Network status display device and method using traffic flow-radar

• US 20070206498A1
• Filed: 11/15/2006
• Published: 09/06/2007
• Est. Priority Date: 11/17/2005
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Jin, Kim, Hyun, Kim, Geon, Na, Jung, Jang, Jong, Kim, Dong, Chang, Beom, Sohn, Sung, Lee, Soo, Bang, Hyo, Sohn, Seon
• Granted Patent: US 7,787,394 B2
• Time in Patent Office: Days
• US Class Current: 370/232
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0817 by checking functioning
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A network status display device using a traffic flow-radar is provided. The network status display device includes: a traffic feature extractor calculating flow occupancy rates for total flows, micro-flows and macro-flows with respect to each of a plurality of traffic features with reference to traffic information for each traffic feature such as a network address, a port, a transmitting/receiving host address or a protocol collected by an external traffic information collector, and storing the calculation result; a traffic status display unit displaying the flow occupancy rates for each traffic feature calculated and stored in the traffic feature extractor on a radar with dots for each traffic feature; and a traffic anomaly determination unit determining whether a network status is abnormal with reference to the radar for each traffic feature, detecting and reporting the type of the abnormal network status and harmful or abnormal traffic that generates the abnormal network status, when the abnormal status occurs.

Claims

1. A network status display device using a traffic pattern map, the device comprising:

a traffic feature extractor calculating flow occupancy rates for total flows, micro-flows and macro-flows with respect to each of a plurality of traffic features with reference to traffic information for each traffic feature such as a network address, a port, a transmitting/receiving host address or a protocol collected by an external traffic information collector, and storing the calculation result;

a traffic status display unit displaying the flow occupancy rates with respect to each traffic feature calculated and stored in the traffic feature extractor on a radar with dots with respect to each traffic feature; and

a traffic anomaly determination unit determining whether a network status is abnormal with reference to the radar with respect to each traffic feature, detecting and reporting the type of the abnormal network status and harmful or abnormal traffic which generates the abnormal network status, when the abnormal status occurs.

2. The device of claim 1, wherein the traffic feature extractor calculates the flow occupancy rates for the macro-flows with respect to each traffic feature by subtracting the flow occupancy rates for the micro-flows with respect to each traffic feature from the flow occupancy rates for the total flows with respect to each traffic feature.

3. The device of claim 1, wherein, in cases of the ports, the transmitting/receiving host addresses and the protocols, the traffic feature extractor stores only the flow occupancy rates of the top N (>

0) ports, the top M (>

0) transmitting/receiving host addresses, and the top P (>

0) protocols having high occupancy rates.

4. The device of claim 1, wherein the traffic status display unit comprises:

a network-radar display module displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to corresponding network address sections with dots on the network-radar in which a total network address range is divided into n network address sections to set radial coordinate axes, and the flow occupancy rates are set to circular coordinate axes with reference to the flow occupancy rates stored in the traffic feature extractor;

a port-radar display module displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to the corresponding ports with dots on the port-radar in which the top N ports having high occupancy rates are set to radial coordinate axes, and the flow occupancy rates are set to circular coordinate axes, with reference to the flow occupancy rates stored in the traffic feature extractor;

a host-radar display module displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to the corresponding transmitting/receiving host address with dots on the transmitting/receiving host-radar in which the top P transmitting/receiving host addresses having high occupancy rates are set to radial coordinate axes, and the flow occupancy rates are set to circular coordinate axes, with reference to the flow occupancy rates stored in the traffic feature extractor; and

a protocol-radar display module displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to the corresponding protocols with dots on the protocol-radar in which the top M protocols having high occupancy rates are set to radial coordinate axes, and the flow occupancy rates are set to circular coordinate axes, with reference to the flow occupancy rates stored in the traffic feature extractor.

5. The device of claim 4, wherein each of the network-radar display module, the port-radar display module, the host-radar display module, and the protocol-radar display module displays first threshold values that are the flow occupancy rates as reference values for determining whether the network status is abnormal on the radars to allow a user to recognize the network status intuitively and displays a plurality of threshold values greater than the first threshold values that are reference values for determining the level of abnormality of the abnormal status of the network on the radars to allow the user to recognize the network status intuitively.

6. The device of claim 5, wherein the traffic anomaly determination unit reports the level of abnormality of the abnormal status of the network by comparing the flow occupancy rate displayed on each of the radars with the first threshold value and the threshold values when reporting the abnormal status of the network.

7. A network status display method using a traffic pattern map, the method comprising:

(a) calculating flow occupancy rates for total flows, micro-flows and macro-flows with respect to each of a plurality of traffic features with reference to traffic information for each traffic feature such as a network address, a port, a transmitting/receiving host address or a protocol collected by an external traffic information collector, and storing the calculation result;

(b) displaying the flow occupancy rates with respect to each traffic feature stored in (a) on a radar with dots for each traffic feature; and

(c) determining whether a network status is abnormal with reference to the radar for each traffic feature, and detecting and reporting harmful traffic or abnormal traffic that generates the abnormal network status.

8. The method of claim 7, wherein, in (a), in cases of the ports, the transmitting/receiving host addresses and the protocols, only the flow occupancy rates of the top N (>

0) ports, the top M (>

0) transmitting/receiving host addresses, and the top P (>

0) protocols having high occupancy rates are stored.

9. The method of claim 7, wherein (b) comprises:

(b_—

1) displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to corresponding network address sections with dots on a network-radar in which a total network address range is divided into n network address sections to set radial coordinate axes, and the flow occupancy rates are set to circular coordinate axes with reference to the flow occupancy rates stored in (a);

(b_—

2) displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to the corresponding ports with dots on a port-radar in which the top N ports having high occupancy rates are set to the radial coordinate axes, and the flow occupancy rates are set to the circular coordinate axes, with reference to the flow occupancy rates stored in (a);

(b_—

3) displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to the corresponding transmitting/receiving host address with dots on the transmitting/receiving host-radar in which the top P transmitting/receiving host addresses having high occupancy rates are set to the radial coordinate axes, and the flow occupancy rates are set to the circular coordinate axes, with reference to the flow occupancy rates stored in (a); and

(b_—

4) displaying the flow occupancy rates for the total flows, the micro-flows, and the macro-flows with respect to the corresponding protocols with dots on a protocol-radar in which the top M protocols having high occupancy rates are set to the radial coordinate axes, and the flow occupancy rates are set to the circular coordinate axes, with reference to the flow occupancy rates stored in (a).

10. The method of claim 7, further comprising displaying first threshold values that are the flow occupancy rates as reference values for determining whether the network status is abnormal on the radars to allow a user to recognize the network status intuitively and displaying a plurality of threshold values greater than the first threshold values that are reference values for determining the level of abnormality of the abnormal status of the network on the radars to allow the user to recognize the network status intuitively,

wherein the level of abnormality of the abnormal status of the network is reported when reporting the abnormal status of the network in (c).