Apparatus and method for dynamic control of network

1 . An apparatus for dynamic control of a network, the apparatus comprising:

a processor; and

a storage medium recording one or more programs configured to be executable by the processor,

wherein the one or more programs include instructions for executing:

collecting network monitoring information;

determining, based on the network monitoring information, whether a network abnormality condition is satisfied;

loading, based on a result of the determination, an extended Berkeley packet filter (eBPF) program controlling a network environment by at least one of changing a network bandwidth, changing a routing path, generating a processing time notification, and executing QoS;

setting the network abnormality condition; and

mapping the eBPF program to the network abnormality condition,

wherein the determining whether the network abnormality condition is satisfied includes:

detecting one or more events included in the network monitoring information; and

determining whether the one or more events satisfy the network abnormality condition,

wherein the network abnormallly condition is set based on at least one of a round trip time (RTT) increase rate, a packet retransmission rate, and an inter packet delay change rate,

wherein the network abnormality condition includes a first abnormality condition being satisfied when an event is detected in which the RTT increase rate is 4 times or more, and

the one or more programs further instructions for executing:

loading a first eBPF program changing the network bandwidth mapped to the first abnormality condition when the first abnormality condition is satisfied.

2 . The apparatus of claim 1 , wherein

the network abnormality condition includes a second abnormality condition being satisfied when an event is detected in which the packet retransmission rate is 2% or more, and

the one or more programs further instructions for executing:

loading a second eBPF program changing the routing path mapped to the second abnormality condition when the second abnormality condition is satisfied.

3 . The apparatus of claim 1 , wherein

the network abnormality condition includes a third abnormality condition being satisfied when an event is detected in which the inter-packet delay change rate is 4 times or more and the RTT increase rate is 3 times or more, and

the one or more programs further instructions for executing:

loading a third eBPF program generating the processing time notification mapped to the third abnormality condition when the third abnormality condition is satisfied.

4 . The apparatus of claim 1 , wherein

the network abnormality condition includes a fourth abnormality condition being satisfied when an event is detected in which the inter-packet delay change rate is 4 times or more and the RTT increase rate is less than 3 times, and

the one or more programs further instructions for executing:

loading a fourth eBPF program executing the QoS mapped to the fourth abnormality condition when the fourth abnormality condition is satisfied.

5 . The apparatus of claim 1 , wherein the one or more programs further instructions for executing:

before the collecting the network monitoring information,

receiving a packet including identification information; and

determining whether a flow of the packet has been generated.

6 . The apparatus of claim 5 , wherein the one or more programs further instructions for executing:

determining whether the flow of the packet has been terminated, after the loading the eBPF program.

7 . A method for dynamic control of a network, the method performed by a computing device including a processor and a storage medium recording one or more programs configured to be executable by the processor, the method comprising:

collecting network monitoring information;

determining, based on the network monitoring information, whether a network abnormality condition is satisfied;

loading, based on a result of the determination, an eBPF program controlling a network environment by at least one of changing a network bandwidth, changing a routing path, generating a processing time notification, and executing QoS;

setting the network abnormality condition; and

mapping the eBPF program to the network abnormality condition,

wherein the determining whether the network abnormality condition is satisfied includes:

detecting one or more events included in the network monitoring information; and

determining whether the one or more events satisfy the network abnormality condition,

wherein the network abnormally condition is set based on at least one of a RTT increase rate, a packet retransmission rate, and an inter-packet delay change rate, and

wherein the network abnormally condition includes a first abnormally condition being satisfied when an event is detected in which the RTT increase rate is fourth times or more, and

the loading the eBPF program includes:

loading a first eBPF program changing the network bandwidth mapped to the first abnormality condition when the first abnormality condition is satisfied.

8 . The method of claim 7 , wherein

the network abnormality condition includes a second abnormality condition being satisfied when an event is detected in which the packet retransmission rate is 2% or more, and

the loading the eBPF program includes:

loading a second eBPF program changing the routing path mapped to the second abnormality condition when the second abnormality condition is satisfied.

9 . The method of claim 7 , wherein

the network abnormality condition includes a third abnormality condition being satisfied when an event is detected in which the inter-packet delay change rate is 4 times or more and the RTT increase rate is 3 times or more, and

the loading the eBPF program includes:

loading a third eBPF program generating the processing time notification notifying a host side mapped to the third abnormality condition when the third abnormality condition is satisfied.

10 . The method of claim 7 , wherein

the network abnormality condition includes a fourth abnormality condition being satisfied when an event is detected in which the inter-packet delay change rate is 4 times or more and the RTT increase rate is less than 3 times, and

the loading the eBPF program includes:

loading a fourth eBPF program executing the QoS mapped to the fourth abnormality condition when the fourth abnormality condition is satisfied.

11 . The method of claim 7 , further comprising:

before the collecting the network monitoring information,

receiving a packet including identification information; and

determining whether a flow of the packet has been generated.

12 . The method of claim 11 , further comprising:

determining whether the flow of the packet has been terminated, after the loading the eBPF program.