NETWORK TRAFFIC ANALYZING DEVICE, NETWORK TRAFFIC ANALYZING METHOD AND NETWORK TRAFFIC ANALYZING SYSTEM

• US 20090185503A1
• Filed: 01/16/2009
• Published: 07/23/2009
• Est. Priority Date: 01/18/2008
• Status: Abandoned Application

• Current Assignee: OKI Electric Industry Company Limited
• Original Assignee: OKI Electric Industry Company Limited
• Inventors: TAN, Joohwa
• Application Number:
  US12/355,060
• Publication Number:
  US 20090185503A1
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 12/66 Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

A network traffic analyzing device accurately analyzes traffic of a communications network. The traffic analysis device includes a real time statistic information setting/managing unit for collecting information regarding communication data between a primary network and an access network from a traffic collecting device in real time. The device also includes a real time statistic information monitoring unit, an alert condition setting unit for alerting one or more conditions regarding the information collected from the traffic collecting device in real time, and an alert managing/notifying unit for generating an alert regarding traffic between the network and the access network based upon one or more alert conditions.

Claims

1. A network traffic analyzing device for analyzing traffic, comprising:

a real time monitoring unit configured to collect information regarding communication data between a primary network and an access network from a traffic collecting device in real time;

an alert condition setting unit configured to set one or more alert conditions regarding the information collected from the traffic collecting device in real time; and

an alert managing/notifying unit configured to generate an alert regarding traffic between the primary network and the access network based upon the one or more alert conditions.

2. The network traffic analyzing device according to claim 1, wherein regarding the information collected from the traffic collecting device in real time, the traffic is analyzed based upon at least one of a graphical representation of the information per hour, a graphical representation of the information per day and a graphical representation of the information per month to produce analysis results.

3. The network traffic analyzing device according to claim 2, further comprising an analysis report creating unit configured to create a report based upon the analysis results.

4. The network traffic analyzing device according to claim 2, wherein

the information collected from the traffic collecting device in real time includes information collected by a packet filter of the traffic collecting device or information collected regarding abnormal traffic;

and

the network traffic analyzing device conducts a basic statistical analysis of all received packets based upon at least one of the information collected by the packet filter, a statistic analysis of packets within a specific range based upon the information collected by the packet filter, and an abnormal traffic analysis based on the information collected regarding abnormal traffic.

5. The network traffic analyzing device according to claim 1, further comprising:

a traffic analysis setting/managing unit configured to conduct a setting for an analysis of the traffic information collected from the traffic collecting device; and

a traffic analyzing unit configured to analyze the traffic information collected from the traffic collecting device, based on results of the analysis set by the traffic analysis setting/managing unit, and to generate an analysis output.

6. The network traffic analyzing device according to claim 5, further comprising a report creating unit configured to create reports based on the analysis output generated by the traffic analyzing unit.

7. The network traffic analyzing device according to claim 1, wherein the alert managing/notifying unit is configured to generate the alert by comparing an alert setting of the alert condition setting unit with an average rate per unit time of acquired traffic data.

8. The network traffic analyzing device according to claim 2, wherein the graphical representation of the information per hour, the graphical representation of the information per day and the graphical representation of the information per month comprises abnormality occurrence time period information.

9. The network traffic analyzing device according to claim 1, further comprising:

a real time statistic information setting/managing unit configured to manage a setting of information to be monitored; and

a real time statistic information monitoring unit configured to acquire data from the traffic collecting device at intervals set by a real time monitoring interval setting, calculate an average value of packets per second/bits per second (pps/bps) of the acquired data, and update a display of a real time monitoring graphical representation for a predetermined period so that the average value pps/bps calculated is output to a real time monitoring oversight.

10. The network traffic analyzing device according to claim 1, wherein the alert managing/notifying unit is configured to generate the alert when an average value of the traffic per unit time exceeds an upper limit threshold value, and exceeds a number of continuous occurrences.

11. The network traffic analyzing device according to claim 1, wherein the alert managing/notifying unit generates the alert when an average value of the traffic per unit value does not exceed a lower limit threshold value, and does not exceed a number of continuous occurrences.

12. The network traffic analyzing device according to claim 1, further comprising a regular report setting/managing unit, a real time statistic information monitoring unit, and a regular statistic information report creating unit, wherein

the regular report setting/managing unit conducts a basic setting of reports,

the real time statistic information monitoring unit acquires data from the traffic collecting device at predetermined intervals, and

the regular statistic information report creating unit maintains/displays either an hourly, daily, or monthly table graphical report.

13. The network traffic analyzing device according to claim 2, wherein when the graphical representation of the information per hour is entered into the traffic analyzing device, the traffic analyzing device sorts hourly during a designated period and outputs a value of instantaneous traffic data as well as time and date data as the analysis results.

14. The network traffic analyzing device according to claim 2, wherein when the graphical representation of the information per day is entered into the traffic analyzing device, the traffic analyzing device sorts daily in descending order, and occurrence time periods of the traffic in a predetermined ranges, and the occurrence time periods of the traffic are output as the analysis results as time periods where the traffic is concentrated.

15. The network traffic analyzing device according to claim 2, wherein when the graphical representation of the information per month is entered into the traffic analyzing device, the traffic analyzing device sorts monthly data in descending order and sub-net, daily-averaged traffic value and dates are output as the analysis results.

16. A network traffic analyzing method, comprising:

collecting information regarding communication data between a primary network and an access network from a traffic collecting device in real time;

setting one or more alert conditions regarding the information collected from the traffic collecting device in real time; and

generating an alert regarding traffic between the primary network and the access network based upon the one or more alert conditions.

17. The network traffic analyzing method according to claim 16, wherein the setting of alert conditions comprises setting at least one of an upper threshold limit and a lower threshold limit for abnormal packets received per unit time.

18. A network traffic analyzing system connecting a traffic collecting device for collecting traffic information from a primary network and an access network with a network traffic analyzing device for analyzing the traffic information, wherein

the network traffic analyzing device comprises:

a real time monitoring unit configured to collect information regarding communication data between the primary network and the access network from the traffic collecting device in real time;

an alert condition setting unit configured to set alert conditions regarding the information collected from the traffic collecting device in real time; and

an alert managing/notifying unit configured to generate an alert regarding traffic between the primary network and the access network based upon the alert conditions.

19. The network traffic analyzing system according to claim 18, wherein the traffic collecting device includes an abnormal traffic detecting unit for detecting signatures that describe patterns indicating abnormal traffic and a reception/transmission unit for interfacing the traffic collecting device with a management unit.

20. The network traffic analyzing system according to claim 19, wherein the abnormal traffic detecting unit is configured to perform a signature search to detect whether a number of simultaneous sessions is greater than an upper limit value, and whether a number of sessions per unit time is registered.