THE METHOD AND THE SYSTEM FOR UN-KNOWN TRAFFIC CLASSIFICATION

摘要

A method and a system for classifying unknown traffic are provided to provide excellent traffic analysis data by allowing the third device to track traffic that subscribers frequently generate but is not defined by the Internet standards and store it in a classification DB for enabling high speed comparison. A classification DB(140) has an IP(Internet Protocol) and combinations of an IP+port+protocol and a port+protocol, and a classification reference of traffic. A packet receiving unit(119) receives packets according to a method of port mirroring. A packet analyzing unit(120) analyzes a packet transmitted from the packet receiving unit(119) to extract IP, port, and protocol information. A packet comparing unit(130) compares results of the packet analyzing unit(120) with the classification DB(140) to classify a packet. A known packet storage unit(150) stores the classified packet. An unknown packet analyzing unit(160) extracts a packet that does not belong to the classification DB(140), analyzes it according to an upper frequency, and transmits corresponding information to an unknown packet receiving unit(210) of an external traffic tracking device.