WO2023075020A1

WO2023075020A1 - Network service quality autonomous control method and system for detecting abnormal network traffic

Info

Publication number: WO2023075020A1
Application number: PCT/KR2021/019370
Authority: WO
Inventors: 김지형; 이상신; 송민환; 최원기
Original assignee: 한국전자기술연구원
Priority date: 2021-10-29
Filing date: 2021-12-20
Publication date: 2023-05-04
Also published as: KR20230061751A; KR102586635B1

Abstract

Provided are a network service quality (QoS) autonomous control method and system for detecting abnormal network traffic. A network service quality autonomous control system, according to one embodiment of the present invention, comprises: an information collection unit for collecting appropriate bit rate (bit per second) information of user devices within a network; and a processor which detects whether burst traffic has occurred on the basis of the collected appropriate bit rate information and topology information of the network, so as to, when the burst traffic is detected, block a network connection of a user device in which the burst traffic has occurred. Even in a low-cost and small network, it is possible to detect abnormal network traffic without any additional equipment and automatically control the service quality on the basis of the detection.

Description

Network service quality autonomous control method and system for detecting abnormal network traffic

The present invention relates to a method and system for self-control of network quality of service (QoS) for detecting abnormal network traffic, and more particularly, to a method and system for autonomously controlling abnormal network traffic by detecting and controlling abnormal network traffic without additional equipment in a low-cost/small-scale network, It relates to a service quality control method and system for providing services with a stable network.

If abnormally large network traffic (burst traffic) is caused, a problem of reducing the network transmission speed of other devices may occur even in a small local wired network.

For example, in order to stably use a high-priority service such as video conference in a network, there is a need for the network to guarantee service quality, and for this, other network traffic needs to be restricted.

However, in order to guarantee such a network data transmission rate in the past, since a software defined network and expensive switch equipment and controllers supporting the software defined network are required, there is a disadvantage in that it is not suitable for small network operation.

Therefore, it is required to find a device that causes such burst traffic and find a way to guarantee the network data transmission rate of other devices by limiting the amount of network traffic generated by local QoS control.

The present invention has been made to solve the above problems, and an object of the present invention is a method and system capable of detecting abnormal network traffic and automatically controlling service quality based on it without additional equipment even in a low-cost / small-scale network. is in providing

According to an embodiment of the present invention for achieving the above object, a network service quality autonomous control system includes an information collection unit for collecting appropriate bit rate (Bit Per Second) information of a user device in a network; and a processor that detects whether burst traffic has occurred based on the collected appropriate bitrate information and network topology information, and cuts off the network connection of the user device in which the burst traffic occurred when the burst traffic is detected.

And the processor, BPS monitoring unit for receiving the appropriate bit rate information from the information collection unit; a control switch management unit that changes a target switch to be controlled when a switch change request message is transmitted from the BPS monitoring unit and transmits information on the changed target switch to a QoS controller; a network topology management unit that transfers topology information of the network to the control switch management unit; and a QoS control unit that sequentially controls the QoS for each port of the switch changed to the target switch based on the target switch information received from the control switch management unit and the appropriate bit rate information received from the determination algorithm module unit.

In addition, the BPS monitoring unit may transmit appropriate bit rate information of the user device connected to the target switch to the QoS controller.

Further, the control switch management unit may generate a topology table including IP information, switch information, and port information with network topology information as an input, and transmit the generated topology table to the QoS controller.

In addition, the QoS control unit lowers the QoS of each port of the target switch connected to the user device currently being monitored one by one (= downQoS) based on the appropriate bit rate information and the topology information of the network. It is possible to detect the occurrence of burst traffic in the target switch by checking whether the bit rate increases.

The QoS control unit may detect whether burst traffic is generated in the target switch, and if burst traffic in the target switch is not detected, detect whether burst traffic is generated in an upper switch to which the target switch is connected.

In addition, the QoS control unit determines that a user device connected to a port whose QoS has been lowered as a user device in which burst traffic is generated when an appropriate bit rate increases when the QoS of a specific port among the ports of the target switch is lowered, and Connections can be blocked.

Further, the QoS controller finally receives data from the user device generating burst traffic when malware installed in the user device generating burst traffic implements the traffic forwarding scheme for the Transmission Control Protocol. The network connection of the recipient's device may be blocked.

In addition, the QoS control unit, when malware installed in the user device generating burst traffic implements a traffic forwarding method for the User Datagram Protocol, switches connected to the user device generating burst traffic network connection may be blocked.

Meanwhile, according to another embodiment of the present invention, a method for self-controlling network service quality includes the steps of, by an information collecting unit, collecting appropriate bit rate (Bit Per Second) information of a user device in a network; and detecting, by a processor, whether burst traffic is generated based on the collected appropriate bitrate information and the topology information of the network. The network connection of the user device can be blocked.

And according to another embodiment of the present invention, the network service quality autonomous control system is provided in each user device in the network, respectively, the information collection unit for individually collecting appropriate bit rate (Bit Per Second) information of each user device; and controlling port QoS of switches in the network based on the collected appropriate bitrate information and topology information of the network, and detecting whether or not burst traffic has occurred based on the control result of the QoS, thereby generating burst traffic. Upon detection, a processor that cuts off the network connection of the user device in which the burst traffic has occurred; may include.

In addition, according to another embodiment of the present invention, a method for self-controlling network service quality includes a plurality of information collection units individually provided in each user device in a network, and appropriate bit rate (Bit Per Second) information of each user device is individually provided. Collecting as; Controlling, by a processor, port QoS of switches in a network based on appropriate bitrate information and network topology information collected; and detecting, by a processor, whether burst traffic is generated based on the quality of service control result. In this case, the detecting step, when burst traffic is detected, blocks the network connection of the user device in which the burst traffic has occurred. can be made

As described above, according to the embodiments of the present invention, it is possible to detect abnormal network traffic and automatically control QoS based on abnormal network traffic even in a low-cost/small-scale network without additional equipment.

1 is a diagram provided for explanation of a network service quality autonomous control system for detecting abnormal network traffic according to an embodiment of the present invention;

2 is a diagram provided for explaining the operation of the processor shown in FIG. 1;

3 is a diagram illustrating an algorithm for the QoS controller shown in FIG. 2 to detect burst traffic;

4 to 7 are diagrams illustrating various types of networks, and

8 is a diagram provided to explain a method for self-controlling network service quality for detecting abnormal network traffic according to an embodiment of the present invention.

Hereinafter, the present invention will be described in more detail with reference to the drawings.

1 is a diagram provided to explain a system for autonomously controlling network service quality for detecting abnormal network traffic according to an embodiment of the present invention, and FIG. 2 is provided to explain the operation of the processor 200 shown in FIG. 1 it is a drawing

The network service quality autonomous control system for detecting abnormal network traffic according to the present embodiment (hereinafter collectively referred to as 'network service quality autonomous control system') detects abnormal network traffic without additional equipment even in a low-cost / small-scale network, It is prepared to automatically control the quality of service based on this.

To this end, the present network service quality autonomous control system includes an information collection unit 100 that collects appropriate bit rate (Bit Per Second) information of the user device 10 in the network, and the collected appropriate bit rate information and topology information of the network. It may include a processor 200 that detects whether burst traffic is generated based on .

The information collecting unit 100 may be provided in each user device 10 in the network and individually collect appropriate bit rate information of each user device 10 .

The processor 200 detects whether burst traffic has occurred based on the collected appropriate bitrate information and network topology information, and when burst traffic is detected, the network connection of the user device 10 in which the burst traffic is generated is blocked. can do.

To this end, the processor 200 may include a BPS monitoring unit 210, a control switch management unit 220, a network topology management unit 230, and a QoS control unit 240.

The BPS monitoring unit 210 may receive appropriate bit rate information from each information collection unit 100 and transmit the appropriate bit rate information of the user device 10 connected to the target switch to the QoS controller 240 .

Specifically, the BPS monitoring unit 210 may receive appropriate bitrate information from each information collection unit 100 and transmit it to the BPS Data Manager of the QoS controller 240 .

When a switch 20 change request message is transmitted from the BPS monitoring unit 210, the control switch management unit 220 can change a target switch to be controlled and transmit information on the changed target switch to the QoS controller 240. .

Specifically, the control switch management unit 220 receives network topology information as an input, generates a topology table including IP information, switch 20 information, and port information, and sends the generated topology table to the QoS controller 240. can be conveyed

The network topology manager 230 may transmit topology information of the network to the control switch manager 220 .

The QoS controller 240 sequentially determines QoS for each port of the switch 20 changed to the target switch based on the target switch information received from the control switch manager 220 and the appropriate bit rate information received from the decision algorithm module unit. can be controlled with

3 is a diagram illustrating an algorithm for detecting burst traffic by the QoS controller 240 shown in FIG. 2, and FIGS. 4 to 7 are diagrams illustrating various types of networks.

Referring to FIG. 3 , the QoS controller 240 lowers (= down) the QoS for each port of the target switch connected to the user device 10 currently being monitored based on appropriate bitrate information and topology information of the network. QoS), it is possible to detect whether burst traffic of the target switch is generated by checking whether the appropriate bit rate of the user device 10 currently being monitored increases.

At this time, the QoS controller 240 detects whether burst traffic is generated in the target switch, and if burst traffic in the target switch is not detected, detects whether burst traffic is generated in the upper switch to which the target switch is connected. can

In addition, when the QoS of a specific port among the ports of the target switch is lowered, the QoS control unit 240, when an appropriate bit rate rises, the user device 10 connected to the port with the lowered QoS is referred to as burst traffic. It is determined by the user device 10 that the network connection may be blocked.

For example, in the network shown in FIG. 4 , when user device A 10-A serves as a transmitter and user device B 10-B serves as a receiver, user device A 10-A When burst traffic is generated from the C user device 10-C connected to the other port of the first switch 20-1 to which ) is connected, the first switch 20-1 and the upper level of the first switch 20-1 Traffic overload may occur even to the second switch 20-2, which is a switch, and the third switch 20-3, which is another lower switch of the second switch 20-2.

In this case, the QoS control unit 240 may detect whether or not burst traffic is generated by using the first switch 20-1 as the target switch, and the C user device 10-1 among the ports of the second switch 20-2. When the QoS of the port connected to C) is lowered, an appropriate bit rate is increased, and the network connection of the C user device 10-C may be blocked.

Specifically, the QoS control unit 240 detects burst traffic when malware installed in the user device 10 in which burst traffic is generated implements a traffic forwarding method for a transmission control protocol. A network connection of a receiver device that finally receives data from the user device 10 may be blocked.

For another example, the QoS control unit 240, when malware installed in the user device 10 in which burst traffic is generated implements a traffic forwarding scheme for the User Datagram Protocol, burst The network connection of the switch 20 connected to the user device 10 where the traffic is generated may be cut off.

That is, in the case of the network illustrated in FIG. 4, the QoS control unit 240, when malware installed in the C user device 10-C implements the traffic forwarding method for the transmission control protocol, the D user device 10-D ) to block the network connection, and if the malware installed in the C user device 10-C implements the traffic forwarding method for the user datagram communication protocol, to block the network connection of the C user device 10-C. can do.

In the network illustrated in FIG. 5, when user device A 10-A serves as a transmitting end and user device B 10-B serves as a receiving end, the first user device A 10-A is connected to. 1 When burst traffic is generated from the C user device 10-C connected to the port of the second switch 20-2, which is an upper switch of the switch 20-1, the first switch 20-1 and the first switch Traffic overload may occur to the second switch 20-2, which is an upper switch of 20-1, and the third switch 20-3, which is another lower switch of the second switch 20-2.

In this case, even if the QoS controller 240 sets the first switch 20-1 as the target switch and detects whether burst traffic is generated, the burst traffic of the target switch will not be detected.

Accordingly, the QoS control unit 240 detects whether burst traffic is generated in the second switch 20-2, which is an upper switch of the first switch 20-1, and at this time, the C user device 10-C It can detect what is generating burst traffic.

Specifically, in the case of the network illustrated in FIG. 5, the QoS control unit 240, when malware installed in the C user device 10-C implements the traffic forwarding method for the transmission control protocol, the D user device 10-C When the network connection of D) is blocked, and the malware installed on the C user device 10-C implements the traffic forwarding method for the user datagram communication protocol, the network connection of the C user device 10-C is blocked. can be made

In the network illustrated in FIG. 6, the first switch 20-1 connected to device A and the fourth switch 20-4 connected to device C have the same upper switch (second switch 20-2). In case it is implemented as

At this time, the C user device ( When burst traffic is generated from 10-C), the first switch 20-1, the second switch 20-2 which is an upper switch of the first switch 20-1, and the second switch 20-2 Traffic overload may occur up to the third switch 20-3, which is another lower switch.

6, the QoS controller 240 detects whether burst traffic is generated in the second switch 20-2, which is an upper switch of the first switch 20-1, and at this time, the C user device 10- C) can detect burst traffic.

Therefore, the QoS control unit 240 blocks the network connection of the D user device 10-D when the malware installed in the C user device 10-C implements the traffic forwarding scheme for the transmission control protocol, When the malware installed in the C user device 10-C implements the traffic forwarding method for the user datagram communication protocol, the network connection of the C user device 10-C may be blocked.

In the network illustrated in FIG. 7, a C user device 10-C connected to a fourth switch 20-4, which is a lower switch of a first switch 20-1 connected to A user device 10-A, bursts This is when traffic is generated.

7, the QoS control unit 240 determines that, when malware installed in the C user device 10-C implements the traffic forwarding scheme for the transmission control protocol, the network connection of the D user device 10-D is terminated. When malware installed in the C user device 10-C implements the traffic forwarding method for the user datagram communication protocol, the network connection of the C user device 10-C may be blocked.

Through this, it is possible to detect abnormal network traffic and automatically control service quality based on it without additional equipment even in a low-cost/small-scale network.

The autonomous network service quality control method for detecting abnormal network traffic (hereinafter, collectively referred to as 'network service quality autonomous control method') according to the present embodiment is the above-described network service quality autonomous control method with reference to FIGS. 1 to 7 can be executed by the system.

Referring to FIG. 8 , the network service quality autonomous control method may generate a topology table including IP information, switch 20 information, and port information through the processor 200 (S810).

And the network service quality autonomous control method, after the topology table is created, individually collects appropriate bit rate (Bit Per Second) information of each user device 10 through the information collection unit 100 (S820), When transmitted to the processor 200, the BPS monitoring unit 210 provided in the processor 200 may transfer appropriate bit rate information of the user device 10 connected to the target switch to the QoS controller 240.

Thereafter, the method for self-controlling network service quality detects whether burst traffic has occurred based on the collected appropriate bitrate information and the topology table through the QoS control unit 240 (S830), and when burst traffic is detected (S830- Y), the network connection of the user device 10 in which the burst traffic is generated may be blocked (S840).

Meanwhile, it goes without saying that the technical spirit of the present invention can also be applied to a computer-readable recording medium containing a computer program for performing the functions of the apparatus and method according to the present embodiment. In addition, technical ideas according to various embodiments of the present invention may be implemented in the form of computer readable codes recorded on a computer readable recording medium. The computer-readable recording medium may be any data storage device that can be read by a computer and store data. For example, the computer-readable recording medium may be ROM, RAM, CD-ROM, magnetic tape, floppy disk, optical disk, hard disk drive, and the like. In addition, computer readable codes or programs stored on a computer readable recording medium may be transmitted through a network connected between computers.

In addition, although the preferred embodiments of the present invention have been shown and described above, the present invention is not limited to the specific embodiments described above, and the technical field to which the present invention belongs without departing from the gist of the present invention claimed in the claims. Of course, various modifications are possible by those skilled in the art, and these modifications should not be individually understood from the technical spirit or perspective of the present invention.

Claims

Information collection unit for collecting the appropriate bit rate (Bit Per Second) information of the user device in the network; and

A processor that detects whether burst traffic has occurred based on the collected appropriate bitrate information and network topology information, and upon detection of burst traffic, blocks the network connection of a user device in which burst traffic has occurred; network service quality including; autonomous control system.
The method of claim 1,

the processor,

BPS monitoring unit for receiving appropriate bit rate information from the information collection unit;

a control switch management unit that changes a target switch to be controlled when a switch change request message is transmitted from the BPS monitoring unit and transmits information on the changed target switch to a QoS controller;

a network topology management unit that transfers topology information of the network to the control switch management unit; and

A QoS control unit that sequentially controls the quality of service for each port of the switch changed to the target switch based on the target switch information received from the control switch management unit and the appropriate bit rate information received from the decision algorithm module unit. Network service quality autonomous control system, characterized in that to do.
The method of claim 2,

BPS monitoring department,

Network service quality autonomous control system, characterized in that for transmitting the appropriate bit rate information of the user device connected to the target switch to the QoS controller.
The method of claim 2,

Control switch management unit,

Network service quality autonomous control system, characterized in that for creating a topology table including IP information, switch information and port information as input of network topology information, and forwarding the generated topology table to a QoS control unit.
The method of claim 3,

QoS controller,

Based on the appropriate bit rate information and topology information of the network, the QoS of each port of the target switch connected to the user device currently being monitored is lowered one by one (= downQoS), while checking whether the appropriate bit rate of the user device currently being monitored increases. Network service quality autonomous control system, characterized in that for detecting whether or not the burst traffic of the target switch is generated in a way.
The method of claim 5,

QoS controller,

Detecting whether burst traffic of the target switch has occurred, and if burst traffic of the target switch is not detected, performing an operation of detecting whether or not burst traffic of an upper switch to which the target switch is connected is autonomously controlled for network service quality system.
The method of claim 5,

QoS controller,

When the service quality of a specific port among the ports of the target switch is lowered and the appropriate bit rate rises, the user device connected to the port with the lowered service quality is judged as a user device with burst traffic and the network connection is cut off. Network service quality autonomous control system, characterized in that.
The method of claim 7,

QoS controller,

When malware installed on a user device that generates burst traffic implements the traffic forwarding method for the Transmission Control Protocol, the network of a receiver device that finally receives data from the user device that generates burst traffic A network service quality autonomous control system characterized in that the connection is blocked.
The method of claim 7,

QoS controller,

When malware installed on a user device with burst traffic implements the traffic forwarding method for the User Datagram Protocol, the switch connected to the user device with burst traffic is disconnected from the network. Network service quality autonomous control system, characterized in that to do.
Collecting, by an information collection unit, appropriate bit rate (Bit Per Second) information of a user device in a network; and

Detecting, by a processor, whether burst traffic is generated based on the collected appropriate bitrate information and topology information of the network;

The step of detecting

When burst traffic is detected, a network service quality autonomous control method characterized in that to cut off the network connection of the user device in which the burst traffic is generated.
An information collection unit that is provided in each user device in the network and individually collects appropriate bit rate (Bit Per Second) information of each user device; and

Based on the collected appropriate bitrate information and topology information of the network, the quality of service of the ports of the switches in the network is controlled, and burst traffic is detected by detecting whether or not burst traffic has occurred based on the control result of the quality of service. A network service quality autonomous control system including;
Collecting, by a plurality of information collection units individually provided for each user device in the network, appropriate bit rate (Bit Per Second) information of each user device;

Controlling, by a processor, port QoS of switches in a network based on appropriate bitrate information and network topology information collected; and

Including; detecting, by a processor, whether burst traffic is generated based on a QoS control result;

The step of detecting

When burst traffic is detected, a network service quality autonomous control method characterized in that to cut off the network connection of the user device in which the burst traffic is generated.