• Annual Conference of KIPS
• /
• 2011.11a
• /
• pp.718-721
• /
• 2011

웹 서비스를 대상으로 하는 DDoS(Distributed Denial-of-Service) 공격 또는 유해 트래픽 유입을 탐지 또는 차단하기 위한 목적으로 HTTP(Hypertext Transfer Protocol) 트래픽을 실시간으로 분석하는 기능은 거의 모든 네트워크 트래픽 보안 솔루션들이 탑재하고 있는 필수적인 요소이다. 하지만, HTTP 트래픽의 실시간 데이터 측정 양이 시간이 지날수록 기하급수적으로 증가함에 따라, HTTP 트래픽을 실시간 패킷 단위로 분석한다는 것에 대한 성능 부담감은 날로 커지고 있는 실정이다. 이제는 응용 어플리케이션 차원에서는 성능에 대한 부담감을 해소할 수 없기 때문에 고비용의 소프트웨어 가속기나 하드웨어에 의존적인 전용 장비를 탑재하여 해결하려는 시도가 대부분이다. 본 논문에서는 현재 대부분의 PC 에 탑재되어 있는 그래픽 카드의 GPU(Graphics Processing Units)를 범용적으로 활용하고자 하는 GPGPU(General-Purpose computation on Graphics Processing Units)의 연구에 힘입어, NVIDIA사의 CUDA(Compute Unified Device Architecture)를 사용하여 네트워크 트래픽에서 HTTP 패킷 추출성능을 응용 어플리케이션 차원에서 향상시켜 보고자 하였다. HTTP 패킷 추출 연산만을 기준으로 GPU 의 연산속도는 CPU 에 비해 10 배 이상의 높은 성능을 얻을 수 있었다.

• The KIPS Transactions:PartC
• /
• v.12C no.5 s.101
• /
• pp.679-686
• /
• 2005

Because EPON access network shares a medium and aggregates the traffic from EPON subscribers, scheduling media access control on EPON bandwidth allocation is very important. Furthermore DBA mechanism of EPON based on TDMA is out of specification and up to implementation. This paper deals with a DBA method to guarantee the QoS of the delay sensitive traffic on the base of best-effort service and delay priority queue management. The proposed method performs virtual scheduling algorithm for the integrated traffic. It uses the same MAC messages and tries to guarantee the QoS of higher priority traffic first with a simple DBA architecture. We evaluate the algorithm for traffic delay according to polling interval and traffic load of upstream and downstream. The results show that the proposed method can guarantee the QoS of the delay sensitive traffic with priority of the service classes.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.5A
• /
• pp.441-450
• /
• 2006

Recently, with the exponential growth of the number of Internet users, IP traffic which occupies more than 90 percent of the entire Internet traffic affects significantly to the performance of networks. Therefore, the design of the self-similar traffic generator reflected the feature of IP traffic is very important to design the networks efficiently and evaluate the performance of it correctly. In this paper, we design the self-similar traffic generator using OPNET. In order to implement the self-similar characteristics, ON-OFF sources with Pateto distribution are employed and aggregated. The designed self-similarity traffic generator is evaluated and verified with R/S plot, variance time(VT) plot under the various offered loads and the number of sources. It is expected that the designed self-similar traffic generator can be put to practical use when wire or wireless networks is designed and verified as well as it can be useful to decide the specific parameter value for Internet traffic modeling.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.1C
• /
• pp.107-115
• /
• 2005

ATC (Abnormal traffic controller) is presented as next generation security technology to securely support reliable Internet service and to guarantee network survivability, which is deployed in Internet access point. The key concept of the ATC is abnormal traffic monitoring and traffic control technology. When fault factors exist continuously and/or are repeated, abnormal traffic control guarantees service completeness as much as possible. The ATC with control policy on abnormal traffic is superior to the ATC with blocking policy as well as conventional network node, when the ratio of effective traffic to abnormal traffic is higher than $30{\%}.$ When traffic intended unknown attack occurs, network IDS is high false positive probability and so is limited to apply. In this environment, the ATC can be a key player to help the network node such as router to control abnormal traffic.

• Journal of Internet Computing and Services
• /
• v.5 no.4
• /
• pp.63-76
• /
• 2004

For efficient design and operation of a communication network, precise simulation of network characteristics is essential. This issue has been the focus of research by several groups. In this study, we first modeled the HTTP traffic which would be employed on simulation on the level of application using the real collected traffic data. There are two different viewpoints on the characteristics of web traffic pattern, Poisson distribution and self-similar characteristics. In our study, the results show that web traffic characteristics do not depend on only one type of distribution, but the traffic can be modeled as composition of these depending on the size of response of Web server. This implicates that the web traffic can be modeled as the combination of two characteristics. We also found that the characteristics of Web traffic rely on the properties of web servers. This result was deployed as a traffic generator in implementing the network simulator (NetDAS).

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.37 no.5B
• /
• pp.348-356
• /
• 2012

The application traffic analysis is getting more and more challenging due to the huge amount of traffic from high-speed network link and variety of applications running on wired and wireless Internet devices. Multi-level combination of various analysis methods is desired to achieve high completeness and accuracy of analysis results for a real-time analysis system, while requires much of processing burden on the contrary. This paper proposes a novel architecture for a real-time traffic analysis system which improves the processing performance on multi-core CPU environment. The main contribution of the proposed architecture is an efficient parallel processing mechanism with multiple threads of various analysis methods. The feasibility of the proposed architecture was proved by implementing and deploying it on our campus network.

• Journal of the Korea Academia-Industrial cooperation Society
• /
• v.15 no.8
• /
• pp.5256-5262
• /
• 2014

Recently, Distributed Denial of Service (DDoS) attacks, such as spreading malicious code, cyber-terrorism, have occurred in government agencies, the press and the financial sector. DDoS attacks are the simplest Internet-based infringement attacks techniques that have fatal consequences. DDoS attacks have caused bandwidth consumption at the network layer. These attacks are difficult to detect defend against because the attack packets are not significantly different from normal traffic. Abnormal traffic is threatening the stability of the network. Therefore, the abnormal traffic by generating indications will need to be detected in advance. This study examined the abnormal traffic detection technique using a forecasting model-based trend model.

• Annual Conference of KIPS
• /
• 2006.05a
• /
• pp.901-904
• /
• 2006

인터넷 사용자들의 무선 네트워크의 활용빈도가 점차 높아지고 무선 네트워크의 보안시스템도 요구되면서 무선 네트워크의 안정적이고 원활한 활용과 사용자의 정보 노출의 위험을 줄이고자 유무선 통합형 IDS/IPS도 개발되고 있는 단계다. 본 논문에서는 무선랜 환경을 지원하는 유무선 IPS시스템을 구현하고, 비정상적인 트래픽 탐지의 효율성을 높여 IPS 시스템의 성능향상에 기여정도를 파악 및 분석하였다. 본 논문에서 구축한 IPS시스템은 하이브리드 형태로 구현하였으며 Snort-inline[11]과 Snort-wireless[12] 모듈을 사용하여 무선 랜 이상탐지 기능을 구현하였다. 네트워크 모니터링 시스템으로 네트워크의 트래픽 상황을 파악하여 비정상적인 트래픽이 증가되었을 경우, 제안한 IPS시스템에서 비정상 트래픽의 탐지 및 차단 기능을 기존 IPS와 성능을 비교/분석하였다.

• Electronics and Telecommunications Trends
• /
• v.14 no.4 s.58
• /
• pp.10-22
• /
• 1999

본 고에서는 ATM 교환기에서 비실시간 트래픽를 수용하기 위한 버퍼 관리방법에 대하여 조사하고 분석하였다. ATM 교환기는 고속으로 교환하지만 트래픽이 많을 경우 혼잡이 발생할 수 있으므로 비실시 간 트래픽을 제어하여 사용자가 요구하는 다양한 서비스 품질(Quality of Service: QoS)을 제공해야 한다. TCP는 대표적인 비실시간 트래픽으로서 교환 및 전송중에 패킷 손실이 발생하는 경우 양 종단의 TCP에서 재전송 및 TCP 흐름 제어를 한다. 본 고에서는 ATM 교환기에서 제한된 버퍼를 효율적으로 활용하기 위하여 버퍼 부족현상이 예견되는 경우 패킷 폐기 정책에 따라 패킷을 폐기함으로써 TCP 계층에서의 처리량(goodput)을 증대시키는 방법을 검토하였다. 아울러 다중점대점 연결을 제공하는 가 상채널 병합(VC merging) 기능을 구현하기 위한 ATM 교환기의 버퍼 요구사항과 지연에 대하여 살펴 보았다.

• Journal of the Korea Institute of Information and Communication Engineering
• /
• v.9 no.5
• /
• pp.981-985
• /
• 2005

In the NGN, QoS must be offered. We try to apply QoS technology and MPLS which makes them possible to support rapidly increasing traffic and franc engineering to maintain steady infra to the environment of MPLS traffic engineering. In this paper, we supplement the defect of the traditional MPLS traffic engineering and apply the technology of QoS. To construct far more steady infra, we suggest the way of its development and advanced protocol(ERSVP) compared to traditional protocol.