JP4952437B2 - Network monitoring device, network monitoring system - Google Patents

Description

  The present invention relates to a network monitoring device that detects an abnormality of the network based on network traffic, and a network monitoring system having the network monitoring device.

  Conventionally, a method for detecting a network abnormality by detecting a change point when time series data such as traffic suddenly changes from a normal state has been proposed with respect to network abnormality detection (Non-Patent Document). 1).

  Regarding the determination of whether traffic trends are similar, paying attention to the difference in the composition ratio and bandwidth of TCP flags (SYN, SYN-ACK, etc.) depending on the configuration of the application used, the degree of coincidence of such feature amounts Based on the above, a method for determining the similarity of traffic trends has been proposed (Non-Patent Document 2).

“Construction of Incident Detection System Using Change Detection Engine”, 2006 Symposium on Cryptography and Information Security (SCIS2006), 2E2-2 "Traffic anomaly detection system using traffic classification according to application characteristics", IEICE Technical Report, NS2006-234, March 2007

  The method described in Non-Patent Document 1 can be regarded as one of detection methods based on statistics and learning. Such a technique can effectively handle the behavior of many network devices in a somewhat large network such as an operator network or an intranet, and functions effectively.

However, in a small network such as a home network or a small office network, there are few connected network devices, that is, traffic sources, and traffic flowing from outside the network is limited. For this reason, traffic data sufficient to perform statistically stable processing cannot be obtained.
Also, since it takes a long time to accumulate a statistically significant amount of traffic data, it takes too much time to detect an abnormality.

  Therefore, there has been a demand for a network monitoring apparatus that can detect network abnormality based on statistical analysis of traffic data in a small network such as a home network or a small office network.

  A network monitoring device according to the present invention is a network monitoring device that detects an abnormality of the network based on network traffic, a data collection unit that collects network traffic data, a detection unit that detects an abnormality of the network, The detection unit includes traffic data collected in another network in which the period total data obtained by totaling traffic data for a certain period is similar to the period total data in the network, and the data collection unit collects in the network And detecting the abnormality of the network based on the traffic data.

  According to the network monitoring apparatus according to the present invention, an abnormality is detected using traffic data collected in another network. Therefore, even when the size of the detection target network is small, a technique similar to that for detecting an abnormality in a large network is used. Can be used.

Embodiment 1 FIG.
FIG. 1 shows a functional block diagram of a self-network probe apparatus 100 according to Embodiment 1 of the present invention. The “network monitoring apparatus” in the first embodiment corresponds to the own network probe apparatus 100.

The own network probe apparatus 100 is installed in a small-scale network such as a home network or a small office network (hereinafter referred to as own network), and detects an abnormality of the own network from the traffic situation of the own network.
The other network probe device 200 has the same configuration as the own network probe device 100 and is connected to the own network probe device 100 via the Internet 300.

  The own network probe apparatus 100 includes an own network data collection unit 110, a period data totaling unit 121, a period data storage unit 122, an own network data transmission unit 130, another network data reception unit 140, a data fusion unit 150, a detection unit 160, and a comparison. Unit 161, period data transmission unit 170, other terminal search unit 181, period data reception unit 182, similarity calculation unit 183, similar terminal storage unit 184, similar terminal information exchange unit 185, and output unit 190.

  First, the configuration related to the collection of traffic data in the own network and its aggregation will be described.

The own network data collection unit 110 collects traffic data in the own network or statistics / features thereof. It is desirable that the installation location of the own network probe device 100 is devised so that the own network data collection unit 110 can collect traffic data from a place where much traffic of the own network passes, such as an entrance of the own network.
In order to ensure the accuracy of the traffic data, the own network data transmitting unit 130, the period data transmitting unit 170, the other terminal searching unit 181, the period data receiving unit 182, and the similar terminal information exchanging unit 185 are connected to the other network probe apparatus 200. Data exchanged between them is excluded from collection.

The period data totaling unit 121 performs statistical processing such as averaging the traffic data collected by the own network data collecting unit 110 over a certain period, and stores the processed data in the period data storage unit 122. The stored data is called period totaling data.
For example, the statistical processing is performed as follows.

(1) The traffic data at the same time on each day is overlapped and averaged for each time zone. Thereby, the period total data which averaged the fluctuation with time of traffic of 24 hours a day are generated.
(2) Further, traffic data is distinguished by day of the week or weekday / holiday and stored as different period total data. As a result, detailed traffic analysis can be performed.

The period data totaling unit 121 updates the period totaling data as needed so that the period totaling data stored in the period data storage unit 122 is tabulated for an appropriate period.
The reasonable period here is determined as follows, for example.
(1) A period in which it is empirically determined that averaging over that period is sufficient to smooth out daily fluctuations.
(2) A period until the total amount of traffic in an arbitrary time zone is equal to or greater than a predetermined amount, that is, until the amount of traffic that is empirically determined to be statistically significant is accumulated.

  Next, a configuration for searching for another network probe apparatus 200 having a similar tendency of period total data will be described.

The other terminal search unit 181 searches for a network monitoring device installed in a network other than its own network (hereinafter referred to as another network), that is, the other network probe device 200 in FIG.
The search range is set by storing a known other network probe device 200 in advance. Alternatively, information on other network monitoring devices known by the other network probe device 200 may be acquired by a similar terminal information exchanging unit 185 described later, and the search range may be further expanded.

  The period data receiving unit 182 requests the period total data from the other network probe 200 and receives the transmitted period total data. The other network probe 200 to be requested is the other network probe apparatus 200 searched by the other terminal searching unit 181.

The similarity calculation unit 183 calculates the similarity between the period total data of the other network probe apparatus 200 received by the period data reception unit 182 and the period total data stored in the period data storage unit 122.
If the similarity is equal to or greater than a predetermined reference value, the other network probe apparatus 200 that transmitted the period total data is determined as a similar terminal, and an identifier such as an address of the other network probe apparatus 200 is stored in the similar terminal storage unit 184. To do.

  Here, for example, a technique as described in Non-Patent Document 2 can be used to calculate the similarity. In addition, a known general similarity calculation method may be used.

The similar terminal information exchange unit 185 exchanges data stored in the similar terminal storage unit 184 with the other network probe apparatus 200 stored in the similar terminal storage unit 184.
The other terminal search unit 181 can further expand the search range based on the data acquired by the similar terminal information exchange unit 185 from the other network probe device 200. That is, by expanding the overlapping range of similar terminals, the range of other network probe devices 200 with similar period totaling data can be expanded, such as “another similar terminal known by similar terminals”. It is.

  Next, a configuration in which the other network probe device 200 searched by the other terminal search unit 181 acquires traffic data collected in the network will be described.

The other network data receiving unit 140 requests transmission of traffic data collected in the network by the other network probe device 200 based on the data of the other network probe device 200 stored in the similar terminal storage unit 184.
The received traffic data is output to the data fusion unit 150.

  Next, a configuration for detecting an abnormality in the own network based on the traffic data acquired from the other network probe apparatus 200 will be described.

The data fusion unit 150 merges the traffic data collected by the own network data collection unit 110 with the traffic data of the other network probe device 200 received by the other network data reception unit 140, and creates fusion data for analysis. .
For example, the fusion data can be created as follows. The image of the fusion data will be supplementarily described with reference to FIGS.

(1) It is created by simply adding own network traffic data and other network traffic data.
(2) Created by weighting and adding between the own network traffic data and the other network traffic data.
(3) The other network traffic data is weighted according to the similarity and added.

  Based on the fusion data created by the data fusion unit 150, the detection unit 160 detects an abnormality of the own network by a method such as detection of a change in traffic tendency as described in Patent Document 1, for example.

The comparison unit 161 compares the period total data stored in the period data storage unit 122 with the fusion data created by the data fusion unit 150. As a result, if there is a divergence between the two, it is determined that there is a chronic abnormality in the own network or that a sudden wide-area abnormality including other networks has occurred.
Judgment of deviation is a method such as comparing with a predetermined parameter or measuring the average value of the usual deviation and determining that there is an abnormality when deviation from the average value exceeds a certain percentage. Can be used.

  The output unit 190 outputs the determination results of the detection unit 160 and the comparison unit 161. The output means may be visual such as a screen display, may output data of determination results, or may be a notification means such as an alarm sound.

The period data transmission unit 170 transmits the period total data stored in the period data storage unit 122 when requested by the other network probe apparatus 200.
The local network data transmission unit 130 transmits the traffic data of the local network collected by the local network data collection unit 110 when requested by the other network probe device 200.

  Next, the operation procedure of the configuration described above will be described with reference to FIGS.

  FIG. 2 illustrates an operation procedure until the traffic data of the own network is aggregated. Hereinafter, each step will be briefly described.

(1) Collection of traffic data The own network data collection unit 110 collects traffic data of the own network.
(2) Aggregation of traffic data The period data aggregation unit 121 aggregates the traffic data of the own network collected by the own network data collection unit 110 to create period aggregation data.
(3) Accumulation of Period Total Data The period data total unit 121 stores the period total data in the period data storage unit 122.

  FIG. 3 illustrates an operation procedure for searching for another network probe apparatus 200 having a similar tendency of period total data. Hereinafter, each step will be briefly described.

(4) Other Terminal Search Instruction The other terminal searching unit 181 outputs the address of the other network probe device 200 installed in the other network to the period data receiving unit 182, and the period totaling data of the other network probe device 200 is output. Instruct to receive. Thereby, the search for the other network probe apparatus 200 is started.
(5) Receiving Period Total Data The period data receiving unit 182 receives period total data from the other network probe apparatus 200 based on a specified address or the like.
(6) Similarity Calculation The similarity calculation unit 183 calculates the similarity between the period total data received by the period data reception unit 182 and the data stored in the period data storage unit 122.
(7) Accumulation of Similar Terminals The similarity calculation unit 183 stores the address of the other network probe device 200 in the similar terminal storage unit 184 when the similarity is greater than or equal to a predetermined reference value.
(8) Exchange of similar terminal information In addition to the above steps, the search range may be further expanded by exchanging information stored in the similar terminal storage unit 184 with another network probe device 200.

  FIG. 4 illustrates an operation procedure until the abnormality determination is performed by integrating the local network traffic data and the other network traffic data. Hereinafter, each step will be described.

(9) Receiving Other Network Traffic The other network data receiving unit 140 receives traffic data from the other network probe apparatus 200 with similar period totaling data based on the address and the like stored in the similar terminal storage unit 184. When there are a plurality of corresponding other network probe apparatuses 200, they are received from all other network probe apparatuses 200.
(10) Fusion of traffic data The data fusion unit 150 fuses the own network traffic data collected by the own network data collection unit 110 and the traffic data of the other network probe device 200 received by the other network data reception unit 140. Create data.
(11) Abnormality determination The detection unit 160 determines an abnormality of the own network based on the fusion data created by the data fusion unit 150 and the own network traffic data collected by the own network data collection unit 110. The determination result is output from the output unit 190.

  FIG. 5 illustrates an operation procedure until the abnormality determination is performed by merging the own network traffic data and the other network traffic data and comparing with the period total data of the own network. Hereinafter, each step will be described.

(12) Reception of other network traffic to (13) Fusion of traffic data Since this is the same as steps (9) to (10) in FIG. The data received or created in steps (9) to (10) may be used.
(14) The comparison unit 161 makes an abnormality determination by comparing the period total data stored in the period data storage unit 122 with the fusion data created by the data fusion unit 150.

  Next, a specific example of traffic data will be described with an actual data example from the viewpoint of comparison with other network traffic data and period total data. Further, the operations described in FIGS. 2 to 5 will be supplemented with specific examples of traffic data.

  FIG. 6 shows an example of a time change of traffic data of the own network. Here, the traffic amount itself is displayed in a graph as the traffic feature amount, but a plurality of other feature amounts may be combined.

  FIG. 6A shows the traffic data collected by the own network data collection unit 110. Here, the change in traffic volume per day is displayed in a graph.

FIG. 6B is an average of the traffic data of FIG.
The period data totaling unit 121 averages the traffic data collected by the own network data collecting unit 110 by adding the data collected at the same time every day for one month, for example. The averaged traffic data is stored in the period data storage unit 122 as period total data. For example, the period total data at 12:30 is obtained by averaging traffic data obtained at 12:30 for the past month.

  As shown in FIG. 6B, by taking an average value for a certain period of time, the variation in traffic data due to different ways of using the local network every day is smoothed. Period total data indicating the cycle is obtained.

  FIG. 7 shows traffic data collected in another network by the other network probe apparatus 200. Here, as in FIG. 6, the change in traffic volume per day is displayed in a graph. FIG. 7A shows the daily traffic data and FIG. 7B shows the period total data.

Each other network probe device 200 installed in another network also creates period totaling data in the same manner as the own network probe device 100. The traffic trend of the network in which the other network probe apparatus 200 having similar period totaling data is installed is considered to be similar to the own network.
Therefore, it is considered that traffic data of another network probe apparatus 200 having a similar traffic tendency is acquired and used for abnormality determination of the own network.

Therefore, after receiving the period total data of the other network probe apparatus 200 by the period data receiving unit 182, the own network probe apparatus 100 calculates the similarity with the period total data of the own network by the similarity calculation unit 183, The other network probe device 200 having similar aggregate data is identified.
As described above, by comparing the aggregated traffic over a certain period, it is possible to stably search for another network probe apparatus 200 having a similar network traffic trend even if the short-term traffic trend is different. This is particularly effective when individual networks are small and short-term traffic fluctuates greatly.

After the other network probe apparatus 200 having similar period total data is specified by the method described above, the (short-term) traffic data of the other network probe apparatus 200 is acquired by the other network data receiving unit 140. The data acquired at this time corresponds to the traffic data before aggregation collected by the own network data collection unit 110.
Here, it is assumed that the traffic data as shown in FIG.

The local network traffic data shown in FIG. 6 (a) and the other network traffic data shown in FIG. 7 (a) vary greatly depending on the use status of the network in each network, particularly when each network is small.
However, by adding the traffic data of each network, individual fluctuations are averaged, and smoothed data such as period total data is obtained. Therefore, the data fusion unit 150 merges the traffic data of the other network received from the other network probe device 200 and the traffic data of the own network collected by the own network data collection unit 110 to create fused data.

FIG. 8 shows an example of fusion data created by the data fusion unit 150. It can be seen that the individual fluctuations are smoothed similarly to the period total data shown in FIG. 6B and FIG. 7B.
In this way, individual fluctuations are smoothed by adding the traffic data of other networks. This is substantially the same as collecting traffic data on a large-scale network by adding the traffic data of multiple networks. This is because similar data can be obtained.

  After the fusion data as shown in FIG. 8 is obtained, the abnormality of the fusion data is detected by the conventional abnormality detection method such as detecting the change point for the fusion data by the detection unit 160 as described in FIG. By detecting this, it is possible to detect short-term abnormalities occurring in similar networks including the own network.

  Further, as described in FIG. 5, the comparison unit 161 compares the period total data of the own network shown in FIG. 6B and the fusion data shown in FIG. 8, and determines the difference between the two, The following abnormality determination can be performed.

(1) The short-term traffic data indicated by the fusion data indicates a trend of short-term traffic including other networks. Therefore, if there is a divergence between the fusion data and the period total data of the own network, there is a possibility that a chronic abnormality has occurred in the own network.
(2) On the other hand, when the traffic indicated by the period summary data of the own network is normal, there is a possibility that short-term abnormal traffic has occurred over a wide area including other networks.

  The “similar terminal searching unit” in the first embodiment corresponds to the other terminal searching unit 181, the period data receiving unit 182, the similarity calculating unit 183, and the similar terminal information exchanging unit 185.

  The own network data collection unit 110, the own network data transmission unit 130, the other network data reception unit 140, the period data transmission unit 170, the period data reception unit 182 and the similar terminal information exchange unit 185 have interfaces necessary for data transmission / reception. Data is transmitted / received using an interface (not shown) included in the network probe apparatus 100 as appropriate.

  The period data totaling unit 121, the data fusion unit 150, the detection unit 160, the comparison unit 161, the other terminal search unit 181 and the similarity calculation unit 183 are configured using hardware such as a circuit device that realizes these functions. It can also be configured as software executed on an arithmetic device such as a CPU or a microcomputer.

  The period data storage unit 122 and the similar terminal storage unit 184 can be configured by a writable storage device such as an HDD (Hard Disk Drive) or a flash memory.

  The output unit 190 appropriately includes an interface necessary for outputting the abnormality determination result.

As described above, the own network probe apparatus 100 according to the first embodiment identifies the other network probe apparatus 200 whose period total data is similar to that of the own network, acquires traffic data from the other network probe apparatus 200, and Create fusion data by merging with network traffic data. Then, the abnormality of the own network is determined based on the fusion data.
Therefore, it is possible to smooth out short-term fluctuations in traffic, which is a feature of a small-scale network, and to perform abnormality determination of the own network using an abnormality determination method similar to that of a large-scale network.

  In particular, when computer viruses spread in home networks or small offices, virus detection software can only detect known patterns because it can only detect known patterns. It is expected to detect these changes by detecting the change points that have started to occur using the same method as for large-scale networks.

In addition, the comparison unit 161 compares the period total data of the own network and the fusion data, so that there is a chronic abnormality in the own network or a wide-area abnormality including other networks has occurred. Can be detected.
In other words, by using aggregated data that is statistical data in the local network and fusion data that is short-term wide-area statistical data including other networks, the same statistical data as in the large-scale network can be obtained in the small-scale network. Therefore, it is possible to perform abnormality determination by a simple method.

  In particular, the fusion data is created by adding the data of other networks that are estimated to be in the same usage situation, so when a network attack occurs in a specific environment, this is superposed and strong. Since it can be detected as an abnormality, there is an effect that the oversight of the abnormality is reduced.

In addition, the other network probe device 200 that is the target of acquiring traffic data is predicted that the period usage data is similar to that of the own network, and therefore the network usage status is also similar to that of the own network. Is done.
Therefore, when there is a deviation from the traffic data of the own network, it is suitable for use as a reference for determining that an abnormality has occurred in the own network. As a result, the accuracy of abnormality determination can be improved even in a network with a small amount of data that can be acquired, such as a small-scale network.

Also, the similar terminal information exchange unit 185 exchanges similar terminal information stored in the similar terminal storage unit 184 and expands the search range based on the exchange result, so that traffic data can be obtained from a wider range of similar terminals. And an improvement in smoothing effect can be expected.
In particular, in an ad hoc network such as a peer-to-peer (P2P) network, such a method of exchanging information with each other when searching for similar terminals is effective.

  Moreover, the period data totaling unit 121 totals the traffic data collected by the own network data collecting unit 110 for each time zone, for each day of the week, for each distinction between weekdays and holidays, and for each period totaling data, the period data storage unit 122, the analysis can be performed in detail.

Embodiment 2. FIG.
In the first embodiment, when the other terminal searching unit 181 searches for the other network probe device 200, the other terminal probe unit 200 is searched for, or the similar terminal information exchanging unit 185 is stored in the similar terminal storage unit 184. The search range was expanded by exchanging information.
In the second embodiment of the present invention, a configuration in which information of another network probe apparatus 200 is collectively managed by a central server will be described.

FIG. 9 is a configuration diagram of the network monitoring system according to the second embodiment. Note that the network 300 is omitted for convenience of description.
In FIG. 9, a server 400 is a central server that collectively manages the locations of the own network probe apparatus 100 and the other network probe apparatus 200.

  In the second embodiment, own network probe apparatus 100 receives similar terminal information instead of other terminal search section 181, period data reception section 182, similarity calculation section 183, and similar terminal information exchange section 185 in FIG. 1. Part 187. Further, a terminal information transmission unit 188 is provided.

The similar terminal information receiving unit 187 inquires of the server 400 about the location of the other network probe device 200 whose period total data is similar to the own network probe device 100 and stores the result in the similar terminal storage unit 184.
The terminal information transmission unit 188 transmits location information such as the address of the own network probe apparatus 100 to the server 400.
The period data transmission unit 170 transmits the period total data accumulated in the period data storage unit 122 to the server 400.

  The server 400 includes a terminal registration unit 401, a terminal storage unit 402, a period data collection unit 403, a clustering unit 404, and a similar terminal information transmission unit 405.

The terminal registration unit 401 receives location information such as its own address transmitted from the own network probe device 100 or the other network probe device 200 and stores it in the terminal storage unit 402.
The period data collection unit 403 receives the respective period total data transmitted by the own network probe apparatus 100 or the other network probe apparatus 200 and outputs the period total data to the clustering unit 404.
The clustering unit 404 classifies the period total data collected by the period data collection unit 403 into similar data. As the classification method, for example, a known data mining method can be used.
The similar terminal information transmission unit 405 transmits information of terminals classified as being similar to each other to each terminal.

  The similar terminal information receiving unit 187 and the terminal information transmitting unit 188 appropriately include an interface necessary for data transmission / reception, or perform data transmission / reception using an interface (not shown) included in the own network probe apparatus 100.

  The terminal registration unit 401 and the period data collection unit 403 appropriately include an interface necessary for data transmission / reception, or perform data transmission / reception using an interface (not shown) included in the server 400.

  The terminal storage unit 402 can be configured by a writable storage device such as an HDD (Hard Disk Drive) or a flash memory.

  The clustering unit 404 can be configured using hardware such as a circuit device that realizes the function, or can be configured as software executed on an arithmetic device such as a CPU or a microcomputer.

As described above, according to the second embodiment, the determination of similarity and the management of similar terminal information can be performed collectively by the server 400, so that the load on the own network probe apparatus 100 is reduced.
In addition, the collective management reduces the possibility of a search omission and the like, and traffic data of more terminals can be collected. Therefore, the smoothing effect can be improved and the accuracy of abnormality determination can be improved.

  It should be noted that the other terminal searching unit 181, the period data receiving unit 182, the similarity calculating unit 183, and the similar terminal information exchanging unit 185 described in the first embodiment, and the similar terminal information receiving unit 187 described in the second embodiment, The terminal information transmission unit 188 may be combined with one local network probe apparatus 100.

Embodiment 3 FIG.
The present invention is to detect abnormalities in a small-scale network by measuring traffic in the network. Therefore, it is effective to be implemented as firmware of a network device such as a modem, a network terminator, or a router that is installed at a position where most of traffic in the network and traffic that goes out of the network pass.
Further, if a set-top box for managing home network devices or a main device is a PC, the same effect can be obtained even if it is implemented as software of each PC.

1 is a functional block diagram of a self-network probe apparatus 100 according to Embodiment 1. FIG. An operation procedure until the traffic data of the own network is totaled will be described. An operation procedure for searching for another network probe apparatus 200 having a similar tendency of period total data will be described. The operation procedure until the abnormality determination is performed by merging the own network traffic data and the other network traffic data will be described. The operation procedure until the abnormality determination is performed by fusing the own network traffic data and the other network traffic data and comparing with the period total data of the own network will be described. The example of the time change of the traffic data of the own network is shown. The traffic data collected in the other network by the other network probe apparatus 200 is shown. It is an example of the fusion data which the data fusion part 150 produced. 6 is a configuration diagram of a network monitoring system according to a second embodiment. FIG.

Explanation of symbols

  100 own network probe device, 110 own network data collection unit, 121 period data totaling unit, 122 period data storage unit, 130 own network data transmission unit, 140 other network data reception unit, 150 data fusion unit, 160 detection unit, 161 comparison Unit, 170 period data transmission unit, 181 other terminal search unit, 182 period data reception unit, 183 similarity calculation unit, 184 similar terminal storage unit, 185 similar terminal information exchange unit, 187 similar terminal information reception unit, 188 terminal information transmission , 190 output unit, 200 other network probe device, 400 server, 401 terminal registration unit, 402 terminal unit, 403 period data collection unit, 404 clustering unit, 405 similar terminal information transmission unit.

Claims (10)

A network monitoring device that detects an abnormality of the network based on network traffic,
A data collection unit that collects network traffic data;
A detection unit for detecting an abnormality of the network;
With
The detector is
Traffic data collected in other networks where the period aggregated data that aggregates traffic data for a certain period is similar to the period aggregated data in the network,
Traffic data collected by the data collection unit in the network;
A network monitoring device that detects an abnormality of the network based on the above. A period data totaling unit for totaling traffic data collected by the data collection unit for a certain period to obtain period totaling data;
A similar terminal search unit for searching for one or more other network monitoring devices with similar period totaling data;
Another network data receiving unit that receives traffic data collected in a network to which one or more other network monitoring devices searched by the similar terminal searching unit belongs;
A data fusion unit that aggregates the traffic data collected by the data collection unit and the traffic data received by the other network data reception unit;
With
The detector is
The network monitoring apparatus according to claim 1, wherein an abnormality of the network is detected based on traffic data collected by the data fusion unit. The detector is
Determining the divergence between the period aggregation data aggregated by the period data aggregation section and the data aggregated by the data fusion section,
If it is determined that they are separated,
The network monitoring apparatus according to claim 2, wherein it is determined that a chronic abnormality exists in the network or a wide-area abnormality including other networks has occurred. A period data receiving unit that receives period aggregated data obtained by compiling traffic data in another network for a certain period from a network monitoring device installed in the network,
The similar terminal search unit,
Period total data in another network received by the period data receiver,
Period aggregate data in the network aggregated by the period data aggregation unit;
The similarity of
The network monitoring device according to claim 2 or 3, wherein when the similarity is equal to or greater than a predetermined reference value, it is determined that both are similar. The similar terminal search unit,
The search result is exchanged with another network monitoring device, and based on the exchange result, a search range of terminals determined to have similar period totaling data is expanded. Network monitoring equipment. The period data totaling unit
The traffic data collected by the data collection unit is aggregated for each time period,
The network monitoring device according to any one of claims 2 to 5, wherein the period total data is created for each total time zone. The period data totaling unit
The network monitoring device according to claim 6, wherein the period totaling data is classified based on a day of the week or a weekday / holiday. The data collection unit
The network monitoring device according to any one of claims 1 to 7, wherein data transmitted / received to / from another network monitoring device is excluded from traffic data collection targets. One or more network monitoring devices according to any one of claims 1 to 8,
A server connected to each of the network monitoring devices;
Have
The server
A storage unit for storing information of each network monitoring device;
The network monitoring device
Information on another network monitoring apparatus is acquired from the server. The server
Each of the network monitoring devices includes a clustering unit that classifies traffic data in the network for a certain period, and classifies the data for each similar thing,
The network monitoring device
10. The network monitoring system according to claim 9, wherein information on another network monitoring device having similar period summary data to the network monitoring device is acquired from the server based on a classification result of the clustering unit.

Images