• Proceedings of the Korea Information Processing Society Conference
• /
• 2002.11b
• /
• pp.1399-1402
• /
• 2002

네트워크 기반의 응용 서비스들이 다양하게 개발되고 업무 전산화로 인한 분산 컴퓨팅 환경이 확대됨에 따라 네트워크 트래픽은 증가 일로에 있다. 특히, 많은 트래픽이 집중되는 백본망에서는 제한된 자원을 효율적으로 사용하기 위하여 효과적인 트래픽 관리 방법이 요구되고 있다. 이를 위해서는 우선적으로 네트워크 트래픽의 총 양에 의한 정량적이고 단순 평면적인 정보가 아닌 네트워크 트래픽을 정밀 분석하고 특성을 파악할 수 있는 방법이 필요하며 또한 어느 한 순간의 데이터나 일괄처리 방식에 의한 분석이 아닌 실시간으로 장기적인 트래픽 측정 및 분석이 필요하다. 본 논문은 트래픽 측정방법 및 특성과 한국전력 백본망을 대상으로 네트워크 트래픽의 발원지로부터 목적지까지의 트래픽을 플로우별로 수집, 분석학 수 있는 트래픽 측정 및 분석 시스템에 대하여 기술하였다. 본 시스템은 백본망 전체의 트래픽을 지속적이며 실시간으로 이용자별, 시간대별, 프로토콜별, 응용 서비스별로 정보 추출이 가능하며 그래픽 환경과 웹 기반의 사용자 환경을 제공한다.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.40 no.11
• /
• pp.2160-2168
• /
• 2015

The SSL/TLS, one of the most popular encryption protocol, was developed as a solution of various network security problem while the network traffic has become complex and diverse. But the SSL/TLS traffic has been identified as its protocol name, not its used services, which is required for the effective network traffic management. This paper proposes a new method to generate service signatures automatically from SSL/TLS payload data and to classify network traffic in accordance with their application services. We utilize the certificate publication information field in the certificate exchanging record of SSL/TLS traffic for the service signatures, which occurs when SSL/TLS performs Handshaking before encrypt transmission. We proved the performance and feasibility of the proposed method by experimental result that classify about 95% SSL/TLS traffic with 95% accuracy for every SSL/TLS services.

• The KIPS Transactions:PartC
• /
• v.14C no.3 s.113
• /
• pp.199-208
• /
• 2007

In a ubiquitous network environment, detecting the leakage of personal information is very important. The leakage of personal information might cause severe problem such as impersonation, cyber criminal and personal privacy violation. In this paper, we have proposed a detection method of personal information leakage based on network traffic characteristics. The experimental results indicate that the traffic character of a real campus network shows the self-similarity and Proposed method can detect the anomaly of leakage of personal information by malicious code.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.29 no.7B
• /
• pp.641-649
• /
• 2004

We propose a dynamic traffic management model which uses adaptive priority reassignment algorithm to deliver service differentiation in home networks, and implement adaptive priority reassignment algorithm using FPGA. The proposed architecture is designed to handle home network traffic without the need for signaling protocol. We categorize home network traffic into three kinds of traffic class: control data traffic class, the Internet data and non-real-time data traffic class, and multimedia data traffic class (include non-real-time and real-time multimedia data traffic). To support differential service about these kinds of traffic class, we designed and implemented a traffic management framework that dynamically change each traffic class priority depending on bandwidth utilization of each traffic class.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.43 no.11 s.353
• /
• pp.192-199
• /
• 2006

Establishment of bandwidth and effective traffic processing are required to treat various traffics according to a rapid increase in Internet traffic. A path setup algorithm was introduced to support backbone franc processing but the failure probability is increasing according to fixed operation in nodes. In other words, fixed maximum permitted time can be raised failure probability. So as to solve this problem, this paper introduces variable path setup time algorithm which support channel service of excessive traffic that is generated from not allowed channel. We proposed GLSP(Generalized Label Switch Path) setup algorithm that use variable path setup time parameters. This algorithm can improve path setup probabilities of backbone network that is composed of fixed way.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.26 no.3
• /
• pp.667-678
• /
• 2016

Due to a development of the cable/wireless network infra, the traffic as big as unable to compare with the past is being served through the internet, the traffic is increasing every year following the change of the network paradigm such as the object internet, especially the traffic of about 1.6 zettabyte is expected to be distributed through the network in 2018. As the network traffic increases, the performance of the security infra is developing together to deal with the bulk terabyte traffic in the security equipment, and is generating hundreds of thousands of security events every day such as hacking attempt and the malignant code. Efficiently analyzing and responding to an event on the attack attempt detected by various kinds of security equipment of company is one of very important assignments for providing a stable internet service. This study attempts to overcome the limit of study such as the detection of Tor network traffic using the existing low-latency by classifying the anonymous network by means of the suggested algorithm about the event detected in the security infra.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.23 no.8
• /
• pp.1926-1940
• /
• 1998

This paper is the part II of research results on the performance evaluation of fully interconnected ATM switch, and includes the performance evaluation results for bursty traffic and nonuniform distribution. The switch model is a fyully interconnected switch type proposed by ETRI and is the proper architecutre for a small-sized switch element. The proposed switch consists of two steps of buffering scheme in the switch fabric in order to effectively absorb the effect of bursty nature of ATM traffic. The switch uses bit addressing method for addressing shcmeme and thus it is easy to implement multicasting function without adding additional functional block. In order to incorporate the bursty nature of traffic in ATM networks, we use IBP(Interrupted Bernoulli Process) model as an input traffic model as well as random traffic model which has been used as a traditional traffic model. In order to design the various scenarios for simulation, we considered both uniform and nonuniform output distribution, and also implemented multicast function. In this paper, we presented the simulation results in diverse environments and evaluated the performance of the switch.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.36 no.8B
• /
• pp.921-928
• /
• 2011

The increase of Internet users and services has caused the upsurge of data traffic over the network. Nowadays, variety of Internet applications has emerged which generates complicated and diverse data traffic. For the efficient management of Internet traffic, many traffic classification methods have been proposed. But most of the methods focused on the application-level classification, not the function-level classification or state changes of applications. The functional classification of application traffic makes possible the in-detail understanding of application behavior as well as the fine-grained control of applications traffic. In this paper we proposed automata based functional classification method of IM application traffic. We verified the feasibility of the proposed method with function-level control experiment of IM application traffic.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.25 no.3
• /
• pp.449-455
• /
• 2021

This paper proposes an encryption web transaction attack detection system based on the existing web application monitoring system. Although there was difficulty in detecting attacks on the encrypted web traffic because the existing web traffic security systems detect and defend attacks based on encrypted packets in the network area of the encryption section between the client and server, by utilizing the technology of the web application monitoring system, it is possible to detect various intelligent cyber-attacks based on information that is already decrypted in the memory of the web application server. In addition, since user identification is possible through the application session ID, statistical detection of attacks such as IP tampering attacks, mass web transaction call users, and DDoS attacks are also possible. Thus, it can be considered that it is possible to respond to various intelligent cyber attacks hidden in the encrypted traffic by collecting and detecting information in the non-encrypted section of the encrypted web traffic.

• Proceedings of the Korean Information Science Society Conference
• /
• 2002.10e
• /
• pp.280-282
• /
• 2002

최근 업무 전산화로 인한 분산 컴퓨팅 환경이 확대되고 네트워크 기반의 응용 서비스들이 다양하게 개발됨에 따라 네트워크 트래픽은 증가 일로에 있으며 어느 호스트에서 어떤 형태의 트래픽이 얼마만큼 유발되는지를 알아내는 일은 한정된 네트워크 자원을 효율적으로 활용하는데 매우 중요한 일이 되었다. 하지만, 현재의 네트워크관리시스템들은 트래픽 모니터링에 따른 통계값 제공 등의 단순 평면적인 정보만을 제공할 뿐, 네트워크를 정밀 분석하고 그에 따른 대책을 마련하기에는 미약하다. 따라서 효율적인 네트워크 자원 활용을 위하여 네트워크 트래픽을 자세히 분석하며, 네트워크 계층별, 지역별, 호스트별 및 응용 서비스 별로 트래픽을 측정 및 분석할 수 있는 시스템의 개발이 필요하다. 본 논문은 한국전력데이터통신망을 대상으로 네트워크 트래픽의 발원지로부터 목적지까지의 백본 및 LAN 구간에서의 트래픽을 플로우별로 수집, 분석할 수 있는 트래픽 분석 시스템을 설계 및 구현하였다본 시스템은 트래픽 측정을 위해 백본에서는 Netflow 기능을 이용하며, LAN 구간에서는 패킷 캡처 방식의 Probe를 이용한다. 이때 기존의 패킷 캡처 방식의 기능을 개선하여 이를 플로우화 함으로써 LAN구간에서도 동일한 인터페이스를 통하여 네트워크 트래픽을 분석할 수 있게 하였다.