JP5799790B2 - Analysis apparatus, analysis program, and analysis method - Google Patents

Description

  The present invention relates to an analysis apparatus, an analysis program, and an analysis method.

  There is an analyzer that analyzes the system by acquiring the contents of communication between a plurality of servers and combining the messages transmitted and received for each protocol from the acquired contents.

  In addition, there is an extraction device that extracts a URI (Uniform Resource Identifier) portion transmitted to a preceding server, which separates processing executed by the succeeding server from a log of a server system having the preceding server and the succeeding server. It should be noted that the extraction of parameters for separating the processes executed by the subsequent server is referred to as “name identification”. When the URL (Uniform Resource Locator) corresponding to a plurality of processes executed in the subsequent server is the same, the extraction device sets the parameter type having a common value for each type of process executed in the subsequent server. Extract. As a result, the extraction device extracts the parameter types and parameter values for separating the processes executed by the subsequent server.

JP 2006-11683 A JP 2010-67047 A JP-A-11-136573 JP 2010-282367 A

  However, each of the above devices has a problem that name identification cannot be performed with high accuracy.

  For example, the above analysis apparatus operates after name identification has already been performed. In this analyzer, name identification is performed by a person such as a developer of the analyzer. As described above, when name identification is performed by a person, an artificial mistake may occur, and an error may occur in the correspondence between the parameter and the process executed by the subsequent server. Therefore, the analyzer cannot perform name identification with high accuracy.

  Further, in the above-described extraction device, when the URLs corresponding to a plurality of processes executed in the subsequent server are the same, the types of parameters having a common value are extracted. For this reason, in the above extraction device, when the URLs corresponding to a plurality of processes executed in the subsequent server are the same, it is difficult to perform name identification when no parameter value is set. Therefore, the extraction device cannot perform name identification with high accuracy.

  In one aspect, an object of the present invention is to perform name identification with high accuracy.

  In one plan, an analysis device disclosed in the present application includes a storage unit, a calculation unit, and a specifying unit. The storage unit stores the parameter type and parameter value included in the first request transmitted from the first device to the second device, and the second device to the third device based on the first request. The identifier of the process executed by the third device based on the transmitted second request is stored in association with each other. The calculation unit calculates a ratio of processing executed by the third device for each parameter type and value based on the storage content of the storage unit. Then, the calculation unit calculates the similarity between the parameter type and the value included in the first request for the parameter type and the value corresponding to the calculated ratio. The specifying unit specifies the type of parameter or the type and value of the parameter corresponding to the process executed by the third device based on the similarity calculated by the calculating unit.

  In one aspect, the present invention can perform name identification with high accuracy.

FIG. 1 is a diagram illustrating an example of an overall configuration diagram of a system to which the analysis apparatus according to the first embodiment is applied. FIG. 2 is a diagram illustrating the configuration of the capture server according to the first embodiment. FIG. 3 is a diagram illustrating an example of a pair list. FIG. 4 is a diagram illustrating an example of a relationship between a combination of a URL, a key, and a value indicated by data transmitted from the switch to the capture server, and a type of SQL processing executed by the DB server. FIG. 5 is a diagram illustrating an example of a part of the data structure of the first table. FIG. 6 is a diagram illustrating an example of a part of the data structure of the second table. FIG. 7 is a diagram for explaining an example of processing for calculating an average value. FIG. 8 is a diagram illustrating an example of a part of the data structure of the third table. FIG. 9 is a diagram illustrating an example of a part of the data structure of the fourth table. FIG. 10 is a diagram illustrating an example of a part of the data structure of the fifth table. FIG. 11 is a flowchart illustrating the procedure of the specifying process according to the first embodiment. FIG. 12 is a diagram illustrating a computer that executes an analysis program.

  Hereinafter, embodiments of an analysis apparatus, an analysis program, and an analysis method disclosed in the present application will be described in detail with reference to the drawings. Note that this embodiment does not limit the disclosed technology. Each embodiment can be appropriately combined within a range in which processing contents are not contradictory.

[System configuration]
A system according to the first embodiment will be described. FIG. 1 is a diagram illustrating an example of an overall configuration diagram of a system to which the analysis apparatus according to the first embodiment is applied. As shown in FIG. 1, the system 1 includes a capture server 10, a client terminal 11, a switch 14, and a service providing system 15. Examples of the system 1 include a LAN (Local Area Network) system in a company and a system for receiving an order for goods via the Internet 16. The capture server 10 is an example of an analysis device.

  The client terminal 11 is a device for making a service request to the service providing system 15. For example, the client terminal 11 is connected to the Internet 16. The client terminal 11 receives a user operation and transmits a request message of HTTP (HyperText Transfer Protocol) for requesting a service to the Internet 16. In this case, the client terminal 11 transmits to the Internet 16 a request message whose destination is a Web server 12 described later. Further, the client terminal 11 receives a response from the Web server 12. For example, the client terminal 11 receives an HTTP response message from the Web server 12. Then, the client terminal 11 displays the content of the response message on the browser. The client terminal 11 is used by a user who receives a service from the service providing system 15, for example. In the example of FIG. 1, a case where there are a plurality of client terminals 11 is illustrated, but any number of client terminals 11 can be adopted.

  On the Internet 16, data is transmitted to a destination device. For example, on the Internet 16, a request message transmitted from the client terminal 11 and whose destination is the Web server 12 is transmitted to the switch 14 connected to the Web server 12. In the Internet 16, a response message transmitted from the switch 14 and having a transmission destination of the client terminal 11 is transmitted to the client terminal 11.

  The service providing system 15 provides a service in response to a request from the user. For example, the service providing system 15 includes a Web server 12 and a DB (Data Base) server 13.

  The Web server 12 transmits a request to the DB server 13 in response to a request from the client terminal 11. For example, the Web server 12 transmits an SQL (Structured Query Language) query to the DB server 13 in response to a request message requesting a service from the client terminal 11.

  Further, the Web server 12 transmits a response to the client terminal 11 in response to the response from the DB server 13. For example, the Web server 12 transmits an HTTP response message to the client terminal 11 in response to an SQL response from the DB server 13. 1 illustrates the case where the number of Web servers 12 is one, the number of Web servers 12 may be plural.

  The DB server 13 transmits a response to the Web server 12 in response to a request from the Web server 12. For example, the DB server 13 accesses a DB (not shown) in response to an SQL inquiry from the Web server 12, and transmits an SQL response to the Web server 12. Here, the SQL response includes an identifier indicating the type of processing executed by the DB server 13. In the example of FIG. 1, the case where the number of DB servers 13 is one is illustrated, but the number of DB servers 13 may be plural.

  The switch 14 transmits and receives data among the devices of the client terminal 11, the Web server 12, and the DB server 13, and transmits a copy of data flowing between the devices to the capture server 10. In the example of FIG. 1, the port P <b> 1 of the switch 14 is connected to the Internet 16. In the example of FIG. 1, the port P <b> 2 of the switch 14 is connected to the Web server 12. In the example of FIG. 1, the port P3 of the switch 14 is connected to the DB server 13. In the example of FIG. 1, the port P4 of the switch 14 is connected to the capture server 10. In the example of FIG. 1, when the switch 14 receives a request message whose destination is the Web server 12 from the client terminal 11 via the Internet 16, the switch 14 sends the received request message from the port P <b> 2 to the Web server 12. Send. In addition, when the switch 14 receives an SQL query from the Web server 12 whose destination is the DB server 13, the switch 14 transmits the received SQL query from the port P 3 to the DB server 13. Further, when the switch 14 receives an SQL response whose destination is the Web server 12 from the DB server 13, the switch 14 transmits the received SQL response to the Web server 12 from the port P <b> 2. When the switch 14 receives a response message whose destination is the client terminal 11 from the Web server 12, the switch 14 transmits the received response message from the port P 1 to the client terminal 11 via the Internet 16.

  The switch 14 has a so-called port mirroring function. For example, the switch 14 copies data that passes through the ports P1, P2, and P3, and transmits the copied data to the capture server 10 from the port P4. As a result, the capture server 10 can collect data flowing between the devices of the client terminal 11, the Web server 12, and the DB server 13. The switch 14 may be a plurality of devices, and may be configured by, for example, a device that relays communication between the client terminal 11 and the Web server 12 and a device that relays communication between the Web server 12 and the DB server 13. .

[Configuration of Capture Server 10]
A capture server according to the first embodiment will be described. FIG. 2 is a diagram illustrating the configuration of the capture server according to the first embodiment. As illustrated in FIG. 2, the capture server 10 includes an input unit 20, an I / F (Interface) 21, a notification unit 22, a storage unit 23, and a control unit 24. The capture server 10 according to the present embodiment acquires the type (key) and value (value) of a CGI (Common Gateway Interface) parameter included in an HTTP request transmitted from the client terminal 11 to the Web server 12. Further, the capture server 10 acquires an identifier (SQL type) of the SQL process executed by the DB server 13 based on the SQL inquiry transmitted from the Web server 12 to the DB server 13 based on the HTTP request. The capture server 10 stores the acquired key and value in association with the SQL type. Then, the capture server 10 calculates the ratio of the SQL process executed by the DB server 13 for each key and value based on the stored content. Then, the capture server 10 calculates the similarity between the key and value included in the HTTP request for the key and value corresponding to the calculated ratio. Subsequently, the capture server 10 specifies the key or the key and value corresponding to the SQL process executed by the DB server 13 based on the calculated similarity. In this way, the capture server 10 performs name identification by processing without causing human work. Further, the capture server 10 can perform name identification in units of keys even when no value is set for the key. Therefore, according to the capture server 10, name identification can be performed with high accuracy.

  The input unit 20 inputs information to the control unit 24. For example, the input unit 20 receives an instruction from the user and inputs an instruction to execute a specific process described later to the control unit 24. Examples of the device of the input unit 20 include a keyboard and a mouse.

  The I / F 21 is a communication interface for performing communication with the switch 14. For example, when the I / F 21 is a copy of the request message transmitted from the switch 14 and receives a copy of the request message from the client terminal 11 to the Web server 12, the I / F 21 controls the copy of the received request message. 24. The I / F 21 is a copy of the SQL query transmitted from the switch 14. When the copy of the SQL query from the Web server 12 to the DB server 13 is received, the I / F 21 is a copy of the received SQL query. Is transmitted to the control unit 24. The I / F 21 is a copy of the SQL response transmitted from the switch 14. When the copy of the SQL response from the DB server 13 to the Web server 12 is received, the I / F 21 is a copy of the received SQL response. Is transmitted to the control unit 24. In addition, when the I / F 21 is a copy of the response message transmitted from the switch 14 and receives a copy of the response message from the Web server 12 to the client terminal 11, the I / F 21 performs the following processing. That is, the I / F 21 transmits a copy of the received response message to the client terminal 11.

  The notification unit 22 notifies information. For example, the notification unit 22 notifies a parameter identification result input by a notification control unit 24d described later. Examples of the device of the notification unit 22 include a display device such as a CRT (Cathode Ray Tube) or a liquid crystal display.

  The storage unit 23 stores various programs executed by the control unit 24. The storage unit 23 also stores a pair list 23a, a first table 23b, a second table 23c, a third table 23d, a fourth table 23e, and a fifth table 23f.

  The pair list 23a is a table in which a pair of a request and a response corresponding to the request is registered. Each pair of request and response is registered in each record of the pair list 23a by the storage unit 24a described later. FIG. 3 is a diagram illustrating an example of a pair list. The example of FIG. 3 indicates that the item “request time”, which is the time when the capture server 10 received the request, is included in the pair list 23a. In the example of FIG. 3, it is shown that the item “response time”, which is the time when the capture server 10 received the response corresponding to the request, is included in the pair list 23a. Further, in the example of FIG. 3, “request / response pair” is transmitted / received between the client terminal 11 and the Web server 12 or between the Web server 12 and the DB server 13. The item “hierarchy” is included in the pair list 23a. In the example of FIG. 3, when a pair of a request and a response is transmitted / received between the client terminal 11 and the Web server 12, a first predetermined value, for example, “1” is “hierarchy”. Is registered. Further, in the example of FIG. 3, when a pair of a request and a response is transmitted / received between the Web server 12 and the DB server 13, a second predetermined value, for example, “2” is “hierarchy”. Is registered. That is, in the item “hierarchy”, information indicating between which devices a pair of a request and a response is generated is registered.

  Further, the example of FIG. 3 indicates that the item “content 1”, which is the content of the request, is included in the pair list 23a. Further, the example of FIG. 3 indicates that the item “serial number” that is the serial number of the record in the pair list 23a is included in the pair list 23a. Further, the example of FIG. 3 indicates that the item “source IP”, which is the IP (Internet Protocol) address of the response transmission source, is included in the pair list 23a. Further, the example of FIG. 3 indicates that the item “transmission destination IP” which is the IP address of the transmission destination of the response is included in the pair list 23a. Further, the example of FIG. 3 indicates that the item “content 2”, which is the content of the response, is included in the pair list 23a. As for the response from the DB server 13 (SQL response), an identifier indicating the type of SQL processing executed by the DB server 13 is registered in “content 2” of the pair list 23a.

  In the example of FIG. 3, the record whose “serial number” is 1 indicates that the time when the capture server 10 received the SQL query is October 28, 2010, 10: 00: 0.9. In the example of FIG. 3, the record whose “serial number” is 1 indicates that the time when the capture server 10 received the corresponding SQL response is October 28, 2010, 10: 00: 1.1. . Further, in the example of FIG. 3, the item of “hierarchy” of the record whose “serial number” is 1, the combination of the SQL query and the SQL response registered in this record is the relationship between the Web server 12 and the DB server 13. Indicates that the message was sent or received between them. In the example of FIG. 3, the record whose “serial number” is 1 indicates that the content of the SQL inquiry is “a”. In the example of FIG. 3, a record whose “serial number” is 1 indicates that the IP address of the transmission source of the SQL response registered in this record is “10.0.0.1”. In the example of FIG. 3, a record whose “serial number” is 1 indicates that the IP address of the transmission destination of the SQL response registered in this record is “10.0.0.2”. In the example of FIG. 3, the record whose “serial number” is 1 indicates that the identifier indicating the type of SQL processing executed by the DB server 13 is 10 included in the SQL response registered in this record. .

  In the example of FIG. 3, the record having “serial number” 2 indicates that the time when the capture server 10 received the request message is 10: 01: 0.0 on October 28, 2010. In the example of FIG. 3, the record whose “serial number” is 2 indicates that the time when the capture server 10 received the corresponding response message is October 28, 2010, 10: 00: 3.0. In the example of FIG. 3, the “hierarchy” item of the record whose “serial number” is 2 indicates that the pair of the request message and the response message registered in this record is between the client terminal 11 and the Web server 12. Indicates that it was sent or received. In the example of FIG. 3, a record with “serial number” 2 indicates that the content of the request message is “urlA.jsp”. In the example of FIG. 3, the record with “serial number” 2 indicates that the IP address of the transmission source of the response message registered in this record is “192.168.0.1”. In the example of FIG. 3, a record with “serial number” 2 indicates that the destination IP address of the response message registered in this record is “10.0.0.1”. In the example of FIG. 3, a record with “serial number” 2 indicates that the content of data included in the response message is “urlA.jsp”. Since the registered contents of the other records in the example of FIG. 3 are the same as the contents described above, description thereof will be omitted.

  The information registered in the pair list 23a is not limited to the above content. Registered in the pair list 23 a is information for associating the URL and parameters (key and value) included in the HTTP request transmitted from the client terminal 11 with the type of SQL processing executed by the DB server 13. It only has to be. For example, the information registered in the pair list 23a may include only the items “request time”, “response time”, “hierarchy”, “content 1”, and “content 2”. Further, information of each item registered in the pair list 23a is obtained by analyzing data from the switch 14 by a storage unit 24a described later.

  FIG. 4 is a diagram illustrating an example of a relationship between a combination of a URL, a key, and a value indicated by data transmitted from the switch to the capture server, and a type of SQL processing executed by the DB server. In the example of FIG. 4, the horizontal axis indicates time. In the example of FIG. 4, there are three types of first sets 30 a, 30 b, and 30 c that are combinations of requests and responses after the HTTP request is transmitted from the client terminal 11 until the client terminal 11 receives the HTTP response. The case where the first set of appears. In the example of FIG. 4, there are two types of second sets 31 a and 31 b that are combinations of a request and a response after the SQL inquiry is transmitted from the Web server 12 until the Web server 12 receives the SQL response. The case where the second set of appears.

  In the example of FIG. 4, the request of the first set 30a includes “urlA” in the URL, “sid = 001”, and “exec = meisai” in the parameters. In the example of FIG. 4, the request of the first set 30 b includes “urlA” in the URL, “sid = 002”, and “exec = meisai” in the parameters. In the example of FIG. 4, the request for the first set 30c includes “urlA” in the URL and “sid = 003” in the parameter. Hereinafter, the identifier of the SQL process included in the response of the second group 31a is “child 1”, and the identifier of the SQL process included in the response of the second group 31b is “child 2”. The identifier of the SQL process included in the response may be referred to as “child 3”.

  In the example of FIG. 4, a case is shown in which the second sets 31 a and 31 b are included between the request and the response of the first set 30 a that have appeared. Note that the “inclusive” referred to here means that the generation time of the second set of requests and responses is included in the time between the first set of requests and responses. In the example of FIG. 4, a case is shown in which the second sets 31 a and 31 c are included between the request and response of the first set 30 b that have appeared. In the example of FIG. 4, a case is shown in which the second set 31 c is included between the request and response of the first set 30 c.

  The first table 23b indicates the type of SQL processing executed by the DB server 13 for the URL indicated by the data transmitted from the switch 14 to the capture server 10, or the URL and key, or a combination of URL, key and value. It is a table in which the ratio is registered. In the first table 23b, the ratio calculated by the calculation unit 24b described later is registered and updated. In each item of the first table 23b, nothing is registered before the contents are registered by the calculation unit 24b, that is, at the initial time. FIG. 5 is a diagram illustrating an example of a part of the data structure of the first table. The first table 23b has items of “URL”, “CGI key”, “CGI value”, and “instance”.

  In the example of FIG. 5, “URL” included in the HTTP request that appears in the data transmitted from the switch 14 to the capture server 10 is registered in the “URL” item. In the example of FIG. 5, “key” of the HTTP request that appears in the data transmitted from the switch 14 to the capture server 10 is registered in the item “CGI key”. In the example of FIG. 5, “value” of the HTTP request that appears in the data transmitted from the switch 14 to the capture server 10 is registered in the item “CGI value”. Further, in the example of FIG. 5, the DB server 13 corresponds to the combination of “URL”, “key”, and “value” of the request that appears in the item “instance” in the data transmitted from the switch 14 to the capture server 10. The ratio of the type of SQL processing executed is registered. The relation between the identifier indicating the SQL process executed by the DB server 13 and the appearance ratio of the SQL process indicated by the identifier is [an identifier indicating the SQL process executed by the DB server 13: SQL process]. Appearance rate].

  Here, in the example of FIG. 4, the first group that can include the second group 31a that appears first is the first group 30a. Moreover, in the example of FIG. 4, the 1st group which can include the 2nd group 31b is the 1st group 30a. In the example of FIG. 4, the first group that can include the second group 31 a that appears second is the first group 30 b. In the example of FIG. 4, the first set that can include the second set 31c is the first set 30b and the first set 30c. Here, the calculation unit 24b described later performs the following processing when the number of the first group that can include the second group is N for a certain second group. . In other words, the calculation unit 24b calculates a value of 1 / N for each of the N first sets for the second set, and uses the URL and parameter combination of the first set of requests. Add to the corresponding “instance” item of the first table 23b.

  For example, in the example of FIG. 4, the first group that can include the second group 31 a that appears first is one of the first groups 30 a. Therefore, in the example of FIG. 4, the calculation unit 24b adds 1 (1/1) to the “instance” item corresponding to the URL and parameter combination of the first set 30a.

  In the example of FIG. 4, the first set that can include the second set 31b is one of the first sets 30a. Therefore, in the example of FIG. 4, the calculation unit 24b adds 1 (1/1) to the “instance” item corresponding to the URL and parameter combination of the first set 30a.

  In the example of FIG. 4, the first group that can include the second group 31 a that appears second is the first group 30 b. Therefore, in the example of FIG. 4, the calculation unit 24b adds 1 (1/1) to the “instance” item corresponding to the URL and parameter combination of the first set 30b.

  In the example of FIG. 4, there are two first sets that can include the second set 31c, the first set 30b and the first set 30c. Therefore, in the case of the example of FIG. 4, the calculation unit 24b sets 0.5 (1/2) to the item “instance” corresponding to the URL and parameter combination of the first set 30b, the first set. It is added to the “instance” item corresponding to the URL and parameter combination of 30c.

  That is, in the case of the example of FIG. 4, the calculation unit 24b described later performs “URL” = “urlA”, “key” = “sid”, and “value” = “001” as illustrated in the example of FIG. The ratio “1” of “child 1” and the ratio “1” of “child 2” are registered in the “instance” item corresponding to. In the case of the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “sid”, and “value” = “002” as illustrated in the example of FIG. In the “instance” item, the ratio “1” of “child 1” and the ratio “0.5” of “child 3” are registered. In the case of the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “sid”, and “value” = “003” as illustrated in the example of FIG. In the “instance” item, the ratio “0.5” of “child 3” is registered. In the case of the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “exec”, and “value” = “meisai” as illustrated in the example of FIG. The following contents are registered in the “instance” item. That is, the calculation unit 24b registers the ratio “1” of “child 1”, the ratio “1” of “child 2”, the ratio “1” of “child 1”, and the ratio “0.5” of “child 3”. To do.

  In the second table 23c, values obtained by normalizing the values registered in the “instance” of the first table 23b by the calculation unit 24b described later are registered. FIG. 6 is an example of a part of the data structure of the second table. For example, in the example of FIG. 5, when the ratio “1” of “child 1” and the ratio “1” of “child 2” are registered in the item “instance”, the calculation unit 24b described later The registration content is treated as a vector (1, 1), and normalization processing is performed. For example, as illustrated in FIG. 6, the calculation unit 24b described later normalizes the vector length so as to be a predetermined value, for example, “1”. In this case, the vector (1,1) is normalized to (0.71, 0.71).

  In the third table 23d, the average value of the ratio after normalization registered in the second table 23c is registered for each second group. The average value is calculated and registered by the calculation unit 24b described later. FIG. 7 is a diagram for explaining an example of processing for calculating an average value. The example of FIG. 7 includes a plurality of “children” in the “instance” item corresponding to “URL” = “urlA”, “CGI key” = “exec”, and “CGI value” = “meisai” in the example of FIG. The case where the ratio of “1” is registered is shown. In the example of FIG. 7, an average value of the ratios of a plurality of “child 1” is calculated by the calculation unit 24b described later. FIG. 8 is a diagram illustrating an example of a part of the data structure of the third table. In the example of FIG. 8, the average value “0.80” (= (0.71 + 0.89) / 2) of “child 1” calculated by the calculation unit 24b in the example of FIG. The case where it is registered in the “model” item provided for each combination is shown. In the example of FIG. 8, the third table 23d also includes the items “URL”, “CGI key”, and “CGI value” described with reference to FIG. In the example of FIG. 8, the average values (0.80, 0.36, 0.23) of “child 1”, “child 2”, and “child 3” are registered in the “model” item. Show the case. The registered content of the item “model” shows an average behavior with respect to the combination of the URL and the parameter. In the following description, a model may be referred to as a provisional model. The example of FIG. 8 is an example of a part of the data structure of the third table 23d. The third table 23d includes, for example, the URL, URL and key, or URL shown in the example of FIG. For each combination of, key and value, each item for registering an average value is included.

  In the fourth table 23e, the similarity calculated by the calculation unit 24b described later is registered. FIG. 9 is a diagram illustrating an example of a part of the data structure of the fourth table. In the example of FIG. 9, the fourth table 23e has an item of “similarity” in addition to the items of “URL”, “CGI key”, and “CGI value” described in FIG. In the item “similarity”, the similarity calculated by the calculation unit 24b described later based on the registration contents of the second table 23c and the registration contents of the third table 23d is registered. In the example of FIG. 9, two values “0.9” are registered in the “similarity” item, but the upper similarity “0.9” indicates the following. That is, the similarity “0.9” on the upper side is “URL” = “urlA”, “CGI key” = “exec”, “CGI value” = “meisai”, “child 1” ratios “1”, “ The similarity calculated for the case of the ratio “1” of “child 2” is shown. Also, the lower similarity “0.9” is “URL” = “urlA”, “CGI key” = “exec”, “CGI value” = “meisai”, “child 1” ratio “1”, The degree of similarity calculated for the case where the ratio of “child 3” is “0.5” is shown.

  The fifth table 23f is associated with combinations of URLs, URLs and keys, URLs, keys, and values, and an average value of similarity (average similarity) calculated by the calculation unit 24b described later. Standard deviation and number of appearances are registered. FIG. 10 is a diagram illustrating an example of a part of the data structure of the fifth table. In the example of FIG. 10, the fifth table 23 f includes “URL unit” and “CGI key unit” in addition to the “URL”, “CGI key”, and “CGI value” items described in FIG. And “CGI value unit”. Each item of “URL unit”, “CGI key unit”, and “CGI value unit” has “average similarity”, “standard deviation”, and “appearance count”. In the “average similarity” item of “URL unit”, an average value of similarity corresponding to the URL registered in the “URL” item is registered by the calculation unit 24b described later. In the “standard deviation” of “URL unit”, the average value of the similarity corresponding to the URL registered in the “URL” item is registered by the calculation unit 24b described later. In the “number of appearances” of “URL unit”, the number of appearances for each type of SQL processing executed in the DB server 13 corresponding to the URL registered in the “URL” item is registered by the calculation unit 24b described later. Is done. “CGI key unit” indicates a combination of URL and key, and “CGI value unit” indicates a combination of URL, key, and value. Since the “average similarity”, “standard deviation”, and “appearance count” of each item of “CGI key unit” and “CGI value unit” are the same as those of “URL unit”, description thereof is omitted. To do. Based on the registered contents of the fifth table 23f, a combination of URL, URL and key, and URL, key, and value for identifying the type of SQL processing executed by the DB server 12 by the specifying unit 24c described later. Identified.

  The storage unit 23 is, for example, a semiconductor memory device such as a flash memory, or a storage device such as a hard disk or an optical disk. In addition, the memory | storage part 23 is not limited to said kind of memory | storage device, RAM (Random Access Memory) and ROM (Read Only Memory) may be sufficient.

  Returning to the description of FIG. 2, the control unit 24 has an internal memory for storing programs and control data that define various processing procedures, and executes various processes using these. As shown in FIG. 2, the control unit 24 includes a storage unit 24a, a calculation unit 24b, a specifying unit 24c, and a notification control unit 24d.

  The storage unit 24a analyzes the data and registers the analysis result in the pair list 23a. For example, the storage unit 24a accumulates data for a predetermined time transmitted from the switch 14, for example, data for 30 seconds in the storage unit 23, and performs a process of performing the analysis described below on the accumulated data. Repeat every predetermined time.

  An example of analysis performed by the storage unit 24a will be described. The storage unit 24a analyzes the copy of the request message transmitted from the client terminal 11 to the Web server 12, and acquires the content of the request included in the request message. For example, the storage unit 24a sends a request message “http://www.server.com/job/urlA.jsp?sid=001&exec=meisai” to the server indicated by “www.server.com” with “/ It is analyzed that it is a request message that requests the content specified by the path notation “job / urlA.jsp”. In addition to this, the storage unit 24a analyzes that the URL is “http://www.server.com/job/urlA.jsp”. In the above, “http://www.server.com/job/urlA.jsp” is abbreviated as “urlA”. In addition, the storage unit 24a analyzes that “sid = 001 & exec = meisai” is a key and value parameter. In addition, the storage unit 24a analyzes the copy of the SQL query transmitted from the Web server 12 to the DB server 13, and acquires the query content included in the SQL query. In addition, the storage unit 24a acquires the time when the copy of the request message is received. In addition, the storage unit 24a obtains the time when a copy of the SQL query is received.

  In addition, the storage unit 24a analyzes a copy of the response message transmitted from the Web server 12 to the client terminal 11, and acquires the content of the response included in the response message. In addition, the storage unit 24a analyzes the copy of the response message and acquires the IP address of the transmission source included in the response message. Further, the storage unit 24a analyzes the copy of the response message and acquires the IP address of the transmission destination included in the response message. The storage unit 24a analyzes a copy of the SQL response transmitted from the DB server 13 to the Web server 12, and indicates the response content included in the SQL response and the type of SQL processing executed by the DB server 13. Get an identifier. In addition, the storage unit 24a analyzes the copy of the SQL response and acquires the IP address of the transmission source included in the SQL response. In addition, the storage unit 24a analyzes the copy of the SQL response and acquires the IP address of the transmission destination included in the SQL response. In addition, the storage unit 24a acquires the time when the copy of the response message is received. In addition, the storage unit 24a acquires the time when the copy of the SQL response is received.

  Then, the storage unit 24a detects a first set of requests and responses between the client terminal 11 and the Web server 12. For example, the storage unit 24a associates the request message with the response message from the analyzed content of the request message and the content of the response message. The association here is also referred to as pairing, and refers to associating a certain request message with a response message for the request message.

  Then, the storage unit 24a registers the first set of associated request message and response message in the pair list 23a. Further, as shown in FIG. 3, the storage unit 24a registers the time when the capture server 10 received a copy of the request message in the pair list 23a. Further, as shown in FIG. 3, the storage unit 24a registers the time when the capture server 10 received a copy of the response message in the pair list 23a. Further, as shown in FIG. 3, the storage unit 24a sets a first predetermined value, for example, “1” for the first set transmitted / received between the client terminal 11 and the Web server 12 in the pair list 23a. Register in the "Hierarchy" item. Further, as shown in FIG. 3, the storage unit 24a registers the URL, key, and value of the request message in “Content 1” of the pair list 23a. Further, as illustrated in FIG. 3, the storage unit 24a registers the content of the response message in “content 2” of the pair list 23a.

  Further, the storage unit 24a detects a second set of requests and responses between the Web server 12 and the DB server 13. For example, the storage unit 24a associates the SQL query with the SQL response from the analyzed content of the SQL query and the content of the SQL response. The association here refers to associating an SQL query with an SQL response to the SQL query.

  Then, the storage unit 24a registers a second set of the associated SQL query and SQL response in the pair list 23a. Further, as shown in FIG. 3, the storage unit 24a registers the time when the capture server 10 receives a copy of the SQL query in the pair list 23a. Further, as shown in FIG. 3, the storage unit 24a registers the time when the capture server 10 receives a copy of the SQL response in the pair list 23a. Further, as shown in FIG. 3, the storage unit 24a sets a second predetermined value, for example “2”, in the pair list 23a for the second set transmitted / received between the Web server 12 and the DB server 13. Register in the "Hierarchy" item. Further, as shown in FIG. 3, the storage unit 24a registers the contents of the SQL inquiry in “content 1” of the pair list 23a. Further, as illustrated in FIG. 3, the storage unit 24a registers, in the “content 2” of the pair list 23a, an identifier indicating the type of SQL processing executed by the DB server 13 included in the SQL query. Further, as shown in FIG. 3, the storage unit 24a registers the IP address of the transmission source of the SQL response in the pair list 23a. Further, as illustrated in FIG. 4, the storage unit 24a registers the IP address of the transmission destination of the SQL response in the pair list 23a.

  The calculation unit 24b uses the pair list 23a, the first table 23b, the second table 23c, the third table 23d, the fourth table 23e, and the fifth table 23f of the storage unit 23 to generate URL, URL, The following values are calculated for each combination of key, URL, key, and value. That is, the calculation unit 24 b calculates the ratio of the types of SQL processes executed by the DB server 13. Then, the calculation unit 24b includes the URL, URL and key, URL and key, and URL and key and value obtained as a result of analysis for each combination of URL, URL and key, and URL and key and value corresponding to the calculated ratio. The similarity of each combination is calculated.

  For example, the calculation unit 24b first refers to the pair list 23a and identifies all the second sets that appear between the first set of requests and responses. Further, the calculation unit 24b refers to the pair list 23a and specifies the URL, key, and value of the HTTP request from the item “content 1” of the first set of requests.

  Then, the calculation unit 24b refers to the pair list 23a and identifies the number N of the first sets that can include the second set for the specified second set. Subsequently, the calculation unit 24b calculates a value of 1 / N for each of the first set. Then, the calculation unit 24b registers each of the URL, URL and key, and combination of URL, key, and value included in the first set of requests in the corresponding item of the first table 23b. The value of 1 / N is added to the “instance” item of 23b.

  For example, in the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “sid”, and “value” = “001” as illustrated in the example of FIG. In the “instance” item, the ratio “1” of “child 1” and the ratio “1” of “child 2” are registered. In the case of the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “sid”, and “value” = “002” as illustrated in the example of FIG. In the “instance” item, the ratio “1” of “child 1” and the ratio “0.5” of “child 3” are registered. In the case of the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “sid”, and “value” = “003” as illustrated in the example of FIG. In the “instance” item, the ratio “0.5” of “child 3” is registered. In the case of the example of FIG. 4, the calculation unit 24b corresponds to “URL” = “urlA”, “key” = “exec”, and “value” = “meisai” as illustrated in the example of FIG. The following contents are registered in the “instance” item. That is, the calculation unit 24b registers the ratio “1” of “child 1”, the ratio “1” of “child 2”, the ratio “1” of “child 1”, and the ratio “0.5” of “child 3”. To do. In this way, various contents are registered in the first table 23b.

  In addition, the calculation unit 24b performs a process of normalizing a vector registered in the “instance” item of the first table 23b and having a ratio of the type of SQL process executed by the DB server 13 as an element. For example, as illustrated in the example of FIG. 5, when the ratio “1” of “child 1” and the ratio “1” of “child 2” are registered, the calculation unit 24 b uses the registered content as a vector (1 , 1) and normalization processing is performed. As a specific example of normalization, the calculation unit 24b normalizes the vector so that the length of the vector becomes a predetermined length, for example, “1”, as shown in FIG. In this case, the vector (1,1) is normalized to (0.71, 0.71). Then, the calculation unit 24b registers the normalized values in the second table 23c together with the URL, the URL and the key, and the combination of the URL, the key, and the value. In this manner, the calculation unit 24b sets the normalized values for the combinations of URL, URL and key, and combination of URL, key, and value in the second table 23c.

  At this time, depending on the appearance timing of the executed SQL process type, a plurality of normalized values for the same SQL process type may be registered in one “instance” item. For example, as shown in the example of FIG. 6, the items of the instance of the second table 23c include [child 1: 0.7, child 2: 0.70] and [child 1: 0.89, child 3: 0. .45], there may be a plurality of normalized ratios for “child 1”. Therefore, the calculation unit 24b calculates an average value of normalized ratios for each type of SQL processing. For example, with respect to [child 1: 0.7, child 2: 0.70] and [child 1: 0.89, child 3: 0.45] in the example of FIG. I do. That is, the calculation unit 24b calculates [child 1: 0.7, child 2: 0.70, child 3: 0.00] and [child 1: 0.89, child 2: 0.00, child 3: 0. 45] and interpolation with the ratio value of child 2 and child 3 being 0, an average value is calculated for each type of SQL processing. In this case, the calculation unit 24b calculates an average value [child 1: 0.80, child 2: 0.36, child 3: 0.23]. This is a model of (URL, CGI key, CGI value) = (urlA, exec, meisai). Then, as illustrated in FIG. 8, the calculation unit 24 b adds the average values [child 1: 0.80, child 2: 0] to the third table 23 d together with the combination of “urlA”, “exec”, and “meisai”. .36, Child 3: 0.23]. In this way, the calculation unit 24b sets the average value for each combination of URL, URL and key, and URL, key, and value in the third table 23d. The registered average value is a model indicating an average behavior in a combination of a corresponding URL, URL and key, and URL, key, and value.

  Further, the calculation unit 24b calculates the similarity of the normalized ratio registered in the second table 23c with respect to the model registered in the third table 23d for each combination of URL, URL and key, and URL, key, and value. To do. For example, as shown in the examples of FIGS. 6 and 8, when (URL, CGI key, CGI value) = (urlA, exec, meisai), “child 1”, “child 2”, and “child 3” are An example of appearing will be described. For the [child 1: 0.70, child 2: 0.70] of the second table 23c, the calculating unit 24b [child 1: 0.70, child 2: 0.70, child 3: 0.00]. In this way, interpolation is performed with the value of child 3 set to 0. Then, the calculating unit 24b interpolates [child 1: 0.70, child 2: 0.70, child 3: 0.00] and [child 1: registered in the “model” of the third table 23d. 0.80, Child 2: 0.36, Child 3: 0.23]. As an example of a method for calculating the similarity, a cosine similarity method can be employed. When this method is used, for example, it is treated as a vector having a ratio value and an average value as elements.

  Similarly, the calculation unit 24b selects [child 1: 0.89, child 2: 0.00, child 3: 0] for [child 1: 0.89, child 3: 0.45] in the second table 23c. .45], the interpolation for setting the value of child 2 to 0 is performed. Then, the calculation unit 24b interpolates [child 1: 0.89, child 2: 0.00, child 3: 0.45] and [child 1: registered in the “model” of the third table 23d. 0.80, Child 2: 0.36, Child 3: 0.23].

  Then, the calculation unit 24b registers the calculated similarity in the fourth table 23e together with the combination of URL, URL and key, and URL, key, and value. For example, the interpolated [child 1: 0.70, child 2: 0.70, child 3: 0.00] and [child 1: 0.80, child registered in the “model” of the third table 23d. 2: 0.36, child 3: 0.23] is registered together with (urlA, exec, meisai). For example, the interpolated [child 1: 0.89, child 2: 0.00, child 3: 0.45] and [child 1: 0.80, child registered in the “model” of the third table 23d. 2: 0.36, child 3: 0.23] is registered together with (urlA, exec, meisai).

  Subsequently, the calculation unit 24b calculates an average value and a standard deviation for each combination of URL, URL and key, and URL, key, and value for the similarity registered in the fourth table. Also, the calculation unit 24b refers to the pair list 23a and counts the number of times SQL processing executed in the DB server 13 is performed for each combination of URL, URL and key, and URL, key, and value. After that, the calculation unit 24b registers the calculated average value, standard deviation, and appearance count of the similarity in the fifth table 23f together with the URL, the URL and key, and the combination of URL, key, and value. For example, as illustrated in the example of FIG. 10, the calculation unit 24b registers each calculated value in each item of the fifth table 23f. Here, the larger the average value of the similarities and the smaller the standard deviation, the more the combinations of SQL processing types in the combination are occupied.

  Based on the similarity calculated by the calculation unit 24b, the specifying unit 24c specifies a URL, a URL and a key, and a combination of a URL, a key, and a value for identifying the type of processing executed by the DB server 13.

  For example, the specifying unit 24c uses all combinations of URL, URL and key, and URL, key, and value as candidates. Then, the specifying unit 24c refers to the fifth table 23f. Then, the specifying unit 24c determines the type of processing executed by the DB server 13 based on the combination of URL, URL and key, and URL, key, and value when the number of appearances of SQL processing is smaller than a predetermined value, for example, 2. Is removed from the parameter candidates for carving out. This is because, for example, if the number of appearances is small, the average value of the similarity is an extreme numerical value, and if the number of appearances is not increased to some extent, the accuracy of the average value of the similarity is not certain. For example, as shown in FIG. 10, in the SQL processing corresponding to (urlA, sid, 001 to 003), the average value of the similarity is high, but the number of appearances is small, so the average of the similarities The accuracy of the value is not certain. Therefore, the specifying unit 24c determines the type of processing executed by the DB server 13 based on the combination of URL, URL and key, and URL, key, and value when the number of appearances is smaller than a predetermined value. Remove from the candidate. In the example of FIG. 10, the specifying unit 24c removes the combination of (urlA, sid, 001 to 003) from the candidates.

  Further, the specifying unit 24c refers to the fifth table 23f, and the DB server 13 determines combinations of URLs, URLs and keys, and URLs, keys, and values when the average similarity is less than a predetermined value. Remove from the parameter candidates for identifying the type of processing to be executed. This is because, when the degree of similarity is low, the parameters indicated by the corresponding combinations of URL, URL and key, and URL, key, and value are not used to isolate the type of processing executed by the DB server 13. It is possible. Note that, when the cosine similarity is adopted as the similarity calculation method, the similarity takes a value from 0 to 1 in this embodiment. Therefore, when a certain variation occurs in the combination of identifiers of processing types, the similarity is considered to be less than 0.5. Therefore, when the cosine similarity is adopted as the similarity calculation method, the specifying unit 24c can perform the following processing. That is, the specifying unit 24c classifies the types of processing executed by the DB server 13 based on the combination of URL, URL and key, and URL, key, and value when the average similarity is less than 0.5. Can be excluded from the parameter candidates. For example, in the example of FIG. 10, the specifying unit 24c excludes the combination of (urlA, exec) from the candidates because the average value of similarity of the combination of (urlA, exec) is smaller than 0.5.

  The specifying unit 24c refers to the fifth table 23f. Then, the specifying unit 24c registers the average value of the similarities registered in the “average similarity” item of the “CGI key unit” item in the “average similarity” item of the “CGI value unit” item. If it is equal to or higher than the average value of the similarities, the following processing is performed. That is, the specifying unit 24c excludes the combination of the corresponding URL, key, and value from the parameter candidates for identifying the type of processing executed by the DB server 13. This is because, when “value” is set in “key”, the type of processing executed by the DB server 13 is not separated, but when “key” is specified, the specified “key” is specified. This is because the type of processing is considered to be separated by the above.

  The specifying unit 24c refers to the fifth table 23f. Then, the specifying unit 24c registers the average value of the similarities registered in the “average similarity” item of the “URL unit” item in the “average similarity” item of the “CGI key unit” item. When the similarity is equal to or higher than the average value, the following processing is performed. That is, the specifying unit 24c excludes the combination of the corresponding URL and key from the parameter candidates for classifying the type of processing executed by the DB server 13. This is not specified when the parameter such as “key” is set in “URL”, but the type of processing executed by the DB server 13 is not separated, but is specified when “URL” is specified. This is because it is considered that the type of processing is classified by “URL”. For example, in the example of FIG. 10, the average value of the similarity corresponding to the combination (urlA) is equal to or greater than the average value of the similarity corresponding to the combination (urlA, sid). Therefore, the identifying unit 24c removes the combination of (urlA, sid) from the candidates. In the example of FIG. 10, the average value of the similarity corresponding to the combination (urlA) is equal to or greater than the average value of the similarity corresponding to the combination (urlA, exec). Therefore, the specifying unit 24c removes the combination of (urlA, meisai) from the candidates.

  Then, the specifying unit 24c specifies the combination remaining as a candidate as a parameter for identifying the type of processing executed by the DB server 13. For example, in the example of FIG. 10, since the combination of (urlA, exec, meisai), (urlA, exec, download) remains as a candidate, the specifying unit 24c uses the parameters for separating the types of processing from these combinations As specified. For example, when the average value of the similarity in the case of the combination of URL and key, or URL, key, and value is smaller than the average value of the similarity in the case of only the URL, the specifying unit 24c processes the URL. It is specified as a parameter for carving out. Thereafter, the specifying unit 24 c stores the specified result in the storage unit 23.

  The notification control unit 24d acquires the specific result stored in the storage unit 23 when receiving an instruction to notify the specific result from the user received by the input unit 20. Then, the notification control unit 24d controls the notification unit 22 so as to notify the specific result.

  The control unit 24 is an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA) or an electronic circuit such as a central processing unit (CPU) or a micro processing unit (MPU).

[Process flow]
Next, a processing flow of the capture server 10 according to the present embodiment will be described. FIG. 11 is a flowchart illustrating the procedure of the specifying process according to the first embodiment. Various cases are conceivable as the execution timing of this specific process. For example, the capture server 10 accumulates data for a predetermined time transmitted from the switch 14, for example, data for 30 seconds in the storage unit 23. The storage unit 24a of the capture server 10 analyzes the accumulated data every predetermined time and repeatedly generates the pair list 23a. Therefore, the storage unit 24a repeatedly generates the pair list 23a every predetermined time. It is conceivable to execute specific processing.

  As illustrated in FIG. 11, the calculation unit 24b refers to the pair list 23a and registers various contents in the first table 23b to generate the first table 23b (Step S101). The calculation unit 24b normalizes the ratio registered in the “instance” item of the first table 23b, and registers the normalized ratio in the second table 23c (step S102). The calculation unit 24b refers to the second table 23c, calculates an average value to generate a provisional model, and registers the generated provisional model in the third table 23d (step S103).

  The calculation unit 24b calculates the similarity using the provisional model and the normalized ratio, and registers the calculated similarity in the fourth table 23e (step S104). The calculation unit 24b calculates the calculated average value, standard deviation, and number of appearances of the similarity, and registers the calculated average value, standard deviation, and number of appearances in the fifth table 23f (step S105). The specifying unit 24c specifies a parameter for dividing the process based on the registered contents of the fifth table 23f (step S106), and ends the process.

  As described above, the capture server 10 according to the present embodiment uses the type (key) and value (value) of the CGI (Common Gateway Interface) parameter included in the HTTP request transmitted from the client terminal 11 to the Web server 12. To get. Further, the capture server 10 acquires an identifier (SQL type) of the SQL process executed by the DB server 13 based on the SQL inquiry transmitted from the Web server 12 to the DB server 13 based on the HTTP request. The capture server 10 stores the acquired key and value in association with the SQL type. Then, the capture server 10 calculates the ratio of the SQL process executed by the DB server 13 for each key and value based on the stored content. Then, the capture server 10 calculates the similarity between the key and value included in the HTTP request for the key and value corresponding to the calculated ratio. Subsequently, the capture server 10 specifies the key or the key and value corresponding to the SQL process executed by the DB server 13 based on the calculated similarity. In this way, the capture server 10 performs name identification by processing without causing human work. Further, the capture server 10 can perform name identification in units of keys even when no value is set for the key. Therefore, according to the capture server 10, name identification can be performed with high accuracy.

  Although the embodiments related to the disclosed apparatus have been described above, the present invention may be implemented in various different forms other than the above-described embodiments. Therefore, another embodiment included in the present invention will be described below.

  For example, in the first embodiment, the content registered in the first table 23b is normalized, and the normalized result is registered in the second table 23c. However, the disclosed apparatus is not limited to this. The disclosed apparatus can normalize the contents registered in the first table 23b before registering in the first table 23b, and register the result of normalization in the first table 23b. Thereby, the disclosed apparatus can reduce the amount of data stored in the storage unit 23.

  Further, in the first embodiment, the case where the parameter for performing the classification of the type of processing executed by the DB server 13 is specified is illustrated, but the disclosed apparatus is not limited thereto. For example, the disclosed apparatus can specify a parameter for performing a process to be executed on the application server instead of the DB server 13. In this case, the disclosed apparatus can specify the parameter by receiving an identifier for identifying a command executed on the application server from the application server.

  In addition, among the processes described in the embodiments, all or a part of the processes described as being automatically performed can be manually performed. In addition, among the processes described in this embodiment, all or a part of the processes described as being performed manually can be automatically performed by a known method.

  In addition, the processing at each step of each processing described in each embodiment can be arbitrarily finely divided or combined according to various loads and usage conditions. Also, the steps can be omitted.

  Further, the order of processing at each step of each processing described in each embodiment can be changed according to various loads and usage conditions.

  Further, each component of each illustrated apparatus is functionally conceptual, and does not necessarily need to be physically configured as illustrated. In other words, the specific state of distribution / integration of each device is not limited to the one shown in the figure, and all or a part thereof may be functionally or physically distributed or arbitrarily distributed in arbitrary units according to various loads or usage conditions. Can be integrated and configured.

[Analysis program]
Various processes of the capture server 10 described in the above embodiment can also be realized by executing a program prepared in advance on a computer system such as a personal computer or a workstation. Therefore, in the following, an example of a computer that executes an analysis program having the same function as the capture server 10 described in the above embodiment will be described with reference to FIG. FIG. 12 is a diagram illustrating a computer that executes an analysis program.

  As illustrated in FIG. 12, the computer 300 includes a CPU (Central Processing Unit) 310, a ROM (Read Only Memory) 320, an HDD (Hard Disk Drive) 330, and a RAM (Random Access Memory) 340. The computer 300 also has a communication interface 350. Each device indicated by the reference numerals 310 to 350 is connected via a bus 360.

  The communication interface 350 is an interface for performing communication. The communication interface 350 corresponds to the I / F 21.

  The ROM 320 stores basic programs such as an OS. The ROM 320 stores in advance an analysis program 320a that performs the same functions as the storage unit 24a, the calculation unit 24b, the specifying unit 24c, and the notification control unit 24d described in the above embodiment. Note that the analysis program 320a may be separated as appropriate. In addition, the HDD 330 is provided with a pair list, a first table to a fifth table. The pair list, first table to fifth table correspond to the above-described pair list 23a and first table 23b to fifth table 23f.

  Then, the CPU 310 reads the analysis program 320a from the ROM 320 and executes it.

  Then, the CPU 310 reads the pair list and the first to fifth tables and stores them in the RAM 340. Further, the CPU 310 executes the analysis program 320a using the pair list and the first to fifth tables stored in the RAM 340. Note that all data stored in the RAM 340 may not always be stored in the RAM 330. Data used for processing may be stored in the RAM 340.

  Note that the above-described analysis program 320a is not necessarily stored in the ROM 320 from the beginning.

  For example, the program is stored in a “portable physical medium” such as a flexible disk (FD), a CD-ROM, a DVD disk, a magneto-optical disk, or an IC card inserted into the computer 300. Then, the computer 300 may read and execute the program from these.

  Furthermore, the program is stored in “another computer (or server)” connected to the computer 300 via a public line, the Internet, a LAN, a WAN, or the like. Then, the computer 300 may read and execute the program from these.

DESCRIPTION OF SYMBOLS 10 Capture server 23 Storage part 23a Pair list 23b 1st table 23c 2nd table 23d 3rd table 23e 4th table 23f 5th table 24 Control part 24b Calculation part 24c Specific part

Claims (4)

The type of parameter included in the first request transmitted from the first device to the second device, the value of the parameter, and the transmission from the second device to the third device based on the first request A storage unit that associates and stores an identifier of a process executed by the third device based on the second request that is made;
Based on the storage content of the storage unit, the ratio of processing executed by the third device for each parameter type and value is calculated, and the first parameter for the parameter type and value corresponding to the calculated ratio is calculated. Calculate the similarity of the parameter type and value included in the request, calculate the first average value and the first standard deviation of the similarity for each parameter type, and for each parameter type and value And a calculation unit for calculating a second average value and a second standard deviation of the similarity ,
Parameters corresponding to processing executed by the third device based on the first average value and the first standard deviation and the second average value and the second standard deviation calculated by the calculation unit A specific part that identifies the type of parameter or parameter type and value,
An analysis apparatus comprising: The storage unit includes a URL, a parameter type and a value included in a first request transmitted from the first device to the second device, and the third device based on the second request. The identifier of the executed process is stored in association with it,
The calculation unit calculates a ratio of processing executed by the third device for each type and value of the URL and parameters based on the storage content of the storage unit, and the URL corresponding to the calculated ratio and Calculating the similarity of the parameter type and value included in the first request to the parameter type and value,
The specifying unit specifies a URL, a URL and a parameter type, or a URL and a parameter type and value corresponding to a process executed by the third device based on the similarity calculated by the calculating unit. The analyzer according to claim 1, wherein: On the computer,
The type of parameter included in the first request transmitted from the first device to the second device, the value of the parameter, and the transmission from the second device to the third device based on the first request The third device for each type and value of the parameter based on the storage content of the storage unit that stores the identifier of the process executed by the third device in association with the second request made The ratio of the processing executed by is calculated, the parameter type and value similarity included in the first request for the parameter type and value corresponding to the calculated ratio are calculated, and for each parameter type, A first average value and a first standard deviation of the similarity are calculated, and a second average value and a second standard value of the similarity are calculated for each type and value of the parameter. To calculate the quasi-deviation,
Based on the calculated first average value and first standard deviation and the second average value and second standard deviation , the type of parameter corresponding to the process executed by the third device, or An analysis program characterized by causing each processing to be executed, specifying a parameter type and a value. An analysis method performed by a computer,
The type of parameter included in the first request transmitted from the first device to the second device, the value of the parameter, and the transmission from the second device to the third device based on the first request The third device for each type and value of the parameter based on the storage content of the storage unit that stores the identifier of the process executed by the third device in association with the second request made The ratio of the processing executed by is calculated, the parameter type and value similarity included in the first request for the parameter type and value corresponding to the calculated ratio are calculated, and for each parameter type, A first average value and a first standard deviation of the similarity are calculated, and a second average value and a second standard value of the similarity are calculated for each type and value of the parameter. To calculate the quasi-deviation,
Based on the calculated first average value and first standard deviation and the second average value and second standard deviation , the type of parameter corresponding to the process executed by the third device, or An analysis method characterized in that each type of process is executed to identify a parameter type and a value.

Images