Apparatus and method for limiting bandwidths of burst aggregate flows

• US 20050152375A1
• Filed: 09/03/2004
• Published: 07/14/2005
• Est. Priority Date: 12/17/2003
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: An, Gaeil, Jang, Jong Soo, Kim, Ki Young
• Granted Patent: US 7,417,951 B2
• Time in Patent Office: Days
• US Class Current: 370/395.410
• CPC Class Codes: H04L 47/10 Flow control; Congestion control
• CPC Class Codes: H04L 47/11 Identifying congestion
• CPC Class Codes: H04L 47/12 Avoiding congestion; Recovering from congestion
• CPC Class Codes: H04L 47/29 using a combination of thresholds
• CPC Class Codes: H04L 63/1458 Denial of Service

Abstract

Provided are an apparatus and method for limiting bandwidths of burst aggregate flows according to the present invention. The apparatus comprises: a bandwidth measuring unit measuring a bandwidth of at least one input aggregate flow; a grade determining unit determining abnormal grades according to abnormal levels of the input aggregate flows; a bandwidth limit determining unit determining a bandwidth volume and aggregate flow to be limited; a bandwidth limiting unit inputting a result determined by the bandwidth limit determining unit, limiting or releasing a bandwidth of a aggregate flow selected among the input aggregate flows and outputting the selected aggregate flow; and a status information storage unit storing status information including a usage bandwidth, an abnormal grade, and a limited bandwidth volume of the input aggregate flow. Accordingly, the apparatus and method provide an effect of dropping attack aggregate flows corresponding to excessive traffic while not influencing normal aggregate flows.

Claims

1. An apparatus for limiting bandwidths of burst aggregate flows, the apparatus comprising:

a bandwidth measuring unit measuring a bandwidth of at least one input aggregate flow on the basis of predetermined information representing the characteristics of the aggregate flows;

a grade determining unit determining the abnormal grades according to the abnormal levels of the input aggregate flows;

a bandwidth limit determining unit determining a bandwidth volume and an aggregate flow to be limited on the basis of the measured bandwidth, abnormal grade, and network state;

a bandwidth limiting unit inputting a result determined by the bandwidth limit determining unit, limiting or releasing a bandwidth of an aggregate flow selected among the input aggregate flows and outputting the selected aggregate flow; and

a status information storage unit storing status information, including a usage bandwidth, an abnormal grade, and a limited bandwidth volume of the input aggregate flow.

2. The apparatus of claim 1, wherein the bandwidth measuring unit measures the bandwidths of the aggregate flows on the basis of the predetermined information, including source IP addresses, protocols, and destination port numbers.

3. The apparatus of claim 1, wherein the bandwidth measuring unit transmits the measured bandwidth to the bandwidth limit determining unit periodically or whenever the measured bandwidth is varied.

4. The apparatus of claim 1, wherein the grade determining unit determines the grade on the basis of an attack type and risk level when it is determined that the input aggregate flow is the attack.

5. The apparatus of claim 1, wherein the bandwidth limit determining unit determines a bandwidth to be limited, an aggregate flow whose bandwidth is limited, or an aggregate flow whose limited bandwidth is released on the basis of the status information and a current network status.

6. A method of limiting bandwidths of burst aggregate flows, the method comprising:

(a) obtaining bandwidth information of at least one input aggregate flow, determining abnormal grades of the input aggregate flows, and storing the result;

(b) determining whether a network congestion risk exists by comparing a total bandwidth of the input aggregate flows with predetermined bandwidths allocated to normal aggregate flows;

(c) if it is determined that the network congestion risk exists in step (b), determining burst aggregate flows, the bandwidths of which are limited, and storing the result;

(d) determining bandwidth volumes to be limited with respect to the burst aggregate flows, the bandwidths of which are limited, and storing the result; and

(e) if it is determined that the network congestion risk does not exist in step (b), releasing the aggregate flows, the bandwidths of which have been limited, and storing the result.

7. The method of claim 6, wherein step (b) comprises:

if the total bandwidth is larger than the bandwidths allocated to normal aggregate flows, determining that the network is in a hazardous state; and

if the total bandwidth is smaller than the bandwidths allocated to normal aggregate flows, determining that the network is in a normal state.

8. The method of claim 6, wherein step (c) comprises:

(c1) setting a total bandwidth allocated to the normal aggregate flows, a least abnormal grade, and all aggregate flows as a margin bandwidth, an abnormal grade, and a burst aggregate flow list, respectively;

(c2) searching an aggregate flow corresponding to the abnormal grade and having the smallest bandwidth in the burst aggregate flow list;

(c3) if the aggregate flow satisfying the conditions in step (c2) does not exist, repeating the search by adding one level to the abnormal grade;

(c4) if the aggregate flow satisfying the conditions in step (c2) exists, and if the margin bandwidth is larger than a bandwidth of the aggregate flow, regarding the aggregate flow as the normal aggregate flow, removing the aggregate flow from the burst aggregate flow list, and subtracting a bandwidth of the normal aggregate flow from the margin bandwidth;

(c5) selecting burst aggregate flows by repeating steps (c1) through (c4) until there is not so large margin bandwidth as provided to the normal aggregate flow, or until there is no aggregate flow to be further searched;

(c6) adding a total bandwidth allocated to the burst aggregate flows and the total bandwidth allocated to the normal aggregate flows and substituting a margin bandwidth for the added bandwidth;

(c7) calculating a bandwidth limited according to each abnormal grade on the basis of the substituted margin bandwidth and an bandwidth allocation policy by abnormal grade; and

(c8) classifying aggregate flows in the burst aggregate flow list with the abnormal grades, allocating a limited bandwidth corresponding to each abnormal grade, and determining a bandwidth volume of an aggregate flow designated as the burst aggregate flow.

9. The method of claim 8, wherein step (c7) comprises:

calculating the bandwidth by multiplying the substituted margin bandwidth by a predetermined ratio.

10. A computer readable medium having recorded thereon a computer-readable program for performing the method of claim 6.