KR101709922B1 - Method, system and computer readable medium for analysing application contents - Google Patents

Abstract

Disclosed is a method, system, and computer readable recording medium for efficiently analyzing application contents of a large amount of high-speed traffic of a network by optimally distributing a packet processing load to a plurality of processes using a distributed processing structure.
According to the present invention, there is provided an application content analysis system based on distributed processing, comprising: a flow management system for statistically processing received packet data on a flow unit basis; And a DPI (Deep Packet Inspection) service analysis system for receiving a new flow not subjected to the statistical processing for each flow management system and analyzing application contents of a new flow for each new flow, wherein a plurality of flow management systems (FMS) It is possible to efficiently distribute a large amount of traffic and guarantee the scalability of the system.

Description

[0001] METHOD, SYSTEM AND COMPUTER READABLE MEDIUM FOR ANALYZING APPLICATION CONTENTS [0002]

BACKGROUND OF THE INVENTION 1. Field of the Invention The present invention relates to a method, system and computer-readable recording medium for analyzing application contents, and more particularly, To a method, system and computer-readable recording medium for efficiently analyzing content.

In general, all data packets transmitted through wired and wireless Internet networks are collected and analyzed in a DPI (Deep Packet Inspection) service analysis system. Such a DPI (Deep Packet Inspection) service analysis system is equipped with a high-performance multicore process and a dedicated network card. By analyzing and packetizing analysis packets at a specific rate using such a high-performance multicore process and a dedicated network card, .

However, there is a problem that the capacity of the DPI service analysis system is limited at the dedicated network card end due to the total amount of collected traffic rather than the actual process processing capacity, because all the packets are collected, analyzed, and processed statistically.

As described above, the conventional DPI (Deep Packet Inspection) service analysis system has a problem that the scalability is limited due to the lack of processing and database capacity by simultaneously performing analysis and statistical management of large capacity traffic in a single equipment.

1. A packet processing method, a traffic processing device, and a computer readable medium, which are disclosed in Korean Patent Publication No. 2010-0116681, published on November 1, 2010. 2. Description of the Prior Art: Packet processing method, traffic processing device, and computer readable medium.

SUMMARY OF THE INVENTION The present invention has been conceived to solve the above-mentioned problems, and it is an object of the present invention to provide a method and apparatus for statistical processing by packet flow, which distinguish unique identifiers of application contents allocated to newly- A system, and a computer-readable recording medium.

The features of the present invention for achieving the objects of the present invention as described above and performing the characteristic functions of the present invention described below are as follows.

According to an aspect of the present invention, there is provided an application content analysis system based on distributed processing, comprising: a flow management system for statistically processing received packet data by flow units; And a DPI (Deep Packet Inspection) service analysis system for analyzing application contents of a new flow for each new flow by receiving a new flow not subjected to the statistical processing for each flow management system.

Here, the flow management system according to an aspect of the present invention can statistically process each flow unit including packets having the same source IP, destination IP, source port, destination port and protocol.

Further, in the flow management system according to an aspect of the present invention, the flow packets for which the statistical processing has been completed may be deleted after completion of statistical processing.

In addition, the DPI service analysis system according to an aspect of the present invention can extract unique identifier information that distinguishes application contents for each new flow through the analysis.

In addition, the DPI service analysis system according to an aspect of the present invention may transmit the unique identifier information for each new flow to the flow management system.

The flow management system according to an aspect of the present invention may generate content statistics flow information by integrating the unique identifier information of each new flow received from the DPI service analysis system and the statistical processed flow statistics.

In addition, the flow management system according to an aspect of the present invention is characterized in that the content statistics flow including basic flow information, statistical start / end time, number of received packets, number of received bytes, unique identifier (ACID), and FMS identifier of the flow management system Information can be generated.

In addition, the flow management system according to an aspect of the present invention may periodically transmit the generated content statistical flow information to the DPI service analysis system.

In addition, the DPI service analysis system according to an aspect of the present invention can collectively manage content information and content statistical information for each flow using the content statistical flow information.

In addition, the DPI service analysis system according to an aspect of the present invention can analyze unprocessed contents through association analysis between the contents statistics flow information.

According to another aspect of the present invention, there is provided a method of analyzing application contents in an application content analysis system based on distributed processing, comprising the steps of: (a) statistically processing received packet data in a flow management system for each flow unit; (b) transmitting, to the DPI (Deep Packet Inspection) service analysis system, a new flow not subjected to the statistical processing for each flow management system; And (c) analyzing the application content of the new flow by the DPI service analysis system for each new flow received.

According to another aspect of the present invention, the step (a) may perform statistical processing in the flow management system for each flow unit including packets having the same source IP, destination IP, source port, destination port and protocol.

Further, in the step (a) according to another aspect of the present invention, the flow packets for which the statistical processing is completed may be deleted from the flow management system after the statistical processing is completed.

According to another aspect of the present invention, in the step (c), the DPI service analysis system may extract unique identifier information that distinguishes application contents for each new flow through the analysis.

According to another aspect of the present invention, in the step (c), the unique ID information for each new flow may be transmitted from the DPI service analysis system to the flow management system.

According to another aspect of the present invention, in the step (a), the flow management system integrates the unique identifier information for each new flow received from the DPI service analysis system and the statistically processed flow statistics, Can be generated.

According to another aspect of the present invention, the step (a) includes the steps of: (a) receiving the content including the basic flow information, the statistics start / end time, the number of received packets, the number of received bytes, the unique identifier Statistical flow information can be generated in the flow management system.

According to another aspect of the present invention, the step (a) may periodically transmit the generated content statistical flow information to the DPI service analysis system in the flow management system.

According to another aspect of the present invention, the step (b) may collectively manage content information and content statistical information for each flow using the content statistical flow information in a DPI service analysis system.

According to another aspect of the present invention, the step (b) may analyze the unprocessed content through the association analysis between the content statistics flow information in the DPI service analysis system.

According to another aspect of the present invention, there is provided a DPI (Deep Packet Inspection) service analysis system communicating with a plurality of flow management systems for statistically processing received packet data on a flow unit basis, A new flow receiving unit for receiving a new flow that does not exist; And a content analyzer for analyzing the application content of the new flow for each new flow received.

Here, the new flow receiver according to another aspect of the present invention can receive the new flow including the first N packets from the flow management system.

According to still another aspect of the present invention, a DPI service analysis system further includes a unique identifier extracting unit for extracting unique identifier information (ACID) that distinguishes application contents for each new flow by analyzing the content analyzing unit have.

According to another aspect of the present invention, there is provided a DPI service analysis system comprising: a unique identifier transmission unit for transmitting unique identifier information for each new flow to the flow management system; And a statistical flow receiving unit for receiving content statistical flow information generated using the unique identifier information from the flow management system.

In addition, the statistical flow receiving unit according to another aspect of the present invention may receive the content statistics flow information that integrates the unique identifier information for each new flow and the statistical processed flow statistics.

According to another aspect of the present invention, the statistical flow receiving unit receives the contents including the basic flow information, the statistics start / end time, the number of received packets, the number of received bytes, the unique identifier (ACID), and the FMS identifier of the flow management system And receive statistics flow information.

In addition, the statistical flow receiving unit according to another aspect of the present invention may periodically receive the contents statistics flow information.

The DPI service analysis system according to another aspect of the present invention may further include a content flow statistics unit for collectively managing content information and content statistical information for each flow using the received content statistical flow information.

In addition, the content flow statistics unit according to another aspect of the present invention can analyze the unprocessed content through association analysis between the content statistics flow information.

According to another aspect of the present invention, there is provided a packet data receiving apparatus including: a packet data receiving unit for receiving packet data from a network device; A statistical processor for statistically processing the received packet data on a flow unit basis; A new flow generating unit for generating at least one new flow for packet data newly received by the packet data receiving unit after statistical processing for each flow unit; A new flow transmission unit for transmitting the generated at least one or more new flows to the DPI service analysis system; And a content identifier receiving unit for receiving, from the DPI service analysis system, unique identifier information (ACID) extracted by distinguishing application content for each new flow after the transmission.

Here, the statistical processing unit according to another aspect of the present invention can statistically process each flow unit including packets having the same source IP, destination IP, source port, destination port and protocol.

In addition, the statistical processing unit according to another aspect of the present invention may delete the flow packets after the statistical processing is completed after the statistical processing is completed.

According to another aspect of the present invention, the new flow transmitting unit may transmit the at least one new flow until receiving the first N packet data or a transmission stop command for the generated new flow.

In addition, the new flow transmitter according to another aspect of the present invention may transmit the new flow including the first N packets to the DPI service analysis system.

According to another aspect of the present invention, there is provided a flow management system for generating a content flow for generating content statistics flow information by integrating the unique identifier information for each new flow received from the DPI service analysis system and the statistical processed flow statistics And < / RTI >

According to another aspect of the present invention, the content flow generation unit generates the content flow including the basic flow information, the statistics start / end time, the number of received packets, the number of received bytes, the unique identifier (ACID), and the FMS identifier of the flow management system Statistics flow information can be generated.

The flow management system according to another aspect of the present invention may further include a content flow transmitter for periodically transmitting the generated content statistical flow information to the DPI service analysis system.

As described above, according to the present invention, application contents of a new flow for each new flow are analyzed to effectively distribute a large amount of traffic by efficiently accommodating a plurality of flow management systems (FMS) .

According to the present invention, by collectively managing content information and statistical information for each flow by utilizing the content statistics flow received from a plurality of flow management systems, a large number of flow management systems (FMS) Can be efficiently distributed and the systematic scalability can be more stably guaranteed.

In addition, according to the present invention, it is possible to perform association analysis of the information received in the FMS by collectively managing the final content information and statistical information for each flow by utilizing the content statistics flow received from a plurality of flow management systems, (The phenomenon that the ACID of one of the upstream and downstream flows is not distinguished from the upstream / downstream flow of the same session via another equipment / line) can be minimized.

FIG. 1 is a configuration diagram illustrating an application content analysis system 100 according to a first embodiment of the present invention.
FIG. 2 is a diagram illustrating a signal processing process between configurations of the application content analysis system 100 according to the first embodiment of the present invention.
FIG. 3 is a flowchart illustrating an application content analysis method (S100) of an application content analysis system 100 according to a second embodiment of the present invention.
FIG. 4 is a flowchart illustrating a process flow of a content analysis system 100 for processing an application content analysis method (S100) according to a second embodiment of the present invention.
FIG. 5 is a configuration diagram illustrating a DPI service analysis system 120 according to a third embodiment of the present invention in more detail.
FIG. 6 is a configuration diagram showing the flow management system 110 according to the fourth embodiment of the present invention in more detail.

Hereinafter, preferred embodiments of the present invention will be described in detail with reference to the accompanying drawings, so that those skilled in the art can easily carry out the present invention. In the drawings, like reference numerals refer to the same or similar functions throughout the several views.

First Embodiment

FIG. 1 is a block diagram illustrating an exemplary application content analysis system 100 according to a first embodiment of the present invention. FIG. 2 is a block diagram illustrating an application content analysis system 100 according to a first embodiment of the present invention. And a signal processing process.

As shown in the figure, the application content analysis system 100 according to the first embodiment of the present invention includes a flow management system 110 and a DPI (Deep Packet Inspection) service analysis system 100 for efficiently processing packet data based on distributed processing 120).

First, the flow management system 110 according to the present invention collects packet data flowing through a wired and wireless Internet network. At this time, the collected packet data is collected by various methods such as a tapping method by an optical distributor or a mirroring in a network device 101 such as a router, and then the flow data is collected through a flow management system 110 .

Accordingly, when receiving the packet data through the network device 101, the flow management system 110 according to the present invention statistically processes the received packet data for each flow unit (flow information).

At this time, the flow information to be statistically processed may include packets having the same source IP, destination IP, source port, destination port, and protocol. Therefore, when such information is statistically processed, the flow packets can be deleted after completing the statistical processing, leaving only the result of the statistical processing, for example, the result of the flow statistical information. Thus, unnecessary waste of bandwidth can be minimized when flow packets are deleted after completion of statistical processing.

However, when the flow management system 110 according to the present invention newly receives the packet data from the network device 101 via the wired and wireless Internet network, the new flow that has not been statistically processed will be referred to as a Deep Packet Inspection (DPI) To the service analysis system 120. Preferably, the first N packets of the new flow may be transmitted to the DPI service analysis system 120.

At this time, a plurality of flow management systems 110 involved in the new flow transmission may be provided. For example, the first flow management system 110 may send a first new flow containing the first N packets to the DPI service analysis system 120, and send a second new flow containing the other first N packets to the DPI service To the analysis system 120.

However, every time a new flow is created, it is not transferred to the DPI service analysis system 120 indefinitely. For example, it is preferable that the flow management system 110 according to the present invention transmits a new flow until the first N pieces of packet data are transmitted for each new flow generated or a transmission stop command is received. This is to reduce the data load (including the statistical load) and distribute it according to the schedule.

At this time, the transmission stop command may be generated by the flow management system 110 itself, for example, by a load reduction algorithm, or by a determination of the DPI service analysis system 120, e.g., a load reduction algorithm. Therefore, upon detecting such a transmission stop command, the transmission of the new flow is stopped.

The flow management system 110 according to an exemplary embodiment of the present invention transmits at least one new flow including the first N packets to the DPI service analysis system 120 , It means that if the first N packets are sent for each new flow, no further transmission is performed. The reason for stopping the transmission is to reduce the data load (which may be referred to as data traffic, including the statistical load) as described above, and distribute the data according to the schedule. However, if requested by the DPI service analysis system 120, it can be resumed again.

Accordingly, the DPI service analysis system 120 according to the present invention receives the new flows that have not been statistically processed for each of the flow management systems 110 described above, and analyzes the first N packets for each new flow.

At this time, if the first N packets are analyzed for each new flow, the application content information of the final new flow can be extracted. The extracted application content information means unique identifier information that distinguishes application content for each new flow.

As described above, only the minimum packet is transmitted and analyzed for application content analysis, thereby minimizing the traffic bandwidth to the DPI service analysis system 120.

However, when the application contents of the new flow are not determined through analysis of the first N packets received from the flow management system 110, the DPI service analysis system 120 according to the present invention additionally adds packets To the DPI service analysis system 120. The DPI service analysis system 120 may be configured to control the flow management system 110 and the DPI service analysis system 120, The unique identifier information for the application content generated through this process is transmitted to the flow management system 110 described above.

That is, the flow management system 110 according to the present invention generates content statistics flow information by integrating the unique identifier information for each new flow received from the DPI service analysis system 120 and the statistical processed flow statistics.

At this time, the generated content statistics flow information includes basic flow information, statistics start / end time, received packet count, received byte count, ACID (Application Content Identifier), and FMS identifier (Flow Management System Identifier) .

In this way, the flow management system 110 according to the present invention combines the unique identifier information of the new flow with the basic flow statistical information (the statistical processed flow statistic) to obtain basic flow information, statistical start / end time, The final content statistics flow information including the number of received bytes, the ACID (application content identifier), and the FMS identifier (Flow Management System Identifier). The generated content statistics flow information is periodically transmitted to the DPI service analysis system 120.

Accordingly, the DPI service analysis system 120 according to the present invention can collectively manage the content information and the content statistical information for each flow using the content statistical flow information transmitted from the plurality of flow management systems 110.

In addition, it can be used to analyze unprocessed contents through association analysis between the received contents statistics flow information. When the association analysis between the contents statistics flow information transmitted from the flow management system 110 is performed, the contents analysis by the asymmetric routing (the up / down flow of the same session is up / down via the other equipment / The phenomenon that the ACID of one flow is not distinguished) can be minimized.

Second Embodiment

FIG. 3 is a flowchart illustrating an application content analysis method (S100) of an application content analysis system 100 according to a second embodiment of the present invention. FIG. 5 is a flowchart illustrating a process flow of a content analysis system 100 for processing an application content analysis method (S100) according to an example.

As shown in the figure, the application content analysis method (S100) according to the second embodiment of the present invention includes steps S110 to S130 for efficiently processing packet data based on the distributed processing.

First, in step S110 according to the present invention, the flow management system 110 collects packet data flowing through a wired and wireless Internet network. At this time, the collected packet data is collected by various methods such as a tapping method by an optical distributor or a mirroring in a network device 101 such as a router, and then the flow data is collected through a flow management system 110 .

In step S110 according to the present invention, when the packet data is received through the network device 101, the flow management system 110 statistically processes the received packet data for each flow unit (flow information).

At this time, the flow information to be statistically processed may include packets having the same source IP, destination IP, source port, destination port, and protocol. Therefore, when such information is statistically processed, the flow packets can be deleted after completing the statistical processing, leaving only the result of the statistical processing, for example, the result of the flow statistical information. In this way, when the flow packets are deleted after the statistical processing is completed, unnecessary waste of bandwidth can be minimized.

In step S120 according to the present invention, when the flow management system 110 newly receives the packet data from the network device 101 through the wired and wireless Internet network, the new flow that has not been statistically processed is called the DPI Deep Packet Inspection service analysis system 120. Preferably, the first N packets of the new flow may be transmitted to the DPI service analysis system 120.

In this case, when a plurality of flow management systems 110 involved in the new flow transmission are provided, a plurality of new flows including the first N packets can be transmitted to the DPI service analysis system 120.

For example, a first new flow including the first N packets may be transmitted from the first flow management system 111 to the DPI service analysis system 120, and a second new flow including the other first N packets may be transmitted 2 flow management system 112 to the DPI service analysis system 120.

However, every time a new flow is created, it is not transferred to the DPI service analysis system 120 indefinitely. For example, in step S120 according to the present invention, it is preferable that a new flow is transmitted from the flow management system 110 until a first N packet data transmission or a transmission stop command is received for each new flow generated. This is to reduce the data load (including the statistical load) and distribute it according to the schedule.

At this time, the transmission stop command may be generated by the flow management system 110 itself, for example, by a load reduction algorithm, or by a determination of the DPI service analysis system 120, e.g., a load reduction algorithm. Therefore, upon detecting such a transmission stop command, the transmission of the new flow is stopped.

In step S120 according to the present invention, at least one new flow including the first N packets is transmitted from the flow management system 110 to the DPI service analysis system 120 (step < RTI ID = 0.0 > ), Which means that if the first N packets are sent for each new flow, no further transmission is performed.

The reason for stopping the transmission is to reduce the data load (which may be referred to as data traffic, including the statistical load) as described above, and distribute the data according to the schedule. However, if requested by the DPI service analysis system 120, it can be resumed again.

Thereafter, in step S130 according to the present invention, the DPI service analysis system 120 receives new flows that have not been statistically processed for each of the flow management systems 110 described above, and receives the first N packets (ACID ) ④ Analyze.

As described above, if the first N packets are analyzed for each new flow, the DPI service analysis system 120 can extract the application content information of the final new flow [5]. The extracted application content information means unique identifier information that distinguishes application content for each new flow.

As described above, only the minimum packet is transmitted and analyzed for application content analysis, thereby minimizing the traffic bandwidth to the DPI service analysis system 120.

However, if the application content of the new flow is not determined through the analysis of the first N packets transmitted from the flow management system 110 in step S130 according to the present invention, the packet is further added to the DPI service analysis system The flow management system 110 may be controlled by the DPI service analysis system 120 so as to transmit the flow management system 110 to the flow control system 120. The unique identifier information of the application content generated through this process is transmitted to the flow management system 110 described above (6).

In step S120 according to the present invention, the flow management system 110 integrates the unique identifier information for each new flow received from the DPI service analysis system 120 and the statistical processed flow statistics, ⑦ Generate.

At this time, the generated content statistics flow information includes basic flow information, statistics start / end time, received packet count, received byte count, ACID (Application Content Identifier), and FMS identifier (Flow Management System Identifier) .

As described above, in step S120 according to the present invention, the unique identifier information of the new flow delivered from the DPI service analysis system 120 is combined with basic flow statistical information (pre-statistically processed flow statistics) to obtain basic flow information, The flow management system 110 generates final content statistics flow information including time, received packet count, received byte count, ACID (Application Content Identifier), and FMS identifier (Flow Management System Identifier).

The generated content statistical flow information is periodically transmitted to the DPI service analysis system 120. (8) Accordingly, in step S130 according to the present invention, content statistics flow information transmitted from a plurality of flow management systems 110 is utilized in the DPI service analysis system 120 to provide flow-specific content information and content statistical information to a DPI service analysis system 120).

In addition, the received content statistics flow information can be used for association analysis of the DPI service analysis system 120. That is, if the DPI service analysis system 120 performs the association analysis between the content statistics flow information received from the flow management system 110, it is possible to analyze the contents by asymmetric routing (the upstream / The ACID (application content identifier) of one of the upstream and downstream flows can not be distinguished).

Third Embodiment

FIG. 5 is a configuration diagram illustrating a DPI service analysis system 120 according to a third embodiment of the present invention in more detail.

Referring to FIG. 5, the DPI service analysis system 120 according to the third embodiment of the present invention communicates with a plurality of flow management systems 110 that statistically process packet data on a flow-by-flow basis, The content analyzer 122, the unique identifier extractor 123, the unique identifier transmitter 124, the statistical flow receiver 125 and the content flow statistics unit 126 to efficiently process .

First, the new flow receiving unit 121 according to the present invention receives a new flow that is not statistically processed for each flow management system 110. At this time, the received new flow can be distinguished from the flow information statistically processed in the plurality of flow management systems 110.

For example, flow information that is statistically processed by the flow management system 110 may include packets having the same source IP, destination IP, source port, destination port, and protocol received from the network device 101, Data, but the new flow received from the flow management system 110 refers to new data that has been introduced after the statistically processed flow information and has not been statistically processed.

In this manner, the new flow receiver 121 according to the present invention does not receive the statistical processed flow information from the flow management system 110, but receives only the new flow that has not been statistically processed from the flow management system 110.

At this time, a plurality of new flows may be received. That is, a first new flow including the first N packets can be received from the first flow management system 111, and a second new flow including other first N packets can be received from the second flow management system 112 .

In this manner, by receiving only the minimum packet from the flow management system 110, the traffic bandwidth flowing into the DPI service analysis system 120 can be minimized.

 However, every time a new flow is created, the new flow is not received infinitely. For example, the new flow receiving unit 121 according to the present invention preferably receives a new flow after receiving the first N pieces of packet data for each new flow received or until a transmission stop command is received. This is to reduce the data load (including the statistical load) and distribute it according to the schedule.

At this time, the transmission stop command may be generated by a judgment of the flow management system 110, for example, a load reduction algorithm, or may be generated by a self-determination of the DPI service analysis system 120, e.g., a load reduction algorithm. Therefore, upon detecting such a transmission stop command, further new flow reception is stopped.

On the other hand, in the case of 'after the first N packet data transmission', the new flow receiving unit 121 according to the present invention receives at least one new flow including the first N packets from the flow management system 110 Which means that if the first N packets are received for each new flow, no further reception is received.

The reason for stopping the transmission is to reduce the data load (which may be referred to as data traffic, including the statistical load) as described above, and distribute the data according to the schedule. However, if a request is made from the self-diagnosis or flow management system 110 of the DPI service analysis system 120, it can be resumed.

Next, the content analysis unit 122 analyzes the application content for each new flow having the first N packets received by the new flow receiving unit 121 described above.

Next, the unique identifier extracting unit 123 analyzes the application contents of the first N packets for each new flow, and generates unique identifier information (ACID) identifying the application content of the new flow for each new flow Identifier can be extracted.

For example, it is possible to finally determine and extract unique identifier information such as unique identifier information (ACID) such as Skype, P2P, etc. that distinguishes application contents of the flow by analyzing the first N packets transmitted.

Next, the unique identifier transmission unit 124 according to the present invention transmits the unique identifier information for each new flow extracted by the unique identifier extraction unit 123 to the corresponding flow management system 110.

Next, the statistical flow receiving unit 125 according to the present invention transmits the unique identifier information to the flow management system 110 by the unique identifier transmitting unit 124 described above, and then, from the flow management system 110, And receive statistics flow information.

At this time, the received contents statistics flow information means the result of receiving the integrated information when the flow management system 110 generates information that integrates the unique identifier information for each new flow and the statistical processed flow statistics.

The content statistics flow information may include basic flow information, statistics start / end time, received packet count, received byte count, unique identifier (ACID), and FMS identifier of the flow management system 110.

Accordingly, the statistical flow receiving unit 125 according to the present invention combines the unique identifier information of the new flow with the basic flow statistical information (the statistical processed flow statistic) to calculate the basic flow information, the statistic start / end time, From the flow management system 110, the final content statistics flow information configured by the number of bytes received, the ACID, and the FMS identifier (Flow Management System Identifier).

The content statistics flow information is periodically transmitted from the flow management system 110 to the statistical flow receiving unit 125. The transmission of the periodical content statistics flow information can efficiently distribute a large amount of traffic and can guarantee system scalability.

Finally, the content flow statistics unit 126 according to the present invention collectively manages the content information and the content statistical information for each flow by using the content statistical flow information received by the statistical flow receiving unit 125 described above .

Furthermore, the content flow statistics unit 126 according to the present invention may analyze the unprocessed content through association analysis between the content statistics flow information. For example, through the association analysis between the content statistical flow information received from the flow management system 110, the up / down flow of the same session by the asymmetric routing passes through the other equipment / line and the ACID of the flow It is possible to know unprocessed contents such as a phenomenon that is not distinguished. Accordingly, not only the already processed content but also the unprocessed content can be analyzed, so that accurate content confirmation and statistical processing can be performed.

Fourth Embodiment

FIG. 6 is a configuration diagram showing the flow management system 110 according to the fourth embodiment of the present invention in more detail.

Referring to FIG. 6, a plurality of flow management systems 110 according to a fourth embodiment of the present invention are provided between the network device 101 and the DPI (Deep Packet Inspection) service analysis system 120. At this time, the DPI service analysis system 120 has been fully described in FIGS. 1 to 5, and therefore, the description thereof is omitted.

The flow management system 110 includes a packet data receiving unit 111, a statistical processing unit 112, a new flow generating unit 113, a new flow transmitting unit 114, a content identifier receiving unit 115, a content flow generating unit 116 And a content flow transfer unit 117. [

First, the packet data receiving unit 111 according to the fourth embodiment of the present invention receives packet data from a network device 101 connected via a wired and wireless Internet network. At this time, the network device 101 can generate packet data by applying various methods such as a tapping method using an optical splitter or a mirroring method using a router. Accordingly, the packet data receiving unit 111 can collect packet data using various methods as described above.

Next, the statistical processing unit 112 according to the present invention receives the packet data received from the packet data receiving unit 111, and then statistically processes the received packet data for each flow unit (flow information).

At this time, the flow information to be statistically processed may include packets having the same source IP, destination IP, source port, destination port, and protocol. Therefore, when such information is statistically processed, the flow packets can be deleted after completing the statistical processing, leaving only the result of the statistical processing, for example, the result of the flow statistical information. Thus, unnecessary waste of bandwidth can be minimized when flow packets are deleted after completion of statistical processing.

Next, the new flow generation unit 113 according to the present invention generates at least one new flow for the packet data newly received by the packet data reception unit 111 described above after being statistically processed for each flow unit.

At this time, the generated at least one new flow refers to the flow information described above only when the packet data is newly received from the network device 101 via the wired or wireless Internet network, the statistical processing is not performed. As described above, flow information can be generated when the source IP, the destination IP, the source port, the destination port, and the protocol are composed of the same packets.

Next, the new flow transmitter 114 according to the present invention transmits at least one or more new flows generated by the new flow generator 113 described above to the DPI service analysis system 120.

However, every time a new flow is created, it is not transferred to the DPI service analysis system 120 indefinitely. For example, the new flow transmitter 114 according to the present invention preferably transmits at least one new flow until the first N packet data transmission or the transmission stop command is received for each new flow generated. This is to reduce the data load (including the statistical load) and distribute it according to the schedule.

At this time, the transmission stop command may be generated according to the flow management system 110's own judgment, for example, according to a load reduction algorithm, or according to a judgment of the DPI service analysis system 120, for example, according to a load reduction algorithm. Therefore, upon detecting such a transmission stop command, the transmission of the new flow is stopped.

The new flow transmitter 114 according to the present invention transmits at least one new flow including the first N packets to the DPI service analysis system 120 It means that if the first N packets are transmitted for each new flow, no further transmission is performed. The reason for stopping the transmission is to reduce the data load (which may be referred to as data traffic, including the statistical load) as described above, and distribute the data according to the schedule.

Next, the content identifier receiving unit 115 transmits a new flow signal including at least one new flow to the DPI service analyzing system 120, identifies application contents for each new flow corresponding thereto, And receives unique identifier information from the DPI service analysis system 120.

Next, the content flow generation unit 116 integrates the unique identifier information for each new flow received from the DPI service analysis system 120 and the flow statistic (flow statistical information) Lt; / RTI >

At this time, the unique identifier information for each new flow indicates an application identifier (ACID) for the application content information (ACID) extracted for each new flow. On the other hand, the content statistics flow information generated by the content flow generation unit 116 includes basic flow information, statistics start / end time, received packet count, received byte count, ACID (Application Content Identifier) And an FMS identifier (Flow Management System Identifier).

Accordingly, the content flow generation unit 116 according to the present invention combines the unique identifier information of the new flow received from the DPI service analysis system 120 with basic flow statistical information (pre-statistically processed flow statistics) , Statistics start / end time, received packet count, received byte count, ACID (application content identifier), and FMS identifier (Flow Management System Identifier).

Finally, the content flow transmitter 117 according to the present invention can periodically transmit the content statistical flow information generated by the content flow generator 116 to the DPI service analysis system 120. FIG. Thus, the DPI service analysis system 120 utilizes the content statistics flow information received from the content flow transmission unit 117 for various purposes such as association analysis and statistical management.

The embodiments of the present invention described above can be implemented in the form of program instructions that can be executed through various computer components and recorded on a computer-readable recording medium. The computer-readable recording medium may include program commands, data files, data structures, and the like, alone or in combination. The program instructions recorded on the computer-readable recording medium may be those specially designed and constructed for the present invention or may be those known and used by those skilled in the computer software arts. Examples of computer-readable recording media include magnetic media such as hard disks, floppy disks and magnetic tape, optical recording media such as CD-ROMs and DVDs, magneto-optical media such as floptical disks, media, and hardware devices specifically configured to store and execute program instructions such as ROM, RAM, flash memory, and the like. Examples of program instructions include machine language code such as those generated by a compiler, as well as high-level language code that can be executed by a computer using an interpreter or the like. The hardware device may be configured to operate as one or more software modules for performing the processing according to the present invention, and vice versa.

While the present invention has been particularly shown and described with reference to exemplary embodiments thereof, it is to be understood that the invention is not limited to the exemplary embodiments or constructions. You can understand that you can do it. The embodiments described above are therefore to be considered in all respects as illustrative and not restrictive.

100: Application content analysis system 101: Network device
110: Flow Management System 111: Packet Data Receiving Unit
112: statistical processing unit 113: new flow generating unit
114: New flow transmitter 115: Content identifier receiver
116: Content flow generation unit 117: Content flow transmission unit
120: DPI service analysis system 121: New flow receiver
122: content analyzing unit 123: unique identifier extracting unit
124: unique identifier transmission unit 125: statistics flow receiver
126: Content flow statistics section

Claims (43)

An application content analysis system based on distributed processing,
A flow management system for statistically processing the received packet data on a flow unit basis; And
A DPI (Deep Packet Inspection) service analysis system for receiving a new flow that is not statistically processed for each flow management system and analyzing application contents of a new flow for each new flow;
/ RTI >
Wherein the flow management system transmits the new flow including the first N packets to the DPI service analysis system, wherein the flow management system involved in the new flow transmission is provided in plurality,
The flow management system transmits the new flow until a transmission stop command is received,
Wherein the DPI service analysis system controls the flow management system to additionally send packets for the new flow if it is not determined through analysis of the first N packets received from the flow management system,
Application content analysis system. The method according to claim 1,
The flow management system includes:
The source IP, the destination IP, the source port, the destination port, and the protocol. 3. The method of claim 2,
The flow management system includes:
Wherein the flow packets having been subjected to the statistical processing are deleted after completion of statistical processing. delete delete The method of claim 3,
The DPI service analysis system comprises:
And extracts unique identifier information that distinguishes application contents for each new flow through the analysis. The method according to claim 6,
The DPI service analysis system comprises:
And transmits the unique identifier information to the flow management system. The method according to claim 6,
The flow management system includes:
And generates content statistics flow information by integrating the unique identifier information received from the DPI service analysis system and the statistical processed flow statistics. 9. The method of claim 8,
The flow management system includes:
The content statistics flow information including basic flow information, statistics start / end time, received packet count, received byte count, ACID (Application Content Identifier), and FMS identifier of the flow management system (Flow Management System Identifier) Wherein the application content analysis system comprises: 10. The method of claim 9,
The flow management system includes:
And transmits the generated content statistical flow information to the DPI service analysis system periodically. 11. The method of claim 10,
The DPI service analysis system comprises:
And collectively managing content information and content statistical information for each flow using the content statistical flow information. 12. The method of claim 11,
The DPI service analysis system comprises:
And analyzes the unprocessed contents through association analysis between the contents statistics flow information. A method for analyzing application content in an application content analysis system based on distributed processing,
(a) statistically processing the received packet data by a flow unit in a flow management system;
(b) transmitting, to the DPI (Deep Packet Inspection) service analysis system, a new flow not subjected to the statistical processing for each flow management system; And
(c) analyzing the application contents of the new flow by the DPI service analysis system for each new flow received;
/ RTI >
Wherein the flow management system transmits the new flow including the first N packets to the DPI service analysis system, wherein the flow management system involved in the new flow transmission is provided in plurality,
The flow management system transmits the new flow until a transmission stop command is received,
Wherein the DPI service analysis system controls the flow management system to additionally send packets for the new flow if it is not determined through analysis of the first N packets received from the flow management system,
Application content analysis method. 14. The method of claim 13,
The step (a)
Wherein the flow management system performs statistical processing for each flow unit including packets having the same source IP, destination IP, source port, destination port, and protocol. 15. The method of claim 14,
The step (a)
Wherein the flow packets having undergone the statistical processing are deleted from the flow management system after the statistical processing is completed. delete delete 16. The method of claim 15,
The step (c)
And extracting, from the DPI service analysis system, unique identifier information that distinguishes application content for each new flow through the analysis. 19. The method of claim 18,
The step (c)
And the unique identifier information for each new flow is transmitted from the DPI service analysis system to the flow management system. 20. The method of claim 19,
The step (a)
Wherein the flow statistics information is generated by integrating the unique identifier information for each new flow received from the DPI service analysis system and the statistically processed flow statistics in a flow management system. 21. The method of claim 20,
The step (a)
The flow statistics management system generates the content statistics flow information including basic flow information, statistics start / end time, received packet count, received byte count, unique identifier (ACID), and FMS identifier of the flow management system (Flow Management System Identifier) And analyzing the contents of the application contents. 22. The method of claim 21,
The step (a)
And the generated content statistical flow information is periodically transmitted from the flow management system to the DPI service analysis system. 23. The method of claim 22,
The step (b)
Wherein the DPI service analyzing system collectively manages the content information and the content statistical information for each flow by using the content statistical flow information. 24. The method of claim 23,
The step (b)
Wherein the DPI service analysis system analyzes the unprocessed contents through association analysis between the contents statistics flow information. A computer-readable recording medium having recorded thereon a program for executing an application content analysis method according to any one of claims 13 to 15 and 18 to 24. A DPI (Deep Packet Inspection) service analysis system for communicating with a plurality of flow management systems for statistically processing received packet data on a flow unit basis,
A new flow receiving unit for receiving a new flow until a transmission stop command is received for the new flow not subjected to the statistical processing for each flow management system; And
A content analyzer for analyzing application content of a new flow for each new flow received;
/ RTI >
Wherein the DPI service analysis system receives the new flow including the first N packets from the flow management system,
Wherein the DPI service analysis system controls the flow management system to additionally send packets for the new flow if it is not determined through analysis of the first N packets received from the flow management system,
DPI Service Analysis System.
delete delete 27. The method of claim 26,
A unique identifier extracting unit for extracting unique identifier information that distinguishes application contents for each new flow through the analysis of the content analyzing unit;
The DPI service analysis system comprising: 30. The method of claim 29,
A unique identifier transfer unit for transferring the unique identifier information for each new flow to the flow management system; And
A statistical flow receiving unit for receiving contents statistics flow information generated using the unique identifier information from the flow management system;
The DPI service analysis system comprising: 31. The method of claim 30,
The statistical flow receiving unit,
And the content statistical flow information combining the unique identifier information for each new flow and the statistical processed flow statistics is received. 32. The method according to claim 30 or 31,
The statistical flow receiving unit,
The content statistics flow information including basic flow information, statistics start / end time, received packet count, received byte count, unique identifier (ACID), and FMS identifier of the flow management system. 33. The method of claim 32,
The statistical flow receiving unit,
And the content statistics flow information is periodically received. 33. The method of claim 32,
A content flow statistics unit for collectively managing content information and content statistical information for each flow using the received content statistical flow information;
The DPI service analysis system comprising: 35. The method of claim 34,
The content-
And analyzing the unprocessed contents through association analysis between the contents statistics flow information. A plurality of flow management systems for statistically processing received packet data on a flow unit basis,
A packet data receiving unit for receiving packet data from a network device;
A statistical processor for statistically processing the received packet data on a flow unit basis;
A new flow generating unit for generating at least one new flow for packet data newly received by the packet data receiving unit after statistical processing for each flow unit;
A new flow transfer unit for transferring the new flow including the first N packets to the DPI service analysis system until a transmission stop command is received; And
A content identifier receiving unit for receiving, from the DPI service analysis system, unique identifier information extracted by distinguishing application content for each new flow after the transmission;
/ RTI >
Wherein the flow management system further sends a packet to the DPI service analysis system for the new flow when the DPI service analysis system is not determined through analysis of the first N packets received from the flow management system doing,
Flow management system. 37. The method of claim 36,
The statistical processing unit,
The source IP, the destination IP, the source port, the destination port, and the protocol. 39. The method of claim 37,
The statistical processing unit,
And the flow packets having been subjected to the statistical processing are deleted after completion of the statistical processing. delete delete 39. The method of claim 37,
A content flow generation unit for generating content statistics flow information by integrating the unique identifier information for each new flow received from the DPI service analysis system and the statistical processed flow statistics;
The flow management system further comprising: 42. The method of claim 41,
Wherein the content-
The content statistics flow information including the basic flow information, the statistics start / end time, the number of received packets, the number of received bytes, the ACID (Application Content Identifier) and the FMS identifier of the flow management system The flow management system comprising: 43. The method of claim 42,
A content flow transmitter for periodically transmitting the generated content statistical flow information to the DPI service analysis system;
The flow management system further comprising:

Images