公开(公告)号：KR100736914B1

公开(公告)日：2007-07-10

申请号：KR1020060063387

申请日：2006-07-06

Applicant: 한국정보통신대학교 산학협력단

Inventor： 한영태 ,  박홍식 ,  조용현 ,  이병일 ,  김진철 ,  하상용 ,  신상철

IPC: H04L12/28

Abstract: A method for identifying an application service in a BcN(Broadband convergence Network) is provided to be utilized for designing a BcN, analyzing a failure, and creating an application service weather map, and effectively manage the BcN. Transmitted packets are collected, start and destination IP address and port information of each collected packet are obtained, and packets having the common start and destination IP address and port information are grouped(S100,S200,S300). The pre-set number of packets having the same start or destination IP address and port information are sampled in the respective groups, payload data of the sampled packets is obtained, and application services are primarily identified according to a signature or a protocol mapping by using the payload data(S400,S500,S600). Each different weight value is applied to the primarily identified application services, and an application service having the largest value is identified as the final application service in a corresponding group(S700).

Abstract translation: 提供了一种用于在BcN（宽带会聚网络）中识别应用服务的方法，用于设计BcN，分析故障并创建应用服务天气图，并且有效地管理BcN。 收集发送的数据包，获得每个收集的数据包的起始和目的地IP地址和端口信息，并将具有共同的起始和目的地IP地址和端口信息的数据包分组（S100，S200，S300）。 在相应的组中采样具有相同开始或目的地IP地址和端口信息的预设数目的分组数据，获得采样分组的有效载荷数据，并且应用服务主要根据签名或通过使用协议映射来识别 有效载荷数据（S400，S500，S600）。 将每个不同的权重值应用于主要识别的应用服务，并且将具有最大值的应用服务识别为相应组中的最终应用服务（S700）。

公开(公告)号：KR1020080061055A

公开(公告)日：2008-07-02

申请号：KR1020060135834

申请日：2006-12-28

Applicant: 한국정보통신대학교 산학협력단

Inventor： 강대희 ,  한영태 ,  박홍식 ,  이영로 ,  하상용 ,  김진철 ,  조용현 ,  류지현

IPC: H04L12/24 ,  H04L12/28

CPC classification number: H04L47/2483 ,  H04L43/026 ,  H04L43/18 ,  H04L69/22

Abstract: A system and a method for identifying a P2P application service are provided to maintain a network safely and effectively by finding an abnormal traffic like a worm virus in managing the network. A method for identifying a P2P application service comprises the following several steps. A flow generator collects IP packets and generates a flow(S200). A port number based identifier identifies a P2P application service on the basis of the port number by using the generated flow(S201). If the P2P application service is identified(S202), an checking unit checks the identified application service(S203). If the application service is not correctly identified(S204) or the P2P application service is not identified in the step S202, a payload based identifier identifies the P2P application service on the basis of the payload(S205). If the P2P application service identified on the basis of the payload(S206) or the identification is checked in the step S204, a SET table generator generates a SET table by using the identified application service flow(S207). A SET table based identifier identifies a P2P application service by using the SET table with respect to a flow not identified via the port number based identification or the payload based identification(S208).

Abstract translation: 提供了一种用于识别P2P应用服务的系统和方法，以通过在管理网络中发现像蠕虫病毒这样的异常流量来安全有效地维护网络。 一种用于识别P2P应用服务的方法包括以下几个步骤。 流发生器收集IP包并产生流（S200）。 基于端口号的标识符通过使用生成的流程，基于端口号识别P2P应用服务（S201）。 如果P2P应用服务被识别（S202），则检查单元检查所识别的应用服务（S203）。 如果在步骤S202中没有正确识别应用服务（S204）或P2P应用服务，则基于有效载荷的标识符基于有效载荷来识别P2P应用服务（S205）。 如果在步骤S204中检查基于有效载荷识别的P2P应用服务（S206）或识别，则SET表生成器通过使用识别的应用服务流程生成SET表（S207）。 基于SET表的标识符通过使用关于未通过基于端口号的识别或基于有效载荷的标识识别的流的SET表来识别P2P应用服务（S208）。