An Ethernet link idle-time traffic dynamic insertion method and system

Abstract

The present invention relates to the field of network information security technology, and discloses a method and system for dynamically inserting idle-time traffic in an Ethernet link. The method detects the distribution of idle bandwidth based on multi-dimensional Ethernet link traffic tracking, and generates simulated traffic to be inserted into the idle bandwidth according to the detected real-time busy and idle conditions of the Ethernet link. The present invention solves the problems existing in the prior art, such as the inability to effectively conceal the user link traffic and bandwidth occupancy rules, etc.

Description

Technical Field

[0001] The present invention relates to the technical field of network information security, and particularly to a method and system for dynamically inserting idle-time traffic in an Ethernet link. Background Art

[0002] Ethernet is one of the main bearer technologies at the link layer. With the increasing attention of people to network information security, the demand for link-layer anti-detection is growing day by day. Especially at the exit of the local area network of some special users, in order to prevent malicious attackers from listening to and detecting the outgoing traffic and bandwidth occupancy of the user's local area network, and analyzing and obtaining the user's service and behavior rules, it is necessary to cover up the rules of outgoing traffic and bandwidth occupancy of the local area network. Currently, the commonly used method is to insert idle-time traffic using the idle bandwidth to cover up the user's service traffic and busy / idle rules. However, if the change of the user's service idle bandwidth cannot be predicted accurately and in real time, the insertion of idle-time traffic may affect the transmission of the user's normal service, resulting in incomplete transmission of the user's data. Currently, the insertion method of idle-time traffic generally takes the time period as the unit, and the inserted traffic is fixed and extremely small, and it is impossible to insert on demand and dynamically. Therefore, it cannot effectively cover up the user's link traffic and bandwidth occupancy rules.

[0003] Currently, Ethernet is widely used in the construction of information networks, including some special networks that carry and transmit important and sensitive information. In the above scenarios, in order to prevent malicious attackers from detecting the user's link traffic distribution and busy / idle conditions, and analyzing and obtaining the user's service and behavior characteristics and rules, it is often necessary to insert idle-time traffic to make the user's link traffic and bandwidth occupancy present a uniform distribution, so that the attacker cannot detect the user's real traffic and busy / idle rules. How to achieve effective, on-demand and dynamic insertion of idle-time traffic without affecting the normal service transmission of users has become the key to the idle-time traffic insertion function. Summary of the Invention

[0004] To overcome the deficiencies of the prior art, the present invention provides a method and system for dynamically inserting idle-time traffic in an Ethernet link, and solves the problems existing in the prior art such as the inability to effectively cover up the user's link traffic and bandwidth occupancy rules.

[0005] The technical solution adopted by the present invention to solve the above problems is:

[0006] A method for dynamically inserting idle-time traffic in an Ethernet link, based on multi-dimensional Ethernet link traffic tracking, detects the distribution of idle bandwidth, and generates simulated traffic according to the detected real-time busy / idle situation of the Ethernet link and inserts it into the idle bandwidth.

[0007] As a preferred technical solution, it includes the following steps:

[0008] S1, Link Detection: Based on multi-dimensional link traffic tracking, detect the distribution of idle bandwidth, analyze the real-time busy and idle status of the Ethernet link, and generate pre-evaluation information on the idle traffic demand and the idle traffic to be inserted in the current interval according to the preset link traffic masking demand threshold.

[0009] S2, Traffic Insertion: Based on the real-time busy and idle status of the Ethernet link, insert simulated traffic into the Ethernet link according to the preset link traffic masking demand threshold to achieve uniform distribution of the Ethernet link traffic.

[0010] As a preferred technical solution, step S1 includes the following steps:

[0011] S11, Detect the multi-dimensional status of the Ethernet link in units of time windows.

[0012] S12, Based on the detection results of the multi-dimensional status of the Ethernet link, conduct link busy and idle detection and analysis.

[0013] As a preferred technical solution, in step S11, the multi-dimensions include the following dimensions: number of packets, packet length, traffic, and bandwidth.

[0014] As a preferred technical solution, in step S11, analyze the bandwidth occupancy information within the window time according to the monitoring of the effective Ethernet data volume.

[0015] As a preferred technical solution, in step S11, analyze the idle bandwidth distribution information within the window time according to the monitoring of the frame gap situation.

[0016] As a preferred technical solution, in step S11, analyze the link bearing characteristics of user information according to the monitoring of the number of packets and packet length.

[0017] As a preferred technical solution, in step S11, step S12 includes the following steps:

[0018] S121, Conduct correlation analysis on the different dimension information obtained and analyzed within the time window, obtain the bandwidth occupancy rate, packet length characteristics, and remaining bandwidth situation information of this time window, and then combine with the preset link traffic masking demand threshold to form pre-evaluation information on the idle traffic insertion demand within this window.

[0019] S122, Conduct correlation statistics and analysis on the analysis conclusions and pre-evaluation information of several adjacent time windows to form the link transmission characteristics within the set interval, the idle traffic generation information within this interval, and the insertion control information; where the interval refers to a period of time formed by multiple consecutive time windows.

[0020] As a preferred technical solution, step S2 includes the following steps:

[0021] S21. Combine the pre-evaluation information of the off-peak traffic demand, adjust the distribution of the idle bandwidth of the user link within the same time window and between adjacent time windows, and integrate them together to ensure that the distribution of the bandwidth occupied by the user and the idle bandwidth meets the preset link traffic masking demand threshold, and the distribution of the idle bandwidth matches the off-peak traffic to be inserted in this interval;

[0022] S22. Allocate the multiplexing method of the idle bandwidth according to the preset link traffic masking demand threshold, determine the packet length of the off-peak traffic and the specific position to be inserted into the original data stream;

[0023] S23. Insert the off-peak traffic with different packet lengths pre-generated into the specific position in the original data stream according to the position and length information of the off-peak traffic insertion.

[0024] An off-peak traffic dynamic insertion system for an Ethernet link, used to implement the off-peak traffic dynamic insertion method for an Ethernet link, includes the following modules connected in sequence:

[0025] Link detection module: Based on multi-dimensional link traffic tracking, detect the distribution of the idle bandwidth, analyze the real-time busy and idle status of the Ethernet link, and generate the pre-evaluation information of the off-peak traffic demand and the off-peak traffic to be inserted in the current interval according to the preset link traffic masking demand threshold;

[0026] Traffic insertion module: Based on the real-time busy and idle status of the Ethernet link, insert simulated traffic into the Ethernet link according to the preset link traffic masking demand threshold to achieve uniform distribution of the Ethernet link traffic.

[0027] Compared with the prior art, the present invention has the following beneficial effects:

[0028] (1) The real-time detection and analysis mechanism for the Ethernet link traffic distribution and busy and idle conditions created by the present invention can track and obtain the busy and idle status information of the Ethernet link in real time;

[0029] (2) The off-peak traffic dynamic insertion method based on the statistical multiplexing of the idle bandwidth of the Ethernet frame created by the present invention can insert simulated traffic using the idle bandwidth according to the preset link traffic masking demand without affecting the normal service traffic of the user, so as to achieve uniform distribution of the link traffic;

[0030] (3) Through the collaborative work of the above two innovative methods, the present invention can insert off-peak traffic on demand and dynamically according to the preset link traffic masking demand and the real-time change of the user service traffic, so that the link traffic and bandwidth occupancy present a uniform distribution, thereby masking the real traffic, bandwidth and busy and idle rules of the user link. Description of the Drawings

[0031] Figure 1 This is the principle block diagram of the present invention. Detailed implementation manners

[0032] The present invention will be further described in detail below in conjunction with embodiments and the accompanying drawings, but the implementation manners of the present invention are not limited thereto.

[0033] Embodiment 1

[0034] As Figure 1 shown, the present invention is a solution proposed for the problems of real-time, dynamic, and on-demand adjustment of idle-time traffic insertion.

[0035] Combining the Ethernet link protocol and transmission principle, the present invention first creates a multi-dimensional detection and analysis mechanism for link traffic and idle bandwidth distribution based on the combination of the number of Ethernet packets, packet length, traffic, and bandwidth. Further, based on the detection and analysis results, a method for dynamically inserting idle-time traffic based on statistical multiplexing of Ethernet link idle bandwidth is creatively proposed. Without affecting the normal outbound traffic of the user local area network, according to the detected real-time busy and idle conditions of the link, analog traffic is generated on demand and inserted into the idle bandwidth to ensure the overall uniform distribution of link traffic and achieve the purpose of masking the user traffic and bandwidth occupancy.

[0036] The principle block diagram of the present invention is as Figure 1 shown.

[0037] The present invention first creates a multi-dimensional detection and analysis mechanism for the distribution of link traffic and idle bandwidth based on the combination of the number of Ethernet packets, packet length, traffic, and bandwidth, which can track and analyze the real-time busy and idle states of Ethernet links in real time. This mechanism is the first innovation point of the present invention. This innovation point includes two parts: The first part is to design a multi-dimensional link state detection mechanism in units of time windows, including: ① Analyze the bandwidth occupancy information within the window time according to the monitoring of the effective Ethernet data volume; ② Analyze the idle bandwidth distribution information within the window time according to the monitoring of the frame gap situation; ③ Analyze the link bearing characteristics of user information according to the monitoring of the number of packets and packet length. The second part is to further design a link busy and idle detection and analysis mechanism based on the multi-dimensional link state detection results, including: ① According to the above time window, perform correlation analysis on the information obtained and analyzed in different dimensions within this window to obtain information such as the bandwidth occupancy rate, packet length characteristics, and remaining bandwidth situation in this time window, and then combine the preset link traffic masking requirement threshold to form pre-evaluation information on the idle traffic insertion requirement within this window; ② Perform correlation statistics and analysis on the analysis conclusions and pre-evaluation information of several adjacent time windows to form link transmission characteristics, idle traffic generation information (such as: the packet length and number of packets of the idle traffic to be generated, etc.), and insertion control information within a certain interval (continuous n time windows, n can be configured as required). Through the cooperation of the above two parts, the busy and idle states of Ethernet links can be analyzed in real time. According to the busy and idle state conditions, on the premise of not affecting the normal business of users, according to the preset link traffic masking requirement threshold, pre-evaluation information on the idle traffic requirement in the current interval and the idle traffic to be inserted can be generated.

[0038] The second innovation point of the present invention is a method for inserting idle-time traffic based on statistical multiplexing of idle bandwidth of Ethernet links. Without affecting the normal service traffic of users, simulated traffic is inserted according to a preset threshold for covering link traffic requirements, so as to achieve uniform distribution of link traffic. The details of this innovation point are as follows: First, combining the pre-evaluation information of idle-time traffic requirements, the distribution of idle bandwidth of user links within the same time window and between adjacent time windows is integrated and adjusted to ensure that the distribution of occupied bandwidth and idle bandwidth of users meets the preset threshold for covering link traffic requirements, and the distribution of idle bandwidth matches the idle-time traffic to be inserted in this interval. Integration and adjustment mean adjusting the positions of the idle bandwidth in adjacent time windows and integrating them together for inserting idle-time traffic packets of effective length (because there are requirements for the length of Ethernet packets, and if the idle bandwidth in some time windows is not enough to insert a normal packet length, this part of the idle bandwidth is integrated with the idle bandwidth of other windows for use). Second, according to the preset threshold for covering link traffic requirements, the multiplexing method of idle bandwidth is allocated to determine the position and length of idle-time traffic insertion (determine the packet length of idle-time traffic and the specific position inserted into the original data stream). Finally, according to the position and length information of idle-time traffic insertion, idle-time traffic of different packet lengths pre-generated is inserted into the corresponding positions. Through the above method, without affecting the normal service traffic of users, simulated traffic can be inserted according to the preset threshold for covering link traffic requirements to achieve uniform distribution of link traffic.

[0039] In summary, the innovative points of this method are as follows:

[0040] First, according to the principle of Ethernet links, a multi-dimensional detection and analysis mechanism of link traffic and idle bandwidth distribution combining the number of Ethernet packets, packet length, traffic, and bandwidth is used to obtain the bandwidth distribution and idle window information of Ethernet links in real time.

[0041] Second, a method for inserting idle-time traffic based on statistical multiplexing of idle bandwidth of Ethernet frames generates simulated traffic and dynamically inserts it into idle bandwidth as needed to achieve uniform distribution of link traffic and complete the covering of user traffic and bandwidth occupancy.

[0042] The real-time detection and analysis mechanism for Ethernet link traffic distribution and busy / idle conditions created by the present invention can track and obtain the busy / idle state information of Ethernet links in real time.

[0043] The method for dynamically inserting idle-time traffic based on statistical multiplexing of idle bandwidth of Ethernet frames created by the present invention can, without affecting the normal service traffic of users, insert simulated traffic using idle bandwidth according to the preset threshold for covering link traffic requirements to achieve uniform distribution of link traffic.

[0044] Through the collaborative work of the above two innovative methods, the present invention can, according to the preset link traffic masking requirements, dynamically insert idle traffic as needed based on the real-time changes in the user service traffic, so that the link traffic and bandwidth occupancy present a uniform distribution, thereby masking the true traffic, bandwidth, and busy / idle patterns of the user link.

[0045] In summary, the present invention provides an effective solution for real-time, effective, and dynamic masking of the traffic and bandwidth occupancy of Ethernet links, and can be applied to various Ethernet networks with requirements for masking user traffic and bandwidth occupancy.

[0046] As described above, the present invention can be preferably implemented.

[0047] All features disclosed in all embodiments in this specification, or all steps in the methods or processes implicitly disclosed, except for mutually exclusive features and / or steps, can be combined and / or extended and replaced in any way.

[0048] The above description is only a preferred embodiment of the present invention, and does not impose any formal limitation on the present invention. Based on the technical essence of the present invention, any simple modification, equivalent replacement, and improvement made to the above embodiments within the spirit and principle of the present invention still fall within the protection scope of the technical solution of the present invention.

Claims

1. A method for dynamically inserting idle traffic in an Ethernet link, characterized in that, Based on multi-dimensional Ethernet link traffic tracking, detect the distribution of idle bandwidth. According to the detected real-time busy and idle conditions of the Ethernet link, generate simulated traffic and insert it into the idle bandwidth, including: S1, link detection: Based on multi-dimensional link traffic tracking, detect the distribution of idle bandwidth, analyze the real-time busy and idle states of the Ethernet link, and generate pre-evaluation information on the idle traffic demand in the current interval and the idle traffic to be inserted according to the preset link traffic masking requirement threshold; S2, traffic insertion: Based on the real-time busy and idle states of the Ethernet link, insert simulated traffic into the Ethernet link according to the preset link traffic masking requirement threshold to achieve uniform distribution of the Ethernet link traffic.

2. The method for dynamically inserting idle traffic in an Ethernet link according to claim 1, characterized in that, Step S1 includes the following steps: S11, perform multi-dimensional detection of the Ethernet link state in time windows; S12, based on the results of multi-dimensional Ethernet link state detection, perform link busy and idle detection and analysis.

3. The method for dynamically inserting idle traffic in an Ethernet link according to claim 2, characterized in that, In step S11, the multi-dimensions include the following dimensions: number of packets, packet length, traffic, and bandwidth.

4. The method for dynamically inserting idle traffic in an Ethernet link according to claim 3, characterized in that, In step S11, according to the monitoring of the effective Ethernet data volume, analyze the bandwidth occupancy information within the window time.

5. The method for dynamically inserting idle traffic in an Ethernet link according to claim 3, characterized in that, In step S11, according to the monitoring of the frame gap situation, analyze the idle bandwidth distribution information within the window time.

6. The method for dynamically inserting idle traffic in an Ethernet link according to claim 3, characterized in that, In step S11, according to the monitoring of the number of packets and packet length, analyze the link bearing characteristics of user information.

7. The method for dynamically inserting idle traffic in an Ethernet link according to claim 2, characterized in that, Step S12 includes the following steps: S121, perform correlation analysis on the different-dimensional information obtained and analyzed within the time window, obtain the bandwidth occupancy rate, packet length characteristics, and remaining bandwidth situation information of this time window, and then combine the preset link traffic masking requirement threshold to form pre-evaluation information on the idle traffic insertion demand within this window; S122, perform correlation statistics and analysis on the analysis conclusions and pre-evaluation information of several adjacent time windows to form the link transmission characteristics within the set interval, the idle traffic generation information within this interval, and the insertion control information; where the interval refers to a period of time formed by multiple consecutive time windows.

8. The method for dynamically inserting idle traffic in an Ethernet link according to any one of claims 1 to 7, characterized in that, Step S2 includes the following steps: S21, in combination with the pre-evaluation information on the idle traffic demand, adjust the positions of the idle bandwidth in the user link idle bandwidth distribution within the same time window and between adjacent time windows and integrate them together to ensure that the distribution of the user occupied bandwidth and the idle bandwidth meets the preset link traffic masking requirement threshold, and the distribution of the idle bandwidth matches the idle traffic to be inserted in this interval; S22, allocate the multiplexing method of the idle bandwidth according to the preset link traffic masking requirement threshold, determine the packet length of the idle traffic and the specific position to be inserted into the original data stream; S23, insert the idle traffic with different packet lengths pre-generated into the specific position in the original data stream according to the position and length information of the idle traffic insertion.

9. An Ethernet link idle traffic dynamic insertion system, characterized in that, An Ethernet link idle traffic dynamic insertion method for implementing any one of claims 1 to 8, includes the following modules connected in sequence: Link detection module: used to detect the distribution of idle bandwidth based on multi-dimensional link traffic tracking, analyze the real-time busy and idle state of the Ethernet link, and generate pre-evaluation information on the idle traffic demand and idle traffic to be inserted in the current interval according to the preset link traffic masking demand threshold. Traffic insertion module: used to insert simulated traffic into the Ethernet link according to the preset link traffic masking demand threshold based on the real-time busy and idle state of the Ethernet link, so as to achieve uniform distribution of the Ethernet link traffic.

Images