KR20240134094A - Method and Apparatus for Monitoring Network Traffic by Using Virtual Network Function - Google Patents

Abstract

According to the present embodiment, a network traffic monitoring device is provided, comprising: a first network function which receives a first packet from a switching unit, performs a first intrusion detection on the first packet, and generates safety traffic information related to a source IP address of the first packet according to a result of the first intrusion detection; and a switching unit which performs a first operation of receiving a second packet and transmitting the second packet to the first network function, but if the second packet has the source IP address, performs a second operation of omitting the performance of the first operation and transmitting the second packet to a client of a local network, and copies the second packet and transmits it to the second network function during the performance of the second operation; and a second network function which receives the second packet from the switching unit and performs a second intrusion detection on the second packet.

Description

{Method and Apparatus for Monitoring Network Traffic by Using Virtual Network Function}

The present embodiment relates to a method and device for monitoring network traffic using a virtual network function.

The content described below merely provides background information related to the present embodiment and does not constitute prior art.

Figure 1 is a diagram showing the basic structure of a network in which an IPS (Intrusion Prevention System) is inserted into the network and packets are transmitted and received in-line.

As illustrated in FIG. 1, packets received from the Internet (110) are transmitted to a client (160) or IDS (Intrusion Detection System) (170) located at the end of the network via a router (120), a firewall (130), an IPS (140), and a switch (150).

The router (120) converts the public IP address and port number included in the packet received from the Internet (110) into a private IP address and transmits it to the firewall (130).

The firewall (130) inspects the header information of packets received from the router (120) based on preset rules and blocks the packets or passes them through to the next transmission destination, the IPS (140), based on the inspection results.

IPS (140) is generally implemented as an inline device inserted in the middle of a network transmission line.

IPS (140) inspects incoming packets and, if the inspection result is detected as an intrusion, blocks attacks from the outside in real time by preventing the packets from entering the internal network. Since IPS (140) is inserted in the middle of a network line, packets entering IPS (140) must be processed and passed quickly so that the overall communication speed does not slow down.

However, if a product with low specifications, such as a CPU or memory, is used in the IPS (140), or if the number of rules for processing incoming packets is large or the processing of rules is inefficient, the computational load borne by the IPS (140) may increase, causing a problem in that the processing speed of the incoming packets on the entire network may decrease.

The main purpose of this embodiment is to provide a high level of intrusion detection while minimizing the burden of processing incoming packets in the operation of the IPS function for network security.

According to the present embodiment, a network traffic monitoring device is provided, comprising: a first network function which receives a first packet from a switching unit, performs a first intrusion detection on the first packet, and generates safety traffic information related to a source IP address of the first packet according to a result of the first intrusion detection; and a switching unit which performs a first operation of receiving a second packet and transmitting the second packet to the first network function, but if the second packet has the source IP address, performs a second operation of omitting the performance of the first operation and transmitting the second packet to a client of a local network, and copies the second packet and transmits it to the second network function during the performance of the second operation; and a second network function which receives the second packet from the switching unit and performs a second intrusion detection on the second packet.

According to the present embodiment, a method for monitoring network traffic by a network traffic monitoring device including a first network function, a second network function, and a switching unit is provided, the method including: a process in which the first network function receives a first packet from the switching unit and performs a first intrusion detection on the first packet, and generates safety traffic information related to a source IP address of the first packet according to a result of the first intrusion detection; a process in which the switching unit performs a first operation of receiving a second packet and transmitting the second packet to the first network function, wherein if the second packet has the source IP address, performing the first operation is omitted and performing a second operation of transmitting the second packet to a client of a local network, and during the performance of the second operation, copying the second packet and transmitting it to the second network function; and a process in which the second network function receives the second packet from the switching unit and performs a second intrusion detection on the second packet.

According to this embodiment, it is possible to provide a high level of intrusion detection while minimizing the burden of processing incoming packets in the operation of the IPS function for network security.

In addition, it is cost-effective because it provides a high level of intrusion detection even without using products with high specifications such as CPU and memory.

Figure 1 is a diagram showing the basic structure of a network in which an IPS (Intrusion Prevention System) is inserted into the network and transmits and receives packets in-line.
Figure 2 is a diagram illustrating the network infrastructure structure for home network security.
FIG. 3 is a block diagram illustrating the structure of a network traffic monitoring device according to the present embodiment implemented using a virtual network.
FIG. 4 is a block diagram illustrating a detailed structure of major components of a network traffic monitoring device according to the present embodiment.
Figure 5 is a flow chart illustrating a network traffic monitoring method according to the present embodiment.

Hereinafter, some embodiments of the present invention will be described in detail with reference to exemplary drawings. When adding reference numerals to components in each drawing, it should be noted that the same components are given the same numerals as much as possible even if they are shown in different drawings. In addition, when describing the present invention, if it is determined that a specific description of a related known configuration or function may obscure the gist of the present invention, the detailed description thereof will be omitted.

Figure 2 is a diagram illustrating a network infrastructure structure for network security.

A network traffic monitoring device (210) is connected to the Internet (220) and receives incoming packets from the Internet (220).

The network traffic monitoring device (210) has a local network switch function. That is, the network traffic monitoring device (210) receives an incoming packet from an external network and uses the destination IP information included in the incoming packet to transmit the incoming packet to one of the clients, such as a smartphone (201), laptop (202), or printer (203) located at the end of the local network.

The network traffic monitoring device (210) may be implemented to check whether an intrusion has occurred by examining the received incoming packet before transmitting the incoming packet to one of the clients. If the network traffic monitoring device (210) determines that an intrusion has not occurred in the received packet, it transmits the packet to one client that is linked with the local network switch function provided. On the other hand, if the network traffic monitoring device (210) determines that an intrusion has occurred as a result of detecting an intrusion, it transmits detection result information related to the intrusion that has occurred to the central control server (230).

The central control server (230) analyzes the detection result information transmitted from the network traffic monitoring device (210) and generates visualization results of security-related statistical information, notifications about security situations, policies for controlling security functions, etc., and transmits them to operator terminals (not shown).

Since the detailed description of the operation of the central control server (230) is beyond the scope of the present invention, further detailed description is omitted.

FIG. 3 is a block diagram illustrating the structure of a network traffic monitoring device (210) according to the present embodiment implemented using a virtual network.

As illustrated in FIG. 3, the network traffic monitoring device (210) according to the present embodiment can be implemented using a virtual system in the docker/container format. The docker/container format refers to a method of installing a docker engine on an OS (Operating System) in the network traffic monitoring device (210) and isolating the work area within the docker engine so that each application to be run has one isolated work area (i.e., container).

The network traffic monitoring device (210) according to the present embodiment includes a software switch (310), a plurality of virtual network functions (VNF: Virtual Network Functions) (320), a local network switch (330), and an external network interface (340).

The software switch (310) may be installed as a separate software layer on top of an OS having the function of a Docker engine in the network traffic monitoring device (210) or as one of the functions of the OS. However, the present invention is not limited thereto, and the software switch (310) may be installed in the network traffic monitoring device (210) in various ways.

The multiple virtual network functions (320) mounted on the Docker engine as containers each include a DHCP (Dynamic Host Configuration Protocol) network function (321), a firewall network function (322), an IPS network function (323), a NAT (Network Address Translation) network function (324), an IDS network function (325), and an agent network function (326).

Each virtual network function included in the plurality of virtual network functions (320) sends and receives packets with the software switch (310).

Here, the types of packets transmitted and received by the multiple virtual network functions (320), local network switch (330) and external network interface (340) to and from the software switch (310) may be one of the following.

- Inbound packets received from the external network interface (340) and destined for the local network

- Outbound packets received from the local network switch (330) and destined for an external network

- Packets that are processed by one of the virtual network functions and then transmitted without updates.

- Packets that are transmitted after some information is updated after being processed by one of the virtual network functions.

- Message packets containing various control information or management information generated from a virtual network function

The software switch (310) stores a switching rule table including at least one switching rule.

Each switching rule includes forwarding information indicating a destination for forwarding the incoming traffic packet in response to the transmitting entity that transmitted the incoming traffic packet. For example, if the transmitting entity of the traffic packet is an external network interface (340), a first switching rule indicating that the receiving destination of the traffic packet is a firewall network function (322) may be stored.

The software switch (310) receives a traffic packet input from an external network interface (340) and transmits the traffic packet to at least one virtual network function among a plurality of virtual network functions (320), for example, a firewall network function (322), based on a switching rule stored in a switching rule table.

Additionally, the software switch (310) may receive a packet from a first virtual network function, which is one of a plurality of virtual network functions (320), and transmit the packet to another virtual network function based on a switching rule associated with the first virtual network function, such as a second switching rule.

Additionally, the software switch (310) may receive a packet from a second virtual network function, which is one of a plurality of virtual network functions (320), and may transmit the packet to a client existing in the local network using the local network switch (330) based on a switching rule associated with the second virtual network function, for example, a third switching rule.

The DHCP network function (321) may have a function of issuing private IP addresses to client devices such as smartphones (201), laptops (202), and printers (203) within an address block allocated from an ISP (Internet Service Provider).

The DHCP network function (321) receives a request for issuing a private IP address from a client via a software switch (310), issues a private IP address for the client from among available private IP addresses, and delivers it to the client via the software switch (310).

Clients such as smartphones (201), laptops (202), and printers (203) can receive network services using private IP addresses issued from the DHCP network function (321).

For reference, the DHCP operation of the DHCP network function (321) is self-evident to those skilled in the art, so further detailed description thereof is omitted.

As described above, the software switch (310) receives various types of packets and forwards the packets to the next receiving destination.

As described above, the software switch (310) stores at least one switching rule in the switching rule table to transmit the received packet to the next receiving destination.

For example, if the transmitter of the packet is an external network interface (340), a first switching rule indicating that the next destination of the packet is a firewall network function (322) may be stored, and if the transmitter of the packet is a firewall network function (322), a second switching rule indicating that the next destination of the packet is an IPS network function (323) may be stored.

In addition, if the transmitter of the packet is an IPS network function (323), a third switching rule indicating that the next destination of the packet is a specific client may be stored, and if an outbound packet from a client of the local network to an external network is received by the software switch (310), a fourth switching rule indicating that the next destination of the packet is an external network interface (340) may be stored.

When the software switch (310) receives a first packet, which is an external traffic packet, from the external network interface (340), it transmits the first packet to the firewall network function (322) based on the first switching rule it has stored.

The firewall network function (322) receives a first packet from the software switch (310) and examines the header information of the first packet based on preset filtering rules. For example, the preset filtering rules may include the source IP address of the packet that needs to be blocked.

The firewall network function (322) may be implemented to discard the packet without allowing it to enter the local network if it is determined as a result of examining the header information of the first packet that the first packet needs to be blocked.

If the firewall network function (322) determines that the first packet is a normal packet as a result of the inspection of the first packet, it forwards the first packet to the software switch (310) so that it is directed to the next receiving destination.

When the software switch (310) receives the first packet transmitted from the firewall network function (322), it transmits the first packet to the next receiving destination, the IPS network function (323), based on the second switching rule.

The IPS network function (323) checks whether an intrusion has occurred in the first incoming packet, and if the result of the check confirms an intrusion, blocks the packet without sending it to a software switch (310) or another virtual network function, thereby blocking external attacks by the first packet in real time.

For reference, intrusion detection performed by the IPS network function (323) generally includes a signature-based pattern matching method. For example, DPI (Deep Packet Inspection) is used to detect known attack patterns or abnormal behaviors using a pattern matching method for the contents included in packets.

The IPS network function (323) transmits the first packet to the software switch (310) so that the first packet is directed to the next receiving destination if, as a result of the inspection on whether an intrusion has occurred in the first packet, it is determined that no intrusion has occurred in the first packet.

The software switch (310) receives the first packet passing through the IPS network function (323) and transmits the first packet to the local network switch (330) based on the third switching rule.

Meanwhile, the software switch (310) checks the information included in the first packet and the third switching rule to check the next destination of the first packet, and if it is confirmed that the next destination is a local network, it transmits the public destination IP address and port information included in the first packet to the NAT network function (324).

The NAT network function (324) receives the public destination IP address and port information included in the first packet from the software switch (310), acquires private IP information for switching the first packet to one of the clients (201, 202, 203) of the local network, and transmits the acquired private IP information to the software switch (310) together with the first packet.

Obtaining private IP information from a packet with public destination IP information is obvious to those skilled in the art, so further detailed description is omitted.

For reference, depending on whether the first packet is configured to include private IP information, the private IP information may be inserted into the first packet and transmitted to the software switch (310) or may be transmitted separately from the first packet to the software switch (310). However, the following description assumes that the private IP information is inserted into the first packet and transmitted to the software switch (310).

The software switch (310) receives a first packet containing private IP information and transmits the first packet to a local network switch (330).

The local network switch (330) receives the first packet from the software switch (310) and transmits the first packet to one of the clients (201, 202, 203) of the local network based on the private IP information included in the first packet.

The software switch (310) transmits the first packet transmitted from the IPS network function (323) to the local network switch (330), then copies the packet and transmits it to the IDS network function (325).

For reference, the software switch (310) may also copy the software first packet and forward it to the IDS network function (325) while performing the operation of transmitting the first packet to the local network switch (330) using the NAT network function (324).

Here, the software switch (310) can use various methods to copy the first packet, such as the software switch (310) performing mirroring or copying using tap equipment on the network path. However, the following description assumes that the mirroring method is used.

The IDS network function (325) receives a copy of the first packet from the software switch (310) and uses the received copy of the first packet to detect whether an intrusion has occurred in the first packet.

The intrusion detection function of the IDS network function (325) may be the same as or different from the intrusion detection function of the IPS network function (323).

The IDS network function (325) can detect an intrusion from the first packet copy and then transmit the intrusion detection results to other devices such as the central control server (230) and agent network function (326).

The agent network function (326) receives detection result information related to intrusion detection results from the IPS network function (323), IDS network function (325), etc., and creates and stores switching-related information based on the received detection result information. Here, the stored switching-related information may be information on the source IP address of a packet to which access is permitted or blocked.

The agent network function (326) may receive messages related to intrusion detection results directly from the IPS network function (323), IDS network function (325), etc., but may also receive them from a software switch (310).

The agent network function (326) transmits the generated switching-related information to the software switch (310), and the software switch (310) generates and stores a switching rule based on the switching-related information received from the agent network function (326).

FIG. 4 is a block diagram illustrating a detailed structure of the main components of a network traffic monitoring device (210) according to the present embodiment.

As illustrated in FIG. 4, the network traffic monitoring device (210) includes a switching unit (410), a first intrusion detection unit (420), a first harmful traffic processing unit (430), a safety traffic processing unit (440), a table management unit (450), a second intrusion detection unit (460), and a second harmful traffic processing unit (470).

Below, a network traffic monitoring device (210) is described with reference to FIG. 3 and FIG. 4 together.

The switching unit (410) can be implemented by being included in the software switch (310), and the function of the switching unit (410) will be described later.

The first intrusion detection unit (420), the first harmful traffic processing unit (430), and the safe traffic processing unit (440) can be implemented as included in the IPS network function (323), and the functions of the first intrusion detection unit (420), the first harmful traffic processing unit (430), and the safe traffic processing unit (440) will be described later.

The table management unit (450) can be implemented as included in the agent network function (326), and the function of the table management unit (450) will be described later.

The second intrusion detection unit (460) and the second malicious traffic processing unit (470) can be implemented as included in the IDS network function (325), and the functions of the second intrusion detection unit (460) and the second malicious traffic processing unit (470) will be described later.

The switching unit (410) receives various types of packets from various transmitters and stores at least one switching rule in the switching rule table (411) to transmit the received packets to the next receiving destination. Here, each switching rule includes forwarding destination information that indicates the next receiving destination to be transmitted in response to the transmitting entity that transmitted the packet.

When the switching unit (410) receives the first packet, which is an external traffic packet, from the external network interface (340), it transmits the first packet to the firewall network function (322) based on the first switching rule stored in the switching rule table (411). In this case, the first switching rule indicates that the next receiving destination corresponding to the IP address included in the packet input from the external network interface (340) is the firewall network function (322).

The firewall network function (322) may be implemented to receive a first packet from a switching unit (410), examine the header information of the first packet based on a preset filtering rule, and if the first packet is determined to be a packet that needs to be blocked as a result of the examination, discard the packet without allowing it to enter the local network any further.

In addition, if the firewall network function (322) determines that the first packet is a normal packet as a result of the inspection of the first packet, it transmits the first packet to the switching unit (410) so that the first packet can be directed to the next receiving destination.

The switching unit (410) receives the first packet transmitted from the firewall network function (322) and transmits the first packet to the first intrusion detection unit (420) included in the IPS network function (323), which is the next receiving destination, based on the second switching rule stored in the switching rule table (411). In this case, the first switching rule indicates that the next receiving destination corresponding to the IP address included in the packet input from the firewall network function (322) is the IPS network function (323). In other words, the switching unit (410) is implemented so that, when receiving the first packet from the firewall network function (322), the received packet is transmitted to the first intrusion detection unit (420) and one of the next receiving destinations based on the stored switching rule.

The first intrusion detection unit (420) checks whether an intrusion has occurred in the first received packet and generates a first detection result.

If the first detection result generated by the first intrusion detection unit (420) means that an intrusion has occurred in the first packet, the first malicious traffic processing unit (430) blocks the first packet without sending the first packet to the switching unit (410) or another virtual network function, thereby blocking an external attack by the first packet in real time.

If the first detection result means that no intrusion has occurred in the first packet, the first intrusion detection unit (420) transmits the first packet to the switching unit (410) so that the first packet is directed to the next receiving destination.

The safe traffic processing unit (440) determines whether the first packet is a safe packet, i.e., a packet of safe traffic, based on preset safe traffic conditions when the first detection result is confirmed as no intrusion has occurred.

Whether the first packet is a packet of safe traffic can be determined based on the amount of traffic generated corresponding to the source IP address of the first packet.

That is, the safe traffic processing unit (440) determines whether the first packet was transmitted from a safe source IP address based on whether the traffic volume of the source IP address of the first packet generated on a daily basis is greater than the first threshold value for more than a preset number of consecutive days.

If the safe traffic processing unit (440) determines that the first packet was transmitted from a safe source IP address, it generates safe traffic information including first information indicating that the first packet is a packet of safe traffic and the source IP address of the first packet.

The safety traffic processing unit (440) transmits safety traffic information to the switching unit (410) to store the safety traffic information.

The switching unit (410) transmits the safety traffic information received from the safety traffic processing unit (440) to the table management unit (450), and the table management unit (450) stores the received safety traffic information as a safety traffic item in the safety traffic table (451).

At least one switching rule stored in the switching rule table (411) of the switching unit (410) can be set based on safety traffic information stored in the safety traffic table (451).

For example, let's assume that the first safety traffic information including the first source IP address is stored as an entry of the safety traffic table (451). In this case, the switching unit (410) can set the first switching rule using the first safety traffic information. That is, when the first packet having the first source IP address is input from the external network interface (340) or the firewall network function (322), the first switching rule can be set so that the first packet is switched and transmitted to one of the clients (201, 202, 203) of the local network.

According to the first switching rule, the first packet is omitted from being transmitted to the IPS network function (323).

The table management unit (450) may be implemented to receive safety traffic information and transmit information about new safety traffic items to the switching unit (410) whenever a new safety traffic item is updated in the safety traffic table (451).

When the safety traffic processing unit (440) transmits the first packet to the switching unit (410) so that the first packet is directed to the next receiving destination, the switching unit (410) transmits the first packet to the local network switch (330) based on the preset third switching rule. In this case, the third switching rule indicates that the next receiving destination of the first packet input from the IPS network function (323) is one of the clients (201, 202, 203) connected to the local network.

The switching unit (410) receives the first packet from the safety traffic processing unit (440), then verifies the information included in the first packet to determine the next destination of the first packet, and if it is confirmed that the next destination is one of the clients (201, 202, 203) of the local network, it transmits the public destination IP address and port information included in the first packet to the NAT network function (324).

The NAT network function (324) receives the public destination IP address and port information included in the first packet from the switching unit (410), acquires private IP information for switching the first packet to one of the clients (201, 202, 203) of the local network, and transmits the acquired private IP information to the switching unit (410) together with the first packet.

The switching unit (410) receives a first packet containing private IP information and transmits the first packet to a local network switch (330).

The local network switch (330) receives the first packet from the switching unit (410) and transmits the first packet to one of the clients (201, 202, 203) of the local network based on the private IP information included in the first packet.

The switching unit (410) transmits the first packet transmitted from the IPS network function (323) to the local network switch (330), and then copies the first packet and transmits it to the second intrusion detection unit (460) within the IDS network function (325).

As a variant embodiment, the switching unit (410) may be implemented to copy the first packet and transmit it to the second intrusion detection unit (460) while performing an operation of transmitting the first packet to the local network switch (330) using the NAT network function (324).

The second intrusion detection unit (460) performs a second intrusion detection on the received first packet and generates a second detection result.

If the second detection result includes information indicating that an intrusion has occurred in the first packet, the second intrusion detection unit (460) can transmit the second detection result to other devices such as a switching unit (410), a table management unit (450), and a central control server (230).

Meanwhile, if the detection result of whether there has been an intrusion for the first packet has already been generated by the IPS network function (323), the second intrusion detection operation for the first packet by the second intrusion detection unit (460) may be omitted.

Meanwhile, the second intrusion detection unit (460) can receive a copy of the first packet from the switching unit (410) and perform intrusion detection on the first packet. In this case, the switching unit (410) creates a copy of the first packet by mirroring.

The second intrusion detection function of the second intrusion detection unit (460) may be the same as or different from the first intrusion detection function of the first intrusion detection unit (420).

The second harmful traffic processing unit (470) may be implemented to receive the second intrusion detection result for the first packet copy from the second intrusion detection unit (460) and transmit the second intrusion detection result to the table management unit (450). For example, if the second intrusion detection result includes information indicating that an intrusion has been detected in the first packet, the second harmful traffic processing unit (470) may generate a first command to delete a safe traffic entry corresponding to the source IP address of the first packet from the safe traffic table (451) and transmit the first command to the table management unit (450).

In addition, if the second intrusion detection result includes information indicating that an intrusion was detected in the first packet, the second harmful traffic processing unit (470) may be implemented to transmit a second command to the switching unit (410) to execute blocking on the first packet.

The second harmful traffic processing unit (470) can be implemented to generate the first command and the second command simultaneously or to generate only one of them.

When the maximum allowable number of safety traffic entries are stored in the safety traffic table (451), the table management unit (450) may be implemented to delete the oldest stored safety traffic entry from the safety traffic table (451) to secure space for storing new safety traffic entries. In this case, the updated safety traffic entry additionally includes information about the time at which the corresponding source IP address was stored.

In addition, when the maximum allowable number of safety traffic items are stored in the safety traffic table (451), the table management unit (450) may be implemented to delete the safety traffic item whose information on traffic occurrence time was updated the longest from the safety traffic table (451) to secure space for storing new safety traffic items. In this case, the safety traffic item includes information on traffic occurrence time that is updated every time a packet corresponding to the corresponding source IP address is generated.

The table management unit (450) may also change the number of safety traffic items that can be stored in the safety traffic table (451) based on the frequency with which safety traffic information including a new IP address is stored in the safety traffic table (451).

Meanwhile, when the safety traffic table (451) is full, the table management unit (450) may increase the number of safety traffic items that can be stored in the safety traffic table (451).

The table management unit (450) receives detection result information related to the intrusion detection results from the safety traffic processing unit (440), the second harmful traffic processing unit (470), etc., and creates and stores switching-related information based on the received detection result information.

The table management unit (450) transmits the generated switching-related information to the switching unit (410), and the switching unit (410) generates and stores a switching rule based on the switching-related information received from the table management unit (450).

Meanwhile, in this embodiment, it has been described that multiple virtual network functions (320) are implemented based on Docker/container, but multiple virtual network functions (320) may also be implemented based on virtual machines (VMs).

Additionally, although this embodiment has been described as being applicable to inbound traffic, it may also be applied to outbound packets depending on the embodiment.

In this embodiment, the IPS function is performed inline for outbound packets received from the local network switch (330) in the same manner as for inbound packets, and if the packet is a safe traffic packet, the performance of the inline IPS function can be omitted and the IDS function can be operated.

The only difference between the inbound packet and the outbound packet is that the inbound packet is input from the local network switch (330) and is input from the external network interface (340) and is then transmitted to the local network switch (330) and is transmitted to the external network interface (340). Therefore, the IPS or IDS operation can be implemented in the same manner as for the inbound packet, and further detailed description of the operation of the network traffic monitoring device (210) for the outbound packet is omitted.

Figure 5 is a flowchart illustrating a network traffic monitoring method according to the present embodiment.

The network traffic monitoring method according to the present embodiment starts with receiving the first packet from the network. When the first packet is received from the network, the switching unit (410) checks the next receiving destination of the first packet based on the preset switching rules (S510).

The switching unit (410) checks whether the next receiving destination of the first packet is an IPS network function (323) (S520), and if the next receiving destination of the first packet is an IPS network function (323), it transmits the first packet to the IPS network function (323).

The first intrusion detection unit (420) within the IPS network function (323) receives the first packet from the switching unit (410) and performs the first intrusion detection on the first packet to generate the first detection result (S530).

It is checked whether the first detection result indicates an intrusion has occurred (S540), and if the first detection result indicates an intrusion has occurred, the first harmful traffic processing unit (430) discards the first packet (S542).

If the first detection result means that an intrusion has not occurred, the safe traffic processing unit (440) checks whether the first detection result means that the first packet is a safe packet, i.e., a packet of safe traffic (S550).

If the first detection result means that there is no intrusion, and if the daily occurrence amount of traffic corresponding to the source IP address of the first packet is greater than the first threshold for more than a preset number of consecutive days, the first packet is determined to be a packet of safe traffic.

If it is confirmed that the first packet is a packet of safe traffic, the safe traffic processing unit (440) generates safe traffic information including the source IP address of the first packet (S560) and transmits the first packet to the switching unit (410) so that the first packet is directed to the next receiving destination (570).

If it is determined that the first packet is not a packet of safe traffic, the safe traffic processing unit (440) transmits the first packet to the switching unit (410) so that the first packet is directed to the next receiving destination without generating safe traffic information (570).

If, in the S520 process, it is confirmed that the next destination of the first packet is the IDS network function (325), the switching unit (410) controls the first packet to be transmitted to the next destination (S570). The switching unit (410) controls the first packet to be transmitted to the next destination, copies the first packet, and transmits it to the IDS network function (325).

The second intrusion detection unit (460) within the IDS network function (325) receives a copy of the first packet from the switching unit (410) and performs a second intrusion detection on the first packet to generate a second detection result (S522).

When the second detection result is generated, it is checked whether the second result indicates an intrusion (S524), and if the second detection result indicates an intrusion, the second harmful traffic processing unit (470) controls the safe traffic entry corresponding to the source IP address of the first packet to be deleted from the safe traffic table (451) and discards the first packet (S526).

If the second detection result means that there is no intrusion, the second harmful traffic processing unit (470) terminates without taking any additional action on the first packet.

Meanwhile, the method according to the present embodiment described in FIG. 5 may be implemented as a program and recorded on a computer-readable recording medium. The computer-readable recording medium on which the program for implementing the method according to the present embodiment is recorded includes all types of recording devices that store data that can be read by a computer system. That is, the computer-readable recording medium includes storage media such as magnetic storage media (e.g., ROM, floppy disk, hard disk, etc.) and optical reading media (e.g., CD-ROM, DVD, etc.). In addition, the computer-readable recording medium may be distributed to computer systems connected to a network, so that the computer-readable code can be stored and executed in a distributed manner.

In addition, the method according to the present embodiment described in FIG. 5 may be implemented in the form of a program such as an application program installed on a mobile web or terminal.

The above description is merely an illustrative description of the technical idea of the present embodiment, and those with ordinary skill in the art to which the present embodiment pertains may make various modifications and variations without departing from the essential characteristics of the present embodiment. Therefore, the present embodiments are not intended to limit the technical idea of the present embodiment but to explain it, and the scope of the technical idea of the present embodiment is not limited by these embodiments. The protection scope of the present embodiment should be interpreted by the following claims, and all technical ideas within a scope equivalent thereto should be interpreted as being included in the scope of the rights of the present embodiment.

110: Internet 120: Router
130: Firewall 140: IPS
150: Switch 160: Client
170: IDS 201: Smartphone
202: Laptop 203: Printer
210: Network traffic monitoring device 220: Internet network
230: Central control server 310: Software switch
320: Multiple Virtual Network Functions 321: DHCP Network Functions
322: Firewall network function 323: IPS network function
324: NAT network function 325: IDS network function
326: Agent network function 330: Local network switch
340: External network interface 410: Switching section
411: Switching Rule Table 420: First Intrusion Detection Unit
430: 1st harmful traffic processing unit 440: Safe traffic processing unit
450: Table Management 451: Safety Traffic Table
460: Second intrusion detection unit 470: Second malicious traffic processing unit

Claims (5)

In network traffic monitoring devices,
A first network function that receives a first packet from a switching unit, performs a first intrusion detection on the first packet, and generates safety traffic information related to the source IP address of the first packet based on the result of the first intrusion detection; and
A switching unit that performs a first operation of receiving a second packet and transmitting the second packet to the first network function, but if the second packet has the source IP address, skips performing the first operation and performs a second operation of transmitting the second packet to a client of the local network, and copies the second packet and transmits it to the second network function during the performing of the second operation; and
A second network function that receives the second packet from the switching unit and performs a second intrusion detection on the second packet.
A network traffic monitoring device including: In the first paragraph,
The above first network function is,
A first intrusion detection unit that performs the first intrusion detection and outputs the first detection result, and controls the first packet to be output to the client if the first detection result indicates that no intrusion has occurred; and
A safety traffic processing unit that generates the safety traffic information including the first information indicating that the first packet is a safe packet and the source IP address according to the amount of traffic corresponding to the source IP address.
A network traffic monitoring device including: In the second paragraph,
Further comprising a table management unit that stores the above safety traffic information as an entry in a safety traffic table,
The above table management department,
A network traffic monitoring device characterized in that, when the maximum allowable number of safety traffic information is stored in the safety traffic table, the oldest stored safety traffic information is deleted from the safety traffic table to secure space for storing new safety traffic information. In the second paragraph,
Further comprising a table management unit that stores the above safety traffic information as an entry in a safety traffic table,
The above table management department,
A network traffic monitoring device characterized in that the number of safe traffic information that can be stored in the safe traffic table is changed based on the frequency with which safe traffic information including a new source IP address is stored in the safe traffic table. A method for monitoring network traffic by a network traffic monitoring device including a first network function, a second network function, and a switching unit,
A process in which the first network function receives a first packet from the switching unit, performs a first intrusion detection on the first packet, and generates safety traffic information related to the source IP address of the first packet according to the result of the first intrusion detection;
A process in which the switching unit performs a first operation of receiving a second packet and transmitting the second packet to the first network function, but if the second packet has the source IP address, the execution of the first operation is omitted and a second operation of transmitting the second packet to a client of the local network is performed, and the second packet is copied and transmitted to the second network function during the execution of the second operation; and
The process of the second network function receiving the second packet from the switching unit and performing a second intrusion detection on the second packet
A method for monitoring network traffic including:

Images