Patent ID: 7849187

Claim:
A network status display device using a traffic pattern map, the device comprising: a traffic feature extractor extracting a port number of a port having the maximum occupancy of packet micro-flows and packet macro-flows for each network address section and host address section with reference to traffic information collected by an external traffic information collector, calculating an occupancy rate of the port, and storing the port number and the occupancy rate as port information, wherein micro-flows are those flows that exist for periods less than a predetermined time and macro-flows are those flows that exist for periods longer than the predetermined time, wherein the traffic feature extractor only stores the occupancy rates of N (N>0) host addresses with the highest occupancy rates; a traffic status display unit making a network traffic pattern map expressed by destination-source network addresses and a host traffic pattern map expressed by destination-source host addresses and displaying the port information stored in the traffic feature extractor on the network traffic pattern map and the host traffic pattern map; and a traffic anomaly determination unit determining whether a network status is abnormal with reference to the network traffic pattern map and the host traffic pattern map of the packet micro-flows and the packet macro-flows displayed by the traffic status display unit and detecting and reporting a harmful or abnormal traffic which causes the abnormal network status; wherein the traffic status display unit comprises: a network status display module generating the network traffic pattern map in which traffic information on the packet micro-flows and the packet macro-flows is displayed on a plane in which a transversal domain is divided into P (>0) destination network address sections and a longitudinal domain is divided into P (>0) source network address sections; and a host status display module generating the host traffic pattern map in which the traffic information on the packet micro-flows and the packet macro-flows is displayed on a plane in which a transversal domain is divided into destination host address sections and a longitudinal domain is divided into source host address sections.