APPARATUS AND METHOD FOR DETECTING ABNORMAL TRAFFIC

• US 20120163212A1
• Filed: 12/21/2011
• Published: 06/28/2012
• Est. Priority Date: 12/22/2010
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: LEE, Wang-Bong, Lee, Joon-Kyung
• Application Number:
  US13/332,972
• Publication Number:
  US 20120163212A1
• Time in Patent Office: Days
• US Class Current: 370/252
• CPC Class Codes: H04L 41/5009 Determining service level performance parameters or violations of service level contracts, e.g. violations of agreed response time or mean time between failures [MTBF]
• CPC Class Codes: H04L 43/04 Processing captured monitoring data, e.g. for logfile generation
• CPC Class Codes: H04L 43/16 Threshold monitoring

Abstract

An apparatus and method for detecting abnormal traffic are provided. According to the apparatus and method, it is possible to easily detect abnormal traffic by analyzing a traffic image that is generated based on traffic statistics data provided by an external traffic analysis device or an internal traffic analysis device without the need to access a traffic analysis device that is hard to access or manipulate.

Claims

1. An apparatus for detecting abnormal traffic, the apparatus comprising:

a traffic image processing unit configured to process a traffic image;

a comparison image processing unit configured to generate a comparison image for detecting abnormal traffic and store the comparison image; and

an image comparison unit configured to determine whether there is abnormal traffic by comparing the traffic image and the comparison image.

2. The apparatus of claim 1, wherein the traffic image processing unit is further configured to receive traffic statistics data from an external traffic analysis device or an internal traffic analysis device and generate a real-time traffic image based on the received traffic statistics data.

3. The apparatus of claim 1, wherein the traffic image processing unit is further configured to receive a real-time traffic image from an external traffic analysis device or an internal traffic analysis device.

4. The apparatus of claim 1, further comprising:

an abnormal traffic notification unit configured to, in response to results of comparison performed by the image comparison unit indicating that there is abnormal traffic, report detection of the abnormal traffic.

5. The apparatus of claim 1, wherein the traffic image processing unit is further configured to display the traffic image via a Graphic User Interface (GUI).

6. The apparatus of claim 1, wherein the comparison image processing unit is further configured to generate a comparison image with a predetermined traffic pattern.

7. The apparatus of claim 6, wherein the comparison image processing unit is further configured to modify the traffic pattern of the comparison image.

8. The apparatus of claim 6, wherein the comparison image processing unit is further configured to store a comparison image with a compressed traffic pattern that is obtained by compressing the predetermined traffic pattern.

9. The apparatus of claim 8, wherein the comparison image processing unit is further configured to compress the predetermined traffic pattern using a Hidden Markov Model (HMM) method.

10. The apparatus of claim 4, wherein the abnormal traffic notification unit is further configured to create and store a log for the abnormal traffic.

11. The apparatus of claim 2, wherein the external traffic analysis device comprises one of a router device, a switch device, and a firewall device.

12. The apparatus of claim 11, wherein the traffic image processing unit is further configured to receive the traffic statistics data from the external traffic analysis device via a Simple Network Management Protocol (SNMP) interface, a Remote Network Monitoring (RMON) interface, or a NetFlow interface.

13. The apparatus of claim 2, wherein the internal traffic analysis device comprises a packet capture board.

14. The apparatus of claim 12, wherein the traffic image processing unit is further configured to receive the traffic statistics data from the internal traffic analysis device via a universal peripheral component interconnect (PCI) interface.

15. A method of detecting abnormal traffic, the method comprising:

processing a traffic image;

determining whether there is abnormal traffic by comparing the traffic image and a previously-stored comparison image; and

in response to results of the comparing indicating that there is abnormal traffic, reporting detection of the abnormal traffic.

16. The method of claim 15, wherein the processing comprises receiving traffic statistics data from an external traffic analysis device or an internal traffic analysis device and generating a real-time traffic image based on the received traffic statistics data.

17. The method of claim 15, wherein the processing comprises receiving a real-time traffic image from an external traffic analysis device or an internal traffic analysis device.

18. The method of claim 15, further comprising:

generating a comparison image for detecting abnormal traffic and storing the generated comparison image.

19. The method of claim 15, wherein the processing comprises displaying the traffic image via a GUI.

20. The method of claim 15, wherein the reporting comprises creating and storing a log for the abnormal traffic.