KR101428573B1 - Network Apparatus and Method for Processing Traffic - Google Patents

Abstract

The present invention relates to a network device and a traffic processing method, and a network device according to an embodiment of the present invention includes a flow unit for receiving traffic including an unusual flow that the user does not want and dividing received traffic by flow, An entropy calculation unit for calculating the entropy of each flow and calculating an average of the calculated entropy, and a flow classifying unit for comparing the entropy and the average of each flow and distinguishing the abnormal flow according to the comparison result.

Description

Technical Field [0001] The present invention relates to a network device,

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a network device and a traffic processing method, and more particularly, to a network device and a traffic processing method, and more particularly, to a network device such as a router for entropy for a flow of traffic, And further relates to a network device and a traffic processing method for distinguishing between an attack (DDoS) or a heavy flow.

As the rapid development of the Internet and the number of users using it have been rapidly increasing, more and more new network services have been developed and commercialized. In particular, peer-to-peer (P2P) traffic among network services is estimated to account for more than 60% of total Internet traffic over the past few years, .

It is easy for users to access the data stored on the computer. However, due to unauthorized access to the computer system and traffic to the network, information leakage and the failure to provide proper service have caused much economic damage, and cases of hacking and internet infringement have increased every year.

Distributed Denial of Service (DDoS) attacks are the most severe, frequent and frequent occurrences on the Internet. DDoS attacks began to occur from the beginning of the 1990s, and in 2000, major DDoS attacks against popular websites such as Yahoo and Amazon occurred. Recently, on July 7, 2009, DDoS attack occurred. As attacks continue to occur, the need for traffic analysis is also increasing.

As the necessity of countermeasures against DDoS attacks has emerged, various studies have been conducted, and among them, machine learning methods are examined. Machine learning methods can be divided into two types: supervised learning method and unsupervised method. Unlike the non-mapping method, the mapping method includes a learning step at the beginning. In this learning phase, the training data set is used to establish standards for judging exceptional situations such as DDoS attacks and general situations. Then, when the data is inputted, it is possible to classify any data by using the reference.

Unlike the map method, there is no learning step at first. In other words, when the data comes in, it is a method of clustering data only by each method. With this clustering information, each detection method can be used to detect and detect anomalous situations such as DDoS attacks.

In this method, a flow is configured using five tuples and a cluster is formed using entropy for each tuple. Here, the entropy cube is obtained based on the destination IP address, the destination IP address, the destination port number, and the destination port number. Here, if the entropy value of the destination IP and the entropy value of the destination port number are large and the entropy value of the destination port number is small, the DDoS attack is detected.

However, in the past, if the entropy value of the heavy traffic has an entropy value similar to that of an attack, there is a problem of classification as a DDoS attack. As a result, the service efficiency is degraded because normal heavy traffic is classified as attack traffic.

The embodiment of the present invention further distinguishes an attack or a heavy flow by additionally using the entropy for the flow of traffic in a network device such as a router and further the characteristics (or characteristics) of the flow such as the packet generation amount and entropy of the transmission destination port And a method for processing a traffic.

A network device according to an embodiment of the present invention includes a flow unit for receiving traffic including an unusual flow that the user desires and for classifying the received traffic by flow, An entropy calculation unit for calculating an average of the calculated entropy, and a flow classifier for comparing the entropy of each flow with the average, and classifying the abnormal flow according to the comparison result.

Here, the flow classifying unit classifies the flow into the abnormal flow when the entropy of each flow is larger than the average.

The flow classifying unit further checks a packet generation amount per second for an abnormal flow of the candidate group, and selects a normal flow.

The flow classifying unit compares a packet generation amount per second with respect to an abnormal flow of the candidate group with a packet generation amount threshold, and finally classifies the packet into an abnormal flow when it is larger than a threshold value and classifies it into a normal flow when it is smaller than a threshold value.

The flow classifying unit further checks the transmission destination port entropy for the abnormal flows classified by the comparison of the packet generation amounts to distinguish the abnormal flows of different kinds.

The flow classifying unit compares a transmission port entropy of the abnormal flow with a transmission destination port threshold and classifies it into a DDoS flow of a distributed denial of service attack when the threshold is greater than a threshold value. And is classified into a large heavy flow.

The network device may further include a storage unit for storing information on the packet generation amount threshold and the transmission destination port threshold.

The network device may further include a flow combining unit for combining the heavy flows and the normal flows from which the attack flow has been removed, or for combining and outputting only the normal flows from which the abnormal flow has been removed.

A traffic processing method according to an exemplary embodiment of the present invention is a traffic processing method for a network device, the method comprising: receiving traffic including an unusual flow that the user does not desire, and classifying the received traffic by flow; Calculating an entropy of each flow and comparing the entropy of each flow with the average and distinguishing the abnormal flow according to the comparison result.

Here, the step of classifying the abnormal flows may be classified into the abnormal flow when the entropy of each flow is greater than the average.

The step of distinguishing the abnormal flow may further include inspecting a normal flow by inspecting a packet generation amount per second for an abnormal flow of the classified candidate group.

The step of classifying the abnormal flows may further include comparing the packet generation amount per second with respect to the abnormal flow of the candidate group to the packet generation amount threshold, finally classifying the abnormal flow into the abnormal flow when it is larger than the threshold value, .

The distinguishing the abnormal flows may further include inspecting the transmission destination port entropy for the abnormal flows classified by the comparison of the packet generation amounts to distinguish the abnormal flows of different kinds.

The step of distinguishing the abnormal flow includes comparing a transmission port entropy of the abnormal flow with a transmission destination port threshold and classifying the result into an attack flow of a distributed denial of service (DDoS) attack when the abnormal port flow is larger than a threshold value, The data is classified into a heavy flow having a large data capacity.

The traffic processing method may further include storing information on the packet generation amount threshold and the transmission destination port threshold.

The traffic processing method may further include combining the heavy flows and the normal flows from which the attack flow has been removed, or outputting the combined only normal flows from which the abnormal flow has been removed.

According to the embodiment of the present invention, even if the service server receives an attack such as DDoS, normal or stable service of general traffic and heavy traffic can be provided.

1 is a diagram illustrating a traffic processing system according to an embodiment of the present invention;
2 is a block diagram illustrating the structure of the network device of FIG. 1;
FIG. 3 is a flowchart illustrating a traffic processing procedure according to the first embodiment of the present invention.
4 is a flowchart illustrating a traffic processing procedure according to a second embodiment of the present invention.
5 is a diagram showing traffic processing when a behavior is applied, and
6 is a diagram illustrating traffic processing using the proposed method of the present invention.

Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

1 is a diagram illustrating a traffic processing system according to an embodiment of the present invention.

1, the traffic processing system 90 according to the embodiment of the present invention may include a part of the user devices 100_1 and 100_2, the communication network 110, the service providing device 120 and the manager device 130, It can include everything.

Including some or all of them means that one of the user devices 100_1 and 100_2 may be omitted or at least one of the service providing device 120 and the administrator device 130 may be omitted. , And to fully understand the present invention.

The user devices 100_1 and 100_2 include a mobile phone such as a smart phone for performing wired / wireless communication, a notebook computer, a personal digital assistant (PDA), and a desktop computer. These user devices 100_1 and 100_2 may use multimedia services in addition to basic communication services such as voice communication and data communication, and may receive multimedia contents such as moving pictures and images. Also, the user equipments 100_1 and 100_2 may be connected to an access point (AP) constituting the communication network 110, that is, a small base station, and receive the above services.

According to an embodiment of the present invention, one of the user equipments 100_1 and 100_2 may cause illegal access to a computer system such as another user apparatus, the service providing apparatus 120, or the manager apparatus 130, It may be an attacking device that can leak information or prevent it from providing proper service.

The communication network 110 includes both wired and wireless communication networks. Here, the wired network includes an Internet network such as a cable network or a public switched telephone network (PSTN), and the wireless communication network includes means such as CDMA, WCDMA, GSM, Evolved Packet Core (EPC), Long Term Evolution (LTE) to be. Therefore, when the communication network 110 is a wired communication network, the access point can access the exchange of a telephone office. In the case of a wireless communication network, the access point can access the SGSN or GGSN (Gateway GPRS Support Node) Station Transmission), NodeB, e-NodeB, and the like.

Also, the communication network 110 includes a small base station such as a femto or pico base station installed in a large number of buildings. Here, the femto or pico base station is classified according to the maximum number of user devices 100_1 and 100_2 that can be connected on the classification of the small base stations. Of course, the AP includes a user equipment (100_1, 100_2) and a short-range communication module for performing short-range communication such as ZigBee and Wi-Fi. In the embodiment of the present invention, the short-range communication includes a wide variety of radio frequency (RF) and ultra wideband (UWB) communications such as Bluetooth, Zigbee, IrDA, UHF and VHF Standard. Accordingly, the AP can extract the location of the data packet, specify the best communication path for the extracted location, and forward the data packet along the designated communication path to the next device, e.g., user device 100_1, 100_2.

The communication network 110 also includes a network device 110_1 such as a router, a repeater, and a repeater for classifying traffic (or traffic flow) when the user devices 100_1 and 100_2 are connected . Here, the network device 110_1 can be viewed as being able to share a plurality of lines in a general network environment, and may be referred to as a traffic processing device according to an embodiment of the present invention. The network device 110_1 according to the embodiment of the present invention distinguishes an abnormal flow (or packet data) caused by an attack device so that only a normal flow can be processed. To this end, the network device 110_1 obtains the entropy, i.e., the complexity, of each flow constituting the data traffic, and obtains the average entropy using each entropy. Then, each entropy is compared with the average entropy, and the abnormal flow is classified according to the comparison result. It is a kind of filtering process. This process may correspond to a process of selecting a candidate group of an abnormal flow according to an embodiment of the present invention. In addition, the network device 110_1 can re-select the normal flow among the above candidates using the packet generation amount per second, which is a characteristic of the flow, for more accurate flow classification. Then, the flow characteristics such as the entropy of the transmission port are reused to distinguish the abnormal flow into the heavy flow and the attack flow. Accordingly, the network device 110_1 may remove the attack flow only from the input traffic, combine the general flow and the heavy flow, or may output only the general flow. In the embodiment of the present invention, there is no particular limitation on how the flow is outputted.

The service providing apparatus 120 is a device for providing a service requested by the user apparatuses 100_1 and 100_2 and may be a kind of server provided by a management company of a specialized portal site such as a broadcasting station or Yahoo. Of course, the service providing apparatus 120 may also include a server provided in a government office. The service providing apparatus 120, and further the user apparatuses 100_1 and 100_2 and the administrator apparatus 130 are connected to the network apparatus 110_1 according to the embodiment of the present invention so that even if a DDoS attack occurs, Or provide services.

The manager device 130 may be regarded as a computer device, for example, as a device for monitoring the status of the service providing device 120. [ Accordingly, the administrator device 130 can manage the database (DB) of the service providing apparatus 120, and manage the overall operation of the service, such as management and updating of the program.

2 is a block diagram illustrating the structure of the network device of FIG.

2, a network device 110_1 according to an exemplary embodiment of the present invention includes a flow configuration unit 200, an entropy calculation unit 210, a flow classification unit 220, a storage unit 230, And may further include a part or all of the packet generation amount calculation unit (not shown) and a port entropy calculation unit (not shown). And may further include a control unit (not shown).

Here, the part or all of them includes the storage part 230, the packet generation amount calculation part (not shown) and the port entropy calculation part (Not shown) may be configured to be integrated with other components, such as flow classifier 220, to fully understand the invention.

The flow configuration unit 200 constructs a flow using, for example, five tuples when traffic having an abnormal flow is input. In other words, it can be seen that the flow configuration unit 200 classifies input traffic into flow units and reconstructs them. At this time, the flow configuration unit 200 can use the transmission destination address, the destination address, the destination port number, the destination port number, and the protocol as the above five tuples. Accordingly, one destination address can be regarded as one port. In other words, an unusual flow, such as an attack flow, is a port because it can have multiple destination addresses for a destination address.

When the classification of each flow is completed, the entropy calculation unit 210 calculates the entropy of each flow, and calculates the average entropy using the calculated entropy. Each entropy can be expressed by Equation (1).

Here, Pi represents the probability of a packet corresponding to the flow in the entire packet.

Next, the entropy calculation unit 210 obtains an entropy average by using the entropy of each flow obtained in Equation (1) to consider a flow having many packets. This is expressed as Equation (2).

Here, N (Xi) represents the number of flows.

Also, the flow classifier 220 compares the entropy of each flow with the average of entropy, and classifies abnormal flows such as heavy flow and attack flow according to the comparison result. On the other hand, if the abnormal flow is classified as the candidate group, the flow classifying unit 220 can add precision to the flow classification by additionally using the packet generation amount per second and the entropy of the transmission destination port.

Hereinafter, in order to facilitate a sufficient understanding of the present invention, it is exemplified that both the entropy and the characteristics of the flow are used.

The flow classifier 220 uses Equation (3) to select candidates for heavy flow and attack flow.

Based on Equation (3), if the entropy H (Xi) of each flow is larger than H (Xavg), it is selected as a candidate group, and if it is smaller or equal, it is classified as a general flow.

Also, the flow classifying unit 220 checks the packet generation amount per second for the candidate group C (Xi) obtained in Equation (3) and classifies it as a general flow if it is smaller than the packet generation amount threshold.

In addition, the candidate group larger than the packet generation amount threshold is classified as an attack flow if it is larger than the transmission port threshold and a heavy flow if it is smaller than the transmission port threshold. The classification of the heavy flow and the attack flow can be expressed as Equation (4).

Based on the contents, the flow classifying unit 220 may calculate the packet generation amount per second and the entropy of the transmission destination port, or may use the result by providing the result in the packet generation amount calculation unit and the port entropy calculation unit. If the entropy of the packet per second and the entropy of the transmission port are to be determined at the time when the traffic is input, the measurement result may be received from the flow generator 200, so that it is not particularly limited as to how to use the measurement result in the embodiment of the present invention I will not.

Also, based on the above, the flow classifying unit 220 according to the embodiment of the present invention may include a judging unit or a comparing unit for comparing and comparing results.

The storage unit 230 may store threshold information on a packet generation amount and a transmission destination port threshold for use in the flow classifier 220. [ In other words, the system designer can obtain information on the threshold value, for example, by a specific experiment or empirical rule, store it in the storage unit 230, and provide the information to the flow classifying unit 220 upon request. Of course, in the case of an implementation in the form of an algorithm, the storage unit 230 may not be necessary, and therefore, the present invention is not limited to the above configuration.

The flow combining unit 240 may combine and output general flows that are classified and output by the flow classifying unit 220. In other words, it can be seen that the flows separated by the flow forming unit 200 are coupled again through the flow combining unit 240. For example, if the heavy flow and the attack flow are determined to be abnormal flows, the flow combining unit 240 may combine and output the general flows. If the attack flow is determined to be an abnormal flow, the flow combining unit 240 outputs the combined general flow and heavy flows will be.

Accordingly, the flow combining unit 240 may be called a filtering unit in that the attacking flow is eliminated, and may include at least one of an adder and a subtracter to perform the above function.

Although not necessarily required in the exemplary embodiment of the present invention, the control unit may be implemented by a flow designer 200, an entropy calculator 210, a flow classifier 220, The storage unit 230, the synthesis unit 240, and the like.

The flow configuration unit 200, the entropy calculation unit 210, the flow classification unit 220, the storage unit 230, and the composition unit 240 constituting the above network device 110_1 may be implemented in an algorithm form Or some or all of them may be integrated into one and implemented in the form of an algorithm.

3 is a flowchart illustrating a traffic processing process according to the first embodiment of the present invention.

Referring to FIG. 3, for convenience of description, FIG. 1 illustrates a network device 110_1 according to an exemplary embodiment of the present invention. The network device 110_1 may classify traffic having an abnormal flow by a flow (S300). For example, it can be seen that the input traffic is divided into flow units and reconstructed using five tuples such as a destination address, a destination address, a destination port number, a destination port number, and a protocol. Here, each flow may be a data package for one user device 100_1, 100_2, and each flow may have a respective packet for five tuples.

Next, the network device 110_1 calculates the entropy of each flow and calculates an average of the calculated entropy (S310). For calculation of such entropy, the network device 110_1 may calculate the number of packets in the flow, calculate the total amount of data constituting the entire packet, and the like.

Thereafter, the network device 110_1 can compare the entropy with the average and classify the abnormal flow according to the comparison result (S320). For example, if the comparison result is less than or equal to the average, it is classified as a normal flow, and if it is larger than the average, the flow can be classified as an abnormal flow. That is, it is judged as a heavy flow or an attack flow.

In the course of this, the network device 110_1 will be able to combine and output only the general flows for which classification, i.e., abnormal flow has been removed.

4 is a flowchart illustrating a traffic processing process according to a second embodiment of the present invention.

Referring to FIG. 4, with reference to FIG. 1, a network device 110_1 according to an embodiment of the present invention can perform a process of calculating a flow configuration and entropy as in the first embodiment of the present invention with reference to FIG. 3 (S400, S410). The details are the same as those in the first embodiment.

Then, the network device 110_1 compares the entropy of each flow and the average of the entropy. When the entropy of each flow is large as a result of the comparison, the network device 110_1 selects the flow as a candidate group of an abnormal flow, ').

In step S420, the network device 110_1 compares the packet generation amount per second with respect to each abnormal flow selected as the candidate group. If the packet generation amount is larger than the comparison result threshold, the network device 110_1 distinguishes the abnormal flow, S430 '). At this time, the threshold value, that is, the packet generation amount threshold value may be information stored in the memory or the like, for example, by an experiment or an empirical rule of the designer.

Then, the network device 110_1 can distinguish the attack flow from the heavy flow by comparing the entropy of the sender port with the threshold value for abnormal flows (S440, S440 ', S440 "). For example, It is determined that the attack flow is larger than the threshold value and the heavy flow is determined to be smaller than the threshold value as a result of comparison between the entropy of the attack flow and the previously stored threshold value. .

Furthermore, the network device 110_1 may combine and output only the classified general flows, or may combine the general flow and the heavy flow by removing only the attack flow (S450).

Hereinafter, a simulation process of the method proposed in the embodiment of the present invention will be described.

FIG. 5 is a diagram illustrating traffic processing when a behavior is applied, and FIG. 6 is a diagram illustrating traffic processing using a proposed method of the present invention.

In the embodiment of the present invention, OPNET was used to analyze the performance of the proposed method. Experimental topology consisted of 7 nodes, 1 server and 3 routers.

The role of each node is to generate general traffic (40 pace / sec) used for nodes (0, 1, 2, 5, 6) generating DDoS attack traffic (280 packets / Nodes 3 and 4, and a node 7 for generating heavy traffic (100 packets / sec) used for P2P, FTP, or the like. The traffic generated by each node is directed to the server and collected traffic from the router close to the server.

The threshold value used in the experiments is 50 packets per second and the threshold value of the send port is 30,

5 and 6 show traffic classification in the router near the server when the DDoS attack situation is present. FIG. 5 shows classification of traffic when the behavior is applied. FIG. 5 shows classification of the traffic based on the destination IP entropy and the entropy of the destination port and the entropy of the destination IP and the entropy of the destination port is small. .

If the input traffic has the same characteristics as the attack traffic, it is judged as an attack and all the traffic is blocked.

In contrast, FIG. 6 shows classification of traffic when the proposed method is applied. In FIG. 5, although the attack is detected using only entropy, the proposed method uses the entropy, the packet generation amount per second, It accurately detects and blocks them, and it shows that the general flow and heavy flow are also categorized into services.

In conclusion, the proposed method of the present invention classifies attack traffic, heavy traffic, and general traffic using entropy and flow characteristics. It is possible to control each traffic according to the control method by classifying the attack traffic which is a problem in society and the heavy traffic which occupies a lot of bandwidth. Through this, it is possible to provide normal service of normal traffic and heavy traffic while receiving attack. The detection performance of the proposed method is presented through experimental results. Experimentally determined thresholds were used to analyze the performance, and these values could be modified enough for future algorithm efficiency.

While the present invention has been described in connection with what is presently considered to be the most practical and preferred embodiment, it is to be understood that the invention is not limited to the disclosed embodiments. That is, within the scope of the present invention, all of the components may be selectively coupled to one or more of them. In addition, although all of the components may be implemented as one independent hardware, some or all of the components may be selectively combined to perform a part or all of the functions in one or a plurality of hardware. As shown in FIG. The codes and code segments constituting the computer program may be easily deduced by those skilled in the art. Such a computer program may be stored in a computer readable medium and read and executed by a computer to implement an embodiment of the present invention. As the storage medium of the computer program, a magnetic recording medium, an optical recording medium, a carrier wave medium, or the like may be included.

While the invention has been described in connection with what is presently considered to be practical exemplary embodiments, it is to be understood that the invention is not limited to the disclosed embodiments, but, on the contrary, It will be understood by those skilled in the art that various changes in form and details may be made therein without departing from the spirit and scope of the present invention.

100_1, 100_2: user equipment 110: communication network
110_1: Network device 120: Service providing device
130: Manager device 200: Flow component
210: entropy calculation unit 220: flow classification unit
230: storage part 240: flow coupling part

Claims (16)

A flow configuration unit for receiving traffic including an unusual flow that the user desires and for classifying the received traffic by flow;
An entropy calculation unit for calculating an entropy of each of the divided flows and calculating an average of the calculated entropy; And
A flow classifying unit for comparing the entropy of each flow with the average and classifying the abnormal flow according to the comparison result;
Including,
The flow classifying unit,
(DDoS) attack when the transmission port entropy of the abnormal flow is larger than a threshold value and classifies the DDoS flow into a DDoS flow when the threshold is greater than a threshold value, (heavy flow). < / RTI > The method according to claim 1,
The flow classifying unit,
And when the entropy of each flow is larger than the average, classifies the flow into the abnormal flow. The method according to claim 1,
The flow classifying unit,
Further checks the packet generation amount per second for the distinguished abnormal flow, and selects a normal flow. The method of claim 3,
The flow classifying unit,
Comparing the packet generation amount per second with respect to the abnormal flow with a packet generation amount threshold, finally classifying the packet into an abnormal flow when the packet generation amount is larger than a threshold value, and classifying the packet into a normal flow when the packet generation amount is smaller than a threshold value. 5. The method of claim 4,
The flow classifying unit,
And further checks the transmission destination port entropy for the abnormal flows classified by the comparison of the packet generation amounts to distinguish the abnormal flows of different kinds. delete 6. The method of claim 5,
And a storage unit for storing information on the packet generation amount threshold and the transmission destination port threshold. 6. The method of claim 5,
Further comprising: a flow combining unit for combining the heavy flows and the normal flows from which the attack flow has been removed, or for combining and outputting only the normal flows from which the abnormal flow has been removed. A traffic processing method for a network device,
The method comprising the steps of: receiving traffic including an unexpected flow that is not desired by a user, and classifying the received traffic by flow;
Calculating entropy of each of the divided flows and calculating an average of the calculated entropy; And
Comparing the entropy of each flow with the average, and classifying the abnormal flow according to the comparison result;
The step of distinguishing the abnormal flow includes:
The transmission port entropy of the abnormal flow is compared with the transmission destination port threshold. If the transmission port entropy of the abnormal flow is greater than the threshold value, it is classified as a DDoS flow of the DDoS attack. When the threshold is smaller than the threshold value, flow). < / RTI > 10. The method of claim 9,
The step of distinguishing the abnormal flow includes:
And when the entropy of each flow is greater than the average, classifies the traffic into the abnormal flow. 10. The method of claim 9,
The step of distinguishing the abnormal flow includes:
And further checks the packet generation amount per second for the abnormal flow, and selects a normal flow. 12. The method of claim 11,
The step of distinguishing the abnormal flow includes:
Comparing a packet generation amount per second with respect to the abnormal flow with a packet generation amount threshold, finally classifying the packet into an abnormal flow when the packet generation amount is larger than a threshold value, and classifying the packet into a normal flow when the packet generation amount is smaller than a threshold value. 13. The method of claim 12,
The step of distinguishing the abnormal flow includes:
And further examining a destination port entropy for the abnormal flow classified by the comparison of the packet generation amount to distinguish the abnormal flows of different kinds. delete 14. The method of claim 13,
And storing information on the packet generation amount threshold and the transmission destination port threshold. 14. The method of claim 13,
Combining the heavy flows and the normal flows from which the attack flow has been removed, or combining only the normal flows from which the abnormal flow has been removed, and outputting.

Images