Hybrid network monitoring system based on active network technology

Abstract

The invention discloses a hybrid network monitoring system based on an active network technology, which is provided with an active node host, a proxy host and a mirror host, and is characterized in that the active node host is a node host participating in monitoring in an active network or a node host with active node capability in a traditional network; active applications of the active node hostare composed of five active applications including an extension engine, a collection engine, an interception engine, a tracing engine and a management engine. The hybrid network monitoring system based on the active network is provided by utilizing the computing power of the intermediate node of the active network, overcomes the defects of the traditional network monitoring system on the basis ofmonitoring compatibility with the traditional monitoring system, expands the functions of the traditional network monitoring system, and is lower in cost and convenient to popularize and use.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a hybrid network monitoring system based on active network technology. Background technique [0002] Traditional network monitoring systems generally adopt the Manager / Agent model, where the Manager is the central management device; the Agent is the monitoring agent device; its typical architecture is as follows: figure 1 As shown, in this structure, there are usually multiple Agents, and they are distributed on different monitoring points, and there is usually one Manager, located in the centralized management center. Agent is responsible for collecting data packets on monitoring points, and forwarding specific data packets to Manager according to the rules. Manager often adopts a layered structure, including information collection layer, information extraction layer and information mining layer. The information collection layer collects each The data message sent by the A...

AI Technical Summary

Problems solved by technology

Considering the performance, the function of the Agent side is often relatively simple, generally only responsible for the collection of data packets

This causes the Manager to receive a large amount of information that may be useless, thereby reducing the extraction of useful information

[0005] 2. Only limited active actions can be taken to discover suspicious behaviors: When traditional network monitoring systems discover suspicious behaviors or even intrusions, they often can only take passive actions or limited active actions

Neither of these two behaviors can take comprehensive and proactive measures against suspicious subjects

[0006] 3. Unable to locate the subject of network behavior well: the application of the Internet is becoming more and more widespread, there are more and more online attacks, and the attack methods are becoming more and more sophisticated

This makes it impossible for the traditional network monitoring system to locate the main body of the network behavior, that is, the attacking party, purely based on the collected data packets.

[0007] 4. It cannot be well expanded to handle data packets of unknown protocols. With the continuous development of the network, there are more and more network transport layer protocols

If the monitoring system cannot understand these unknown protocols well, it cannot process the corresponding protocol packets well.

The traditional network monitoring system can only adapt to the data packets of the new protocol by continuously upgrading the Agent

Images