JP5221594B2 - Network monitoring apparatus, network monitoring method, and network monitoring program - Google Patents

Description

  The present invention relates to a network monitoring device, a network monitoring method, and a network monitoring program.

  Generally, an IP (Internet Protocol) network is divided for each AS (Autonomous System) that is a set of networks operated under a common management. Such routing between ASs is performed by a routing protocol called EGP (Exterior Gateway Protocol). As EGP, for example, BGP (Border Gateway Protocol) that performs path control between ASs is known.

  In an IP network to which BGP is applied, a route of a packet that circulates between ASs is determined by sending and receiving BGP messages between ASs. The packet distribution path between ASs may fluctuate due to a cable failure between ASs. When a route change occurs, the amount of traffic flowing between the ASs changes, which may make it difficult to perform stable network communication. Therefore, a communication carrier or the like monitors network path fluctuations or network traffic for the purpose of safe network operation.

  For example, a technique is known in which the amount of traffic flowing between predetermined ASs is periodically acquired, and the traffic fluctuation amount is monitored by comparing the current traffic amount with the immediately preceding traffic amount.

JP 2008-167484 A

Jian Wu, Z. Morley Mao, Jennifer Rexford, and Jia Wang, Finding a needle in a haystack: Pinpointing significant BGP routing changes in an IP network, Proc.Networked Systems Design and Implementation, May 2005.

  However, the above-described conventional technology has a problem that it is difficult to accurately extract a factor of traffic fluctuation. For example, for example, with a technology that compares the current traffic volume with the immediately previous traffic volume, it is difficult to accurately identify a factor of traffic fluctuation even if the traffic fluctuation can be detected. In recent years, in a situation where an IP network environment is widespread, a technique for accurately extracting a factor of traffic fluctuation is required.

  Therefore, the present invention has been made in view of the above, and an object of the present invention is to provide a network monitoring device, a network monitoring method, and a network monitoring program capable of accurately extracting a factor of traffic fluctuation.

  In order to solve the above-described problems and achieve the object, a network monitoring apparatus according to the present invention is a network monitoring apparatus that monitors an autonomous system included in a network, and shows a route of traffic flowing through the autonomous system. For each attribute of the route information, a traffic totaling unit that totals the amount of traffic that circulates the route including the attribute, and for each attribute of the route information, the traffic amount totaled by the traffic totaling unit An extraction unit that extracts a traffic amount corresponding to a predetermined time range in the past date and time for a plurality of dates and a traffic fluctuation distribution among traffic amounts corresponding to the plurality of dates and times extracted by the extraction unit. Traffic volume similar to the traffic fluctuation distribution at the monitoring date and time Therefore, a threshold value calculation unit that calculates a threshold value indicating a traffic fluctuation allowable range for each attribute of the route information, and a traffic amount at the monitoring target date and time is calculated by the threshold value calculation unit for each attribute of the route information. And a traffic fluctuation detection unit that detects whether or not it falls within a threshold range.

  Further, the network monitoring method according to the present invention is a network monitoring method for monitoring an autonomous system included in a network, wherein the attribute is assigned to each attribute of route information indicating a route of traffic flowing through the autonomous system. A traffic totaling step for totaling the traffic volume that circulates the route including the route, and for each attribute of the route information, from the traffic amount totaled by the traffic totaling step, a predetermined period in the past date and time from the monitoring target date and time An extraction process for extracting a traffic amount for a time range of a plurality of dates and times, and a traffic fluctuation distribution corresponding to a plurality of dates and times extracted by the extraction process is a traffic fluctuation distribution at the monitoring target date and time Traffic based on traffic volume similar to A threshold calculation step for calculating a threshold value indicating an allowable fluctuation range for each route information attribute, and a threshold range in which the traffic amount at the monitoring target date and time is calculated by the threshold calculation step for each attribute of the route information And a traffic fluctuation detecting step for detecting whether or not the data is included in the network.

  A network monitoring program according to the present invention causes a computer to function as the network monitoring device.

  The network monitoring device, the network monitoring method, and the network monitoring program according to the present invention have an effect that the factors of traffic fluctuation can be specified accurately.

FIG. 1 is a diagram illustrating a configuration example of a network to which the network monitoring apparatus according to the first embodiment is applied. FIG. 2 is a block diagram illustrating a configuration example of the network monitoring apparatus according to the first embodiment. FIG. 3 is a diagram illustrating an example of the route information storage unit. FIG. 4 is a diagram illustrating an example of the attribute change information storage unit. FIG. 5 is a diagram illustrating an example of the flow information storage unit. FIG. 6 is a diagram illustrating an example of the prefix unit storage unit. FIG. 7 is a diagram illustrating an example of the origin AS unit storage unit. FIG. 8 is a diagram illustrating an example of the peer AS unit storage unit. FIG. 9 is a diagram illustrating an example of the AS path unit storage unit. FIG. 10 is a diagram illustrating an example of the AS link unit storage unit. FIG. 11 is a diagram illustrating an example of a router address unit storage unit. FIG. 12 is a diagram illustrating an example of traffic fluctuation. FIG. 13 is a diagram illustrating an example of traffic fluctuation per unit time. FIG. 14 is a diagram illustrating an example of traffic fluctuation. FIG. 15 is a flowchart of the traffic counting process procedure performed by the network monitoring apparatus according to the first embodiment. FIG. 16 is a flowchart of the traffic variation detection processing procedure performed by the network monitoring apparatus according to the first embodiment. FIG. 17 is a diagram illustrating that the information processing by the network monitoring program is specifically realized using a computer.

  Hereinafter, embodiments of a network monitoring apparatus, a network monitoring method, and a network monitoring program according to the present invention will be described in detail with reference to the drawings. In addition, this invention is not limited by this Example.

[Network configuration]
First, a configuration example of a network to which the network monitoring apparatus according to the first embodiment is applied will be described with reference to FIG. FIG. 1 is a diagram illustrating a configuration example of a network to which the network monitoring apparatus according to the first embodiment is applied.

  As shown in FIG. 1, the network 1 in the first embodiment includes AS10 to AS80. The AS 10 includes the network monitoring apparatus 100 according to the first embodiment, routers 11 and 12, and a terminal 13. The AS 20 includes a router 21, and the AS 30 includes a router 31 and a Web server 32.

  The router 11 and the router 21 are connected to each other. That is, the router 11 performs a process of relaying the traffic passing through the AS 10 to the AS 20 and receives the traffic passing through the AS 20 from the router 21. The router 12 and the router 31 are connected to each other. That is, the router 12 performs a process of relaying the traffic passing through the AS 10 to the AS 30 and accepts the traffic passing through the AS 30 from the router 31. In the example shown in FIG. 1, illustration of routers arranged in the AS 40 to AS 80 is omitted, but it is assumed that routers are arranged in the AS 40 to AS 80. The AS 40 to the AS 80 are connected to other ASs by connecting the router in the own AS and the router in the other AS.

  In this way, the ASs are connected to each other by connecting the routers arranged in each AS. In the example shown in FIG. 1, AS10 is connected to AS20, AS30, and AS80, AS20 is connected to AS10, AS50, and AS60, AS30 is connected to AS10 and AS40, and AS40 is connected to AS40. , AS30 and AS80 are mutually connected, and AS70 is mutually connected with AS50 and AS60.

  Such a connection relationship between ASs is called an “AS link”. In the example shown in FIG. 1, AS10 and AS20 are connected by AS link L12, and AS10 and AS30 are connected by AS link L13. As described above, the ASs are connected by the AS link having the symbol starting with “L” in the example illustrated in FIG. 1.

  The terminal 13 is arranged in the local network N1 formed in the AS 10. The terminal 13 is connected to the router 11 and transmits and receives packets to and from other terminals and servers via the router 11. Further, the Web server 32 is arranged in the AS 30 and, for example, transmits an HTML (HyperText Markup Language) document or the like to the terminal 13 when accessed from the terminal 13.

  The network monitoring apparatus 100 monitors the AS 10 and is connected to the routers 11 and 12. The network monitoring apparatus 100 collects route information including the transmission destination prefix of traffic passing through the AS 10 and the AS route (AS path) through which the traffic passes from the routers 11 and 12. In the example shown in FIG. 1, the network monitoring device 100 is arranged in the AS 10. For example, by receiving an OPEN message, an UPDATE message, or the like in I-BGP (Internal-BGP) from the routers 11 and 12, Collect route information.

  Further, the network monitoring apparatus 100 collects flow information including the transmission source IP address, the transmission destination IP address, and the traffic amount of the traffic passing through the AS 10 from the routers 11 and 12. For example, the network monitoring apparatus 100 collects flow information from the routers 11 to 13 and the like by a technique such as sFlow (registered trademark), NetFlow, and IPFIX.

  Then, the network monitoring apparatus 100 according to the first embodiment uses the route information and flow information collected from the routers 11 and 12, and for each attribute of the route information, the amount of traffic flowing through the route including the attribute in time series. Tally. The attribute of the route information in the first embodiment is, for example, “destination prefix”, “AS path”, “next hop” and “community” included in the BGP message, and “peer AS that can be extracted from the AS path”. (Adjacent AS) ”,“ origin AS (route information generation source AS) ”,“ AS link ”,“ AS path length ”, and the like. That is, for example, the network monitoring apparatus 100 aggregates the traffic amount distributed to the transmission destination prefix in time series for each transmission destination prefix. Further, for example, the network monitoring apparatus 100 aggregates the traffic volume flowing through the AS path in time series for each AS path, or aggregates the traffic volume flowing through the AS link in time series for each AS link. Or

  Note that the network monitoring apparatus 100 uses only the prefix with the longest prefix length and the attribute value of the prefix among the destination prefixes collected from the BGP message. This is because a prefix having a long prefix length is preferentially selected in route routing. That is, the network monitoring apparatus 100 can prevent multiple additions of traffic by setting only the prefix with the longest prefix length as a traffic aggregation target.

  Then, the network monitoring apparatus 100 monitors the traffic amount for each attribute of the route information using the traffic amount collected for each attribute of the route information. The outline of the traffic fluctuation detection process by the network monitoring apparatus 100 will be described below. Here, a case where the network monitoring apparatus 100 monitors the traffic amount aggregated for each transmission destination prefix will be described as an example.

  First, the network monitoring apparatus 100 is past a predetermined period from the traffic monitoring target date and time (hereinafter sometimes referred to as “monitoring target date and time”) from the traffic volume aggregated in time series for each destination prefix. The traffic volume for a predetermined time range at the date and time is extracted for a plurality of dates and times. Then, the network monitoring apparatus 100 identifies a traffic volume whose traffic volume fluctuation distribution is similar to the traffic volume fluctuation distribution at the monitoring target date and time among the extracted traffic volumes at a plurality of dates and times.

  For example, the network monitoring device 100 acquires the traffic volume on the day before the monitoring target date and time, the traffic volume on the date and time one week before the monitoring target date and time, and the like from the traffic volume aggregated for each transmission destination prefix. Then, the network monitoring apparatus 100 identifies a traffic volume whose traffic volume fluctuation distribution is similar to the traffic volume fluctuation distribution at the monitoring target date and time among the acquired traffic volumes at each date and time.

  Then, the network monitoring apparatus 100 calculates a threshold value indicating a traffic fluctuation allowable range based on the traffic amount specified above. For example, the network monitoring apparatus 100 calculates an average value of the traffic amount specified above, and calculates a threshold value indicating a traffic fluctuation allowable range by adding or subtracting a predetermined margin to the calculated average value. Then, the network monitoring apparatus 100 notifies a warning when the monitoring target traffic volume at the monitoring target date and time is not included in the threshold range calculated above.

  In the above description, the case where the network monitoring device 100 monitors the traffic amount aggregated for each transmission destination prefix has been described as an example. However, the network monitoring device 100 performs the above threshold calculation processing for each attribute of route information. And traffic fluctuation detection processing.

  As described above, the network monitoring apparatus 100 according to the first embodiment aggregates the traffic amount for each attribute of the route information, and monitors the fluctuation of the traffic for each attribute of the route information. Thereby, the network monitoring apparatus 100 according to the first embodiment can detect an abnormality in traffic fluctuation for each attribute of the route information. That is, when the network monitoring apparatus 100 detects an abnormality in traffic fluctuation, the network monitoring apparatus 100 can extract the attribute of the path information that has affected the abnormality, and therefore extracts the path fluctuation that has caused the traffic fluctuation. Can do.

  Further, the network monitoring apparatus 100 according to the first embodiment extracts the traffic volume at a plurality of dates and times at a past date and time for a predetermined period from the monitoring date and time in the traffic fluctuation detection process, and the traffic volumes at the extracted dates and times Among them, a threshold indicating a traffic fluctuation allowable range is calculated based on a traffic volume whose traffic volume fluctuation distribution is similar to the traffic volume fluctuation distribution at the monitoring target date and time. There is a high possibility that the traffic fluctuation at the date and time when the monitoring target date and time and the traffic fluctuation are similar are similar to the traffic fluctuation after the monitoring target date and time. That is, since the network monitoring apparatus 100 according to the first embodiment calculates the threshold based on the traffic fluctuation at the date and time when the monitoring target date and time and the traffic fluctuation are similar, the abnormality of the traffic fluctuation can be accurately detected. From the above, it is possible to accurately extract a factor of traffic fluctuation. The configuration and processing procedure of the network monitoring apparatus 100 according to the first embodiment will be described in detail below.

[Configuration of network monitoring device]
Next, the configuration of the network monitoring apparatus 100 according to the first embodiment will be described with reference to FIG. FIG. 2 is a block diagram illustrating a configuration example of the network monitoring apparatus 100 according to the first embodiment.

  As illustrated in FIG. 2, the network monitoring apparatus 100 according to the first embodiment includes a network information storage unit 110, a path information storage unit 121, a flow information storage unit 122, a traffic amount storage unit 130, and a traffic totaling unit 141. A threshold calculation unit 142, a traffic fluctuation detection unit 143, a detection history storage unit 144, and a warning unit 145.

  The network information storage unit 110 is a storage device that stores various types of information, and includes a route information storage unit 111, an attribute change information storage unit 112, and a flow information storage unit 113. Various types of information stored in the network information storage unit 110 are stored and updated by a path information storage unit 121 and a flow information storage unit 122 described later. The route information storage unit 111, the attribute change information storage unit 112, and the flow information storage unit 113 will be described together with the route information storage unit 121 and the flow information storage unit 122.

  The route information storage unit 121 receives a BGP message from the router 11 or the like, and stores various information included in the received BGP message in the route information storage unit 121. Specifically, the route information storage unit 121 collects route information by receiving an OPEN message, an UPDATE message, or the like in I-BGP from the router 11 or the like. The route information storage unit 121 stores the route information collected from the router 11 or the like in the route information storage unit 111.

  The route information collected by the route information storage unit 121 includes a destination prefix indicating a traffic destination network address, information indicating addition or deletion of route information, a next hop address, and an AS route through which the traffic passes. AS path and the like are included. The route information storage unit 121 stores various types of information included in such route information in the route information storage unit 111. At this time, the route information storage unit 121 extracts, from the AS path information, an AS link that is a combination of the peer AS adjacent to the AS 10 to which the device belongs, the origin AS that generated the route information, the AS path length, and the adjacent AS. Then, the extracted various information is also stored in the route information storage unit 111.

  Here, FIG. 3 shows an example of the route information storage unit 111. As shown in FIG. 3, the route information storage unit 111 includes “reception time”, “router address”, “add / delete”, “prefix”, “next hop”, “AS path”, “community”, “peer”. It has items such as “AS”, “origin AS”, “AS path length”, and “AS link”.

  “Reception time” indicates the date and time when the path information storage unit 121 received the BGP message from the router or the date and time when the BGP message was generated. FIG. 3 shows an example in which the date and time is stored in “reception time” in units of month and date. However, the “reception time” may store the date / time in units of year / month / day / hour / minute / second, for example. Regarding “reception time” in another storage unit described below, the date and time may be stored in units of year / month / day / hour / minute / second.

  “Router address” indicates the IP address of the router that has transmitted the BGP message. In the example shown in FIG. 3, “RA11” stored in “router address” is the IP address of the router 11 shown in FIG. 1, and “RA12” is the IP address of the router 12. And “Add / Delete” indicates information for identifying whether route information is added or deleted.

  “Prefix” indicates a destination prefix included in the BGP message. In the example shown in FIG. 3, “M.0.0.0 / N” stored in “Prefix” is connected to AS “M” 0 among AS10 to AS80 shown in FIG. Network address of the network to be used. For example, “50.0.0.0/24” stored in “Prefix” in FIG. 3 indicates the network address of the network connected to the AS 50, and “70.0.0.0/24” is The network address of the network connected to the AS 70 is indicated.

  “Next hop” indicates the next hop address included in the BGP message. “AS path” indicates an AS path included in the BGP message. Note that FIG. 3 shows an example in which the AS order through which the BGP message passes is stored in the “AS path” by separating the AS number of the AS in order from the right by a space. The AS AS number is identification information for identifying the AS, and is a code given to each AS shown in FIG. For example, the AS number of the AS 10 is “10”, and the AS number of the AS 20 is “20”. “Community” indicates a community included in the BGP message.

  “Peer AS” is information extracted from the AS path by the route information storage unit 121 and indicates an AS adjacent to the AS 10 in which the network monitoring apparatus 100 is installed. “Origin AS” is information extracted from the AS path by the route information storage unit 121 and indicates the AS that generated the route information. FIG. 3 shows an example in which the AS number of the peer AS is stored in “Peer AS” and “Origin AS”.

  “AS path length” and “AS link” are information extracted from the AS path by the route information storage unit 121. FIG. 3 shows an example in which “AS link” stores the codes attached to the AS links shown in FIG. 1 as information for identifying the AS link. FIG. 3 shows an example in which information indicating the AS link is stored in “AS link” in a comma-delimited manner. In addition, the “AS path length” described above may be included in the BGP message. In such a case, the route information storage unit 121 stores the AS path length included in the BGP message in the route information storage unit 111.

  Therefore, the first line of the route information storage unit 111 illustrated in FIG. 3 includes, for example, a router whose route information storage unit 121 has an IP address “RA11” at the reception time “April 10, 10:00”. 11 shows that a BGP message including the destination prefix “50.0.0.0/24”, the next hop “RA11”, the AS path “10 20 50”, and the community “C11” has been received. In the first line of the route information storage unit 111 illustrated in FIG. 3, since the AS path is “10 20 50”, the peer AS adjacent to the AS 10 is “AS 20”, and the AS that generated the route information is In the example, “AS50”, the AS path length is “3”, and the AS links are “AS link L12” and “AS link L25”.

When the route information is deleted, attribute information such as “AS path” may not be included in the BGP message. Therefore, when receiving a BGP message including information indicating that the route information is to be deleted, the route information storage unit 121 “next hop”, “AS path”, “community”, “peer AS”, “origin” Information stored in a record that satisfies all of the following conditions (A1) to (A3) is copied to items such as “AS”, “AS path length”, and “AS link”.
(A1) The information stored in the “router address” of the route information storage unit 111 matches the IP address of the router that is the source of the BGP message. (A2) stored in the “prefix” of the route information storage unit 111. (A3) Among the records satisfying the above (A1) and (A2), the “reception time” is the maximum (the most recent date and time).

  Further, the route information storage unit 121 detects whether or not the attribute of the route information has been changed based on the route information received from the router 11 or the like, and stores the detected change content in the attribute change information storage unit 112. Specifically, when receiving a BGP message from the router 11 or the like, the route information storage unit 121 acquires a record that satisfies all the above conditions (A1) to (A3) from the route information storage unit 111.

  When the route information storage unit 121 acquires a record that satisfies all of the above conditions (A1) to (A3), the route information storage unit 121 includes the various information included in the acquired record and the BGP message received from the router 11 or the like. And whether the next hop, peer AS, origin AS, or AS path has been changed. Then, when any information is changed, the route information storage unit 121 stores the change content in the attribute change information storage unit 112.

  For example, referring to the second and fifth lines of the route information storage unit 111 illustrated in FIG. 3, the router addresses and prefixes in both records match. Therefore, when the route information storage unit 121 receives the BGP message corresponding to the fifth row of the route information storage unit 111 illustrated in FIG. 3, the route information illustrated in FIG. The record stored in the second row of the information storage unit 111 is compared. Then, the route information storage unit 121 detects that the AS path has been changed from “10 20 50 70” to “10 20 60 70”, and stores the detected change content in the attribute change information storage unit 112.

  Further, when the route information storage unit 121 receives a BGP message corresponding to the seventh line of the route information storage unit 111 illustrated in FIG. 3, the route information illustrated in FIG. The record stored in the third row of the information storage unit 111 is compared. Then, the route information storage unit 121 detects that the AS path is changed from “10 30 40” to “10 80 40” and the peer AS is changed from “AS30” to “AS80”, and the detected change contents Is stored in the attribute change information storage unit 112.

  Further, when the route information storage unit 121 receives a BGP message corresponding to the sixth line of the route information storage unit 111 illustrated in FIG. 3, the route information illustrated in FIG. 3 includes various information included in the BGP message. The record stored in the fourth line of the information storage unit 111 is compared. Then, the route information storage unit 121 detects that the route information has been deleted, and stores the detection result in the attribute change information storage unit 112.

  FIG. 4 shows an example of the attribute change information storage unit 112. As shown in FIG. 4, the attribute change information storage unit 112 includes “reception time”, “router address”, “next hop change”, “peer AS change”, “origin AS change”, “AS path change”, “ It has items such as “prefix”, “next hop”, “AS path”, and “community”.

  “Reception time”, “router address”, “prefix”, “next hop”, “AS path”, and “community” correspond to the items included in the route information storage unit 111 illustrated in FIG.

  The “next hop change” is information stored when the next hop is changed, and stores the next hop before the change and the next hop after the change. “Peer AS change” is information stored when the peer AS is changed, and the peer AS before and after the change is stored. “Origin AS change” is information stored when the origin AS is changed, and stores the origin AS before and after the change. “AS path change” is information stored when the AS path is changed, and the AS paths before and after the change are stored.

  For example, the first line of the attribute change information storage unit 112 illustrated in FIG. 4 is displayed when the route information storage unit 121 receives a BGP message corresponding to the fifth line of the route information storage unit 111 illustrated in FIG. Information to be stored. Specifically, the first line of the attribute change information storage unit 112 illustrated in FIG. 4 indicates that the AS path is changed from “10 20 50 70” to “10” according to the BGP message received at the time “April 16, 21:00”. 20 60 70 ”.

  Returning to the description of FIG. 2, the flow information storage unit 122 receives flow information from the router 11 or the like, and stores various information included in the received flow information in the flow information storage unit 113. Specifically, the router 11 or the like transmits flow information to the network monitoring apparatus 100 when a technique such as sFlow (registered trademark), NetFlow, or IPFIX is applied. The flow information storage unit 122 collects flow information by receiving flow information transmitted from the router 11 or the like.

  The flow information collected by the flow information storage unit 122 includes the IP address and port number of the traffic transmission source terminal, the IP address and port number of the traffic transmission destination terminal, the protocol used for packet distribution, the traffic volume, and the like. included. The flow information storage unit 122 stores various information included in such flow information in the flow information storage unit 113.

  FIG. 5 shows an example of the flow information storage unit 113. As illustrated in FIG. 5, the flow information storage unit 113 includes “reception time”, “router address”, “interface ID”, “source IP address”, “destination IP address”, “protocol”, “source”. Items such as “port number”, “destination port number”, and “traffic amount” are included.

  “Reception time” indicates the date and time when the flow information storage unit 122 received the flow information from the router, or the date and time when the flow information was generated by the router. “Router address” indicates the IP address of the router that transmitted the flow information. “Interface ID” indicates identification information for identifying the interface of the router that has transmitted the flow information. In the example illustrated in FIG. 5, “IF 11 a” stored in “Interface ID” indicates the interface of the router 11 connected to the router 12.

  As described above, “source IP address”, “destination IP address”, “protocol”, “source port number”, “destination port number”, and “traffic volume” are various information included in the flow information. Indicates.

  Returning to the description of FIG. 2, the traffic volume storage unit 130 stores the traffic volume in time series in association with a predetermined time interval for each attribute of the route information. Specifically, the traffic volume storage unit 130 includes a prefix unit storage unit 131, an origin AS unit storage unit 132, a peer AS unit storage unit 133, an AS path unit storage unit 134, and an AS link unit storage unit 135. And a router address unit storage unit 136. Various types of information stored in the traffic amount storage unit 130 are stored and updated by a traffic aggregation unit 141 described later.

  The traffic volume stored in the traffic volume storage unit 130 corresponds to the traffic volume corresponding to the prefix having the longest prefix length among the prefixes stored in the path information storage unit 111 and the attribute value of the prefix. Only traffic volume.

  FIG. 6 shows an example of the prefix unit storage unit 131. As illustrated in FIG. 6, the prefix unit storage unit 131 includes items such as “total time”, “prefix”, “input traffic amount”, and “output traffic amount”. “Aggregation time” indicates the time at which traffic is distributed. In the example illustrated in FIG. 6, a case where the traffic aggregation time interval is “5 minutes” is illustrated. “Prefix” indicates a destination prefix included in the route information, and corresponds to “prefix” in the route information storage unit 111 illustrated in FIG. 3. The “input traffic amount” indicates traffic input to the AS. “Output traffic amount” indicates traffic output from the AS. Since the network monitoring apparatus 100 according to the first embodiment is arranged in the AS 10, “input traffic volume” indicates the traffic volume input to the AS 10, and “output traffic volume” indicates the traffic volume output from the AS 10. Indicates.

  For example, the first line of the prefix unit storage unit 131 illustrated in FIG. 6 has a prefix of “50.0.0.0/24” on “April 13, 10:00 to 10: 5”. This indicates that traffic of “50 Mbps” is input to the AS 10 and traffic having the prefix “50.0.0.0/24” is output of “250 Mbps” from the AS 10.

  FIG. 7 shows an example of the origin AS unit storage unit 132. As illustrated in FIG. 7, the origin AS unit storage unit 132 includes items such as “total time”, “origin AS”, “input traffic volume”, and “output traffic volume”. “Origin AS” corresponds to “origin AS” in the path information storage unit 111 illustrated in FIG. 3. The “input traffic amount” indicates traffic that is input to the AS 10 through a route in which the AS stored in the corresponding “origin AS” is the origin AS. The “output traffic amount” indicates traffic that is output from the AS 10 and flows through a route in which the AS stored in the corresponding “origin AS” is the origin AS.

  For example, in the third line of the origin AS unit storage unit 132 illustrated in FIG. 7, the traffic flowing through the route whose origin AS is AS50 is transmitted to the AS10 on “April 13, 10:00:00 to 10:05”. Only “50 Mbps” is input, and traffic flowing through the route whose origin AS is AS 50 is output from the AS 10 by “250 Mbps”.

  FIG. 8 shows an example of the peer AS unit storage unit 133. As shown in FIG. 8, the peer AS unit storage unit 133 includes items such as “total time”, “peer AS”, “input traffic amount”, and “output traffic amount”. “Peer AS” corresponds to “Peer AS” in the path information storage unit 111 illustrated in FIG. 3. The “input traffic amount” indicates traffic input to the AS 10 through a route in which the AS stored in the corresponding “peer AS” is the peer AS. The “output traffic amount” indicates traffic that is output from the AS 10 and flows through a route in which the AS stored in the corresponding “peer AS” is the peer AS.

  For example, the first line of the peer AS unit storage unit 133 illustrated in FIG. 8 is “April 13, 10:00:00 to 10: 5”, and traffic flowing through the route where the peer AS is AS20 is transferred to the AS10. Only “250 Mbps” is input, and traffic flowing through the route whose peer AS is the AS 20 is output from the AS 10 by “350 Mbps”.

  FIG. 9 shows an example of the AS path unit storage unit 134. As illustrated in FIG. 9, the AS path unit storage unit 134 includes items such as “total time”, “AS path”, “input traffic volume”, and “output traffic volume”. The “AS path” corresponds to the “AS path” in the path information storage unit 111 illustrated in FIG. The “input traffic amount” indicates the traffic that is input to the AS 10 through the route stored in the corresponding “AS path”. The “output traffic amount” indicates the traffic that is output from the AS 10 and flows through the route stored in the corresponding “AS path”.

  For example, the first line of the AS path unit storage unit 134 illustrated in FIG. 9 shows traffic flowing through the route indicated by the AS path “10 20 50” on “April 13, 10:00:00 to 10:05”. Is input to the AS 10 by “50 Mbps”, and traffic flowing through the route indicated by the AS path “10 20 50” is output from the AS 10 by “250 Mbps”.

  FIG. 10 shows an example of the AS link unit storage unit 135. As shown in FIG. 10, the AS link unit storage unit 135 has items such as “total time”, “AS link”, “input traffic volume”, and “output traffic volume”. The “AS link” corresponds to the “AS link” in the route information storage unit 111 illustrated in FIG. The “input traffic amount” indicates traffic that is input to the AS 10 through the AS link stored in the corresponding “AS link”. The “output traffic amount” indicates traffic that is output from the AS 10 and flows through the AS link stored in the corresponding “AS link”.

  For example, the first line of the AS link unit storage unit 135 illustrated in FIG. 10 indicates that traffic flowing through the AS link L12 is “250 Mbps” in the AS 10 at “10: 10-10: 05 April 13”. This indicates that the traffic that has been input and distributed through the AS link 12 has been output from the AS 10 by “350 Mbps”.

  FIG. 11 shows an example of the router address unit storage unit 136. As shown in FIG. 11, the router address unit storage unit 136 includes items such as “total time”, “router address”, “input traffic amount”, and “output traffic amount”. The “router address” corresponds to the “router address” in the route information storage unit 111 illustrated in FIG. The “input traffic amount” indicates the traffic input to the router stored in the corresponding “router address”. The “output traffic amount” indicates the traffic output from the router stored in the corresponding “router address”.

  Returning to the description of FIG. 2, the traffic totaling unit 141 includes the source IP address, destination IP address, traffic volume stored in the flow information storage unit 113, and prefix stored in the route information storage unit 111. Based on the above, the traffic volume is aggregated for each attribute of the route information.

  Specifically, the traffic totaling unit 141 totals traffic for each transmission destination prefix at a predetermined time interval, and stores the totaling result in the prefix unit storage unit 131. Further, the traffic totaling unit 141 totals traffic for each origin AS at a predetermined time interval, and stores the totaling result in the origin AS unit storage unit 132. The traffic totaling unit 141 totals traffic for each peer AS at a predetermined time interval, and stores the totaling result in the peer AS unit storage unit 133. The traffic totaling unit 141 totals traffic for each AS path at a predetermined time interval, and stores the totalization result in the AS path unit storage unit 134. The traffic totaling unit 141 totals traffic for each AS link at a predetermined time interval, and stores the totalization result in the AS link unit storage unit 135. The traffic totaling unit 141 totals traffic for each IP address of the router at a predetermined time interval, and stores the totaling result in the router address unit storage unit 136.

  Note that the traffic totaling unit 141 totals the traffic amount for each attribute of the route information other than the above. Specifically, the traffic totalization unit 141 totals traffic for each next hop, totals traffic for each community, totals traffic for each AS path length, and stores each totalization result in a storage unit (not shown). .

  Here, the traffic totaling process by the traffic totaling unit 141 will be described. Here, it is assumed that the route information storage unit 111 is in the state shown in FIG. 3 and the flow information storage unit 113 is in the state shown in FIG. In the following, it is assumed that the traffic totaling unit 141 totals the traffic volume at intervals of 5 minutes.

  The traffic totaling unit 141 first acquires a record whose reception time corresponds to the totaling time from the flow information storage unit 113. Then, the traffic counting unit 141 divides the traffic amount included in the acquired record into input traffic and output traffic, and totals each prefix. At this time, the flow information storage unit 113 totals the traffic amount for each prefix stored in the route information storage unit 111. Then, the traffic totaling unit 141 stores the total traffic amount in the prefix unit storage unit 131. Note that the traffic totaling unit 141 sets only the prefix with the longest prefix length among the prefixes stored in the route information storage unit 111 as the traffic totaling target.

  For example, when the aggregation target time is “10:00 on April 13, 10:10 to 10: 5”, the traffic aggregation unit 141 displays the first to sixth lines of the flow information storage unit 113 illustrated in FIG. Get the record. Then, the traffic totaling unit 141 determines whether the traffic amount included in the acquired record indicates input traffic input to the AS 10 or indicates output traffic output from the AS 10.

  Here, the process of determining traffic input / output will be described by taking the record in the first row of the flow information storage unit 113 shown in FIG. 5 as an example. Referring to the first line of the flow information storage unit 113 shown in FIG. 5, the router address is “RA11”, the interface ID is “IF11a”, and the transmission source IP address is “10.0.0.1”. And the destination IP address is “50.0.0.1”.

  As described above, the router address “RA11” indicates the router 11, and the interface ID “IF11a” indicates the interface of the router 11 connected to the router 12. The prefix “M.0.0.0 / N” indicates the network address of the network connected to AS “M” 0 among AS10 to AS80. That is, the network address “10.0.0.0/N” corresponding to the IP address “10.0.0.1” is a network connected to the AS 10 and the IP address “50.0.0.1”. The network address “50.0.0.0/N” corresponding to “” is a network connected to the AS 50.

  Therefore, the first line of the flow information storage unit 113 indicates that the traffic distributed from the AS 10 to the AS 50 is “150 Mbps”. In other words, the first line of the flow information storage unit 113 shown in FIG. 5 indicates that the amount of traffic output from the interface of the router 11 in the AS 10 to the router 12 is “150 Mbps”.

  For the same reason, for example, the second row of the flow information storage unit 113 illustrated in FIG. 5 indicates that the traffic amount output from the router 11 to the router 12 is “100 Mbps”, and the flow illustrated in FIG. The third line of the information storage unit 113 indicates that the amount of traffic input from the router 12 to the router 11 is “50 Mbps”.

  As described above, the traffic totaling unit 141 specifies the interface of the router through which the traffic flows based on the router address, the interface ID, the transmission source IP address, and the transmission destination IP address stored in the flow information storage unit 113. In addition, it is possible to specify whether such traffic is input to or output from the interface of the router.

  After determining the traffic input / output in this way, the traffic totaling unit 141 acquires a prefix from the path information storage unit 111. Here, since the aggregation target time is “April 13, 10:00 to 10: 5”, the route information storage unit 111 shown in FIG. 3 has information only in the first to fourth lines. Not remembered. Therefore, the traffic totaling unit 141 receives the prefix “50.0.0.0/24”, “70.0.0.0/16”, “40.0.0.0/24” from the route information storage unit 111. And “30.0.0.0/16” are acquired.

  Subsequently, the traffic totaling unit 141 specifies a record whose transmission source IP address belongs to the prefix “50.0.0.0/24” among the records acquired from the flow information storage unit 113. Here, the traffic totaling unit 141 identifies the record in the third row of the flow information storage unit 113. Then, the traffic totaling unit 141 totals the traffic amount “50 Mbps” included in the record in the third row of the flow information storage unit 113 as the input traffic of the prefix “50.0.0.0/24”.

  Subsequently, the traffic totaling unit 141 specifies a record whose transmission destination IP address belongs to the prefix “50.0.0.0/24” among the records acquired from the flow information storage unit 113. Here, the traffic totaling unit 141 identifies the records on the first and second lines of the flow information storage unit 113. The traffic totaling unit 141 then outputs traffic volumes “150 Mbps” and “150 Mbps” included in the records in the first and second rows of the flow information storage unit 113 as output traffic of the prefix “50.0.0.0/24”. “250 Mbps” obtained by adding “100 Mbps” is added up.

  Similarly, the traffic totaling unit 141 totals the traffic amount “200 Mbps” as the output traffic of the prefix “70.0.0.0/16”, and the input traffic of the prefix “70.0.0.0/16”. As a result, the traffic volume “100 Mbps” is totaled.

  Then, the traffic totaling unit 141 stores the total traffic amount in the prefix unit storage unit 131. Specifically, like the prefix unit storage unit 131 illustrated in FIG. 6, the traffic totaling unit 141 includes the totaling time “April 13, 10:00:00 to 10: 5” and the prefix “50.0. 0.0 / 24 ”, the input traffic volume“ 50 Mbps ”, and the output traffic volume“ 250 Mbps ”are associated with each other and stored in the prefix unit storage unit 131. Further, the traffic totaling unit 141 outputs the totaling time “April 13, 10: 00: 00-10: 05”, the prefix “70.0.0.0/16”, the input traffic amount “200 Mbps”, and the output The traffic volume “100 Mbps” is stored in the prefix unit storage unit 131 in association with it.

  Subsequently, the traffic totaling unit 141 totals the traffic amount for each origin AS. Specifically, the traffic totaling unit 141 acquires the origin AS from the route information storage unit 111. As described above, since the monitoring target time is “April 13, 10: 00: 00-10: 05”, the path information storage unit 111 shown in FIG. Information is stored only up to the eyes. Therefore, the traffic totaling unit 141 acquires AS30, AS40, AS50, and AS70 as the origin AS from the route information storage unit 111.

  Then, the traffic totaling unit 141 acquires the prefix “30.0.0.0/16” in which the AS 30 is the origin AS from the route information storage unit 111. Then, the traffic totaling unit 141 acquires the input traffic amount and the output traffic amount corresponding to the prefix “30.0.0.0/16” from the prefix unit storage unit 131. As illustrated in FIG. 6, the prefix unit storage unit 131 does not hold the input traffic volume and the output traffic volume corresponding to the aggregation time “April 13, 10: 00: 00-10: 05”. Therefore, the traffic totaling unit 141 does not acquire the input traffic amount and the output traffic amount corresponding to the prefix “30.0.0.0/16” from the prefix unit storage unit 131.

  Then, as shown in FIG. 7, the traffic totaling unit 141 outputs the totaling time “April 13, 10:00:00 to 10: 5”, the origin AS “30”, the input traffic amount “0 Mbps”, and the output The traffic volume “0 Mbps” is stored in the origin AS unit storage unit 132 in association with each other. Similarly, the traffic totaling unit 141 stores the origin AS “40”, the input traffic amount “0 Mbps”, and the output traffic amount “0 Mbps” in association with each other in the origin AS unit storage unit 132.

  In addition, the traffic totaling unit 141 acquires the prefix “50.0.0.0/24” in which the AS 50 is the origin AS from the route information storage unit 111. Then, the traffic totaling unit 141 receives the input traffic amount “50 Mbps” and the output traffic amount “250 Mbps” corresponding to the prefix “50.0.0.0/24” from the prefix unit storage unit 131 illustrated in FIG. To get. Then, as shown in FIG. 7, the traffic totaling unit 141 outputs the totaling time “April 13, 10:00:00 to 10: 5”, the origin AS “50”, the input traffic amount “50 Mbps”, and the output The traffic amount “250 Mbps” is associated with each other and stored in the origin AS unit storage unit 132. Similarly, the traffic totalization unit 141 calculates the total time “April 13, 10:00 to 10: 5”, the origin AS “70”, the input traffic volume “200 Mbps”, and the output traffic volume “100 Mbps”. Are stored in the origin AS unit storage unit 132 in association with each other.

  Subsequently, the traffic totaling unit 141 totals the traffic amount for each peer AS. Specifically, the traffic totaling unit 141 acquires the peer AS from the route information storage unit 111. Here, the traffic totalization unit 141 acquires AS20 and AS30 as the peer AS from the route information storage unit 111.

  Then, the traffic totaling unit 141 acquires the prefixes “50.0.0.0/24” and “70.0.0.0/16” in which the AS 20 is the peer AS from the route information storage unit 111. Then, the traffic totaling unit 141 acquires the input traffic amount “50 Mbps” and the output traffic amount “250 Mbps” corresponding to the prefix “50.0.0.0/24” from the prefix unit storage unit 131. Further, the traffic totaling unit 141 acquires the input traffic amount “200 Mbps” and the output traffic amount “100 Mbps” corresponding to the prefix “70.0.0.0/16” from the prefix unit storage unit 131.

  Then, the traffic totaling unit 141 receives the input traffic volume “50 Mbps” corresponding to the prefix “50.0.0.0/24” and the input traffic volume “70.0.0.0/16” “ "200 Mbps" is added to calculate "250 Mbps". Further, the traffic totaling unit 141 outputs the output traffic amount “250 Mbps” corresponding to the prefix “50.0.0.0/24” and the output traffic amount “50.0.0.0/16” corresponding to the prefix “70.0.0.0/16”. “350 Mbps” is calculated by adding “100 Mbps”.

  Then, as shown in FIG. 8, the traffic totaling unit 141 outputs the totaling time “April 13, 10:00:00 to 10: 5”, the peer AS “20”, the input traffic amount “250 Mbps”, and the output The traffic amount “350 Mbps” is associated and stored in the peer AS unit storage unit 133. Similarly, the traffic totalization unit 141 calculates the total time “April 13, 10: 00: 00-10: 05”, peer AS “30”, input traffic volume “0 Mbps”, and output traffic volume “0 Mbps”. Are stored in the peer AS unit storage unit 133 in association with each other.

  Further, the traffic totaling unit 141 acquires the prefix “50.0.0.0/24” in which the AS 50 is the peer AS from the route information storage unit 111. Then, the traffic totaling unit 141 receives the input traffic amount “50 Mbps” and the output traffic amount “250 Mbps” corresponding to the prefix “50.0.0.0/24” from the prefix unit storage unit 131 illustrated in FIG. To get. Then, as shown in FIG. 7, the traffic totaling unit 141 outputs the totaling time “April 13, 10:00 to 10: 5”, the peer AS “50”, the input traffic amount “50 Mbps”, and the output The traffic amount “250 Mbps” is associated with each other and stored in the peer AS unit storage unit 133. Similarly, the traffic totaling unit 141 stores the peer AS “70”, the input traffic amount “200 Mbps”, and the output traffic amount “100 Mbps” in the peer AS unit storage unit 133 in association with each other.

  Similarly, the traffic totaling unit 141 aggregates traffic for each AS path and updates the AS path unit storage unit 134, aggregates traffic for each AS link, updates the AS link unit storage unit 135, and updates the router address. The traffic is counted every time and the router address unit storage unit 136 is updated.

  When performing traffic monitoring, the threshold value calculation unit 142 sets a threshold value used when a traffic fluctuation detection unit 143 (to be described later) detects a traffic amount abnormality based on information stored in the traffic amount storage unit 130. calculate. The traffic fluctuation detection unit 143 described later determines whether or not the traffic amount is abnormal for each attribute of the route information. Therefore, the threshold calculation unit 142 calculates a threshold for input traffic and a threshold for output traffic for each attribute of the route information. Since the process for calculating the threshold for input traffic and the process for calculating the threshold for output traffic are the same, in the following, either the threshold for input traffic or the threshold for output traffic may be used. Will be described without distinguishing both.

  Specifically, the threshold value calculation unit 142 uses the information stored in the prefix unit storage unit 131 when the traffic fluctuation detection unit 143 determines whether the traffic amount for each prefix is abnormal. Calculate the threshold used. Similarly, the threshold value calculation unit 142 calculates threshold values used when it is determined whether or not the traffic amount for each origin AS, each peer AS, each AS path, each AS link, and each router address is abnormal. To do.

  Here, the threshold value calculation processing by the threshold value calculation unit 142 will be described in detail with reference to FIGS. 12 and 13. FIG. 12 is a diagram illustrating an example of traffic fluctuation. FIG. 13 is a diagram illustrating an example of traffic fluctuation per unit time. Note that the threshold calculation processing by the threshold calculation unit 142 does not differ depending on the attribute of the route information, and here, a case where a threshold corresponding to the traffic amount for each prefix is calculated will be described as an example. That is, FIG. 12 is a diagram showing the traffic amount stored in the prefix unit storage unit 131 in a graph.

  In the example illustrated in FIG. 12, it is assumed that the traffic fluctuation detection unit 143 described later detects whether or not the traffic in the monitoring time zone “t0” at the traffic monitoring target date and time is abnormal. In the first embodiment, the monitoring time zone corresponds to the total time illustrated in FIGS. That is, in the example shown in FIGS. 6 to 11, the monitoring time zone is “5 minutes”.

  In such a case, the threshold value calculation unit 142 acquires the traffic amount for the unit time used for calculating the threshold value (hereinafter sometimes referred to as “threshold value calculation unit time”) from the prefix unit storage unit 131. At this time, the threshold calculation unit 142 acquires, for example, the traffic amount for the threshold calculation unit time “t1” immediately before the monitoring time period “t0” from the prefix unit storage unit 131.

  Further, the threshold value calculation unit 142 acquires, from the prefix unit storage unit 131, a traffic amount that is a predetermined period before the date and time in the threshold value calculation unit time “t1” and that is in the same time zone as the date and time. . Here, the threshold value calculation unit 142 according to the first embodiment uses “1 day”, “1 week (7 days)”, and “most recent holiday” as the “predetermined period”.

  That is, in the example illustrated in FIG. 12, the threshold calculation unit 142 is one day before the date and time in the threshold calculation unit time “t1” and is in the threshold calculation unit time “t2” that is the same time zone as the date and time. Get traffic volume. Further, the threshold value calculation unit 142 acquires the traffic volume in the threshold value calculation unit time “t3” that is the latest holiday with respect to the date and time in the threshold value calculation unit time “t1” and is in the same time zone as the date and time. Further, the threshold value calculation unit 142 acquires the traffic volume in the threshold value calculation unit time “t4” that is one week before the date and time in the threshold value calculation unit time “t1” and that is in the same time zone as the date and time.

  For example, it is assumed that the threshold calculation unit time is “1 hour” and the monitoring time zone “t0” is “April 13, 10:00 to 10: 5”. In such a case, the threshold value calculation unit 142 sets the threshold value calculation unit time “t1” immediately before the monitoring time period t0 = “April 13, 10:00:00 to 10: 5” = “April 13, 9:00 to 10”. Get traffic volume for "hours". Further, the threshold value calculation unit 142 acquires the traffic amount for the threshold calculation unit time “t2” = “9:00 to 10:00 on April 12,” as the traffic amount before “1 day”. Further, the threshold value calculation unit 142 acquires the traffic amount of the threshold calculation unit time “t3” = “9:00 to 10:00 on April 11” as the traffic amount of “the latest holiday”. Here, it is assumed that “April 11” is a holiday. Further, the threshold value calculation unit 142 acquires the traffic amount of the threshold calculation unit time “t4” = “April 6 from 9:00 to 10:00” as the traffic amount before “one week”.

  Then, the threshold value calculation unit 142 calculates the threshold value calculation unit immediately before the monitoring time period “t0” in the traffic amount fluctuation distribution among the traffic amounts of the threshold value calculation unit times “t2” to “t4” acquired in this way. A traffic volume similar to the traffic volume fluctuation distribution at time “t1” is extracted. Then, the threshold value calculation unit 142 calculates a threshold value that is an allowable fluctuation range of the traffic amount using the extracted traffic amount.

  The reason for using “1 day” as the “predetermined period” is that traffic fluctuations are often not significantly different from the previous day, and when the traffic volume on the previous day is significantly different, it can be determined that there is an abnormality. It is. The reason for using “one week” as the “predetermined period” is that traffic fluctuations often do not change significantly on the same day of the week. Also, the reason for using “most recent holiday” as the “predetermined period” is that traffic fluctuations may differ between weekdays and holidays, and if the monitoring target day is a holiday, the traffic volume of the previous day or one week ago This is because there is a possibility that correct traffic fluctuation detection processing cannot be performed even if the comparison is made. However, by using “the most recent holiday” as the “predetermined period”, traffic fluctuation detection processing can be performed accurately even if the monitoring target day is a holiday, and as a result, the factors of traffic fluctuation can be accurately extracted. can do.

  Here, an example of a process for determining the similarity of the traffic amount by the threshold calculation unit 142 will be described. The traffic volume in the threshold calculation unit times “t1” to “t4” is represented by, for example, the traffic volume aggregated at predetermined aggregation time intervals as illustrated in FIG. The threshold value calculation unit 142 calculates, for example, an average value of the traffic volume in the threshold calculation unit time “t1” when determining whether or not the traffic volume fluctuation distributions shown in FIG. 13 are similar. Further, the threshold calculation unit 142 calculates the average value of the traffic volume in the threshold calculation unit time “t2”, the average value of the traffic volume in the threshold calculation unit time “t3”, and the average value of the traffic volume in the threshold calculation unit time “t4”. Is also calculated. Then, the threshold value calculation unit 142 has a traffic amount that is closest to the average value of the traffic amounts in the threshold calculation unit time “t1” among the traffic amounts in the threshold calculation unit times “t2” to “t4”. , It is determined that it is most similar to the traffic amount in the threshold calculation unit time “t1”.

  For example, the threshold value calculation unit 142 may determine the similarity by calculating a traffic fluctuation range that is a difference between the maximum value and the minimum value of the traffic volume. Specifically, the threshold value calculation unit 142 calculates the traffic fluctuation width of the traffic amount in the threshold value calculation unit times “t1” to “t4”. Then, the threshold value calculation unit 142 determines that the traffic amount whose traffic fluctuation width is closest to the traffic fluctuation width in the threshold calculation unit time “t1” among the traffic amounts in the threshold calculation unit times “t2” to “t4” is the threshold calculation unit. It may be determined that the traffic amount at the time “t1” is most similar.

  Next, an example of threshold calculation processing by the threshold calculation unit 142 will be described. It is assumed that the threshold calculation unit 142 extracts the traffic amount illustrated in FIG. 13 as the traffic amount of the threshold calculation unit time similar to the traffic amount in the threshold calculation unit time “t1” as described above. In such a case, the threshold calculation unit 142 calculates, for example, the average value T10 of the traffic amount illustrated in FIG. Then, as illustrated in FIG. 13, the threshold calculation unit 142 calculates the upper limit threshold T11 by adding the margin M10 to the average value T10, and calculates the lower limit threshold T12 by subtracting the margin M10 from the threshold T10. . The upper limit threshold value T11 to the lower limit threshold value T12 calculated in this way are the threshold values of the fluctuation allowable range.

  The threshold calculation unit 142 uses the average value and the standard deviation of the traffic volume to calculate the threshold so that the traffic volume is determined to be abnormal when the traffic volume exceeds a predetermined degree of deviation. Also good.

  Returning to the description of FIG. 2, the traffic fluctuation detection unit 143 determines whether the traffic amount in the monitoring time period is included in the traffic threshold range calculated by the threshold calculation unit 142 for each attribute of the route information. Determine. The traffic fluctuation detection unit 143 performs a comparison process with a threshold value for both input traffic and output traffic. Since the process for input traffic and the process for output traffic are the same, in the following, when either the process for input traffic or the process for output traffic may be performed, both will be described without distinction.

  And the traffic fluctuation | variation detection part 143 determines similarly about output traffic amount. The traffic fluctuation detection unit 143 detects that the traffic amount is abnormal when the traffic amount in the monitoring target time is not included in the threshold range. Then, the traffic fluctuation detection unit 143 stores the detection result in the detection history storage unit 144. For example, the traffic fluctuation detection unit 143 stores the abnormality detection section from the date and time when the traffic amount abnormality is detected to the date and time when the traffic amount abnormality is no longer detected in the detection history storage unit 144. The traffic fluctuation detection unit 143 performs such traffic fluctuation detection processing for each attribute of the route information.

  The detection history storage unit 144 stores the detection result by the traffic fluctuation detection unit 143. For example, as described above, the detection history storage unit 144 stores the abnormality detection section in which the traffic fluctuation detection unit 143 detects that the traffic amount is abnormal.

  The threshold value calculation unit 142 calculates the threshold value by excluding the abnormality detection section stored in the detection history storage unit 144. This will be specifically described with reference to FIG. FIG. 14 is a diagram illustrating an example of traffic fluctuation. When calculating the threshold value from the traffic amount shown in FIG. 14, the threshold value calculation unit 142 refers to the detection history storage unit 144 and identifies the abnormality detection section G11. Then, the threshold value calculation unit 142 calculates the threshold value by calculating the average value of the traffic volume and the like by excluding the specified abnormality detection section G11.

  The warning unit 145 notifies a warning when the traffic fluctuation detection unit 143 detects an abnormality in the traffic amount. Specifically, the warning unit 145 is stored in the route information storage unit 111, the attribute change information storage unit 112, the flow information storage unit 113, etc., when the traffic fluctuation detection unit 143 detects an abnormality in traffic volume. A warning including various information is displayed on a display unit (not shown) or notified to a network administrator or the like.

  For example, when the traffic fluctuation detection unit 143 detects an abnormality with respect to the traffic amount for each prefix, the warning unit 145 sends various information corresponding to the prefix in which the abnormality is detected from the route information storage unit 111. In addition to the acquisition, various information corresponding to the prefix in which the abnormality is detected is acquired from the attribute change information storage unit 112. At this time, the warning unit 145 acquires, from the route information storage unit 111 and the attribute change information storage unit 112, various pieces of information in which the information stored in the “reception time” is near the date and time when the abnormality is detected. The warning unit 145 notifies the network administrator or the like of various information acquired from the route information storage unit 111 or the attribute change information storage unit 112.

  Further, for example, when the traffic fluctuation detection unit 143 detects an abnormality in the traffic amount with respect to the traffic amount for each origin AS stored in the origin AS unit storage unit 132, the warning unit 145 determines the route information. Acquire various information corresponding to the origin AS in which an abnormality is detected from the storage unit 111, acquire various information corresponding to the origin AS in which an abnormality is detected from the attribute change information storage unit 112, and acquire the acquired various information Notify the network administrator.

  In this way, when the traffic fluctuation detection unit 143 detects an abnormality in the traffic amount, the warning unit 145 sends various information related to the attribute of the route information to be detected to the route information storage unit 111 and the attribute change information storage unit 112. Or the flow information storage unit 113 or the like, and notifies the network administrator or the like of the acquired various information.

[Traffic aggregation processing procedure]
Next, the procedure of the traffic totaling process performed by the network monitoring apparatus 100 according to the first embodiment will be described with reference to FIG. FIG. 15 is a flowchart of the traffic counting process procedure performed by the network monitoring apparatus 100 according to the first embodiment.

  As illustrated in FIG. 15, the route information storage unit 121 of the network monitoring device 100 collects route information by receiving a BGP message from the router 11 or the like (step S101), and the collected route information is stored in the route information storage unit 111. (Step S102). Further, when the attribute of the route information has been changed (Yes at Step S103), the route information storage unit 121 stores the changed content in the attribute change information storage unit 112 (Step S104).

  The flow information storage unit 122 of the network monitoring apparatus 100 collects flow information by receiving flow information from the router 11 or the like (step S105), and stores the collected flow information in the flow information storage unit 113 (step S105). S106). Then, the traffic totaling unit 141 totals the traffic amount for each attribute of the route information in the flow information storage unit 113 (step S107).

  Note that the processing procedures in S101 to S104 and the processing procedures in S105 and S106 may be performed simultaneously, or only one of them may be performed. Moreover, the process procedure in S107 does not need to be performed after the process procedure in S101 to S107, and may be performed periodically independently.

[Traffic fluctuation detection processing procedure]
Next, the procedure of traffic fluctuation detection processing by the network monitoring apparatus 100 according to the first embodiment will be described with reference to FIG. FIG. 16 is a flowchart of the traffic variation detection processing procedure performed by the network monitoring apparatus 100 according to the first embodiment.

  As illustrated in FIG. 16, the threshold calculation unit 142 of the network monitoring device 100, when the monitoring timing comes (Yes in step S201), is the threshold calculation unit time for the past date and time for a predetermined period from the monitoring target date and time. The traffic volume is extracted for a plurality of dates and times (step S202).

  Then, the threshold value calculation unit 142 identifies a traffic volume whose traffic volume fluctuation distribution is similar to the traffic volume fluctuation distribution at the monitoring target date and time among the traffic volumes extracted at step S202 (step S203). A threshold value is calculated based on the identified traffic volume (step S204). At this time, the threshold value calculation unit 142 calculates the threshold value by excluding the abnormality detection section stored in the detection history storage unit 144.

  Then, the traffic fluctuation detection unit 143 determines whether or not the traffic volume at the monitoring target date and time is included within the threshold range (step S205). When the traffic fluctuation detection unit 143 determines that the traffic volume is not included in the threshold range (No at Step S205), the warning unit 145 displays the attribute information stored in the attribute change information storage unit 112. A warning including the change contents is notified (step S206).

  When the network monitoring apparatus 100 has not performed the traffic fluctuation detection process for all the attributes of the route information (No at Step S207), the network monitoring apparatus 100 returns to Step S202. On the other hand, when the network monitoring apparatus 100 has performed the traffic fluctuation detection process for all the attributes of the route information (Yes at step S207), the network monitoring apparatus 100 ends the process.

[Effect of Example 1]
As described above, the network monitoring apparatus 100 according to the first embodiment aggregates the traffic amount for each attribute of the route information, and monitors the traffic fluctuation for each attribute of the route information. Further, in the traffic fluctuation detection process, the network monitoring apparatus 100 extracts the traffic volume at the past date and time for a plurality of dates and times for a predetermined period from the monitoring date and time, and out of the extracted traffic volumes at the plurality of date and time, the traffic volume Is calculated based on a traffic volume similar to the traffic volume fluctuation distribution at the monitoring target date and time. Thereby, the network monitoring apparatus 100 according to the first embodiment can accurately extract the factor of the traffic fluctuation from the above. Further, the network monitoring apparatus 100 according to the first embodiment can detect a traffic abnormality even for traffic having a small number of transmission / reception hosts as an attribute of route information, and extracts a route variation factor as a traffic variation factor. be able to.

  In addition, when the network monitoring apparatus 100 according to the first embodiment detects an abnormality in traffic fluctuation, the network monitoring apparatus 100 notifies a warning including the change contents of the attribute of the route information corresponding to the traffic in which the abnormality is detected. As a result, the network monitoring apparatus 100 can notify the network administrator or the like of the cause of traffic fluctuation.

  In addition, the network monitoring apparatus 100 according to the first embodiment calculates the threshold value by excluding the traffic amount in the abnormality detection section where the abnormality of the traffic fluctuation is detected, so that the cause of the traffic fluctuation can be extracted more accurately. .

  Incidentally, the network monitoring device, the network monitoring method, and the network monitoring program disclosed in the present application may be implemented in various different forms other than the above-described embodiments. Accordingly, in the second embodiment, another embodiment of the network monitoring device, the network monitoring method, and the network monitoring program disclosed in the present application will be described.

[period]
In the first embodiment, the threshold value calculation unit 142 uses “1 day”, “1 week (7 days)”, and “most recent holiday” as the predetermined cycle. However, this is only an example, and the threshold value calculation unit 142 may use a cycle every other day such as “1 day”, “2 days”, “3 days”, or the like as “1”. Periods every other week such as “week”, “2 weeks”, and “3 weeks” may be used.

[Threshold calculation processing]
In the first embodiment, the example in which the threshold calculation unit 142 calculates the threshold based on the traffic volume stored in the traffic volume storage unit 130 has been described. However, when the traffic volume is stored in the traffic volume storage unit 130 or when the traffic volume storage unit 130 does not store a traffic volume similar to the traffic volume variation distribution at the monitoring target date and time, the threshold calculation unit 142 may use a predetermined threshold value.

[Group]
In addition, the traffic fluctuation detection unit 143 stores information stored in the route information storage unit 111 or the attribute change information storage unit 112 when a traffic abnormality is detected for a plurality of attributes at the same time. Based on the stored information, it may be determined whether or not the attribute change content and the BGP message are duplicated. The traffic fluctuation detection unit 143 groups the plurality of attributes, assuming that the contents of the attribute change and the BGP message overlap, the traffic fluctuation in the plurality of attributes is the same factor. To do. Then, the traffic fluctuation detection unit 143 assigns the same group ID to the plurality of attributes in which the traffic abnormality is detected and the changed content of the duplicate attribute or the BGP message, and for each group ID, The change contents and various information included in the BGP message may be displayed on the display unit or notified to a network administrator or the like.

[Route information]
In addition, the traffic counting unit 141 and the like may perform processing after merging when the BGP information stored in the route information storage unit 111 is stored. May be.

[System configuration, etc.]
Further, in the above-described embodiment, each component of each illustrated apparatus is functionally conceptual and does not necessarily need to be physically configured as illustrated. In other words, the specific form of distribution / integration of each device is not limited to that shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured. For example, the flow information storage unit 122 and the traffic aggregation unit 141 illustrated in FIG. 2 may be integrated, or the threshold value calculation unit 142 and the traffic fluctuation detection unit 143 may be integrated.

[program]
The various processes described in the above embodiments can be realized by executing a program prepared in advance on a computer such as a personal computer or a workstation. Therefore, in the following, an example of a computer that executes a network monitoring program having the same function as that of the network monitoring apparatus 100 illustrated in FIG. 2 will be described with reference to FIG.

  FIG. 17 is a diagram illustrating that information processing by the network monitoring program according to the disclosed technique is specifically realized using a computer. As illustrated in FIG. 17, the computer 1000 includes, for example, a memory 1010, a CPU (Central Processing Unit) 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, A network interface 1070, and these units are connected by a bus 1080.

  The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM (Random Access Memory) 1012 as illustrated in FIG. The ROM 1011 stores a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031 as illustrated in FIG. The disk drive interface 1040 is connected to the disk drive 1041 as illustrated in FIG. For example, a removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive. The serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052 as illustrated in FIG. The video adapter 1060 is connected to a display 1061, for example, as illustrated in FIG.

  Here, as illustrated in FIG. 17, the hard disk drive 1031 stores, for example, an OS, application programs, program modules, and program data. In other words, the network monitoring program according to the disclosed technique is stored in, for example, the hard disk drive 1031 as a program module in which a command executed by the computer 1000 is described. Specifically, a route information storage procedure for executing information processing similar to that of the route information storage unit 121 described in the above embodiment, a flow information storage procedure for executing information processing similar to that of the flow information storage unit 122, and traffic Traffic aggregation procedure for executing information processing similar to that of the aggregation unit 141, threshold calculation procedure for executing information processing similar to that of the threshold value calculation unit 142, and traffic fluctuation detection procedure for performing information processing similar to that of the traffic fluctuation detection unit 143 And a program module in which a warning procedure for executing the same information processing as the warning unit 145 is described is stored in the hard disk drive 1031.

  In addition, data used for information processing by the network monitoring program, such as data stored in the network information storage unit 110, the traffic volume storage unit 130, and the detection history storage unit 144 described in the above embodiment, is program data. For example, it is stored in the hard disk drive 1031. Then, the CPU 1020 reads the program module and program data stored in the hard disk drive 1031 to the RAM 1012 as necessary, and stores a route information storage procedure, a flow information storage procedure, a traffic counting procedure, a threshold calculation procedure, a traffic fluctuation detection procedure, a warning. Perform the procedure.

  Note that the program module and program data related to the network monitoring program are not limited to being stored in the hard disk drive 1031, but may be stored in, for example, a removable storage medium and read out by the CPU 1020 via the disk drive or the like. . Alternatively, a program module and program data relating to the transfer program are stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.), and the CPU 1020 via the network interface 1070. May be read.

1 network 10-80 AS
11, 12, 21, 31 Router 13 Terminal 32 Web server 100 Network monitoring device 110 Network information storage unit 111 Path information storage unit 112 Attribute change information storage unit 113 Flow information storage unit 121 Path information storage unit 122 Flow information storage unit 130 Traffic Quantity storage unit 131 Prefix unit storage unit 132 Origin AS unit storage unit 133 Peer AS unit storage unit 134 AS path unit storage unit 135 AS link unit storage unit 136 Router address unit storage unit 141 Traffic totaling unit 142 Threshold calculation unit 143 Traffic fluctuation detection Part 144 Detection history storage part 145 Warning part

Claims (7)

A network monitoring device for monitoring an autonomous system included in a network,
For each attribute of route information indicating the route of traffic flowing through the autonomous system, a traffic totaling unit that totals the amount of traffic flowing through the route including the attribute;
An extraction unit that extracts, for a plurality of dates and times, a traffic amount for a predetermined time range in the past date and time for a predetermined period from the monitoring target date and time, from the traffic amount totaled by the traffic counting unit for each attribute of the route information When,
Of the amount of traffic corresponding to a plurality of time extracted by the extraction unit, to identify the nearest traffic volume and the average value or the maximum fluctuation width of the traffic volume in the average value or the maximum fluctuation width of the traffic volume the monitoring target date A threshold value calculation unit that calculates a threshold value that is a fluctuation allowable range obtained by adding or subtracting a predetermined value to the average value of the identified traffic amount for each attribute of the route information;
A traffic fluctuation detecting unit that detects whether the traffic volume at the monitoring target date and time is included within a threshold range calculated by the threshold value calculating unit for each attribute of the route information. Monitoring device. A route information storage unit that collects route information from the autonomous system and detects the change content of the attribute included in the route information, and stores the change content in the attribute change information storage unit;
When the traffic fluctuation detection unit determines that the traffic amount at the monitoring target date and time is not included in the threshold range, the attribute change information storage unit displays the change contents of the attribute of the route information corresponding to the traffic amount. The network monitoring apparatus according to claim 1, further comprising: a warning unit that obtains a warning including the acquired change content. The traffic fluctuation detection unit
An abnormality detection interval from a date / time at which it is determined that the traffic amount at the monitoring target date / time is not included in the threshold range to a date / time at which the traffic amount at the monitoring date / time is determined to be included in the threshold range is a predetermined value. Store it in the detection history storage,
The threshold value calculation unit
Of the traffic volumes extracted by the extraction unit, the traffic volume average value or maximum fluctuation range specifies the traffic volume closest to the traffic volume average value or maximum fluctuation width at the monitoring target date and time, and from the identified traffic volume The network monitoring apparatus according to claim 1, wherein the threshold value is calculated by excluding a traffic amount in the abnormality detection section . The extraction unit includes:
Of the traffic volume aggregated by the traffic aggregation unit, the traffic volume in the past for a predetermined number of weeks from the monitoring date and time, the traffic volume in the past for the predetermined number of days from the monitoring date and time, and the monitoring date and time The network monitoring device according to any one of claims 1 to 3, wherein a traffic volume of a holiday is extracted. The warning part is
When a plurality of attributes are determined that the traffic amount is not included in the threshold range by the traffic fluctuation detection unit, change contents corresponding to the plurality of attributes are acquired from the attribute change information storage unit and acquired. The network monitoring apparatus according to claim 2, wherein, when the contents of change are duplicated, the plurality of attributes are collectively alerted. A network monitoring method for monitoring an autonomous system included in a network,
Computer
For each attribute of route information indicating the route of traffic flowing through the autonomous system, a traffic counting step of counting the amount of traffic flowing through the route including the attribute;
An extraction step for extracting a traffic amount for a predetermined time range in the past date and time for a predetermined period from the monitoring target date and time, for a plurality of dates and times, from the traffic amount totaled by the traffic counting step for each attribute of the route information When,
Among traffic volumes corresponding to a plurality of dates and times extracted by the extraction step, a traffic volume whose average value or maximum fluctuation range is closest to the average or maximum fluctuation range of traffic volume at the monitoring date and time is specified. A threshold value calculation step for calculating a threshold value that is a fluctuation allowable range obtained by adding or subtracting a predetermined value to the average value of the identified traffic volume for each attribute of the route information;
A traffic fluctuation detecting step for detecting whether or not the traffic volume at the monitoring target date and time is included in the threshold value range calculated by the threshold value calculating step for each attribute of the route information. Monitoring method.   A network monitoring program for causing a computer to function as the network monitoring device according to claim 1.

Images