Traffic measurement system and traffic analysis method thereof

• US 7,508,768 B2
• Filed: 10/23/2003
• Issued: 03/24/2009
• Est. Priority Date: 12/13/2002
• Status: Active Grant

• Current Assignee: Electronics and Telecommunications Research Institute
• Original Assignee: Electronics and Telecommunications Research Institute
• Inventors: Kim, Chang Hoon, Jeong, Tae Soo, Yoon, Seung Hyun, Choi, Tae Sang, Park, Jeong Sook, Chung, Hyung Seok, Kim, Hyung Hwan
• Primary Examiner(s): Orgad; Edan
• Assistant Examiner(s): HALIYUR, VENKATESH N
• Application Number:
  US10/693,416
• Publication Number:
  US 20050249125A1
• Time in Patent Office: 1,979 Days
• Field of Search: 370229-241, 370252-254, 370/338, 370/392, 370/401, 370/395.32, 370/395.52, 709224-232
• US Class Current: 370/252
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/045 for graphical visualisation of monitoring data
• CPC Class Codes: H04L 43/062 related to network traffic

Abstract

A traffic measurement system and a traffic analysis method are provided. The traffic measurement system includes a plurality of measurement devices that collect all of packets flowing through Internet links, extract traffic data required to analyze traffic from the collected packets, and process the extracted data into predetermined flow types, and an analysis server that identifies applications of traffic by analyzing the traffic data transferred from the plurality of measurement devices as a whole, classifies the identified applications into predetermined traffic types, and outputs the classification result. The traffic measurement system measures the traffics in the Internet network and processes the measured traffics to generate detailed traffic statistical data according to applications. In particular, the traffics are analyzed considering measurement data from various points, and the data for identifying the applications are extracted from headers of the applications included in payloads of IP packets in real time. Accordingly, detailed traffic analysis result is provided.

Claims

1. A traffic measurement system comprising:

a plurality of measurement devices that collect packets flowing through Internet links between routers, extract traffic data required to analyze traffic from the collected packets, and process the extracted data into predetermined flow types; and

an analysis server that identifies applications of traffic by analyzing the traffic data transferred from measurement devices, classifies the identified applications into predetermined traffic types, and outputs the classification result,

and the traffic types comprise;

a first traffic type whose applications are identified using only TCP/UDP port numbers;

a second traffic type whose application is identified by collecting application headers and application signatures that are included in payloads of the packets;

a third traffic type whose applications are identified by extracting application data from the second traffic type, since application data is not included in reverse traffic of the second traffic type;

a forth traffic type whose applications are assigned predetermined port numbers are identified based on application signature of other flows since the port numbers are exchanged through an other control flow; and

a fifth traffic type whose applications are not classified into the first through the fourth traffic types.

2. The traffic measurement system of claim 1, further comprising a plurality of time receiving devices that extract time signals from a GPS satellite or a CDMA base station to synchronize the times of the plurality of measurement devices.

3. The traffic measurement system of any one of claims 1 and 2, wherein each of the plurality of measurement devices comprises:

a packet collection unit that collects the packets flowing through the Internet lines from router connection lines and records the collection times of the packets;

a flow generation unit that generates flows using the packets having the same data including a target address, a protocol, and a port number, from the packets collected by the packet collection unit, extracts data required for detailed analysis of the applications after analyzing the contents of the packets, and stores the extracted data according to the flow; and

a transfer unit that transfers the data stored in the flow generation unit to the analysis server according to a predetermined time interval.

4. The traffic measurement system of claim 3, wherein the packet collection unit collects the packets by using one of tapping, port mirroring, and signal distribution.

5. The traffic measurement system of claim 3, wherein the data required for detailed analysis of the applications are application signatures for identifying the applications in payload of the packets.

6. The traffic measurement system of any one of claims 1 and 2, wherein the analysis server comprises:

a data receiving unit that receives the packet data from the plurality of measurement devices;

a traffic analysis unit that analyzes the data provided from the plurality of measurement devices via the data receiving unit as a whole, and classifies the applications into the traffic types according to the analysis result;

a data storing unit that stores the traffic analysis result of the traffic analysis unit; and

a user interface that displays the traffic analysis result stored in the data storing unit to a user after processing the traffic analysis result into various types desired by the user.

7. The traffic measurement system of claim 6, wherein the analysis server further comprises a report output unit that processes the traffic analysis result from the traffic analysis unit into a predetermined report type and stores the processed data in the data storing unit, and the report is displayed to the user through the user interface.

14. The traffic measurement system of claim 1, wherein the analysis server receives the traffic data from the plurality of measurement devices as a whole.

8. A traffic analysis method performed in a traffic measurement system that collects packets flowing through Internet links between routers, analyzes traffic, and identifies the applications of the packets, the method comprising:

classifying a first traffic type whose applications are identified using only port numbers included in flow data that is processed into a predetermined type;

classifying a second traffic type whose applications are identified by collecting application headers and application signature that are included in payload of the packets, from the flow data remaining after the first traffic type is classified;

classifying a third traffic type whose applications are identified by analyzing the flow data remaining after the second traffic type is classified and reverse-direction flow data of the flow that are measured at different points as a whole, wherein the third traffic type is identified based on an application signature from other flows since the port numbers are exchanged through other control flows;

classifying a fourth traffic type whose applications are identified by analyzing the flow data remaining after the third traffic type is classified and flow data measured at different points, since port numbers for the applications are not predetermined;

classifying a fifth traffic type whose applications cannot be identified using the flow data remaining after the fourth traffic type is classified; and

taking statistics on traffic classified into the fifth traffic type in order to monitor the applications and storing the statistics result, after classifying the fifth traffic type.

9. The traffic analysis method of claim 8, wherein the flow data is packets having the same target address, the same protocol, and the same port number among the packets flowing through the Internet lines.

10. The traffic analysis method of claim 8, further comprising determining whether identification data of the fourth traffic type is present in traffic included classified into the first traffic type and extracting and storing the application signature of the fourth traffic type, after classifying the first traffic type.

11. The traffic analysis method of claim 8, further comprising extracting and storing the application signature of traffic classified into the third traffic type when traffic classified into the second traffic type is backward traffic of traffic classified into the third traffic type, after classifying the second traffic type.

12. The traffic analysis method of claim 8, further comprising determining whether identification data of the fourth traffic type is present in traffic classified into the second traffic type and extracting and storing the application signature of the fourth traffic type, after classifying the second traffic type.

13. The traffic analysis method of claim 8, further comprising processing the classified traffic types into predetermined report types desired by a user and storing or providing the processed report through a user interface, after classifying the fifth traffic type.