A management system and control method for mirroring network traffic in a virtual network environment

Abstract

A management system for mirrored network traffic in a virtualized network environment and a software-defined mirrored traffic management and control method, the mirrored network traffic management and monitoring system of the present invention includes a mirrored network traffic center control node, a virtualized mirrored traffic management node , a virtualized image traffic distribution node. Use the mirrored network traffic center control node for global management and control, use the virtualized mirrored traffic management node deployed close to the business virtual machine to realize data packet capture and forward according to the action of the flow table, and use the virtualized mirrored traffic distribution node deployed close to the security device to realize data packet Reproduction and distribution by security business. The present invention has an optimized mirror flow export strategy from a global perspective, and the mirror flow scheduling is quick and complete, and the mirror flow management nodes only occupy few computing resources.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to the management of mirrored network traffic in a virtualized network environment and a network security monitoring solution based on the mirrored network traffic. Background technique [0002] In a virtualized network environment, user business systems are deployed on virtual machines. In order to ensure the security of these systems and comply with relevant security compliance, it is still necessary to perform network security on these virtual machines as in traditional physical network environments. monitor. However, traditional hardware physical security products cannot accurately capture the network traffic of business virtual machines that need to be monitored. [0003] Software Defined Networks (SDN) is a new network control architecture proposed in recent years that utilizes the control layer, forwarding layer and data layer of decoupling network hardware to a...

AI Technical Summary

Problems solved by technology

[0006] The purpose of the present invention is to implement a new technical architecture and system that utilizes the concept of software definition to realize the forwarding management and control of mirrored network traffic, which is used to solve: 1) the problem of capturing network traffic by security devices during the security monitoring process; 2) Due to performance limitations, the network traffic capture terminal cannot implement a fine-grained bypass network traffic forwarding strategy; 3) Due to the lack of global vision, the network traffic capture terminal captures repeated traffic; 4) To multiple security The problem that the bandwidth of the service host is too large due to the multi-purpose traffic forwarding of the device forwarding traffic at the same time

Images