WO2015046697A1

WO2015046697A1 - Apparatus for detecting abnormal increase of control packets, method therefor, and recording medium

Info

Publication number: WO2015046697A1
Application number: PCT/KR2014/003397
Authority: WO
Inventors: 차양명
Original assignee: 주식회사 아이디어웨어
Priority date: 2013-09-24
Filing date: 2014-04-18
Publication date: 2015-04-02

Abstract

The present invention relates to an apparatus for detecting an abnormal increase in control packets. The apparatus according to the present invention comprises: a collecting unit for collecting or capturing a plurality of packets mutually transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network; a measuring unit for classifying the packets collected or captured by the collecting unit according to each server identification information, and measuring the amount of control packets generated for each identification information with respect to each flag during the latest n-unit time; a recording unit for recording the number of control packets for each flag, generated during the last predetermined time on the basis of a current time, according to the unit time and calculating an average or maximum amount of the generated control packets by using information on the number of flags recorded during the predetermined time; and a determination unit for detecting an abnormal increase in the control packets by using the amount of generated control flags per unit time measured by the measuring unit, and an average value or a maximum value of an input amount of the control packets per unit time for each flag calculated by the recording unit.

Description

Control packet abnormality increase detection device, method and recording medium

The present invention is to detect an abnormal increase phenomenon of the control packet which is the main cause of the wireless network load.

Since the spread of smartphones, personal terminal usage patterns have been rapidly shifting from voice calls to data communication.

As shown in the mobile (wireless) data traffic indicator of FIG. 1, mobile traffic is expected to increase by about 26 times over the next 10 to 15 years, and the amount of mobile data used by individuals in 2010 was 15MB, but in 2020 It can reach 1GB.

This increase in mobile traffic directly affects the profitability and service quality of mobile carriers, and involves the expansion of equipment of mobile carriers as service providers. As a result, profit deterioration is inevitable. In addition, service dissatisfaction is increased due to data communication speed delay.

As a result, mobile operators face the challenge of efficiently utilizing network infrastructure to reduce investment and ensure quality of service, and current solutions have limitations, requiring alternatives that guarantee predictability and real-time control.

On the other hand, as shown in Figure 2, the main factor of mobile network congestion is the generation of traffic channels with the server on the communication network through various applications installed in the wireless terminal device.

That is, in order to create a traffic channel with a server on a communication network in a wireless terminal device, dozens of signal communication must be preceded by devices on the communication network such as base station positioning, and such signal communication is performed on a communication network rather than a large packet transmission. Cause a greater load.

In addition, in a situation where several wireless terminal devices are connected to the server using a TCP protocol in one server (divided by IP), the server is shut down normally for server management or the server is down due to various reasons. If the connection is lost, a control packet in which RST or FIN, which is a control flag of TCP, is transmitted to wireless terminal devices connected to the server within a short time.

If a large number of servers are connected to multiple wireless terminal devices, the control packets may increase exponentially in this situation. In particular, the wireless network may be overloaded to deliver these control packets to the wireless terminal device. Can occur.

In conclusion, in order to solve the enormous cost consumption of mobile operators due to network congestion and service dissatisfaction of wireless terminal politics users, the increase of server information that leads to excessive traffic channel generation and the increase of control packets due to the creation and release of traffic channels are required. Although it should be possible to monitor, there is no way to handle such monitoring more easily and conveniently in the network system.

Recognition of the problems and problems of the prior art described above is not obvious to those of ordinary skill in the art of the present invention and should not judge the progress of the present invention compared to the prior art based on such recognition. Reveal.

An object of the present invention for solving the above problems is, after classifying a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network by server identification information (IP, etc.), the control generated for each identification information The present invention provides an apparatus, a method, and a recording medium for monitoring an abnormal increase in a control packet, which is one of the causes of overload of a mobile network, by detecting an abnormal increase in packets.

The technical problem to be achieved in the present invention is not limited to the technical problem mentioned above, and other technical problems not mentioned above may be clearly understood by those skilled in the art from the following description. There will be.

An apparatus for detecting an abnormal increase in a control packet according to the present invention includes: a collecting unit configured to collect or capture a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network; A measuring unit for classifying packets collected or captured by the collection unit by server identification information, and measuring a generation amount of a control packet generated for each identification information during a recent n unit time for each flag; A recording unit for recording the number of control packet flags that occurred during the last predetermined time based on the current time according to the unit time, and calculating an average or maximum generation amount using information on the number of flags recorded during the predetermined time; And a determination unit that detects an abnormal increase in the control packet by using the average value or the maximum value of the generation amount per unit time of the control flags measured by the measurement unit and the unit flow amount per unit time calculated by the recording unit.

In addition, the control packet traffic increase detection method according to the present invention comprises the steps of: collecting or capturing a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network; Classifying packets collected or captured by the collector by server identification information; Measuring a generation amount of a control packet generated for each identification information for a recent n unit time for each flag; Recording the number of control packet flags that occurred during the last predetermined time based on the current time according to the unit time, and calculating an average or maximum generation amount using information on the number of flags recorded during the predetermined time; And detecting an abnormal increase in the control packet by using the average value or the maximum value of the generation amount per unit time of the control flags measured by the measurement unit and the unit flow amount per unit time calculated by the recording unit.

According to another aspect, the control packet abnormal increase detection device may further include a communication unit for notifying an increase in control packet abnormality to one or more terminals or servers when an abnormal increase in the control packet is detected as a result of detection of the determination unit. .

In addition, the control packet abnormality increase detection apparatus according to the present invention, a collection unit for collecting or capturing a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network, and the server to identify the packets collected or captured by the collection unit After classifying by information, the control unit measures the amount of control packets generated for each identification information for the last n seconds for each flag, and the number of control packet flags that occurred during the last predetermined time based on the current time. A recording unit which records for a predetermined time in units of time and calculates an average or maximum generation amount using information on the number of flags recorded in units of seconds for a predetermined time, and the generation amount per second of the control flags measured by the measuring unit and the calculation unit Error of control packet by using average value or maximum value of inflow per second for each flag A determination unit for detecting an increase and an alarm recording unit for recording alarm information required for informing the user of an alarm when an abnormal increase is detected in the determination unit.

According to one side, the alarm recorder, when detecting the abnormal increase in the determination unit, based on the current time to record the past n seconds and the time up to the next m seconds, and outputs the alarm information or Alternatively, the alarm information may be transmitted to one or more terminals or servers.

According to another aspect of the present invention, when the average value is calculated, the recording unit measures the number of flags flowing in every second, compares this value with an existing peak value, and sets the current peak value to the number of new flags, It is possible to decide whether to set the peak value to the number of flags or to set the number of flags to a value that has decreased the previous peak value, and to calculate the average of each calculated peak flag number, and if the new flag number is greater than the previous peak value. If the number of new flags is set to the peak value and the number of new flags is less than the previous peak value, and the number of new flags subtracted from the previous peak value exceeds a certain value for a certain time, the new peak value is replaced with the previous peak value. Set to a value reduced to a certain value, and if the number of new flags is less than the previous peak value, The number obtained by subtracting the peaceful flag number does not exceed a certain value for a certain period of time, it is possible to maintain a new peak in the previous peak value.

According to another aspect, the determination unit may determine that an abnormal increase in the control packet when the amount of generation per second of the specific flag exceeds a predetermined upper limit, or the generation amount per second is earlier than the average value of inflows per second per flag. If it becomes larger than one or more times and exceeds a predetermined lower limit, it can be determined that the control packet is abnormally increased.

According to another aspect, the determination unit, the identification information information of the server in which the abnormal increase occurs, the abnormal increase occurrence time information, and the information about the control packets from the predetermined schedule time until the later time of the abnormal increase occurrence time An abnormality can be detected, and the recording unit can control how much time is recorded when the number of control packet flags that have occurred in the last predetermined time on the basis of the current time for a predetermined time in seconds.

According to an aspect of the present invention, by detecting an increase in control packet abnormality on the communication network between the wireless terminal device and the server, it is easier and faster to monitor the network overload control according to the increase in the control packet abnormality with a specific server. It can have the effect.

Another effect according to an aspect of the present invention, it is possible to control the connection with a specific server that leads to excessive control packet increase phenomenon, it can bring the optimization of network use, through which the network for the expansion of mobile operators Can be minimized.

Another effect according to an aspect of the present invention, by minimizing the dissatisfaction of the user of the wireless terminal device due to data communication delay, etc. through the optimization of the network use can significantly reduce the battery consumption of the wireless terminal device.

The following drawings, which are attached to this specification, illustrate preferred embodiments of the present invention, and together with the detailed description of the present invention serve to further understand the technical spirit of the present invention. It should not be construed as limited to.

1 is a diagram illustrating a mobile (wireless) data traffic indicator.

2 is a diagram illustrating one of the main factors of the conventional mobile network congestion.

3 is a view showing the main components of the control packet abnormality increase detection apparatus according to the embodiment of the present invention.

4 is a diagram illustrating an example of a packet including a general control packet.

5 is a diagram illustrating an example of a measured control packet.

6 is another exemplary diagram illustrating the measured control packet.

7 is a diagram illustrating an example of measuring an amount of generation of control flags per second according to an embodiment of the present invention.

8 to 10 are exemplary embodiments illustrating a process for calculating an average value of a control flag according to an embodiment of the present invention.

11 to 13 are exemplary embodiments illustrating a process for calculating a peak average value of a control flag according to an embodiment of the present invention.

14 is a diagram illustrating a process of detecting an abnormal increase phenomenon of a control packet according to an exemplary embodiment of the present invention.

Hereinafter, with reference to the accompanying drawings and description will be described in detail the operating principle of the preferred embodiment of the present invention. However, the drawings and the following description shown below are for the preferred method among various methods for effectively explaining the features of the present invention, the present invention is not limited only to the drawings and description below. In addition, in the following description of the present invention, if it is determined that a detailed description of a related known function or configuration may unnecessarily obscure the subject matter of the present invention, the detailed description thereof will be omitted. Terms to be described later are terms defined in consideration of functions in the present invention, which may vary according to intentions or customs of users or operators. Therefore, the definition should be made based on the contents throughout the present invention.

As a result, the technical spirit of the present invention is determined by the claims, and the following examples are one means for efficiently explaining the technical spirit of the present invention to those skilled in the art to which the present invention pertains. It is only.

3 is a view showing the main components of the control packet abnormal increase detection apparatus 100 according to the embodiment of the present invention.

In more detail, in FIG. 3, the control packet abnormality increase detection device 100 is connected to a communication network or a network in which a plurality of wireless terminal devices 200 and a plurality of servers 300 transmit and receive packets, and thus the packet (the packet is data). The packet and data are interpreted in the same sense.) After collecting or capturing, an abnormal increase in the control packet is detected.

Each configuration shown in FIG. 3 is merely a configuration for describing an embodiment of the present invention, and the present invention is not limited to the technical features only by the implementation method shown in FIG. 3.

According to one embodiment of the present invention, the control packet abnormality increase detection apparatus 100 collects or captures a plurality of packets transmitted and received between a plurality of wireless terminal device 200 and a plurality of servers 300 through a communication network, and the collection Alternatively, the packets to be captured are classified by server identification information, and a control packet generated for each identification information is measured for the latest n unit time (for example, n seconds) for each flag, and based on the current time. The number of control packet flags that occurred in the last predetermined time is recorded for a predetermined time in seconds, and after calculating the average or maximum generation amount using the information on the number of flags recorded in the second for a predetermined time, the measured control An abnormal increase in the control packet is obtained by using the average value or the maximum value of the flags generated per second and the calculated inflows per second per flag. Shipping plays a role.

In addition, when an abnormal increase is detected, the control packet abnormal increase detection apparatus 100 records alarm information required for informing the user of an abnormal increase alarm, notifies one or more terminals or servers, or outputs the alarm. It plays a role.

Here, the control packet, the server 300 is connected to the wireless terminal device 200 because the server 300 is normally shut down or the server 300 is down due to one or more causes due to one or more causes. When disconnected, the packet is set to restart the session (RST) or the end of the session (FIN) or the session connection (SYN) of the control plug-in of TCP transmitted to the wireless terminal device 200 connected to the server 300 The control packet flag may include one or more session restart (RST), session termination (FIN), and session connection (SYN).

The alarm information may include an abnormal increase detection time, identification information on the packet-switching server, DNS information, TCP flag, flow rate per second, the number of clients connected, and one or more detection logs of the corresponding time interval. The abnormal increase means that the generation amount per second of the control packet exceeds a predetermined threshold, and n seconds may be 1 second.

Referring to FIG. 3, the control packet abnormality increase detection apparatus 100 according to the embodiment of the present invention includes a collecting unit 10, a measuring unit 20, a recording unit 30, a determining unit 40, , An alarm recording unit 50, an output unit 55, and a communication unit 60 are configured.

Here, the control packet abnormal increase detection device 100 is shown as a single device in the drawings for the purpose of embodiment, each of the components may be configured to be separated into one or more devices or servers, respectively.

Referring to FIG. 3, the collection unit 10 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 200 and the plurality of servers 300 through a communication network.

According to the exemplary embodiment of the present invention, when the wireless terminal device 200 communicates with the server 300 (game, web, chat, YouTube, etc.), the packet generated by the wireless terminal device 200 is basically GGSN. (Gateway GPRS Support Node) is converted to the TCP / IP protocol and transmitted to the corresponding server 300, the packets are transmitted without causing problems in the communication between the wireless terminal device 200 and the server 300 As it should be analyzed, it is preferable that the collection unit 10 replicates the packet and then transfers the duplicated packet to the measurement unit 20 and the recording unit 30.

In general, the server 300 and the wireless terminal device 200 use the TCP protocol to perform a session connection (SYN), data transmission, termination of a session (FIN), session restart (RST), and the like. While establishing a specific field value on the TCP header to send and receive packets, a connection is made through the control packet, data is transmitted or terminated, and the header information is shown in FIG.

Figure 4 shows an embodiment showing the information of the header of the packet transmitted and received between the wireless terminal device 200 and the server 300 in general.

According to FIG. 4, in the header information, “RST (1 bit)? Reset the connection ”,“ SYN (1 bit)? Synchronize sequence numbers. Only the first packet sent from each end should have this flag set. Some other flags change meaning based on this flag, and some -are only valid for when it is set, and others when it is clear ”,“ FIN (1 bit)? No more data from sender ”.

The present invention detects an abnormal increase in the amount of such control flags, such as a case where a control packet with a large amount of FIN or RST is set in a short time from the server 300 to the wireless terminal device 200, thereby detecting a network. To monitor the cause of the overload.

The measurement unit 20 according to an exemplary embodiment of the present invention classifies the packets collected or captured by the collection unit 10 by the server 300 identification information, and then flags the control packets generated for each identification information. For the role of measuring the amount of occurrence in the last n seconds.

5 is an example in which the number of control flags that the specific server 300 exchanges with the wireless terminal device 200 for one hour is plotted in units of seconds according to the type (Graph description: based on the horizontal lines TX and RX, + The y-axis is the number of control packets per second sent from the server 300 to the wireless terminal device 200, and the -y axis is the number of control packets per second sent from the wireless terminal device 200 to the server 300).

According to FIG. 5, about 50 minutes, a certain amount of FIN, SYN, and RST packets are generated from the server 300, and then RST packets increase rapidly in about 54 minutes.

FIG. 6 is a diagram illustrating a graph for detecting abnormal increase-related information on the basis of the time when an abnormal increase in the control packet identified through FIG. 5 occurs.

According to an exemplary embodiment of the present invention, the control packet abnormal increase detection apparatus 100 checks an abnormal increase phenomenon of the control packet through FIGS. 5 and 6, and identifies identification information of the server 300 in which the abnormal increase has occurred, At least one abnormality increase occurrence time information and information on control packets from a predetermined time to a predetermined time after the occurrence time are detected.

FIG. 7 classifies packets currently flowing through the measurement unit 20 by identification information of the server 300, and then indicates a control packet generated for each identification information for each flag (SYN, FIN, RST, etc.). An example of measuring the amount of occurrence over a second is shown.

Here, TX means a packet sent from the server 300 to the wireless terminal device 200, and RX means a packet sent from the wireless terminal device 200 to the server 300.

According to the exemplary embodiment of the present invention, the packet captured from the collecting unit 10 is recorded in milliseconds (1/1000 second) as the packet capture time, and continuously enters the packet. 20) calculates the inflows per second by summing flags for each of the packets in the last 1 second of these packets.

The recording unit 30 according to the exemplary embodiment of the present invention records the number of control packet flags that occurred during the last predetermined time based on the current time for a predetermined time in seconds, and the flag recorded in the second for a predetermined time. It calculates the average or maximum generation amount using the number information of these.

According to the present invention, the calculation unit, when calculating the average generation amount (average value), measures the number of flags flowing in every second, compare this value with the existing peak value, and then set this peak value to the number of new flags It is possible to determine whether to set the previous peak value to the number of flags, or to set the number of flags to a value obtained by decreasing the previous peak value, and calculate the average of each calculated peak flag number.

In addition, the output unit 55 according to the exemplary embodiment of the present invention performs a role of outputting an alarm when an abnormal increase in the control packet is detected as a result of the detection by the determination unit 40.

According to the present invention, the output unit 55 may output an alarm on the monitoring screen or output an alarm through a speaker.

Communication unit 60 according to an embodiment of the present invention, if the detection result of the determination unit 40, an abnormal increase in the control packet, the role of notifying the control packet abnormal increase to one or more terminals or server 300; Do this.

According to the present invention, the communication unit 60 may notify an increase in a control packet error to a wired and / or wireless terminal of one or more preset managers.

8 to 10 are diagrams illustrating an example of a process for calculating an average value of a control flag in the recording unit according to an exemplary embodiment of the present invention.

There are various methods of calculating the average based on the information recorded in the recording unit (that is, the number of occurrences per second for each flag).

First, as shown in FIG. 8, as a graph measuring the number of RSTs generated in 10 minutes, it is possible to confirm which values are produced according to a method of determining an average criterion, and finally apply an average calculation method that is determined to be the most appropriate. have. (Horizontal axis: 10 minutes = 600 seconds in total, Vertical axis: 100 blue lines)

In this state, as shown in FIG. 9, the average value of the abnormal increase may be appropriately the average value of the red lines (peak average), and the average value of the red lines will be about 50.

After calculating the mean, it is used to determine abnormal increase if the next inflow is more than n times the mean.

Determination unit 40 according to an embodiment of the present invention, by using the average value or the maximum value of the flow rate per second of the control flags measured by the measurement unit 20 and the calculated flow rate per flag calculated by the recording unit 30 It detects abnormal increase of control packet.

On the other hand, as shown in Figure 10, there are a variety of ways to calculate the average value.

First, in the case of the simple arithmetic normal value, the sum of all generated RSTs is divided by 600 seconds, and shows 8536 (total occurrences) / 600 (total time, in seconds) = 14.2 (average occurrences per second). However, this value is very different from the target value and is not appropriate as an average value for determining abnormal increase.

In addition, in the case of active (> 0,> 30), the sum of the RSTs is the same, and the denominator is divided by the number of times that the number of generations per second satisfies> 0 and> 30 (actually in a section where a value exists). Is greater than or equal to 17, and if it is> 0, it has a value of 17 for> 0 and 46 for> 30, and similar to the target value for> 30. It is sometimes not used because sometimes it shows proper value or not.

On the other hand, the peak average is a value obtained by calculating a virtual peak value (the horizontal red line) while maintaining, increasing, or decreasing the value using the previous peak value and the new peak value. It can be seen that it has a value and derives a value similar to the target value. Using this, the average value can be calculated and it can be determined as an abnormal increase when the value is * n times.

That is, in the method of using the peak average, by using the previously determined peak value and the number of newly measured flags (new value), the number of incoming flags every second is measured (new value), and After comparing the value with the existing peak value, the figure shows whether the current peak value is set to new value, the previous peak value (preserves the existing value), or the previous peak value is reduced. It is determined by an algorithm and calculates an average of each calculated peak value.

In FIG. 11, for example, when a drop condition exceeds a certain value during a drop time, for example, when a difference between two values is greater than half of an existing value every second, it is found that a specific time ( Drop time) is 5, and a specific value (Drop condition) is (previous peak value / 2).

In addition, in FIG. 11, for example, “drop value = peak value / 3” of drop value to a specific value may be included, and the previous value may be decreased by some amount. It can be arbitrarily specified as to whether or not to reduce the gap when the gap is over a certain value. The average value can be different depending on how to set this value.

12 is a diagram illustrating an example of calculating a peak average value, assuming that the RST flag enters 10, 5, 3, 20, 5, 5, 5, 5, 5, 15 every second, and the drop time is 3 ( More than 3 times when the difference with the existing value is large), the drop condition is the existing value / 2 (if the difference with the existing value is larger than this value), and the drop value is the existing value / 3 (1/3 of the existing value) Assuming a new value) shows the change in peak mean value.

That is, when the peak average is calculated in the same manner as in FIG. 12, the actual measured value (series 1) and the virtually generated value (series 2) can be derived as shown in FIG. 13, and the average value can be calculated using the same. It becomes possible.

As shown in FIGS. 8 to 13, the recording unit according to the present invention is only one embodiment, and a method for calculating an average value (average generation amount) may be variously performed according to the intention of those skilled in the art.

According to the present invention, the determination unit 40 determines that an abnormal increase in the control packet occurs when the generation amount of the specific flag exceeds a predetermined upper limit, or the average value of the inflow amount per flag per second is generated. If it is more than the preset multiple and more than the predetermined lower limit, it can be determined that the abnormal increase of the control packet.

In addition, the determination unit 40 may include identification information of the server 300 in which an abnormal increase occurs, abnormal increase occurrence time information, and information on control packets from a predetermined schedule time until a later constant time of the abnormal increase occurrence time. At least one can be detected, and the recording unit 30 controls the number of control packet flags that occurred during the last predetermined time on the basis of the current time for a predetermined time in seconds, and for how long to record. You can play more roles.

Alarm recording unit 50 according to an embodiment of the present invention, when the detection result of the determination unit 40, the abnormal increase in the control packet is detected, the role of recording the alarm information required to inform the alarm to the user Do this.

According to the present invention, when the alarm recording unit 50 detects an abnormal increase, the alarm recording unit 50 records up to n seconds in the past and time up to m seconds thereafter, based on the current time, and outputs alarm information. Alternatively, the alarm information may be transmitted to one or more terminals or servers.

The alarm information may include an abnormal increase detection time, a packet switching server, DNS information, a TCP flag, an amount of inflows per second, the number of connected clients, and one or more detection logs of a corresponding time interval.

Examples of the alarm information, "Occurrence time: October 21, 2013 1:18:53 PM", "Server: 127.0.0.1 (www.naver.com)", "Detection of abnormal increase of the RST flag" , “Inflow 300 per second”, “number of clients connected: 234”, and the like.

According to the present invention, each component of the control packet abnormal increase detection apparatus 100 may be implemented in the form of a program or a program set, and may be divided into two or more devices.

First, the control packet abnormal increase detection apparatus 100 collects or captures a plurality of packets transmitted and received between the plurality of wireless terminal devices 200 and the plurality of servers 300 through the collection unit 10 (S1410).

Thereafter, the control packet abnormal increase detection apparatus 100 classifies the packets collected or captured by the collection unit 10 through the measurement unit 20 by the server 300 identification information (S1420).

Thereafter, the measuring unit 20 of the control packet abnormality increase detection apparatus 100 measures the generation amount of the control packet generated for each identification information for each flag for the last n seconds (S1430).

On the other hand, the packet abnormal increase detection apparatus 100 records the number of control packet flags that occurred during the last predetermined time on the basis of the current time through the recording unit 30 for a predetermined time (S1440).

Subsequently, the apparatus 100 for detecting an abnormality of the packet calculates an average or maximum generation amount using the information on the number of flags recorded in units of seconds for a predetermined time through the recording unit 30 (S1450).

Here, the steps S1420 and S1430 may be replaced with the steps S1440 and S1450, and the steps S1420 and S1430, S1440, and S1450 may be changed. May be performed simultaneously.

Thereafter, the packet abnormality increase detection apparatus 100 checks through the determination unit 40 whether the amount of generation of the specific flag per second exceeds a predetermined upper limit (S1460).

If, in the step (S1460), as a result of the check, if the amount of occurrence of the specific flag per second exceeds a predetermined upper limit (S1470), the determination unit 40 of the packet abnormality increase detection apparatus 100 determines that the control packet is abnormal. It is determined that the increase (S1475).

If, in the process (S1460), as a result of the check, the generation amount of the specific flag per second does not exceed a predetermined upper limit (S1480), the packet abnormality increase detection apparatus 100 is determined per flag per second through the determination unit 40. It is checked whether the amount of generation is larger than a predetermined multiple by a predetermined value more than the average value of inflows per second per flag and exceeds a predetermined lower limit (S1485).

If, in the step (S1485), as a result of the check, if the generation amount per second for the flag is larger than a preset multiple of the average value of inflows per second for the flag, and exceeds the predetermined lower limit (S1490), the packet abnormality increase detection apparatus 100 The determination unit 40 determines that the abnormal increase in the control packet (S1475).

If, in the process of (S1485), the result of the check indicates that the generation amount per second does not exceed the predetermined multiple by more than the average value of the inflows per second by the flag, or does not exceed the predetermined lower limit or exceeds the predetermined multiple. If the predetermined lower limit value is not exceeded (S1495), the control packet abnormality increase detecting apparatus 100 repeats the process (S1410) (S1495).

In FIG. 14, processes (S1460) and (S1485) are sequentially processed to explain one embodiment of the present invention. However, processes (S1460) and (S1485) may be reversed, and may be processed simultaneously. It's okay.

Although not shown separately on the drawing, if an abnormal increase in the control packet is detected through the process (S1475), the control packet abnormal increase detecting apparatus 100 then outputs an alarm on the monitoring screen or the speaker through the output unit 55. Or, and / or notify the control packet abnormal increase to one or more terminals or servers 300 through the communication unit 60.

Explanation of the sign

100: control packet abnormal increase detection device

200: wireless terminal device 300: server

10: collecting unit 20: measuring unit

30: recording unit 40: judgment unit

50: alarm log

55: output unit

60: communication unit

Claims

A collecting unit for collecting or capturing a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network;

A measuring unit for classifying packets collected or captured by the collection unit by server identification information, and measuring a generation amount of a control packet generated for each identification information during a recent n unit time for each flag;

A recording unit for recording the number of control packet flags that occurred during the last predetermined time based on the current time according to the unit time, and calculating an average or maximum generation amount using information on the number of flags recorded during the predetermined time; And

And a determination unit that detects an abnormal increase in the control packet by using the average value or the maximum value of the generation amount per unit time of the control flags measured by the measurement unit and the unit flow rate per flag calculated by the recording unit.

Control packet abnormal increase detection device.
The method of claim 1,

If the abnormality is detected in the determination unit, the alarm recording unit for recording the alarm information required to inform the user of the alarm; further comprising a;

Control packet abnormal increase detection device.
The method of claim 1,

The detection unit may further include an output unit configured to output an alarm when an abnormal increase in the control packet is detected.

Control packet abnormal increase detection device.
The method of claim 1,

If the detection unit detects an abnormal increase in the control packet, further comprising a communication unit for notifying the control packet abnormal increase to one or more terminals, servers,

Control packet abnormal increase detection device.
The method of claim 1, wherein the determination unit,

When the generation amount per unit time of a specific flag exceeds a predetermined upper limit value, or the generation amount per unit time for each flag is greater than or equal to a predetermined multiple more than an average value of the inflow rate per unit time for each flag and exceeds a predetermined predetermined lower limit value. If judged to be abnormal increase of control packet

Control packet abnormal increase detection device.
The method of claim 1, wherein the determination unit,

Detects one or more IP information of the server in which an abnormal increase has occurred, information on the time of occurrence of an abnormal increase, and information on control packets from a predetermined time period to a later time of the abnormal increase occurrence time.

Control packet abnormal increase detection device.
The method of claim 1, wherein the control packet,

When the server connected to one or more wireless terminal devices is normally shut down or the server is down due to one or more causes and the connection with the wireless terminal device is lost, the TCP transmitted to the wireless terminal devices connected to the server is transmitted. It is characterized in that the control plug-in session (RST) or session termination (FIN) or session connection (SYN) of the packet is set,

Control packet abnormal increase detection device.
The method of claim 2, wherein the alarm recording unit,

When the determination unit detects an abnormal increase, the record up to the past n seconds and the time up to the next m seconds are recorded based on the current time.

Control packet abnormal increase detection device.
The method of claim 2, wherein the alarm information

At least one of an abnormal increase detection time, a packet switching server, DNS information, a TCP flag, an inflow rate per second, the number of clients connected, and a detection log of a corresponding time interval.

Control packet abnormal increase detection device.
The method of claim 1, wherein the recording unit,

When calculating the average value, measure the number of flags flowing in every second, compare this value with the existing peak value, set this peak value as the new flag number, set the previous peak value as the flag number, Determining whether to set the flag number to a value having a reduced peak value, and calculating an average of each calculated peak flag number;

Control packet abnormal increase detection device.
The method of claim 1, wherein the recording unit,

If the number of new flags is greater than the previous peak value, set the number of new flags as the peak value, and if the number of new flags is less than the previous peak value, the number of new flags subtracted from the previous peak value will be changed to the specified value for a certain time. When exceeded, the new peak value is set to the value obtained by reducing the previous peak value to a specific value. If the number of new flags is less than the previous peak value, the number of new flags subtracted from the previous peak value decrements the specific value for a specific time. If not exceeded, keep the new peak value at the previous peak value.

Control packet abnormal increase detection device.
The method of claim 1, wherein the determination unit,

The recording unit controls the number of control packet flags that occurred during the last predetermined time on the basis of the current time for a predetermined time in seconds, and for how long to record.

Control packet abnormal increase detection device.
Collecting or capturing a plurality of packets transmitted and received between a plurality of wireless terminal devices and a plurality of servers through a communication network;

Classifying packets collected or captured by the collector by server identification information;

Measuring a generation amount of a control packet generated for each identification information for a recent n unit time for each flag;

Recording the number of control packet flags that occurred during the last predetermined time based on the current time according to the unit time, and calculating an average or maximum generation amount using information on the number of flags recorded during the predetermined time; And

Detecting an abnormal increase in a control packet by using the average value or the maximum value of the generation amount of the control flags measured by the measuring unit and the unit hourly inflow amount for each flag calculated by the recording unit;

Control packet abnormal increase detection method.
The method of claim 13,

If the abnormal increase is detected, further comprising the step of recording the alarm information required to inform the user of the alarm;

Control packet abnormal increase detection method.
The method of claim 13,

Outputting an alarm when an abnormal increase in the control packet is detected;

Control packet abnormal increase detection method.
The method of claim 13,

If an abnormal increase in the control packet is detected, notifying the control packet abnormal increase to one or more terminals or servers;

Control packet abnormal increase detection method.
The method of claim 13, wherein the detecting comprises:

When the generation amount per unit time of a specific flag exceeds a predetermined upper limit value, or the generation amount per unit time for each flag is greater than or equal to a predetermined multiple more than an average value of the inflow rate per unit time for each flag and exceeds a predetermined predetermined lower limit value. In the case, comprising the step of determining that the abnormal increase of the control packet

Control packet abnormal increase detection method.
The method of claim 13, wherein the detecting comprises:

Detecting one or more IP information of the server in which the abnormal increase has occurred, information on the abnormal increase occurrence time, and information on control packets from a predetermined time to a predetermined time after the abnormal increase occurrence time;

Control packet abnormal increase detection method.
The method of claim 13, wherein the control packet,

When the server connected to one or more wireless terminal devices is normally shut down or the server is down due to one or more causes and the connection with the wireless terminal device is lost, the TCP transmitted to the wireless terminal devices connected to the server is transmitted. It is characterized in that the control plug-in session (RST) or session termination (FIN) or session connection (SYN) of the packet is set,

Control packet abnormal increase detection method.
15. The method of claim 14, wherein recording the alarm information

If the abnormal increase is detected, recording up to n seconds in the past and time up to m seconds thereafter based on the present time;

Control packet abnormal increase detection method.
The method of claim 14, wherein the alarm information

At least one of an abnormal increase detection time, a packet switching server, DNS information, a TCP flag, an inflow rate per second, the number of clients connected, and a detection log of a corresponding time interval.

Control packet abnormal increase detection method.
The method of claim 1, wherein the calculating of the average or maximum occurrence amount

When calculating the average value, measure the number of flags flowing in every second, compare this value with the existing peak value, set this peak value as the new flag number, set the previous peak value as the flag number, Determining whether to set the flag number to a value having a reduced peak value, and calculating an average of each calculated peak flag number.

Control packet abnormal increase detection method.
The method of claim 1, wherein the calculating of the average or maximum occurrence amount

If the number of new flags is greater than the previous peak value, set the number of new flags as the peak value, and if the number of new flags is less than the previous peak value, the number of new flags subtracted from the previous peak value will be changed to the specified value for a certain time. When exceeded, the new peak value is set to the value obtained by reducing the previous peak value to a specific value. If the number of new flags is less than the previous peak value, the number of new flags subtracted from the previous peak value decrements the specific value for a specific time. If not exceeding, maintaining the new peak value at the previous peak value;

Control packet abnormal increase detection method.
The method of claim 1, wherein the detecting step

Controlling how long to record when the number of control packet flags that occurred during the last predetermined time on the basis of the current time for a predetermined time, for a certain time;

Control packet abnormal increase detection method.
A recording medium having recorded thereon a program for executing a method according to any one of claims 13 to 24 on a computer.