TWI581590B - Real - time traffic collection and analysis system and method - Google Patents

Description

Instant traffic collection and analysis system and method

The invention relates to a system and a method for collecting and analyzing broadband network traffic, in particular to a software-defined network technology for real-time traffic collection through a network controller and a programmable network switch. Analytical method.

For the traditional network management of traffic collection monitoring and analysis methods, currently through other network devices (such as network packet probes, network traffic monitoring devices, etc.) to achieve traffic collection methods, and through this network The device performs pre-packet classification or filtering and provides it to the traffic analysis software (such as netflow, etc.).

In a scenario where traffic is collected through other network devices, the network device collects traffic information by using a network switch to perform traffic mirroring, or pre-classifying and filtering the traffic packets. The method is implanted into the network switch to reduce the excessive amount of unnecessary data received by the traffic collecting device. Generally, in the traffic mirroring mode, the network switch loses performance, and not only can not obtain accurate traffic packet data, but also It will affect the behavior of normal packet delivery, and the network device will get a lot of unwanted information when collecting traffic. The other is to embed the method of traffic collection into the network switch. It is usually impossible to classify or filter the pre-message packet. Due to the limitation of usability, the network switch also increases the hardware requirements due to the classification and filtering function of the traffic packet, and increases the cost of the network switch. Generally, the method for collecting such traffic is too long because the sampling interval is too long. As a result, the obtained traffic information cannot present accurate data, and the analysis results cannot reflect the details of the traffic, such as the impact of the glitch.

In view of the fact that traditional network switches can not effectively obtain instant traffic information, after the creators of this case conducted research and improvement, they proposed a software-defined network technology exchanged with a programmable network through a network controller. The device achieves instant traffic collection and analysis methods to improve the accuracy of traffic collection while avoiding the cost of additional network traffic detection systems.

The present invention proposes a system and method for network traffic collection and analysis through software-defined network technology, so that network monitoring can achieve real-time monitoring of traffic traffic and provide accurate traffic information analysis.

An instant traffic collection and analysis system and method for instantly obtaining traffic information from a programmable network switch. The programmable switch belongs to the data plane of the software-defined network, and includes a flow-based traffic packet classification and mediation method and a traffic volume statistical method. The flow-based traffic packet classification and mediation method is different from the mediation method. After the packet is transmitted or modified, it can also be used as a packet classification method for collecting traffic. The classification includes Media Access Control (MAC) and Virtual Local Area Network (VLAN). ), the Internet Protocol (IP), the Differentiated Services Code Point (DSCP), and the Transmission Control Protocol (TCP), and each After the packet classification, the traffic statistics method is available. The traffic statistics method can count the packet amount, the total traffic, the time tag, etc., so as to improve the performance of the traffic collection module to collect the traffic information. The control plane of the software-defined network includes a controller application interface module for transmitting a traffic collection request message and a traffic information return message, a traffic collection module and a traffic analysis module, and a traffic collection module. Periodically obtain the classified traffic information from the traffic statistics module through the application interface module of the network controller and store it in the database, and the traffic analysis module analyzes the traffic information in the database. It shows the usage situation and abnormal behavior of various kinds of traffic types to achieve instant traffic collection and analysis.

The present invention is an instant traffic collection and analysis system, comprising a plurality of programmable network switches, processing a plurality of packets, a network controller, the network controller and the programmable computer The network switch connects and manages and monitors the programmable network switch, an instant traffic collection and analysis module, and the instant traffic collection and analysis module is connected to the network controller, and Conduct real-time traffic collection and analysis.

The programmable network switch includes a packet classification medium module, and a plurality of classification and matching rules are stored to match the respective packets, and a traffic statistics module is connected with the packet classification medium module. Generating a traffic information, a data plane network interface module, forwarding each packet to a data plane network, a control plane network interface module, and the packet classification media module is transmitted through the control plane network interface module The group is connected to the network controller.

The network controller includes an application interface module, which enables the application to manage and monitor the command of the programmable network switch through the application interface module.

The instant messaging collection and analysis module includes a traffic collection module for instantly collecting the programmable network exchange through the network controller. The information in the device, a database module, storing the collected information, and a traffic analysis module, analyzing the information stored in the database module.

The instant traffic collection and analysis system of the present invention further comprises an instant traffic collection and analysis module for real-time traffic collection and analysis of the network, the instant traffic collection and analysis module includes a traffic The collection module can issue a traffic information request, and the network controller can instantly collect the information of the programmable network switch, a database module, store the collected traffic information, and a message. The analysis module analyzes the information stored in the database module.

The network controller and the programmable network switch may be in a one-to-one or one-to-many connection relationship, that is, one network controller is connected to one or more of the programmable exchanges. And one of the programmable switches is connected to one of the network controllers.

The packet classification media module has a classification and matching rule, and each classification and matching rule may include more than one packet classification setting and at least one packet processing action, wherein the packet classification setting is performed by the packet classification media module. The header content of the second layer to the fourth layer of the network and the entity connection number of the received packet, the basis for classifying the packet, and the packet processing action defines how the packet classification media module handles the network packet. The processing action includes forwarding the packet, discarding the packet, changing the header content of the second layer to the fourth layer, and the like.

The traffic statistics module has a traffic statistics setting to generate traffic information, and the traffic statistics setting statistics include the total number of media packets, the total traffic of the media packets, and the classification rules. The total time label; and the packet classification media module adds a packet to the traffic statistics module in the traffic statistics module for each packet, and each of the data The packet only matches a classification and matching rule in the packet classification and matching method at a time.

The instant messaging collection module performs the following actions: the traffic collection requirement is periodically transmitted to the programmable network switch through the application interface module on the network controller to obtain the traffic information. And retrieving the classification information and the traffic statistics of the packet from the traffic classification media module and the traffic statistics module on the programmable network switch, the programmable network switch according to the packet The classified information and the statistical information of the traffic generate a traffic information and transmit, and the database module stores the traffic information.

The database module stores the traffic information including the traffic packet classification and media setting, the total amount of the mediation packet, the total traffic of the mediation packet, and the total time label of the classification and matching rule, and the traffic analysis The module will be able to retrieve the classified traffic information from the database module, presenting instant and accurate traffic statistics, and analyzing network usage and abnormal network behavior.

In summary, through the software-defined network technology, the traffic collection module can obtain detailed and accurate flow-based traffic statistics from the programmable switch through the controller application interface module. Traffic information, reducing the cost of additional networked traffic detection systems, and directly obtaining pre-classified media information, eliminating the need to create packet read components and avoid loss converter performance, effectively reducing traffic collection The time interval for the system to sample traffic information enables the traffic information to be presented more instantly.

The purpose of the present invention is to solve the problem that the current traffic collection system is generally inaccurate, and propose an instant traffic collection method for collecting precise traffic through software-defined network technology, and directly using the stream-based information from the switch. Traffic statistics method to obtain pre-classified media information to avoid The cost of additional network traffic detection systems.

101‧‧‧Traditional Network Switch

102‧‧‧Internet interface

103‧‧‧Traffic mirror components

104‧‧‧ Terminal equipment

105‧‧‧Information Network

106‧‧‧Monitoring network

110‧‧‧ Traffic Monitoring and Analysis Module

111‧‧‧Traffic collection and classification components

112‧‧‧ Traffic Analysis Components

201‧‧‧Programmable Network Switch

202‧‧‧Data plane network interface

203‧‧‧Control plane network interface

204‧‧‧ Terminal equipment

205‧‧‧Information Network

206‧‧‧Management Network

207‧‧‧Network Controller

208‧‧‧Application Interface Module

210‧‧‧ Instant Messaging Collection and Analysis System

211‧‧‧Service Classification Media Module

212‧‧‧Traffic Statistics Module

213‧‧‧Information Collection Module

214‧‧‧Database Module

215‧‧‧ Traffic Analysis Module

S301~S304‧‧‧ Method flow

S404~S406‧‧‧ Method flow

FIG. 1 is a conventional architecture diagram of a traffic monitoring and analysis module.

2 is a structural diagram of an instant traffic collection and analysis system of the present invention.

FIG. 3 is a flowchart of establishing a traffic classification and matching rule according to the present invention.

4 is a flow chart of a method for collecting and analyzing instant traffic according to the present invention.

1 is a conventional traffic monitoring and analysis system architecture. The traditional traffic monitoring and analysis system architecture typically uses the traffic mirroring component 103 on the conventional network switch 101 to direct the traffic mirror to the traffic monitoring and analysis system 110. The method mainly mirrors the traffic on the network interface 102 from the traffic mirror component 103, and mainly uses the data packet between the terminal device 104 and the data network 105 to exchange all the mirrors. The monitoring and analysis module 110 obtains the mirrored traffic information through the monitoring network 106, analyzes the mirrored traffic through the traffic collecting and sorting component 111, and eliminates unnecessary traffic information and the remaining traffic information. sort. The traffic analysis component 112 obtains the simplified traffic information from the traffic collection and classification component 111 and analyzes the traffic information for the purpose of providing analysis data such as usage and abnormal behavior of the network administrator network. In the system architecture of Figure 1, the traffic mirroring component 103 consumes the power of the conventional network switch 101, while the traffic collection and classification component 111 must parse all of the packets.

2 is an architecture of an instant traffic collection and analysis system. The network controller 207 is connected to the management network via the control plane network interface module 203. A control connection is established with the programmable network switch 201. The traffic classification and matching module 211 on the programmable network switch 201 is written by the network controller 207 to write the traffic classification and matching rules, and all the data packets between the terminal device 204 and the data network 205 are exchanged. After the packet matching rule, the packet matching rule is further processed, for example, the packet is modified and forwarded by the data plane network interface module 202, and the traffic statistics module 212 counts each of the classification rules. The information collection and analysis module 210 firstly sends the information from the instant message collection module 213 through the application interface module 208 on the network controller 207. The traffic controller collects the demand, and the network controller 207 immediately obtains the traffic information from the traffic statistics module 212 after receiving the demand, and then returns the traffic information to the instant traffic collection module 213 through the application interface module 208, and then The collected traffic information is stored in the database module 214, and finally the traffic analysis module 215 can obtain accurate and instant network traffic data from the database module 214, and present the fine Usage of the Internet and instant analysis of the network behavior anomaly.

The flow chart of the establishment of the traffic classification and the flow chart of the instant traffic collection and analysis method are shown in FIG. 3 and FIG. 4 . Referring first to FIG. 3, step S301 of the traffic classification rule building flow chart establishes a new connection between the network controller and the programmable network switch. In this step, the network controller 207 passes through the control plane network interface. The module 203 establishes a control connection with more than one programmable network switch 201 via the management network 206, and proceeds to step S302 to check whether the programmable network switch has established a packet classification match rule.

In step S302, it is checked whether the programmable network switch has established a packet classification and matching rule, and the network controller 207 checks whether it can be checked first. The programmatic network switch 201 has established a traffic classification and mediation rule. If the traffic classification and mediation rules have been established, the packet will enter the programmable network switch 201 and then perform classification and mediation. If the mediation is successful, the After proceeding to step S304, the packet is forwarded and packet forwarding is performed, and the number of packets and traffic is counted; otherwise, the unmatched packet is notified from the programmable network switch 201 to the network controller 207 to inform that the classification rule is not Established, and proceeds to step S303 to establish a classification and matching rule on the programmable network switch through the network controller.

In step S303, the network controller 207 performs a classification and mediation rule decision on the unmatched packet through the network controller, and determines to write to the programmable network switch 201. After the decision is made, the traffic classification rule is written into the programmable network switch 201 and the process returns to step S302 to check whether the programmable network switch has established the packet classification medium. Rules to check if the classification rules have been successfully written.

Step S304: After the packet is matched, the packet is forwarded and the number of packets and the traffic are counted. After the packet enters the mediation rule of the traffic classification module 211, the packet is processed according to the packet processing method defined on the classification and matching rule. The processing method includes a packet header modification, a packet forwarding, and a packet discarding action, and each successfully combined packet is counted in the traffic statistics module 212 connected to the classification media module, including the mediation. The amount of packets, the total traffic of the traffic, etc., then enter the process of instant traffic collection and analysis methods.

Referring to FIG. 4, in the step S401 of the instant message collection and analysis method flow chart, the traffic collection module sends the traffic information request through the network controller application interface module, and the instant traffic collection and collection in this step The instant messaging collection module 213 of the analysis module 210 periodically sends a specific traffic information request through the application interface module 208 on the network controller 207. The time interval can be adjusted according to the application's requirements for traffic information, and the minimum time interval can be set every five seconds. After receiving the traffic demand, the network controller 207 forwards the demand to the programmable network switch to obtain the traffic information.

In the classification method of checking whether the programmable network switch has a demand in step S402, the programmable network switch 201 checks whether there is a required classification rule according to the requirement sent by the network controller 207, if there is already The classification matching rule proceeds to step S404 to transmit the instant traffic statistics information to the traffic collection module through the network controller; otherwise, the return notification informs that the classification matching rule does not exist, and proceeds to step S403 to control through the network. The device establishes a packet classification rule on the programmable network switch.

In step S403, the packet classification protocol is established on the programmable network switch by the network controller, and the network controller 207 is used to re-determine the traffic classification and matching rules suitable for the instant message collection requirement, and the decision is made. The following classification and matching rules are written into the traffic classification media module 211 on the programmable network switch 201, and the process returns to step S401. The traffic collection module transmits the message through the network controller application interface module. Traffic information needs.

In step S404, the instantaneous traffic statistics information is transmitted back to the traffic collection module through the network controller, and the programmable network switch 201 obtains the information from the traffic classification media module 211 and the traffic statistics module 212. After the information, the traffic information such as the traffic classification rule, the mediation packet volume and the traffic flow are transmitted back to the instant message collection and analysis module 210 through the network controller 207, and the instant message is received by the instant message. The collecting module 213 receives the traffic information and proceeds to step S405 to store the traffic information in the database module.

In step S405, the traffic information is stored in the database module 214, and the instant message collecting module 213 classifies the traffic information according to different traffic classification methods. The data is stored in the database module 214, and the data includes the packet quantity, the traffic flow, the time label, and the like, and then proceeds to the next time interval, and returns to the S401 service collection module to send through the network controller application interface module. The traffic information requirement is to continue the next traffic collection operation; if there is a traffic analysis request, the process proceeds to step S406. The traffic analysis module obtains the traffic information from the database module for analysis.

In step S406, the traffic analysis module obtains the traffic information from the database module for analysis, and the traffic analysis module 215 obtains various classified backhaul information from the database module 214, because of the collected traffic information interval. Short, the traffic analysis module 215 can present real-time and accurate traffic statistics, and correctly analyze the network usage and abnormal network behavior for network administrators to refer to.

The instant traffic collection and analysis system and method provided by the present invention have the following advantages when compared with other prior art technologies:

1. The present invention proposes a plurality of methods for collecting and sorting traffic, such as MAC, VLAN, IP, DSCP, TCP, and the like, and the system for providing analysis services presents more information about the traffic.

2. The invention can save the packet reading component, obtain the pre-classified media information directly from the flow-based traffic statistics method on the programmable exchanger, and provide an accurate and instant traffic collection mode. The traffic statistics found abnormal surges and immediately reflected the abnormal situation of the traffic.

3. The data plane of the present invention is also a decentralized plane, and the instant traffic collection and analysis module can obtain a wide range of network traffic information through a centralized control plane.

The detailed description of the preferred embodiments of the present invention is specifically described, but the embodiment is not intended to limit the scope of the invention. Equivalent implementations or modifications that do not depart from the spirit of the invention are intended to be included in the scope of the invention.

In summary, the present invention is innovative in terms of technical ideas, and also has various functions that are not in the prior art, and has fully complied with the statutory invention patent requirements of novelty and progressiveness, and has filed a patent application according to law, and invites you to approve the invention. The patent application was inspired to invent, and it was a matter of feeling.

201‧‧‧Programmable Network Switch

202‧‧‧Data plane network interface

203‧‧‧Control plane network interface

204‧‧‧ Terminal equipment

205‧‧‧Information Network

206‧‧‧Management Network

207‧‧‧Network Controller

208‧‧‧Application interface

210‧‧‧ Instant Messaging Collection and Analysis System

211‧‧‧Service classification method

212‧‧‧ Traffic Statistics Method

213‧‧‧ Instant Messaging Collection Module

214‧‧‧Database Module

215‧‧‧ Traffic Analysis Module

Claims (5)

An instant traffic collection and analysis system includes: a plurality of programmable network switches that process a plurality of packets; and a network controller that manages the network and the programmable network The switch connects and manages and monitors the programmable network switch; an instant traffic collection and analysis module, the instant traffic collection and analysis module is connected to the network controller, and performs instant messaging Collecting and analyzing; wherein the programmable network switch comprises: a packet classification medium module, storing a plurality of classification and matching rules to match each of the packets; a traffic statistics module, and the packet classification The media module connects and generates a message information; a data plane network interface module forwards each packet to the data plane network; and a control plane network interface module, the packet classification media module transmits the The control plane network interface module is connected to the network controller; wherein the network controller includes an application interface module, so that the application can manage the network controller through the application interface module Monitoring the command of the programmable network switch; wherein the instant traffic collection and analysis module comprises: a traffic collection module, through which the network controller immediately collects the programmable network switch The information module, a database module for storing the collected information, and a traffic analysis module for analyzing the information stored in the database module. The instant traffic collection and analysis system of claim 1, wherein each of the classification rules comprises at least one packet classification setting and at least one packet processing action, wherein: the packet classification media module is based on The packet classification setting sets the header content of the second layer to the fourth layer of the network and the physical connection number of the received packet to classify each packet; and the packet classification mediation module forwards the packet according to the packet processing action. , discard the packet, change the header content of the second layer to the fourth layer of the network. For example, the instant traffic collection and analysis system described in claim 1 wherein the traffic information includes a total amount of the media packet, a total traffic of the media packet, each of the classification rules, and each of the categories. The total time stamp in which the match rule exists. An instant traffic collection and analysis method includes the following steps: a traffic collection module in an instant traffic collection and analysis module sends a message through an application interface module on a network controller Information request, the network controller forwards the traffic information request to a programmable network switch to obtain a traffic information; the programmable network switch sends the message according to the network controller The traffic information needs to check whether there is a corresponding classification and matching rule. If yes, the traffic information is transmitted back to the traffic collection module through the network controller, and if not, the network controller is passed through the network controller. Establishing the classification matching rule on the programmable network exchange; the network controller writes the packet classification and matching rule into a traffic classification medium module on the programmable network switch, The traffic collection module transmits the traffic information request again through the application interface module of the network controller; The programmable network switch obtains the traffic information from the traffic classification media module and a traffic statistics module, and then transmits the traffic information to the instant message collection through the network controller. And the analysis module, and the information collection module is received by the instant messaging collection module and stored in a database module; the instant messaging collection module transmits the traffic information request through the application interface module And a traffic analysis module of the instant messaging collection and analysis module obtains the traffic information from the database module for real-time analysis. The instant messaging collection and analysis method described in claim 4, wherein the instant messaging collection module comprises the steps of: transmitting the traffic collection requirement to the application on the network controller The interface module is passed to the programmable network switch to obtain the traffic information; the traffic classification media module on the programmable network switch and the traffic statistics module retrieve the Traffic information; and the database module stores the traffic information.