flow detector 132 , and the normality of the flow is predicted according to the input feature.

The intelligent server health inspection unit 130 shares the packet classifier 111 of the packet learning unit 120 and the abnormal flow detection model storage 122, and includes a flow information temporary storage 131 and an abnormal flow detector 132. do.

Traffic information is stored in the flow information temporary storage 131 by the packet classifier 111 . Here, the traffic information is used as an input characteristic of the abnormal flow detector 132 .

The abnormal flow detector 132 determines in real time whether traffic is normal by using the abnormal flow detection model that has been trained in the flow learner 122 of the packet learning unit 120 . If an abnormal flow is detected, it is determined that an error has occurred in the individual server (service or microservice) corresponding to the destination address or source address.

8 is a reference diagram for explaining the operation of the abnormal flow detector 132 of the intelligent server health inspection unit 130 shown in FIG.

As shown in FIG. 8 , flow information is stored for as long as a time window in the flow information temporary storage 131 . The flow information stored for this time window is input as an input feature to the abnormal flow detection model that has been trained by the packet learning unit 120 .

The input characteristic is an arrangement of traffic inflow/outflow at each time within the time window like the input characteristic of the packet learning unit 120. In an embodiment of the present invention, [[1350, 0], [0, 42], [1350, 0], [0, 42]].

The abnormal flow detection model receives input characteristics and predicts whether the flow is normal. To predict an abnormal flow, if an error occurs in the server (service or microservice) and only a request message continues without a response message, one-way traffic will abnormally occur in the flow table of the flow information temporary storage 131, and There will also be cases where the size of is abnormally large or small. The abnormal flow detector 132 determines that the server (service or microservice) causing the error condition is abnormal.

According to an embodiment of the present invention, in an integrated service based on microservices and server clusters, there is an effect of predicting the health status of individual microservices and individual servers without incurring additional network overhead primarily.

And, according to an embodiment of the present invention, secondarily, when the network packet-based intelligent server health check method presented in the present invention is used in combination with the existing periodic, explicit and active server health check method, more efficiently You can check the health of the server.

That is, if an abnormal server is discovered according to the present invention and the status is checked only for the corresponding server by the existing method, the following benefits can be obtained. First, it is possible to reduce the network overhead used for heartbeat compared to the case where the existing method is used from the beginning, secondly, it is possible to increase the accuracy of abnormal server detection, and finally, the result of the existing method is inputted by the packet learning unit. In addition to this, there is an effect of increasing the accuracy of the abnormal flow detection model.

As mentioned above, although the configuration of the present invention has been described in detail with reference to the accompanying drawings, this is merely an example, and those skilled in the art to which the present invention pertains can make various modifications and changes within the scope of the technical spirit of the present invention. Of course, this is possible. Therefore, the protection scope of the present invention should not be limited to the above-described embodiments and should be defined by the description of the following claims.

Claims (1)

Packet learning unit that classifies and stores network packets flowing in or out between the external Internet and the internal server into packet flows for each service, learning normal traffic using the inflow and outflow amounts as input characteristics, and then storing the learned model ; and
Network packets classified as packet flows for each service are temporarily stored according to a time window, and flow information corresponding to the temporarily stored time window is input as an input feature to the abnormal flow detection model for which the learning is completed, and whether the traffic is normal in real time An intelligent server health check device based on machine learning of network packets that includes an intelligent server health inspection unit to determine.

Images