TW201225581A - Network monitoring method and system thereof - Google Patents

Abstract

The present invention discloses a network monitoring method and the system thereof. The system comprises a packet analyzing module, a real-time connection record processing module, and a record rearrangement update module. The packet analyzing module is for obtaining analyzed packet information according to a packet. The real-time connection record processing module generates a real-time connection record including an identification column according to the analyzed packet information. The record rearrangement update module is for rearranging and updating the real-time connection record whose identification column is recorded as void; and if there doesn't exist any data at least partially corresponding to a group of member relation tables, a new identification code will be generated and used to update the identification column of the real-time connection record; meanwhile, the updated real-time connection record will be added to the group of member relation tables.

Description

201225581 VI. Description of the Invention: 嘱 Technical Field of the Invention The present invention relates to a network monitoring system, particularly to a network monitoring system for monitoring network behavior that is not limited to a specific object. [Previous technology] With the promotion of enterprise networkization, employees can use the Internet to carry out various tasks. Therefore, how to effectively control the online access of all employees in the enterprise, so as to avoid the employees from browsing unnecessary web pages or using during the service hours. Instant messaging chats affect job performance and become a very important topic in large enterprises. At present, many technologies for network monitoring have been seen. In addition to real-time analysis of packets, network behaviors can be recorded to facilitate administrators to grasp the use of the network by internal employees. The network packet analysis technology is mainly analyzed according to the communication protocol defined in the Open System Interconnection Reference Model (〇SI) proposed by the International Standards Organization. Obtained in the third layer of the network layer: the user's Internet Protocol (IP) address and Media Access Control (MAC) address. The fourth layer of the transport layer controls the monitoring and management of network equipment and data traffic to ensure smooth communication. In the seventh layer application layer, the network packet has different types according to different application methods. For example, in the Simple Mail Transfer Protocol (SMTP), the packet has information such as a mail account and a mail address. A conventional network monitoring technology, such as Taiwan Patent No. 1313993, discloses a network monitoring system, which is provided with a monitoring feeding device between a proxy server and a plurality of computers each having a network 201225581... In a monitoring address list 1 having at least one monitoring address: the terminal transmits the plurality of packet data through the network and the corresponding terminal-receiving end, and the calling terminal and the receiving end start transmitting the plurality of packet data, when the calling message When the address is known to match the monitoring address in the monitoring address list, the monitoring server immediately monitors and records. - The above-mentioned 4 conventional network monitoring technologies, for which certain preset special objects (such as 'users whose network addresses exist in the monitoring address list') are controlled by I, for their network addresses Clients that are not preset to this monitoring address list are not monitored on the fly. SUMMARY OF THE INVENTION Accordingly, it is an object of the present invention to provide a network monitoring method.于疋, the network monitoring method of the present invention comprises the following steps: (the illusion is based on at least - the packet is obtained - the packet information is analyzed; (b) the analyzed packet information is compared with the group correspondence table, Generating an instant connection record including: an idiom and an at least one analysis information field, wherein the person correspondence table includes at least one identity code for use as an index, and the analysis information field is used for recording The analyzed packet information, if there is no data in the group corresponding to the at least part of the analyzed packet information, the identity identification field is recorded as a null value, otherwise, the analyzed packet information is corresponding to Updating the group personnel correspondence table and the identity identification code corresponding to the at least part of the data in the group correspondence table has been recorded in the identity identification field of the instant connection record; and (c) repeating the steps (a)~(b) After a predetermined period of time, the identity identification field is recorded as 201225581. The instant connection record of the step (C) empty value is reorganized and updated, including the following sub (6): comparing the instant connection record in which the identity identification field is recorded as a null value to the correspondence table of the group, if the pair is aligned with the group - the instant connection record The information of the analyzed packet information in the analysis information field is at least partially matched, and the corresponding person's expensive correspondence table is updated correspondingly to the analyzed package resource, and the corresponding person in the group is corresponding to the table.

The identity identification code corresponding to the at least partially matching data updates the identity identification field of the instant connection record. Otherwise, a new identity identifier is generated for the instant connection whose identity recognition block is recorded as a null value. Recording, and updating the identity identification shelf of the instant connection record with the new identity identifier, and correspondingly adding the updated updated instant connection record to the group of personnel; and (C-2) repeating the substep (4) Until all of the identity recognition blocks are not null. Another object of the present invention is to provide a network monitoring system. Thus, the network monitoring system of the present invention comprises a packet analysis module, an instant connection recording processing module, and a recording reorganization update module. The packet analysis module is configured to receive at least one packet and obtain an analyzed packet information according to the packet. The instant connection record processing module is configured to compare the analyzed packet information with the group correspondence table to generate an instant connection record including an identity identification booth and at least one analysis information block, wherein The group correspondence table includes at least one identity identifier for use as an index, and the analysis 201225581 information field is used to record the analyzed packet information, if any of the analyzed packets are not present in the group correspondence table. If the information is at least partially consistent, the identity identification field is recorded as a null value; otherwise, the group correspondence table is updated corresponding to the analyzed packet information, and the at least part of the group correspondence table is matched. The identity identifier corresponding to the data is recorded in the identity identification block of the instant connection record. The 8H has recorded a reorganization update module for reorganizing the instant connection record in which the identity recognition field is recorded as a null value after every predetermined time, wherein the identification field for the identity is recorded For each instant_connection record of the null value, the record reorganization update module compares the instant connection record with the group correspondence table, and if the pair is matched in the group correspondence table If the information of the analyzed packet information recorded in the analysis information field of the instant connection record is at least partially matched, the corresponding personnel table of the group is updated corresponding to the analyzed packet information and the at least part of the group correspondence table The identity identification code corresponding to the knife-matching data updates the body knife identification field of the instant connection record. Otherwise, a new identity identification code is generated for the instant connection record whose identity recognition booth is recorded as a null value. And updating the identity identification booth of the instant connection record with the new identity ♦ identification code, and correspondingly adding the updated updated instant connection record to the group correspondence table. The present invention can also monitor the network behavior of any person who does not exist in the group correspondence table by the instant connection record processing module and the record reorganization update module. The purpose. [Embodiment] Regarding the foregoing and other technical contents, features and effects of the present invention, a detailed and clear presentation of a preferred embodiment of the reference profile of the following 2012 can be referred to. The system is applied to a network system architecture including a plurality of networks, that is, point 5; the network monitoring system 1 can be implemented by a combination of body, body, or the like, and is integrated in the system. Device 2. In the preferred embodiment t, the network system architecture is - the implementation manner of the enterprise P Zhoulu It electronic device 2 is set on the intranet of the enterprise.

The "network behavior" and control server between the road and the external Internet are used to collect and analyze the packets on the network to further control the network behavior. Referring to FIG. 2', the network monitoring system 1 includes a packet analysis module U, an instant connection record processing module 12, a record reorganization 13 and a database 14. The packet analysis module η is configured to receive a packet on the network, and obtain an analyzed packet information according to the packet. The instant connection record processing module 12 is configured to compare the analyzed packet information with the group of personnel present in the (four) library 14 to generate an include-identification field and at least an analysis information block. - instant connection record. The group correspondence table includes at least one identity identifier for use as an index, and the analysis information block is used to record the analyzed packet information. If there is no data in the group corresponding to the analyzed packet information, the wire-time recording processing module 12 should record the identity identification site as a line. If there is any data in the corresponding table in the corresponding table that matches the information of the analyzed packet, then Jiang said that the corresponding identification code is filled into the 201225581. The instant connection record processing module is stored in the data frame f. The query and monitoring of the instant connection record (4) (4) perform the network behavior - the pre-= module 13 is connected to the _ library 14, and after the elapse of time, the record reorganization update module 13 is collected by the instant connection record. Identifying the instants, which are randomly selected as the null value, ..., and 'and sequentially identify them - the identity of the instant connection record and the group of personnel recorded as the value of the staff member to the temple" It should be compared with the 'if the group Φ ^ 廷廷深° has recorded the analyzed packet information recorded in the information field, at least part of the analyzed packet information corresponding to update the group', then the member Correspondence table, and the group of personnel new: Xiao at least partially matched data corresponding to the identity identification code, ~ instant connection record identity identification block, otherwise, generate a new identity identification code to identify their identity The field is recorded as a null value of the instant connection record' and the identity identifier of the instant connection record is updated with the new identity, and the updated updated instant connection record is added to the group. The identity of the person _^赖(四)" connection record Don't block any of them. Referring to Figures 2 and 3, corresponding to the preferred embodiment of the network monitoring system i described below, the network monitoring method is used to detail the operation between the modules. The network monitoring method includes the following steps. In step S31, the § hai packet analysis module u extracts at least one packet on the network, and analyzes the packet to obtain an analyzed packet information. In the present embodiment, the processed packet information includes at least one of an authentication account number, an Internet 201225581 network protocol address, a media access control address, and a communication protocol message. It is worth mentioning that the analyzed packet information can have different forms according to different web applications. For example, if the employee whose authentication account is jason is authenticated and the webpage is "Liu Ming", the analyzed packet information is as shown in Table 1. The protocol information includes a web address; and, if an employee is logged in, The instant messaging software's information about the analyzed packet is shown in Table 2. The information of the protocol includes an instant messaging type and an instant messaging account. In addition, if an employee is sending a mail, the information of the analyzed packet is as shown in Table 3. As shown, the protocol information includes a mail account. --- Table 1 IP MAC Web Address Authentication Account 192.168.1.2 0 00:17:31:1A:DB:67 http://tw.yaho o.com Jason --- Table 2 IP ___mac Type Instant Messenger Account 192.168 .1.30 -^iii^lA:DD:67 MSN john@hotmail.c〇m --------

192.168.1.40 mail account mary@hotmail.com In step S32, 兮 '--- '^ instant connection record processing module 12 stores and stores the analyzed packet information. The group of people in the poor library 14 correspond to the table. The group's representative list of temples includes 201225581, which uses the identity code as an index. a person basic data correspondence table, an instant messaging account correspondence table, and a mail account. In the preferred embodiment, the comparison process of the instant connection record processing module 12 is performed according to the authentication account. And the order of the mail account, the instant messenger account, the internet protocol address, and the media access control address are compared with the group correspondence table, and when any one of the comparisons is successful (ie, If there is any information in the group corresponding to the at least part of the analyzed packet information, the step printing is continued, otherwise step S34 is performed. Continuing the above example, it is assumed that the current personnel correspondence table in the database 14 is as shown in Tables 4-6. For the analyzed packet information of the table, the authentication account can obtain the corresponding identity code 2Gimm71_GGG in the corresponding basic data correspondence table of Table 4; similarly, for the analyzed packet information of Table 2 The instant messenger account can be compared to the corresponding identity code 2010072710100002 in the instant pass account correspondence table in Table 5; and the analyzed packet information in Table 3 is not in the mail of the sixth account by the mail account. The account correspondence table is compared to any matching data. ID code name IP mac authentication account ___________ No. 20100727101 Jason 192.16 00:17:31:1a:DB: jason 00001 8.1.21 67 —~--- Five instant account number to apply f identity code instant pass type instant messaging Account number 10 201225581 201225581 2010072710100002 MSN — john (Sh〇tmail.com Table 6 ------ mail account correspondence table identity code mail account number) In step S33, the instant connection record processing module i2 according to the step S32 As a result of the comparison, the Lianhuahuau house includes a body identification field and at least one analysis of the efl field-instant connection record, and the information of the analyzed package information should be updated. The group identification table is configured to record the identification information of the analyzed package and the corresponding identification number of the group of personnel, and the analysis information is used to record the identity identifier. Analysis of the packet information. Continuing the above example, the analyzed packet information of Table 1 corresponds to one of the instant connection records of the webpage as shown in Table 7; the analyzed packet of Table 2 Il 'correspond to generate one of the instant instant connection records shown in Table 8. Table 7 Instant connection record IP MAC Web address authentication account identity ID 192.168.1. 00:17:31: http://tw Jason 20100727101 21 1A:DB:6 7 yahoo.ς〇m 00001 Table 8 Instant Messenger Instant Connection Record IP MAC Type IM Account Authentication Account Identity ID 201225581 192.1 00:16:3 MSN john@hot 2010072710 68.1.3 5 :1A:D mail.com 100002 0 D:67 In step S34, the instant connection record processing module 12 generates an identity recognition block and at least one analysis information field according to the comparison result of the step S32. An instant connection record, wherein the identity identification field is recorded as a null value, and the analysis information field records the analyzed packet information. Continuing the above example, the analyzed packet information in Table 3 is generated as shown in Table 9. The identity identification block shown is recorded as one of the null values of the instant connection record. Table 9 Mail instant connection record IP 192.16 8.1.40 MAC 00:15:33: 1A:BB:66 Email account rnary@h 〇tm ail.com certification account identity The code is worth mentioning that the instant connection record processing module 12 generates different types of instant connection records according to the communication protocol information in the analyzed package information (see Table 7, Table and Table 9). Shown) is stored in the database 14 'convenient for network administrators to query. In step S35, the record reorganization update module 13 determines whether the elapsed time has elapsed. If the pre- (four) time has elapsed, the step coffee is performed. Otherwise, the data is returned to the packet on the network. In the preferred embodiment, the pre-twist time is set to one hour. 12 201225581 - in step S36, the record resetting module 13 records, from the database μ H for the predetermined time period, the identity identification fields are recorded as null values, and according to at least Associate the key values and group the P-time connection records. For example, in the instant connection records, the instant connection record having the same Internet Protocol address is regarded as the same-group, so that the network administrator can monitor the specific group.

In step S37, the record reorganization update module 13 records the instant connection records after the grouping and the identity recognition fields are respectively recorded as null values, and sequentially and the group of personnel according to a comparison key value. The correspondence table is compared. The comparison key value can be customized by the manager. In the preferred embodiment, the comparison key value can be any of the authentication account number, the internet protocol address, or the media access control address. By. If the comparison is successful, step S38 is performed; otherwise, step S39 is performed. Continuing the above example, the record reorganization update module 13 retrieves the instant connection record of the email whose identity identification block is recorded as a null value as shown in Table IX, and according to the authentication account number and the internet communication protocol. The address or any one of the media access control addresses is compared with the group of personnel correspondence table. Since there is no corresponding data, the process proceeds to step S39. In step S38, the record reorganization update module is performed. 13 updating the identity identification code obtained according to the comparison key value to the instant connection record in which the identity identification field is recorded as a null value, that is, updating the corresponding identity identification code The identity identification field of the instant connection record; and the analyzed package information recorded by the instant 13 201225581 connection corresponding to the group correspondence table of the update database. In step S39+, the record reorganization update module 13 generates a new identity identifier 'and updates the body cutter identification field of the instant connection record with the new identity identification code, and correspondingly adds the updated instant. The connection is recorded to the group correspondence table of the database 14. Continuing the example above, the new identity ID 2G1GG7271G1G_3 is generated for the instant connection record of the mail shown in Table IX, and the new identity code is updated to the instant connection record and table of the mail in Table 9. In the correspondence table of the mail account of the sixth, the updated instant connection record of the mail and the correspondence table of the mail account are respectively as shown in the following Tables 10-11.

14 201225581 One person's network behavior is “monitored”. In addition, each instant connection record has the corresponding identity code after being updated, and the network administrator can use the identity identifier as an index. The related monitoring, control and maintenance 'make the network management more humane, so it can achieve the purpose of the present invention.

However, the above description is only a preferred embodiment of the present invention, and is not intended to limit the scope of the present invention, that is, the simple equivalent changes and modifications made by the scope of the invention and the description of the invention, All remain within the scope of the invention patent. BRIEF DESCRIPTION OF THE DRAWINGS FIG. 1 is a network system architecture diagram illustrating a preferred embodiment of the network monitoring system of the present invention and a network system diagram for applying the network monitoring system;

Figure 2 is a block diagram, an embodiment; and Figure 3 is a flow chart, method. The preferred description of the network monitoring system of the present invention corresponds to the network monitoring of the preferred embodiment. 15 201225581 [Signal Description of Main Components] 1 .......... • Network Monitoring System 14. .........Database 11......... • Packet Analysis Module 2 ........... Electronic Device 12... • Instant connection record S31~S40 · Step management module 5 ........... Network node 13......... Record reorganization update mode

16

Claims (1)

201225581 VII. Patent application scope: i• A network monitoring method, implemented in an electronic column step: (a) according to the device to be extracted, the method includes at least one packet, the packet information is analyzed, and (b) The analyzed packet information is compared with a set of bay correspondence tables to generate an identity identification field and at least - ^, the instant connection of the information field, which has been recorded, wherein the group of personnel goes to 2|AAS| 3 The application form includes the Y-identification identification code used as the home bow|the identity number is used to record the information of the seal. If the group of personnel corresponds to P8, there is no such thing as the seal. L information at least partially matched ^ λ. * The identity recognition field is recorded as a null value, otherwise, the 0 packet analysis information corresponding to update the group of people corresponding table, and the group ^ ^ ^ ^ α, the identification of the identity corresponding to the data in the table corresponding to the at least part of the knife. V, the identity recognition block recorded in the instant connection record; and (C) repeating the step (a)~ (b) to one-... After the top time, the identity The basin is reorganized and updated by the 止1 连1 line. The step (C) includes the following sub-steps: (4) (2) The identification field of one of the identification points is recorded as a null value. Correspondence table comparison, if at least in the corresponding group of the corresponding table, the analysis of the analyzed packet in the analysis of the 2 interception records of the n4ggv ^ q instant connection records at least partially matched You will update the group correspondence table corresponding to the analyzed packet information, and use the corresponding personnel in the group to match the V and V. The identity data of 17 201225581 should update the identity identification field of the instant connection record, otherwise, generate a new identity identifier to the instant identification field whose record identification field is blank. Line recording, and updating the identity identification block of the instant connection record with the new identity identifier, and correspondingly adding the updated updated instant connection record to the group correspondence table; and (c-2) repeating execution Sub-step (c_1} until all the identity recognition fields are not null. 2. According to the network monitoring method described in the scope of the patent application, wherein the step (a) of the analyzed packet information The method includes: an authentication account, an internet protocol address, a media access control address, and a communication protocol information. 3. The network monitoring method according to claim 1, wherein The group correspondence table of the step (b) includes a person basic data correspondence table, an instant pass account correspondence table, and a mail account correspondence table using the identity identification code as an index. According to the network monitoring method described in the scope of the patent application, in the step (b), the comparison process is based on one of the analyzed packet information, an email account, and an instant account. Comparing the sequence of an internet protocol address and a media access control address. The network monitoring method according to claim 1 of the patent application scope further includes the sub-step (c-1) In the previous sub-step (c-3), the instant connection records whose identity recognition blocks are respectively recorded as null values are grouped according to at least the associated key value to have the same associated key value. The instant 18 201225581 connection record group is the same group. 6. A network monitoring system, comprising: a sealing packet analysis module for receiving at least a packet, and according to the packet - has been analyzed Packet information; π two instant connection record processing module, ^ the analysis of the packaged package. - Group of personnel correspondence table for comparison, to block and at least one eight private - I sincerely identify the knife Field-instant connection record, The U two-person correspondence table includes at least one identity identification code information used as a cable to record the analyzed packet information, and if the group of personnel correspondence table does not exist any-and the analyzed packet information For at least part of the data, the identity identification field is recorded as a null value, otherwise the knife resolution packet is updated corresponding to the group correspondence table, and the data corresponding to the at least part in the group correspondence table is corresponding to The body identification code δ has been recorded in the identity identification field of the instant connection record; and the recording reorganization update module is configured to record the identity identification field as a null value after every predetermined time. The instant connection record is performed - group update 'where, for the instant connection record whose identity recognition field is recorded as a null value, the record reorganization update mode line performs the instant connection = record with the group (4) The comparison, if the group of people corresponding to the $ match-to-at-the-at least the part of the analyzed packet information recorded in the analysis information block of the instant connection record, the data is The packet information correspondingly updates the group correspondence table, and the identity identification field of the instant connection record is newly identified by the identity identifier corresponding to the at least partially matching 枓 邳 枓 该 该, otherwise, the identity identifier of the new 19 201225581 is given to the instant connection record whose identity recognition block is recorded as a null value, and the identity identification block of the instant connection record is updated with the new identity identifier. At the same time, correspondingly adding the updated instant connection record to the group correspondence table. 7. The network monitoring system according to claim 6, wherein the analyzed packet information includes an authentication account number, an internet protocol address, a media access control address, and a communication protocol information. At least one of them. 8: The network monitoring system according to item 6 of the patent application scope, wherein the group correspondence table includes a person basic data correspondence table, an instant account number correspondence table, and a mail account corresponding to using the identity identification code as an index. table. 9. The network monitoring system according to claim 6, wherein the order of the instant connection recording processing module is based on one of the analyzed account information, a mail account, The sequence of an instant messenger account, an internet protocol address, and a media access control address are compared. The network monitoring system according to claim 6, wherein the record reorganization update module further records the identity identification field as a null value according to at least one associated key value. The line records are grouped to group the instant connection records having the same associated key value into the same group.