TWI411263B - Network monitoring method and its system - Google Patents

Abstract

The present invention discloses a network monitoring method and the system thereof. The system comprises a packet analyzing module, a real-time connection record processing module, and a record rearrangement update module. The packet analyzing module is for obtaining analyzed packet information according to a packet. The real-time connection record processing module generates a real-time connection record including an identification column according to the analyzed packet information. The record rearrangement update module is for rearranging and updating the real-time connection record whose identification column is recorded as void; and if there doesn't exist any data at least partially corresponding to a group of member relation tables, a new identification code will be generated and used to update the identification column of the real-time connection record; meanwhile, the updated real-time connection record will be added to the group of member relation tables.

Description

Network monitoring method and system thereof

The present invention relates to a network monitoring system, and more particularly to a network monitoring system for monitoring network behavior that is not limited to a specific object.

With the promotion of enterprise networking, employees can use the Internet to carry out various tasks. Therefore, how to effectively control the online access of all employees in the enterprise, so as to avoid employees browsing unnecessary pages during the service hours or using instant messaging chat to affect work efficiency. It has become a very important topic in large enterprises.

At present, many technologies for network monitoring have been seen. In addition to real-time analysis of packets, network behaviors can be recorded to facilitate managers to grasp the use of the network by internal employees. The network packet analysis technology is mainly analyzed according to the communication protocol defined in the Open System Interconnection Reference Model (OSI) proposed by the International Standards Organization. The Internet Protocol (IP) address and the Media Access Control (MAC) address of the user are obtained in the third layer of the network layer. The fourth layer of the transport layer controls the monitoring and management of network equipment and data traffic to ensure smooth communication. In the seventh layer application layer, network packets have different types according to different applications. For example, in the Simple Mail Transfer Protocol (SMTP), the packet has information such as a mail account and a mail address.

A conventional network monitoring technology, such as Taiwan Patent No. I313993 discloses a network monitoring system, which is a monitoring server between a proxy server and a plurality of client terminals each having a network address, the monitoring servo The device stores a monitoring address list having at least one monitoring address, wherein a calling terminal transmits a plurality of packet data through the network and the corresponding one of the receiving terminals through the proxy server, so that the calling terminal and the receiving end start transmitting the plurality of packet data. When the address of the calling terminal meets the monitoring address in the monitoring address list, the monitoring server immediately monitors and records.

The above-mentioned conventional network monitoring technology can only monitor certain preset specific objects (for example, the user whose network address exists in the monitoring address list), and the network address is not pre-prescribed. The user terminal located in the monitoring address list does not perform real-time monitoring.

Accordingly, it is an object of the present invention to provide a method of network monitoring.

Therefore, the network monitoring method of the present invention comprises the following steps: (a) obtaining an analyzed packet information according to at least one packet retrieved; (b) comparing the analyzed packet information with a group of personnel correspondence tables, Generating an instant connection record including an identity identification field and at least one analysis information field, wherein the group of personnel correspondence table includes at least one identity identifier for use as an index, and the analysis information field is used to record the The packet information is analyzed. If there is no data in the corresponding table corresponding to at least part of the analyzed packet information, the identity identification field is recorded as a null value; otherwise, the analyzed packet information is updated accordingly. The group correspondence table records the identity identifier corresponding to the at least part of the data in the group correspondence table in the identity identification field of the instant connection record; and (c) repeats the step (a) - (b) After a predetermined time, the instant connection record in which the identity recognition field is recorded as a null value is reorganized, wherein the step (c) includes the following sub-steps:

(c-1) comparing the instant connection record in which one of the identification fields is recorded as a null value with the correspondence table of the group of persons, if the pair is matched with the instant connection in the group correspondence table The data of the analyzed packet information recorded in the analysis information field of the line record is at least partially matched, and the corresponding personnel table is updated correspondingly to the analyzed packet information, and the at least part of the group correspondence table is matched with the at least part The identity identifier corresponding to the data updates the identity identification field of the instant connection record, otherwise, a new identity identifier is generated for the instant connection record whose identity recognition field is recorded as a null value, and the new connection record is used. The identity identifier updates the identity identification field of the instant connection record, and correspondingly adds the updated instant connection record to the group correspondence table; and

(c-2) Repeat sub-step (c-1) until all of the identity recognition fields are not null.

Another object of the present invention is to provide a network monitoring system.

Therefore, the network monitoring system of the present invention comprises a packet analysis module, an instant connection recording processing module, and a record reorganization update module.

The packet analysis module is configured to receive at least one packet, and obtain an analyzed packet information according to the packet.

The instant connection record processing module is configured to compare the analyzed packet information with a set of personnel correspondence tables to generate an instant connection record including an identity identification field and at least one analysis information field, wherein The group correspondence table includes at least one identity identifier used as an index, and the analysis information field is used to record the analyzed packet information, and if the group correspondence table does not exist, at least one of the analyzed packet information is not present. If the data is partially consistent, the identity identification field is recorded as a null value; otherwise, the group correspondence table is updated correspondingly to the analyzed packet information, and the data corresponding to the at least part of the group correspondence table is corresponding. The identity identifier is recorded in the identity identification field of the instant connection record.

The record reorganization update module is configured to reorganize the instant connection record in which the identity recognition field is recorded as a null value after every predetermined time, wherein the identity recognition field is recorded as a null value Each of the instant connection records, the record reorganization update module compares the instant connection record with the group correspondence table, and compares any of the instant connection records in the group correspondence table The information of the analyzed packet information recorded in the analysis information field is at least partially matched, and the corresponding personnel correspondence table is updated correspondingly to the analyzed packet information, and corresponding to the at least part of the data in the group correspondence table The identity identification code updates the identity identification field of the instant connection record, otherwise, generates a new identity identification code for the instant connection record whose identity recognition field is recorded as a null value, and uses the new identity The identification code updates the identity identification field of the instant connection record, and correspondingly adds the updated instant connection record to the group correspondence table.

The present invention can also monitor the network behavior of any person who does not exist in the group correspondence table by using the instant connection record processing module and the record reorganization update module, so that the present invention can be achieved. The purpose.

The above and other technical contents, features and advantages of the present invention will be apparent from the following detailed description of the preferred embodiments.

Referring to FIG. 1, the network monitoring system 1 of the present invention is applied to a network system architecture including a plurality of network nodes 5; the network monitoring system 1 can be implemented by a combination of software, firmware, hardware, or the like. It is integrated into an electronic device 2. In the preferred embodiment, the network system architecture is an enterprise internal network, and the implementation of the electronic device 2 is a network behavior analysis between the internal network of the enterprise and the external Internet. A control server that collects packets from the network and analyzes them to further control network behavior.

Referring to FIG. 2, the network monitoring system 1 includes a packet analysis module 11, an instant connection record processing module 12, a record reorganization update module 13 and a database 14.

The packet analysis module 11 is configured to receive a packet on the network, and obtain an analyzed packet information according to the packet.

The instant connection record processing module 12 is configured to compare the analyzed packet information with a group of personnel correspondence tables existing in the database 14 to generate an identity identification field and at least one analysis information field. An instant connection record. The group correspondence table includes at least one identity identifier for use as an index, and the analysis information field is used to record the analyzed packet information. If there is no data in the group corresponding to the analyzed packet information, the instant connection record processing module 12 records the identity identification field as a null value. If any data corresponding to the analyzed packet information exists in the group correspondence table, the corresponding identity identification code is filled in the identity identification field. The instant connection record processing module 12 stores the instant connection record in the database 14 to facilitate network administrators to query and monitor network behavior.

The record reorganization update module 13 is connected to the database 14. After a predetermined time, the record reorganization update module 13 collects the identity identification field recorded by the instant connection record processing module 12 as a null value. Waiting for the instant connection record, and sequentially comparing the instant connection record in which one of the identification fields is recorded as a null value with the corresponding table of the group of personnel, if the comparison is in the correspondence table of the group And the data corresponding to the analyzed packet information recorded in the analysis information field of the instant connection record is at least partially matched, and the group correspondence table is updated corresponding to the analyzed packet information, and the correspondence table of the group is The identity identification code corresponding to the at least partially matching data updates the identity identification field of the instant connection record; otherwise, a new identity identification code is generated for the instant connection record whose identity recognition field is recorded as a null value. And updating the identity identification field of the instant connection record with the new identity identifier, and correspondingly adding the updated instant connection record to the group correspondence table until all the instants are The Identity field of linear recording neither null value.

Referring to FIG. 2 and FIG. 3, corresponding to the preferred embodiment of the network monitoring system 1, the following is a network monitoring method to detail the operation between modules. The network monitoring method includes the following steps.

In step S31, the packet analysis module 11 captures at least one packet on the network and analyzes the packet to obtain an analyzed packet information. In the preferred embodiment, the analyzed packet information includes at least one of an authentication account number, an internet protocol address, a media access control address, and a communication protocol information. It is worth mentioning that the analyzed packet information can have different forms according to different web applications.

For example, if the authentication account is Jason's employee authenticated and browsed the webpage, the analyzed packet information is as shown in Table 1. The protocol information includes a web address; and, if an employee is logged in, an instant message For software, the information of the analyzed packet is as shown in Table 2. The information of the protocol includes an instant messaging type and an instant messaging account. In addition, if an employee sends a mail, the analyzed packet information is as shown in Table 3. The newsletter information includes a mail account.

In step S32, the instant connection record processing module 12 compares the analyzed package information with the group of personnel correspondence tables stored in the database 14. The group correspondence table includes a person basic data correspondence table, an instant pass account correspondence table, and a mail account correspondence table using the identity identification code as an index. In the preferred embodiment, the comparison process performed by the instant connection recording processing module 12 is performed according to the authentication account, the email account, the instant messaging account, the internet protocol address, and the media storage. The order of taking the control address is compared with the corresponding table of the group of personnel. When any of the above comparisons is successful (that is, the data in the group corresponding to the at least part of the analyzed packet information is present), the continuation is continued. Step S33 is performed, otherwise step S34 is performed.

Continuing the above example, it is assumed that the current personnel correspondence table in the database 14 is as shown in Tables 4-6. For the analyzed packet information of Table 1, the authentication account can obtain the corresponding identity ID 201007271010000 in the corresponding basic data correspondence table of Table 4; similarly, for the analyzed packet information of Table 2, The instant messenger account can be compared to the corresponding identity code 2010072710100002 in the instant pass account correspondence table in Table 5; and for the analyzed packet information in Table 3, the mail account cannot be in the table 6 The mail account correspondence table is compared to any matching data.

In step S33, the instant connection record processing module 12 generates an instant connection record including an identity identification field and at least one analysis information field according to the comparison result of the step S32, and uses the analyzed packet. The information correspondingly updates the group correspondence table of the database 14; wherein the identity identification field is used to record the identity identifier of the analyzed packet information and the pair of personnel correspondence tables, and the analysis is performed. The information field is used to record the analyzed packet information.

Continuing the above example, the analyzed packet information in Table 1 corresponds to one of the instant connection records of the webpage as shown in Table 7. The analyzed packet information in Table 2 corresponds to one instant communication as shown in Table 8. Instant connection record.

In step S34, the instant connection record processing module 12 generates an instant connection record including an identity identification field and at least one analysis information field according to the comparison result of the step S32, wherein the identity identification column The bit is recorded as a null value, and the analysis information field records the analyzed packet information.

Continuing the above example, the analyzed packet information of Table 3 is correspondingly generated as shown in Table IX. The identity identification field is recorded as one of the null instant mail connection records.

It is worth mentioning that the instant connection record processing module 12 generates different types of instant connection records corresponding to the communication protocol information in the analyzed package information (see Tables 7 and 8). The table 9 is stored in the database 14 for the network administrator to query.

In step S35, the record reorganization update module 13 determines whether a predetermined time has elapsed. If the predetermined time has elapsed, the process proceeds to step S36. Otherwise, the process returns to step S31 to continue to listen to the packet on the network. In the preferred embodiment, the predetermined time is set to one hour.

In step S36, the record reorganization update module 13 is retrieved from the database 14 for the predetermined time, and the identity recognition fields are respectively recorded as null-valued instant connection records, and according to at least one associated key. Values, grouping these instant connection records. For example, in the instant connection records, the instant connection records having the same Internet Protocol address are regarded as the same group, so that the network administrator can monitor the specific group.

In step S37, the record reorganization update module 13 records the instant connection records after the grouping and the identity recognition fields are respectively recorded as null values, and sequentially and the group of personnel according to a comparison key value. The correspondence table is compared. The comparison key value can be customized by the administrator. In the preferred embodiment, the comparison key value can be the authentication account number, the internet protocol address, or the media access control address. One. If the comparison is successful, step S38 is performed; otherwise, step S39 is performed.

Continuing the above example, the record reorganization update module 13 takes out the instant connection record of the email whose identification field is recorded as a null value as shown in Table IX, and according to the authentication account number and the internet protocol bit. Any one of the address or the media access control address is compared with the group of personnel correspondence table. Since there is no corresponding data, step S39 is followed.

In step S38, the record reorganization update module 13 updates the identity identification code obtained according to the comparison key value to the instant connection record in which the identity identification field is recorded as a null value, that is, And updating the identity identification field of the instant connection record with the corresponding identity identifier; and updating the group correspondence table of the database 14 corresponding to the analyzed packet information recorded by the instant connection.

In step S39, the record reorganization update module 13 generates a new identity identification code, and updates the identity identification field of the instant connection record with the new identity identification code, and correspondingly adds the updated instant connection. The line is recorded to the group of personnel correspondence tables of the database 14.

Continuing the above example, for the instant connection record of the mail shown in Table 9, after generating a new identity code 2010072710100003, the new identity code is updated to the instant connection record of the mail and the table 6 In the mail account correspondence table, the updated instant connection record of the mail and the correspondence table of the mail account are respectively shown in the following tenth to eleventh.

In step S40, the record reorganization update module 13 determines whether there is still the instant connection record in which the identity recognition field is recorded as a null value, and if so, returns to step S37, otherwise, returns to step S31.

With the instant connection record processing module 12 and the record reorganization update module 13 of the present invention, the network behavior of "anyone" that does not exist in the group correspondence table is monitored. Each instant connection record has an corresponding identity identifier after being updated, and the network administrator can use the identity identifier as an index to perform related monitoring, control, and maintenance, thereby making the network management more It is humanized, so it can achieve the purpose of the present invention.

The above is only the preferred embodiment of the present invention, and the scope of the invention is not limited thereto, that is, the simple equivalent changes and modifications made by the scope of the invention and the description of the invention are All remain within the scope of the invention patent.

1. . . Network monitoring system

11. . . Packet analysis module

12. . . Instant connection recording processing module

13. . . Record reorganization update module

14. . . database

2. . . Electronic device

S31~S40. . . step

5. . . Network node

1 is a network system architecture diagram illustrating a preferred embodiment of the network monitoring system of the present invention and a network system architecture diagram of one of the network monitoring systems;

Figure 2 is a block diagram showing the preferred embodiment of the network monitoring system of the present invention; and

Figure 3 is a flow chart illustrating a network monitoring method in accordance with a preferred embodiment.

1. . . Network monitoring system

11. . . Packet analysis module

12. . . Instant connection recording processing module

13. . . Record reorganization update module

14. . . database

Claims (10)

A network monitoring method is implemented in an electronic device, the method comprising the steps of: (a) obtaining an analyzed packet information according to at least one packet retrieved; and (b) correspondingly analyzing the analyzed packet information with a group of personnel The table is compared to generate an instant connection record including an identity identification field and at least one analysis information field, wherein the group personnel correspondence table includes at least one identity identifier for use as an index, and the analysis information column The bit is used to record the analyzed packet information, and if there is no data in the group corresponding to the at least part of the analyzed packet information, the identity identification field is recorded as a null value; otherwise, the The analyzing the packet information corresponds to updating the group correspondence table, and recording the identity identifier corresponding to the at least part of the data in the group correspondence table in the identity identification field of the instant connection record; and (c) After repeating steps (a)-(b) to a predetermined time, the instant connection record whose identity recognition field is recorded as a null value is reorganized and updated, wherein the step (c) includes Sub-step: (c-1) comparing the instant connection record in which one of the identification fields is recorded as a null value with the corresponding person's correspondence table, if any one of the group correspondence table is compared with the If the analyzed packet information recorded in the analysis information field of the instant connection record is at least partially matched, the group correspondence table is updated correspondingly to the analyzed packet information, and the at least part of the group correspondence table is The identity identification code corresponding to the matching data updates the identity identification field of the instant connection record, otherwise, a new identity identification code is generated for the instant connection record whose identity recognition field is recorded as a null value, and The new identity identifier updates the identity identification field of the instant connection record, and correspondingly adds the updated instant connection record to the group correspondence table; and (c-2) repeats the execution sub-step (c- 1) Until all of the identity recognition fields are not null. According to the network monitoring method of claim 1, wherein the analyzed packet information of the step (a) includes an authentication account, an internet protocol address, a media access control address, and At least one of the information of the communication agreement. According to the network monitoring method of claim 1, wherein the group correspondence table of the step (b) includes a person basic data correspondence table using the identity identification code as an index, and an instant account account correspondence table. And a mail account correspondence table. According to the network monitoring method of claim 1, wherein in the step (b), the comparison process is based on one of the analyzed packet information, an email account, and an instant account. The order of an internet protocol address and a media access control address are compared. According to the network monitoring method described in claim 1, the sub-step (c-3) before the sub-step (c-1) is further included, and the identity identification field is respectively determined according to at least one associated key value. The instant connection records recorded as null values are grouped to group the instant connection records having the same associated key value into the same group. A network monitoring system includes: a packet analysis module for receiving at least one packet, and obtaining an analyzed packet information according to the packet; and an instant connection recording processing module for using the analyzed packet information Comparing a set of personnel correspondence tables to generate an instant connection record including an identity identification field and at least one analysis information field, wherein the group personnel correspondence table includes at least one identity identifier for use as an index, The analysis information field is used to record the analyzed packet information. If there is no data in the group corresponding to the at least part of the analyzed packet information, the identity identification field is recorded as a null value, otherwise And updating the group correspondence table corresponding to the analyzed packet information, and recording the identity identification code corresponding to the at least part of the data in the group correspondence table in the identity identification field of the instant connection record; And a record reorganization update module for reorganizing the instant connection record in which the identity recognition field is recorded as a null value after every predetermined time Wherein, for each instant connection record whose identity recognition field is recorded as a null value, the record reorganization update module compares the instant connection record with the group of personnel correspondence table, if the group of personnel And comparing, in the correspondence table, any data that is at least partially consistent with the analyzed packet information recorded in the analysis information field of the instant connection record, updating the group correspondence table corresponding to the analyzed package information, and The identity identification code corresponding to the at least partially matching data in the group correspondence table updates the identity identification field of the instant connection record; otherwise, a new identity identification code is generated to record the identity identification field is blank. The instant connection record of the value, and updating the identity identification field of the instant connection record with the new identity identifier, and correspondingly adding the updated instant connection record to the group correspondence table. The network monitoring system according to claim 6, wherein the analyzed packet information includes an authentication account number, an internet protocol address, a media access control address, and a communication protocol information. At least one. According to the network monitoring system of claim 6, wherein the group correspondence table includes a person basic data correspondence table, an instant account number correspondence table, and a mail account correspondence table using the identity identification code as an index. . According to the network monitoring system of claim 6, wherein the order of the instant connection recording processing module is an authentication account, a mail account, and an instant account according to the analyzed packet information. The order of an internet protocol address and a media access control address are compared. The network monitoring system of claim 6, wherein the record reorganization update module further performs the instant connection record whose identity recognition field is recorded as a null value according to at least one associated key value. Grouping to group the instant connection records having the same associated key value into the same group.