Method and system for extracting access control list

Patent metadata

Field	Value
Publication number	US-2016006740-A1
Application number	US-201514693782-A
Country	US
Kind code	A1
Filing date	Apr 22, 2015
Priority date	Jul 3, 2014
Publication date	Jan 7, 2016
Grant date	—

Abstract

A method and system for extracting an access control list having a predetermined format from packets collected for a predetermined period of time, without requiring TCP flag information. By an information collection unit, network packets and network traffic logs are collected. By the information collection unit, a network traffic log including Media Access Control (MAC), Internet Protocol (IP), and port information is extracted from each network packet. By an information analysis unit, an access control list is generated based on the network traffic log.

First claim

What is claimed is:

1 . A method for extracting an access control list, comprising:
collecting, by an information collection unit, network packets and network traffic logs; extracting, by the information collection unit, a network traffic log including Media Access Control (MAC), Internet Protocol (IP), and port information from each network packet; and generating, by an information analysis unit, an access control list based on the network traffic log.

2 . The method of claim 1 , wherein the access control list includes one or more of an access control list related to a MAC protocol, an access control list related to an IP, and an access control list related to a port protocol.

3 . The method of claim 2 , wherein when the access control list is the access control list related to the MAC protocol, generating the access control list comprises:
extracting an item corresponding to the MAC protocol from a log set that is a set of the network traffic logs; and including the item in the access control list.

4 . The method of claim 3 , wherein the item includes a source MAC address, a protocol, and a destination MAC address.

5 . The method of claim 2 , wherein when the access control list is the access control list related to the IP, generating the access control list comprises:
extracting an item corresponding to the IP from a log set that is a set of the network traffic logs; and including the item in the access control list.

6 . The method of claim 5 , wherein the item includes a source MAC address, a source IP address, a protocol, a destination MAC address, and a destination IP address.

7 . The method of claim 2 , wherein when the access control list is the access control list related to the port protocol, generating the access control list comprises:
generating the access control list using a rate of ports used; and supplementing the generated access control list.

8 . The method of claim 7 , wherein generating the access control list using the rate of ports used comprises, if, for each IP2 that communicates with an IP address and port number (IP1, port1), a number of ports used by the IP2 is greater than a preset value, determining that the port1 of the IP1 is a static port and a port of the IP2 is not a static port, thus enabling the access control list to be generated.

9 . A system for extracting an access control list, comprising:
an information collection unit for collecting network packets and network traffic logs, and extracting a network traffic log including Media Access Control (MAC), Internet Protocol (IP), and port information from each network packet; and an information analysis unit for generating an access control list based on the network traffic log.

10 . The system of claim 9 , wherein the access control list includes one or more of an access control list related to a MAC protocol, an access control list related to an IP, and an access control list related to a port protocol.

11 . The system of claim 10 , wherein when the access control list is the access control list related to the MAC protocol, the information analysis unit is configured to extract an item corresponding to the MAC protocol from a log set that is a set of the network traffic logs and include the item in the access control list.

12 . The system of claim 11 , wherein the item includes a source MAC address, a protocol, and a destination MAC address.

13 . The system of claim 10 , wherein when the access control list is the access control list related to the IP, the information analysis unit extracts an item corresponding, to the IP from a log set that is a set of the network traffic logs, and includes the item in the access control list.

14 . The system of claim 13 , wherein the item includes a source MAC address, a source IP address, a protocol, a destination MAC address, and a destination IP address.

15 . The system of claim 10 , wherein when the access control list is the access control list related to the port protocol, the information analysis unit generates the access control list using a rate of ports used, and supplements the generated access control list.

16 . The system of claim 15 , wherein the information analysis unit is configured such that, upon generating the access control list using the rate of ports used, if, for each IP2 that communicates with an IP address and port number (IP1, port1), a number of ports used by the IP2 is greater than a preset value, it is determined that the port1 of the IP1 is a static port and a port of the IP2 is not a static port, thus enabling the access control list to be generated.

Assignees

• Korea Electronics Telecomm

Inventors

• Yun Jeong-Han
• Kim Heemin
• Kim Kyoung-Ho
• Kim Woonyon
• Seo Jungtaek
• Park Eung Ki

Classifications

• H04L43/00

  Arrangements for monitoring or testing data switching networks · CPC title

• H04L63/162

  at the data link layer · CPC title

• H04L63/101 Primary

  Access control lists [ACL] · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title

• H04L61/6022

  Electricity · mapped topic