APPARATUS AND METHOD FOR COLLECTING NETWORK DATA TRAFFIC

• US 20150128271A1
• Filed: 05/21/2013
• Published: 05/07/2015
• Est. Priority Date: 05/22/2012
• Status: Abandoned Application

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Shin, In-Cheol, Jeon, Yu-Seok, Kim, Sin-Kyu, Seo, Jung-Taek
• Application Number:
  US14/401,364
• Publication Number:
  US 20150128271A1
• Time in Patent Office: Days
• US Class Current: 726/23
• CPC Class Codes: G06F 16/2246 Trees, e.g. B+trees
• CPC Class Codes: H04L 41/145 involving simulating, designing, planning or modelling of a network
• CPC Class Codes: H04L 45/48 Routing tree calculation
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00
• CPC Class Codes: H04W 40/246 Connectivity information discovery
• CPC Class Codes: Y04S 40/20 Information technology specific aspects, e.g. CAD, simulation, modelling, system security

Abstract

The present invention relates to an apparatus and method for collecting network data traffic. The apparatus for collecting network data traffic includes a graph creation unit, an initialization unit, an edge selection unit, a reconstruction unit, an algorithm application unit and a traffic collection route provision unit. The reconstruction unit converts the selected edge into an inactive edge and connects the inactive edge to two nodes, so that the reconstruction unit reconstructs the tree structure. The algorithm application unit applies a minimal spanning tree algorithm to the reconstructed tree structure. The traffic collection route provision unit eliminates a leaf node and a leaf edge from the tree structure to which the minimal spanning tree algorithm has been applied, and generates a monitoring tree for providing a traffic collection route minimizing a total weight of the edges.

Claims

1. An apparatus for collecting network data traffic, comprising:

a graph creation unit for creating a graph in a form of a set of nodes and edges by using traffic collection units on a network as the nodes and using connection relations between the traffic collection units as the edges;

an initialization unit for arranging the edges of the graph in ascending order of weights of the edges and initializing a tree structure of the nodes;

an edge selection unit for selecting an edge having a minimum weight from among the arranged edges;

a reconstruction unit for converting the selected edge into an inactive edge, and connecting the inactive edge to two nodes, thus reconstructing the tree structure;

an algorithm application unit for applying a minimal spanning tree algorithm to the reconstructed tree structure; and

a traffic collection route provision unit for eliminating a leaf node and a leaf edge from the tree structure to which the minimal spanning tree algorithm has been applied, and generating a monitoring tree for providing a traffic collection route minimizing a total weight of the edges.

2. The apparatus of claim 1, wherein the weights of the edges are values corresponding to distances between the traffic collection units.

3. The apparatus of claim 1, wherein the reconstruction unit comprises:

a node connection determination unit for determining whether the two nodes are connected to other nodes through active edges;

an edge elimination unit for, if the two nodes are connected to other nodes through the active edges, eliminating the active edges;

a node conversion determination unit for determining whether an existing leaf node has been converted into an internal node due to the edge converted into the inactive edge; and

an edge connection unit for, if the existing leaf node has been converted into the internal node, connecting the initialized nodes through active edges, and then reconstructing the tree structure into a tree structure having a maximum number of leaf edges.

4. The apparatus of claim 3, wherein the reconstruction unit reconstructs the tree structure until all of the nodes are included in the tree structure.

5. The apparatus of claim 3, wherein the traffic collection units are classified into a first traffic collection unit corresponding to a leaf node of the tree structure and not belonging to the monitoring tree, and a second traffic collection unit corresponding to an internal node of the tree structure and belonging to the monitoring tree.

6. The apparatus of claim 5, wherein the total weight of the edges does not include a weight of the first traffic collection unit.

7. The apparatus of claim 5, wherein the total weight of the edges includes only a weight of the second traffic collection unit.

8. The apparatus of claim 5, wherein the second traffic collection unit receives a communication request signal from the first traffic collection unit, collects data traffic, and transmits the data traffic to a management server through the traffic collection route.

9. The apparatus of claim 8, wherein the first traffic collection unit comprises:

a communication request transmission unit for transmitting the communication request signal to the second traffic collection unit;

a communication preparation unit for receiving, a communication preparation signal from the second traffic collection unit; and

a first traffic transmission unit for transmitting collected data traffic to the second traffic collection unit.

10. The apparatus of claim 8, wherein the second traffic collection unit comprises:

a communication request reception unit for receiving the communication request signal from the first traffic collection unit;

a communication preparation transmission unit for transmitting the communication preparation signal to the first traffic collection unit;

a traffic reception unit for receiving the data traffic from the first traffic collection unit; and

a second traffic transmission unit for collecting the received data traffic and transmitting the data traffic to the management server through the traffic collection route.

11. The apparatus of claim 1, wherein each of the traffic collection unit includes a plurality of smart meters.

12. The apparatus of claim 10, wherein the management server is implemented as an intrusion detection server for analyzing the received data traffic and detecting an abnormal action.

13. A method for collecting network data traffic, comprising:

creating, by a graph creation unit, a graph in a form of a set of nodes and edges by using traffic collection units on a network as the nodes and using connection relations between the traffic collection units as the edges;

arranging, by an initialization unit, the edges of the graph in ascending order of weights of the edges and initializing a tree structure of the nodes;

selecting, by an edge selection unit, an edge having a minimum weight from among the arranged edges;

converting, by a reconstruction unit, the selected edge into an inactive edge, and connecting the inactive edge to two nodes, thus reconstructing the tree structure;

applying, by an algorithm application unit, a minimal spanning free algorithm to the reconstructed tree structure; and

eliminating, by a traffic collection route provision unit, a leaf node and a leaf edge from the tree structure to which the minimal spanning tree algorithm has been applied, and generating a monitoring tree for providing a traffic collection route minimizing a total weight of the edges.

14. The method of claim 13, wherein the weights of the edges are values corresponding to distances between the traffic collection units.

15. The method of claim 13, wherein reconstructing the tree structure comprises:

determining whether the two nodes are connected to other nodes through active edges;

if the two nodes are connected to other nodes through the active edges, eliminating the active edges;

determining whether an existing leaf node has been converted into an internal node due to the edge converted into the inactive edge; and

if the existing leaf node has been converted into the internal node, connecting the initialized nodes through active edges, and then reconstructing the tree structure into a tree structure having a maximum number of leaf edges.

16. The method of claim 15, wherein reconstructing the tree structure is repeated until all of the nodes are included in the tree structure, thus reconstructing the tree structure.

17. The method of claim 13, further comprising, after generating the monitoring tree:

transmitting, by a first traffic collection unit, a communication request signal to a second traffic collection unit;

receiving, by the second traffic collection unit, the communication request signal;

transmitting, by the second traffic collection unit, a communication preparation signal to the first traffic collection unit;

receiving, by the first traffic collection unit, the communication preparation signal;

transmitting, by the first traffic collection unit, collected data traffic to the second traffic collection unit; and

transmitting, by the second traffic collection unit, the received data traffic to a management server.

18. The method of claim 17, wherein the first traffic collection unit includes traffic collection units corresponding to leaf nodes of the tree structure and not belonging to the monitoring tree, and the second traffic collection unit includes traffic collection units corresponding to internal nodes of the tree structure and belonging to the monitoring tree.

19. The method of claim 17, wherein the total weight of the edges does not include a weight of the first traffic collection unit, and includes only a weight of the second traffic collection unit.