Patent Application
20070204060
The present application claims priorities from Japanese applications JP2005-147948 filed on May 20, 2005, JP2006-077978 filed on Mar. 22, 2006, the contents of which are hereby incorporated by reference into this application.
1. Field of the Invention
The present invention generally relates to a network control apparatus and a network control method. More specifically, the present invention is directed to a network control apparatus and a network control method, capable of sensing abnormal traffics.
2. Description of the Related Art
Various sorts of services involving telephone and broadcasting services are started to be provided via IP networks, and thus, quality supervising techniques for traffics flowing through IP networks have been rapidly progressed. Sensing techniques and monitoring techniques of traffics have been standardized even in standardization organizations such as IFTF. Also, communication quality control functions using traffic analyzing techniques have been marketed as products.
A first description is made of a traffic monitoring method which is called as “sFlow” and whose standardization has been progressed by IFTF, and the like. This traffic monitoring method is described in “A Method for Monitoring Traffic in Switched and Routed Networks” written by P. Phaal, S. Panchen, and N. McKee, [online], September in 2001, IFTF, [retrieved on Apr. 19, 2005],
<URL:http://www.ietf.org/rfc/rfc3176.txt> (will be referred to as “non-patent publication 1” hereinafter). In sFlow, a router (or switch) executes a sampling process operation of packets (traffics) under transfer and cuts out the sampled packet so as to form a corresponding sFlow packet. The sFlow packet outputted from the router is sent to a traffic analyzing apparatus called as either a “collector” or an “analyzer”, and the traffic analyzing apparatus stores thereinto these sFlow packets, statistically analyzes these sFlow packets, and displays a result of the statistical analysis to a manager. A major subject of this sFlow technique is a packet measuring technique, and information elements of the sFlow packets which are transmitted by the router to the traffic analyzing apparatus have been mainly described in this sFlow technique. While analyzing functions are entrusted to traffic analyzing apparatus actually provided in respective vendors (there are products capable of mainly displaying analyzing functions), the analyzing functions are not equipped within the router apparatus in the sFlow technique.
Next, a description is made of a traffic monitoring method called as “CLEAR-Flow” as an example of a product in which a traffic analyzing technique is equipped in a router (or switch). This traffic monitoring method is described in “WHITE PAPER CLEAR-Flow”, [online], retrieved on Feb. 19, 2006, <URL: http://www.extremenetworkds.co.jp/download/Whitepaper/C LEAR-Flow_Wp.pdf> (will be referred to as “non-patent publication 2” hereinafter). An operation flow of “CLEAR-Flow” is constituted by three stages, namely, “observation”, “analysis”, and “response.” The traffic analyzing technique corresponds to the “observation” stage executed in the router. In the “observation” stage, such a packet which is made coincident with an observation basis is focused; when the packet coincident with the observation basis is found out (step 1-filter), a condition of an occurrence is traced by employing an event counter (step 2-count); and when the occurring condition exceeds a present threshold value, a set action is executed (step 3-threshold value). As a result of the “observation” stage, when the relevant traffic is detected, the operation flow is advanced to the “analysis” stage. In this “analysis” stage, such an operation required in the case that a more precise analysis is required is carried, and the router transmits relevant traffic packet data to an external apparatus equipped with a higher analyzing function. As methods for transferring this traffic packet data, there are three transferring methods, namely, a mirror method, a tunnel method, and an sFlow method. The external apparatus performs a higher traffic analysis by employing the above-explained various information. In the traffic monitoring method of CLEAR-Flow, the operator is required to previously designate the observation basis with respect to the observation subject to the CLEAR-Flow classifier assembled in the switch. For example, as described in the non-patent publication 2, a setting operation is carried out which counts a total number of SYN packets which are transmitted to a specific port. Upon receipt of this setting operation, the router switch executes “observation”, and as a result of the detection, traffic data which is transmitted to the external apparatus becomes such a traffic data which is made coincident with a preset detecting condition. It should be noted that although not yet been publicly opened, one Japanese patent application has been filed under number of JP-A-2005-109744 as the patent application related to the present invention.
In the sFlow technique described in the non-patent publication 1, the router executes the sampling process operation of the traffics (packets) under transfer operation, and cuts out the sampled packet so as to form the traffic data packet. The traffic data packet outputted from the router corresponds to the cut out information as to the sampled respective packets. Inside the router apparatus, the storing operation of the information is not carried out, but also, the statistical analyzing process operation directed to the information contained in the header of the packet is not carried out. As a consequence, in such a case that a phenomenon of such a featured traffic as worms and DDOS (Distributed Denial Of Service) hidden in a traffic having a large capacity is sensed, traffic data packets outputted from the router become a large capacity in direct proportional thereto. Accordingly, there is such a problem that the sFlow packet producing load given to the router is increased, the load of transferring the sFlow packets to the traffic analyzing apparatus is increased, and further, the load given to the band of the network is increased.
In the CLEAR-Flow technical idea described in the above-explained non-patent publication 2, while the “observation” processing function is provided in the router, the router executes the focusing process operation of the subject traffic. The operator previously must designate the traffic subject to be detected with respect to the CLEAR-Flow classifier, and the router detects such a traffic which becomes conspicuous as the relevant traffic from the traffics which are made coincident with the set classifier condition (step 1-filter). The router is not equipped with a function capable of extracting a featured traffic from the entire traffics, but also not equipped with another function capable of summing up very small traffics so as to float up the featured track, which are executed by a traffic statistical analysis processing unit of the present invention, which is described in detail later.
Also, the router transfers the traffic only when the relevant traffic is detected (“analysis” stage), and need not continuously transfer the traffics to the traffic analyzing apparatus. As a result, the load of producing the relevant traffic information which should be transferred can be decreased, the load of transferring the relevant traffic information to the traffic analyzing apparatus can be decreased, and furthermore, the load given to the band of the network can be reduced. However, since the relevant traffic information to be transferred corresponds to copies of the respective packets, there is another problem that the transfer amount when the relevant traffic information is transferred is still large. In the CLEAR-Flow technical idea, a function for summing up to featured information is equipped in the traffic analyzing apparatus.
The present invention has been made to solve the problems described in the above-explained non-patent publications 1 and 2, and therefore, has an object to provide such a network control apparatus that the network control apparatus (either router or switch) analyzes a traffic, sums up the analyzed traffics to featured information, and thus, a transfer load/cost can be reduced.
To achieve the above-explained object, in the network control apparatus (either router or switch) of the present invention, a traffic statistical analysis processing unit is provided, and a featured traffic is monitored by this traffic statistical analysis processing unit. The traffic statistical analysis processing unit employs the following structure. That is, when the traffic statistical analysis processing unit detects the featured traffic, this traffic statistical analysis processing unit assembles information as to a feature element and a flow amount (time interval, and amount of traffics transferred within this time interval) into a packet, and then, transfers this summed-up information to a traffic analyzing apparatus. Also, the network control apparatus employs the following structure. That is, setting of an analyzing range (which information element of packet is to be analyzed) where the traffic statistical analyzing process operation of the network control apparatus is carried out may be changed from an upper grade apparatus (traffic analyzing apparatus etc.) based upon a parameter contained in control information.
Referring now to drawings, various embodiment modes of the present invention will be described by employing embodiments.
A first embodiment of the present invention will now be explained with reference to
In
In this monitoring system 100, the above-explained flow statistical information contains abnormal information detected by the network control apparatus 10. Also, the above-explained control information contains a reset of a counter and a change of a threshold value level (increasing instruction of threshold value), which are judged by the traffic analyzing apparatus 20 based upon the abnormal information. Conversely when abnormal traffics are small, a decreasing instruction of the threshold value is contained in the control information. Since the monitoring system 100 is arranged in the above-explained manner, an abnormal traffic is analyzed/sensed by the network control apparatus 10, so that the threshold value level can be changed in response to a condition of an abnormal traffic. As a result, the threshold value level can become a sensitivity in response to the condition of the abnormal traffic. It should be understood that an arrow indicating flow statistical information, and an arrow indicating control information between the traffic analyzing apparatus 20 and the network control apparatus 10-K have been omitted, for the sake of a simple illustration.
The network control apparatus 10 shown in
A normal packet is transferred to a transfer destination by the packet transfer processing unit 11. Also, as to the normal packet, a copy thereof is transferred from the packet transfer processing unit 11 to the sampling statistical processing unit 121. The sampling statistical processing unit 121 samples packets to be sampled at a predetermined ratio so as to cut out N bytes which contain headers of the packets to be sampled. The sampling statistical processing unit 121 produces such a packet (sFlow packet) which has been stored in a payload by superimposing portions of the cut packets with each other, and then, transfers the formed packet as a statistical information packet via the packet transfer processing unit 11 to the traffic analyzing apparatus 20.
Also, the sample statistical processing unit 121 transfers the packet to be sampled to the traffic statistical analysis processing unit 13. The traffic statistical analysis processing unit 13 previously receives a control information packet sent from the traffic analyzing apparatus 20 via the packet transfer processing unit 11, and a threshold value has been set. The traffic statistical analysis processing unit 13 senses a traffic abnormal condition by using this threshold value. The traffic statistical analysis processing unit 13 which has sensed the traffic abnormal condition transfers abnormal condition sensing information to the traffic abnormal condition sensing information packet producing unit 122. The traffic abnormal condition sensing information packet producing unit 122 produces an abnormal condition sensing information packet based upon the abnormal condition sensing information, and then, transfers this produced abnormal condition sensing information packet to the sampling statistical processing unit 121. The sampling statistical processing unit 121 which has received the abnormal condition sensing information packet adds abnormal flow sensing information to an sFlow packet so as to form a statistical information packet, and then, transfers the statistical information packet via the packet transfer processing unit 11 to the traffic analyzing apparatus 20.
Since the threshold value of the network control apparatus 10 according to this first embodiment can be externally varied, this network control apparatus 10 can be arranged as a network control apparatus capable of sensing a traffic abnormal condition, while a control parameter is variable.
The traffic analyzing apparatus 20 shown in
The packet count table 200 indicated in
In the item number-2 table 202, packet numbers are counted under AND condition between the sorts/numbers of the item 1 and the sorts/numbers of the item 2. In the item number-3 table 203 and the item number-4 table 204, packet numbers are counted under AND condition of either the item number 3 or the item number 4. The packet numbers of the packet count table 200 are reset in a predetermined interval. Also, the resetting operation may be carried out based upon the control information transmitted by the traffic analyzing apparatus 20.
Item columns of the packet count table are selected from information of packets. As an example of the packet information, there are such information contained in various headers (IP header, TCP header, UDP header, MPLS header, MAC header etc.), hash values of payload data, and the like. In view of this implication, in the packet count table 200, a total arrival number of these packets is counted based upon the header information.
A packet count table 1500 of
In this first embodiment, items for discriminating traffics from each other are made of 4 sorts, namely, a transmission source IP address (src ip), a destination IP address (dst ip), a transmission source port number (src port), and a destination port number (dst port). A combination of arbitrary “n” items (1≦n≦4) selected from the above-explained 4 sorts of items is produced. The above-explained item sorts are indicated in an item field 1501.
It should also be noted that although a total number of the items to be processed is selected to be 4 sorts in this embodiment, another item may be furthermore added, or may be deleted in response to a characteristic of a traffic which is wanted to be sensed. For instance, in order to extract such a traffic related to an establishing process and a cutting process of a TCP cession, flag information contained in a TCP header may be alternatively involved in these items to be processed. Alternatively, in order to more correctly grasp a characteristic of a traffic, several bytes of a head portion as to application data which succeeds either a TCP header or a UDP header may be involved in the items to be processed. Otherwise, in the case that an MPLS label is attached, an analysis of a traffic for every LSP may be alternatively carried out by also involving the value of the above-explained MPLS label. Also, when a tunneling protocol such as L2TP is used, an analysis of a traffic which passes through each of the tunnels may be alternatively carried out by involving a tunnel identifier.
A value field 1503 of the packet count table 1500 stores thereinto a value of such an item if this item constitutes the above-described combined structural element, and if an item does not constitute above-explained combined structural element, then a total number of sorts as to values of the above-described items appeared in a count of a packet having the above-described combined structural element is stored in this value field 1503. Information for indicating as to whether a numeral value stored in the value field 1503 corresponds to the value, or the total number of appearing sort is stored in an attribute field 1502.
For instance, an entry of an entry number 4 in
Furthermore, the respective entries of the packet count table 1500 own a packet number field 1504, an accumulated octet number field 1505, and a count starting time instant field 1506. The packet number field 1504 is used to count a packet number for each entry. The accumulated octet number field 1505 is used to accumulate a length of a packet to be counted in the above entry. The count starting time instant field 1506 holds a time instant when a counting operation of a packet number is started in the above entry.
The packet count table 1500 owns a different point from the above-explained packet count table 200. That is, when a packet number for paying an attention to a combination of certain items is counted, at the same time, such a counting operation is carried out for counting how many different values appear as to an item which is not involved in the combination of the items.
The threshold value table indicated in
The abnormal condition sensing information table 80 indicated in
A packet (
A structural example of the abnormal flow sensing information 45 will now be explained with reference to
The abnormal flow sensing information 45 is constituted by a flow sort 1201, a sampling rate 1202, a threshold value 1203, an accumulated octet number 1204, an accumulation time 1205, an item number 1206, and a plurality of items 1207. The flow sort 1201 indicates a sort of a sensed flow. Sort information, for example, DDoS and a worm is entered as a value of the flow sort 1201. The sampling rate 1202 shows a packet sampling rate when a flow is sensed, and a sampling rate held by the sampling statistical processing unit 121 is stored in the sampling rate 1202. The threshold value 1203 represents such a threshold value of a packet count number which triggers a notification of this message, while any one of the threshold values 33 of the threshold value table 30 is stored in this threshold value 1203. The accumulated octet number 1204 indicates a total octet number of packet lengths which have been received until the packet count value exceeds the threshold value, while a value of the accumulated octet number field 1505 of the entry of the packet count table 1500 where the packet number field 1504 exceeds the threshold value is stored in this accumulated octet number 1204.
The entry accumulated time 1205 indicates a time defined after a counting operation for a packet count number of a flow notified by this message is commenced until the counted packet number exceeds the threshold value. A difference between the present time instant and the value of the count starting time instant 1506 of the entry of the packet count table 1500 in which the packet number field 1504 exceeds the threshold value is stored in this entry accumulated time 1205. The item number 1206 shows a total number of items 1207 which are contained in this message. In an example of the packet count table 1500, since one entry is constructed of 4 pieces of items, the value of the item number 1206 becomes 4. The item 1207 represents contents of the respective items which are contained in the entry of the packet count table 1500 in which the packet number 1504 exceeds the threshold value.
The item 1207 owns such a structure as shown in
When the network control apparatus 10 detects an abnormal flow, since the network control apparatus 10 transmits the packet containing the above-explained information to the traffic analyzing apparatus 20, the traffic analyzing apparatus 20 can grasp the sort, the scale, and the duration time of the abnormal flow based upon the above-described information with a short time under low processing load.
Next, a description is made of operations as to the traffic statistical analysis processing unit 13 of the network control apparatus 10 with reference to
Referring now to a flow chart of
Firstly, a judgement is made as to whether or not there is a combination between a sort and a value of an item which exceeds the threshold value in the item number-2 table 202 (step S1001). In the case that there is such a combination other than a combination between “scr jp” and “dst port”, and another combination between “dst ip” and “dst port”, the detecting flow operation is ended.
When the combination between the sort and the value of the item which exceeds the threshold value in the item nubmer-2 table 202 corresponds to “scr ip” and “dst port”, the item number-3 table 203 is retrieved (step S1002). In the item number-3 table 203, a confirmation is made as to whether or not an entry indicative of a communication with respect to a specific host is present, while both “scr ip” and “dst port” are identical to those of this entry (step S1003). In this case, as the item indicative of the communication with respect to the specific host, “dst ip” is employed. When the confirmation result becomes “YES”, it is so judged that the traffic is not the worm, the detecting flow operation is ended. On the other hand, when the confirmation result becomes “NO”, it is so judged that the traffic is the worm (step S1004).
On the other hand, when the combination between the sort and the value of the item which exceeds the threshold value in the item number-2 table 202 corresponds to “dst ip” and “dst port”, the item number-3 table 203 is retrieved (step S1005). In the item number-3 table 203, a confirmation is made as to whether or not an entry indicative of a communication with respect to a specific host is present, while both “scr ip” and “dst port” are identical to those of this entry (step S1006). In this case, as the third item indicative of the communication with respect to the specific host, “scr ip” is employed. When the confirmation result becomes “YES”, it is so judged that the traffic corresponds to a P2P communication between two specific terminals, and is not DDOS, the detecting flow operation is ended. On the other hand, when the confirmation result becomes “NO”, it is so judged that the traffic corresponds to DDoS equal to a communication from a plurality of transmission sources to a specific destination (step S1007).
Returning back to
At the same time, the network control apparatus 10 sets a filter (not shown) to the output unit of the packet transfer processing unit 11 so as to stop transferring operation of an abnormal packet.
In
A control information packet 50 which is indicated in
It should also be understood that although the packet has been exemplified as sFlow in the above-described first embodiment, either NetFlow or mirrored packet may be alternatively employed, and also, the present invention is not limited only thereto. Alternatively, information for changing the combination setting information of the items whose packets should be counted in the packet count table may be involved in the control information 54, or such an information for changing the flow sorts and the sensing levels of the threshold value table may be involved in the control information 54. Furthermore, the threshold values of the sensing levels 1 and 2 of the flow X are not changed, but a sensing level 3 (threshold value being 3000) may be newly provided.
Also, an issuing destination of notifying an abnormal condition when a traffic abnormal condition happens to occur is not limited only to a traffic analyzing apparatus, but may be alternatively directed to an upper grade of a network monitoring apparatus.
In accordance with this first embodiment, the analysis of the abnormal traffic and the analysis of the overloaded traffic can be carried out by the network control apparatus (routers, or switches) which are arranged in the distribution manner. As a result, the analyzing load given to the traffic analyzing apparatus (collector, or analyzer) can be reduced. Also, since the analysis information of the abnormal traffic is added to the conventional sFlow statistical information, the function can be expanded while utilizing the function of the conventional Flow statistical calculation sever. Furthermore, in accordance with this first embodiment, since the setting conditions as to the packet counter table and the threshold value table are changed in response to attacking patterns, even such a network attack which will newly occur in future may be avoided.
In this first embodiment, when an algorithm whose process load is low is applied to the traffic statistical analysis processing unit 13, and this traffic statistical analysis processing unit 13 is built in the network control apparatus 10, and then, the network control apparatus. 10 executes the traffic analyzing operation and the information collecting operation, the workload of the network control apparatus 10 for transferring the packets to the traffic analyzing apparatus 20 can be reduced. Furthermore, the load to the network band can be reduced.
In addition, the executions of traffic analyzing operations can be distributed to the respective network control apparatus 10. As a result, the processing load and the cost of the traffic analyzing apparatus 20 can be reduced.
A second embodiment of the present invention will now be explained with reference to
The packet of the flow statistical information which has sensed the abnormal flow, indicated in
In this second embodiment, only the abnormal flow sensing information 64 is transferred to the traffic analyzing apparatus 20. As a consequence, the sampling statistical process operation of the sampling statistical processing unit 121 can be simplified.
Also, an issuing destination of notifying an abnormal condition when a traffic abnormal condition happens to occur is not limited only to a traffic analyzing apparatus, but may be alternatively directed to an upper grade of a network monitoring apparatus. Similar to the normal packet, the abnormal packet may be notified via a network to a PC of a network manager.
Referring now to
The abnormal traffic sensing information has been added to a verification packet in addition to original verification information as shown in
In accordance with this third embodiment, since the abnormal traffic is analyzed/sensed by the network control apparatus 1302, a work load given to the traffic analyzing apparatus 20 can be reduced, a work load of transferring packets to the traffic analyzing apparatus 20 can be reduced, and further, a load given to the network band can be lowered.
Also, in accordance with this third embodiment, in the system for verifying the PCs via the network control apparatus 1302, since the abnormal traffic sensing information in the unit of PC is notified from the network control apparatus 1302 to the verification server 1301 when the verifying/re-verifying operations are carried out, the dynamic traffic information is added in addition to the static verification information (password, digital signature information, and the like). As a result, the traffic control operation of the relevant PC can be carried out in addition to the verification function.
It should be further understood by those skilled in the art that although the foregoing description has been made on embodiments of the invention, the invention is not limited thereto and various changes and modifications may be made without departing from the spirit of the invention and the scope of the appended claims.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2005-147948 | May 2005 | JP | national |
| 2006-077978 | Mar 2006 | JP | national |
