JP5863581B2 - Determination rule generation device, router, program and method for generating determination rule for terminal information estimation - Google Patents

Description

  The present invention relates to a technique for managing and monitoring a network in which a plurality of terminals are connected.

  The network administrator must grasp the network user's usage environment and usage status in order to maintain stable network operation. By grasping this, it becomes possible to prevent a user's action causing a communication failure in advance, or to predict the degree of future increase in communication volume and increase necessary communication facilities.

  However, it is generally difficult for the network administrator to fully grasp the actual usage of the user. For example, when an administrator and a user belong to different organizations such as an Internet service provider (ISP) and the user, it is difficult for the administrator to monitor the usage status of the user. is there. In particular, when a user selects a terminal that suits his / her preference and installs an arbitrary application himself / herself, it is difficult for the administrator to grasp the situation of the user.

  On the other hand, there are cases where users are allowed to use unauthorized devices by connecting unauthorized terminals even when the network usage of users is strictly regulated, such as in-company networks. To do. In addition, for example, when a company's network extends to domestic and foreign countries, it is extremely difficult to directly monitor and directly grasp the usage status.

  Under such circumstances, a technique for monitoring only the communication by the user and grasping the usage environment and usage status of the user from the communication itself is currently being studied.

  For example, Non-Patent Documents 1 and 2 are installed in each terminal of a user by monitoring behaviors specific to an operating system (OS) in TCP / IP (Transmission Control Protocol / Internet Protocol). A method for identifying the OS type is disclosed.

  Non-Patent Document 3 identifies the type of web browser (Web browser) installed in the user terminal by extracting and combining character strings specific to the OS or application included in the HTTP (Hypertext Transfer Protocol) header. Techniques to do this are disclosed.

  Furthermore, Non-Patent Document 4 discloses a method of analyzing a DNS (Domain Name System) query pattern and identifying the OS type and the web browser type from the relationship between the query pattern time difference and the number of pattern appearances. . Here, this method is based on a communication environment in which IPv4 (Internet Protocol version 4) and IPv6 (Internet Protocol version 6) are mixed.

  Further, although not packet monitoring on a communication network, Patent Document 1 uses a character string unique to a virus file as a signature in order to detect a virus-infected file or the virus itself on a computer network. Technology is disclosed. Here, this signature is registered in advance, and a file containing this signature is determined to contain a virus.

  Further, Patent Document 2 discloses a method for automatically generating a signature for detecting a computer virus. Here, a known normal file is compared with a known illegal file, and a signature is automatically generated using an n-gram algorithm.

Japanese National Patent Publication No. 11-513153 Japanese Patent Laid-Open No. 6-250861

Passive OS Fingerprinting (p0f), "the new p0f: 2.0.8 (2006-09-06)", [online], [searched on January 19, 2012], Internet <URL: http: //lcamtuf.coredump .cx / p0f.shtml> Nmap Fingerprint, “Understanding an NmapFingerprint”, [online], [searched on January 19, 2012], Internet <URL: http://nmap.org/book/osdetect-fingerprint-format.html> Peter Eckersley, ELECTRONIC FRONTIERFOUNDATION “How Unique Is Your Web Browser?”, [Online], [searched on January 19, 2012], Internet <URL: http://panopticlick.eff.org/browser-uniqueness.pdf> Takashi Kawaguchi, Goto Laboratory B4 1G06R055-7, Department of Computer Network Engineering, Faculty of Science and Engineering, Waseda University, Announcement of graduation thesis, “Estimation of OS using DNS query pattern”, [online], [Search January 19, 2012], Internet <URL: http://www.goto.info.waseda.ac.jp/forB4/pdf-th/2009/0201_kawaguchi.pdf>

  However, even using the above-described conventional technology, it is extremely difficult to estimate terminal information such as terminal types and software types (OS types and application types) installed in terminals in an entire ISP level large-scale network. It is difficult to.

  For example, in the techniques of Non-Patent Documents 1 and 3, basically all communication on the network needs to be acquired. As a result, in a large-scale network, the introduction cost or monitoring burden increases and the feasibility decreases. In the techniques of Non-Patent Documents 1 and 2, since the characteristics of TCP / IP are used, only the OS type can be identified. On the other hand, in the technique of Non-Patent Document 3, since the feature of the HTTP header is used, only the web browser type can be identified.

  Furthermore, since the technique of Non-Patent Document 4 is premised on a communication environment in which IPv4 and IPv6 are mixed, the OS type cannot be identified in an IPv4 or IPv6 single environment. Therefore, the technology cannot be applied in the case of a full transition to IPv6.

  When the terminal is a mobile device such as a mobile phone, the terminal may move to another communication area on the order of several minutes to several hours. For this reason, in the conventional technology as described above, it becomes more difficult to appropriately acquire actual terminal information.

  As described above, in order to acquire / estimate terminal information such as terminal type, OS type, application type, and the total number of terminals corresponding to these, packet monitoring on a communication network is performed based on an appropriate determination rule. Need to be done in as short a time as possible.

  Here, the file monitoring method using the signature and the automatic signature generation method described in Patent Documents 1 and 2 certainly detect a virus by using a determination rule including the signature. However, these methods are intended only for files on a computer network. Here, for example, even if a determination rule using such a unique signature (character string) is simply applied to packet monitoring on a communication network, the above-described problem cannot be solved.

  Therefore, the present invention provides a determination rule generation device, a router, a program, and a method for generating a determination rule used to estimate terminal information including software types in the entire network with high accuracy in a short time. Objective.

According to the present invention, there is provided a determination rule generation device for generating a determination rule for estimating terminal information in a large number of terminals that transmit a query including a query name to a DNS server,
Terminal information registration means for preregistering in association with the software type installed in the terminal related to the source address, for each source address assigned to a plurality of connected terminals;
Query collection means for collecting the query transmitted from a plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A generation cycle calculation means for sequentially calculating and updating the cycle stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability A determination rule generating device is provided that includes a determination rule generating means for generating a determination rule that records the above.

In this determination rule generation device of the present invention,
It further includes query information acquisition means for extracting the query name and source address included in each collected query, and recording the query occurrence time and the query name and source address in association with each other,
For each of the query names, the generation period calculation means calculates the query generation period as an average of the generation time intervals of the queries including the query name for each of the extracted source addresses. It is also preferable to calculate the variance as the variance in the distribution.

  Further, in the determination rule generation device of the present invention, the software type is an OS type and / or an application type, and the query name is necessary when performing software update confirmation in the OS type and / or application type or for executing a process. It is also preferable to include a connection destination address at the time of requesting information.

Further, in the determination rule generation device of the present invention, the determination rule generation means is mounted on the terminal connected to the network from the number of queries per unit time transmitted from the multiple terminals using the query generation period . Calculate the number of one software type, and generate a determination rule that makes it possible to estimate the number of terminals equipped with the software type by using the periodic stability as a weight for the calculated number of the software type It is also preferable.

Furthermore, as another embodiment of the determination rule generation device of the present invention, the terminal information registration means further associates the terminal type of the terminal related to the source address for each source address assigned to a plurality of terminals. pre-registered Te and,
The determination rule generation means, each said query name, a terminal type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generator It is also preferable to further generate a determination rule in which the period and the period stability are recorded.

  In the determination rule generation device of the present invention, it is also preferable that the periodic stability is determined from a predetermined average of variance, kurtosis, and skewness in the distribution of the generation time intervals of the query.

According to the present invention, the router further includes a function for generating a determination rule for estimating terminal information in a large number of terminals that send a query including a query name via a network to a DNS server,
Terminal information registration means for preregistering in association with the software type installed in the terminal related to the source address, for each source address assigned to a plurality of connected terminals;
Query collection means for collecting the query transmitted from a plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A generation cycle calculation means for sequentially calculating and updating the cycle stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability A router having determination rule generation means for generating a determination rule recording the above is provided.

According to the present invention, furthermore, a determination rule generation for causing a DNS server to function a computer to generate a determination rule for estimating terminal information in a large number of terminals that transmit a query including a query name via a network. A program,
Terminal information registration means for preregistering in association with the software type installed in the terminal related to the source address, for each source address assigned to a plurality of connected terminals;
Query collection means for collecting the query transmitted from a plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A generation cycle calculation means for sequentially calculating and updating the cycle stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability A determination rule generation program for causing a computer to function as a determination rule generation means for generating a determination rule recording the above is provided.

According to the present invention, there is further provided a determination rule generation method for generating a determination rule for estimating terminal information in a large number of terminals that send a query including a query name to a DNS server via a network,
For each source address given to a plurality of connected terminals, using a terminal information registration means pre-registered in association with the software type installed in the terminal related to the source address ,
A first step of collecting the queries transmitted from a plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A second step of sequentially calculating and updating the periodic stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability And a third step of generating a determination rule in which is recorded.

  According to the determination rule generation device, router, program, and method of the present invention, it is possible to generate a determination rule that is used to estimate terminal information including software types in the entire network with high accuracy in a short time.

It is a block diagram of a network to which a determination rule generating device according to the present invention is connected. It is a functional block diagram in one Embodiment of the determination rule production | generation apparatus by this invention. It is an example of the various tables formed in the determination rule production | generation process by this invention. It is one Embodiment of the determination rule which concerns on this invention. It is a flowchart which shows one Embodiment of the determination rule production | generation method by this invention. It is a flowchart which shows the terminal information estimation example using the determination rule which concerns on this invention.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a configuration diagram of a network to which a determination rule generation apparatus according to the present invention is connected.

  According to FIG. 1, the determination rule generation device 1 includes wired / wireless interfaces 100 a and 100 b to which a plurality of terminals 2 are connected, a determination rule generation unit 114, and a communication interface 101 connected to the provider network 4. .

  The determination rule generation unit 114 inputs analysis results of a DNS query (query) transmitted from a plurality of terminals 2 to the DNS server 3 responsible for name resolution in the provider network 4, and terminal information related to a large number of terminals 7. A “judgment rule” for estimating Here, the plurality of terminals 2 are terminals connected to generate a “determination rule”. On the other hand, a large number of terminals 7 are terminals connected to the provider network 4 and are estimation targets of terminal information.

  The provider network 4 is an ISP provider network, for example, and includes one or a plurality of access networks. This access network may be, for example, a network such as 3G (3rd Generation), WiMAX (Worldwide Interoperability for Microwave Access), LTE (Long Term Evolution), an optical fiber network, or ADSL (Asymmetric Digital Subscriber Line).

  Here, each terminal 2 appropriately updates software such as the installed OS and applications. At that time, it periodically tries to check for updates on a site specific to the software type through the Internet 5. Therefore, it is necessary to know the address of this site. Therefore, each terminal 2 transmits a DNS query including the domain name (inquiry name) of this site to the DNS server 3 at a time interval specific to the software type. Upon receiving the DNS query, the DNS server 3 communicates with another DNS server or resolves the name itself, and transmits a response (resource record) including the connection destination address to the terminal 2 that has sent the query.

For example, the query name when confirming the update for each OS type is as follows.
<< OS type OS _i >><< Inquiry name N _d >>
Windows OS (Microsoft) download.windowsupdate.com
Android (Google) android.clients.google.com
Mac OS (Apple) swscan.apple.com
iOS (Apple) push.apple.com, phobos.apple.com,
iphone-ld.apple.com
Although the time interval for OS update confirmation depends on the OS type, for example, Apple iOS has 12 hours.

In addition, as an example of the application type, a reference name at the time of update confirmation for each typical web browser is, for example, as follows.
<< Web browser >><< Inquiry name _Nd >>
Mozilla Firefox (Mozilla Foundation) www.mozilla.com
Chrome (Google) www.google.com
Opera (Opera Software) autoupdate.opera.com
The application update confirmation time interval depends on the application type, but is 1.5 hours for Apple's iCloud, for example.

  Furthermore, the transmission of the DNS query related to the software installed in each terminal 2 is performed not only at the time of software update confirmation as described above, but also at the time of requesting information necessary for execution of software processing. For example, a DNS query is also transmitted when requesting time information for time adjustment, when checking a mailbox in an e-mail, or when checking other person information in various social network services. That is, in many software, one pattern is to start communication after resolving the name using the DNS server 3.

  In this case, many inquiry names (domain names of connection destinations) are unique to the software type (OS type, application type) and further to the terminal type (terminal manufacturer, model number). Further, for example, even if one OS type (for example, AndroidOS provided by Google Inc.) is installed in many different terminal manufacturers. Further, a lot of software installed in the terminal 2 accesses the site of the terminal manufacturer every time it is started up. However, even if the terminal is the same terminal manufacturer, the site to be accessed may differ depending on the model number. Accordingly, there are many cases where each terminal 2 transmits a DNS query to the DNS server 3 not only with a reference destination specific to the software type but also with a reference destination specific to the terminal type. The determination rule generation device 1 collects DNS queries having these unique reference destinations and generates a “determination rule”.

  Similarly, in FIG. 1, the “determination rule” created by the determination rule generation unit 114 of the determination rule generation device 1 is data used when the terminal information estimation device 6 estimates “terminal information” in a large number of terminals 7. It is a table. Here, a large number of terminals 7 are provider network user terminals and are connected to the Internet 5 via the provider network 4. “Terminal information” refers to the terminal type (terminal manufacturer name, model) of the terminal 7, the software type (OS type, application type) installed in the terminal 7, and the number of terminals for each type. .

  The terminal information estimation device 6 is connected to the provider network 4 via a network tap (or mirroring hub) provided on the line to the DNS server 3. As a result, the terminal information estimation device 6 collects all the DNS queries that a large number of terminals 7 send to the DNS server 3 via the provider network 4 and analyzes the DNS queries to estimate “terminal information”.

  At that time, the terminal information estimation device 6 receives the “determination rule” transmitted from the determination rule generation device 1 via the provider network 4 and uses it for terminal information estimation. In this “determination rule”, a query name (domain name) is adopted as a predetermined character string (signature) used when analyzing a DNS query transmitted from a large number of terminals 7.

  In order to generate such a “determination rule”, it is also preferable that about 10 to 100 terminals 2 are connected to the wired / wireless interfaces 100a and 100b, for example, for one installed OS type and application type. Of course, by connecting more terminals 2, it is possible to generate a “judgment rule” with higher accuracy.

  In order to obtain a highly reliable “determination rule”, it is also preferable that the terminal 2 is always placed in a connection established state during the determination rule generation period in which DNS queries are collected. In any case, the terminal information (assigned IP (Internet Protocol) address, terminal type, installed OS type, application type, etc.) of the plurality of terminals 2 to be connected is registered in the determination rule generation device 1, Used to generate “judgment rules”.

  The determination rule generation device 1 can generate a “determination rule” by collecting DNS queries transmitted from the terminal 2 continuously, for example, for 24 hours to several months. At that time, the determination rule generating device 1 registers the software type (OS type or application) corresponding to the DNS query query name registered in association with the DNS query source IP address (the IP address assigned to the terminal 2). For each type, “query generation cycle” and “cycle stability” are sequentially calculated and updated.

  Here, the inventors of the present application, for many software types (OS type, application type), are not limited to DNS queries for software update confirmation, but the transmission timing of various DNS queries is “query generation specific to the software type. It has been found that it can have a “period”.

  This “query generation cycle” is an average value of the generation time intervals of the target DNS query. DNS queries are often sent with a time interval (cycle) specific to the corresponding software type (inquiry name), such as periodic OS update confirmation, and a “query generation period” is determined for each software type (inquiry name). Is possible.

  However, in actual name resolution, a predetermined time is specified according to TTL (Time To Live) of the resource record cached as a response to the previous DNS query, and the query is not transmitted within this time ( The domain name answered in this resource record is reused). Under such circumstances, the query generation time interval (cycle) varies. The “period stability” corresponds to a small amount of the fluctuation, and is determined from the variance in at least the “query generation period” distribution, as will be described later.

  As described above, the determination rule generation device 1 finally generates a “determination rule” in which “query generation period” and “period stability” are associated with each other for each query name and software type.

  On the other hand, the terminal information estimation device 6 uses the “query generation cycle” of the received “determination rules” to connect the terminal connected to the provider network 4 from the number of DNS queries per unit time transmitted from a large number of terminals 7. The number (the number of terminals 7 loaded with each software type) is calculated. Further, as will be described later, the terminal information estimation device 6 estimates the number of terminals with higher accuracy by performing a weighted average on the calculated number of terminals using “periodic stability”.

  Here, as described above, the “determination rule” is generated by the determination rule generation device 1 using a plurality of terminals 2 for which terminal information is known and taking a sufficient amount of time. As a result, the “query generation period” and the “period stability” associated with each inquiry name and software type can be sufficiently reliable values. As a result, the terminal information estimation device 6 can estimate the number of terminals with high accuracy in a considerably short time. That is, according to the determination rule generation device 1, it is possible to generate a “determination rule” used for estimating terminal information including the software type in the entire provider network 4 with high accuracy in a short time.

  Note that the determination rule generation device 1 described above can be installed, for example, at a router position in a corporate network. A router that has the function of the determination rule generation device 1 and performs routing of a plurality of terminals 2 can also be used as the determination rule generation device. Further, the determination rule generation device 1 may mediate an experimental network independent of the actually operated network and the plurality of terminals 2. In any case, the determination rule generation device is installed in an environment where terminal information of all the plurality of terminals 2 can be managed and registered.

[Judgment rule generator]
FIG. 2 is a functional configuration diagram of an embodiment of the determination rule generation device according to the present invention. FIG. 3 is an example of various tables formed in the determination rule generation process according to the present invention, and FIG. 4 is an embodiment of the determination rule finally generated.

  According to FIG. 2, the determination rule generation device 1 includes a wireless interface 100a, a wired interface 100b, a communication interface 101, an input unit 102, an output unit 103, a query collection unit 110, and a query information acquisition unit 111. The terminal information registration unit 112, the generation period calculation unit 113, and the determination rule generation unit 114. The determination rule generation device 1 is a personal computer, for example, and by executing a program that causes the computer mounted on the device 1 to function, functions related to generation of the determination rule are realized.

  The wireless interface 100a and the wired interface 100b are connected to the plurality of terminals 2 and establish communication with the plurality of terminals 2. As the wireless interface 100a, for example, one or more of a wireless LAN such as Wi-Fi (registered trademark), Bluetooth (registered trademark), and the like can be employed. As the wired interface 100b, one or more of a wired LAN (Local Area Network), a USB (Universal Serial Bus), and the like can be adopted.

  The communication interface 101 mediates communication with the provider network 4 by the terminal 2 and mediates communication for transmitting the determination rule table 114 t generated by the determination rule generation unit 114 to the terminal information estimation device 6.

  The input unit 102 inputs terminal information registered in the terminal information registration unit 112. The input unit 102 may be, for example, an interface that enables input of a database of information related to a plurality of terminals 2 connected to the corporate network edited by an administrator of the corporate network. Here, the information related to each terminal 2 includes an IP address given by a DHCP (Dynamic Host Configuration Protocol) server, a MAC (Media Access Control) address of the terminal 2, a terminal manufacturer, a model, and installed software (OS / application) ) Type.

  The DHCP server that assigns IP addresses to a plurality of terminals 2 is set to assign a predetermined IP address to a predetermined MAC address, and this assignment information is transmitted to the terminal information registration unit 112 via the communication interface 101. It is also preferred that Further, the determination rule generation device 1 itself has a DHCP server function, and assigns IP addresses to a plurality of terminals 2 and outputs a correspondence table of IP addresses and MAC addresses to the terminal information registration unit 112. Is also preferable. Further, when there is a regulation such that use of only a predetermined OS or application is permitted in the corporate network, this regulation information is also preferably input via the input unit 102. The input unit may include an input device such as a keyboard for inputting (part of) terminal information corresponding to the IP address.

  The output unit 103 displays and displays the determination rule generated by the determination rule generation unit 114 as a medium such as paper, or outputs it as data to an external device.

  The query collection unit 110 identifies, collects, and accumulates DNS queries addressed to the DNS server 3 among packets transmitted from the plurality of terminals 2 and input via the wireless / wired interfaces 100a and 100b.

The query information acquisition unit 111 extracts query information such as a query name N _d and a source IP address included in each collected DNS query, and stores data that associates the query information with the occurrence time of the DNS query. The data is output to the sequential generation period calculator 113 and recorded. It is also preferable to create / update the query information table 111t (FIG. 3A) that stores this data.

According to FIG. 3A, in the query information table 111t, the query name N _d , the source IP address, and the query type included in this DNS query are recorded for each occurrence time of the DNS query. Here, the query type represents the type of information requested by the DNS query. For example, type A indicates that a host address is requested. Here, hereinafter, it is possible to query type to use only the information related to the query name N _d is A, that.

  Returning to FIG. 2, the terminal information registration unit 112 determines the correspondence between the IP addresses assigned to the plurality of terminals 2 and the terminal information (MAC address, terminal manufacturer, model, and installed software type) of each terminal 2. The terminal information table 112t (FIG. 3B) is registered.

According to FIG. 3B, in the terminal information table 112t, for each IP address assigned to a plurality of terminals 2, the MAC address of the terminal 2, the software type installed in the terminal 2 (OS type OS _i .application Type AP _j ) and the hardware type (terminal manufacturer, model, etc.) of the terminal 2 are recorded.

Returning to FIG. 2, the generation period calculation unit 113 sequentially inputs data (or updated query information table 111 t) in which the generation time of the DNS query is associated with the query information from the query information acquisition unit 111. In this case, the query name N _d is determined whether new or not, if novel, entry into the query name N _d new query cycle table 113 t (FIG. 3 (C)). On the other hand, if the new and already updated the column of the query name N _d that are entries in the query cycle table 113 t. More specifically, for each query name _{N d} (software for each type corresponding to the query name _{N d),} the frequency fq of DNS queries, records and updates the query cycle table 113 t.

Further, the generation period calculation unit 113 has, for each query name N _d , a DNS query generation time interval that includes the same source IP address and includes the query name N _{d for} each of the DNS query source IP addresses. Δt _n (n-th occurrence time interval) calculation formula (1) Δt _n = t _{n + 1} −t _n (t _n : n-th occurrence time of DNS query)
Using first calculated Delta] t _1, for each software type corresponding to the query name N _d, as a query generation period T _q, and it records the query cycle table 113 t.

Next, using the sequentially input data, the generation time interval Δt _n (n ≧ 1) is sequentially calculated.
(2) T _q = Σ (Δt _m ) / n
As updates the query generation period _{T q} query cycle table 113 t. Here, Σ is a summation for m = 1, 2,..., N. That is, the query generation period _{T q} is generation time interval Δt _1, Δt _2, ···, is sequentially updated as the mean value of Delta] t _n.

The generation period calculation unit 113 further calculates the variance V _q in the distribution of the generation time intervals Δt ₁ , Δt ₂ ,..., Δt _n by the following equation (3) V _q = Σ (Δt _m −T _q (n)) ² / n
Are sequentially calculated and sequentially recorded and updated in the query cycle table 113t. Here, Σ is the sum for m = 1, 2,..., N. T _q (n) is a query generation cycle calculated in consideration up to the generation time interval Δt _n .

The generation period calculation unit 113 also calculates the kurtosis K _q in the distribution of the generation time intervals Δt ₁ , Δt ₂ ,..., Δt _n by the following equation (4) K _q = Σ (Δt _m − (T _q (n )) ⁴ ) / (nV _q ² ) -3
Are sequentially calculated and sequentially recorded and updated in the query cycle table 113t. Here, Σ is the sum for m = 1, 2,..., N. In general, the kurtosis K _q of a distribution that is sharper (flattened) than the normal distribution is larger (smaller) than zero. The kurtosis of the distribution corresponding to the normal distribution is zero.

The generation period calculation unit 113 further calculates the skewness S _q in the distribution of the generation time intervals Δt ₁ , Δt ₂ ,..., Δt _n by the following equation (5) S _q = Σ (Δt _m −T _q (n) ) ³ / (nV _q ^1.5 )
Are sequentially calculated and sequentially recorded and updated in the query cycle table 113t. Here, Σ is the sum for m = 1, 2,..., N. In general, the skewness S _{q of} the distribution biased to the left side (right side) is larger (smaller) than zero. The skewness of the symmetrical distribution is zero.

Generation period calculation unit 113, further, the calculated variance _{V q,} kurtosis _K using _q and skewness _{S q,} generation time interval Δt _1, Δt _2, ···, the period of Delta] t _n stability _{S T} (6a) S _T = 1−AS _T
(6b) AS _T = N [(V _q ² + K _q ² + S _q ² ) ^0.5 ]
Are sequentially calculated and sequentially recorded and updated in the query cycle table 113t. Here, the function N [X] in the above equation (6b) is a function that normalizes a variable X that takes zero or a positive value to a value from 0 to 1, for example,
(7) N [X] = − (X + 1) ⁻¹ +1
It can be. As a result, AS _T corresponds to the instability (uncertainty) of the average value (query generation period T _q ) in the distribution of the occurrence time intervals Δt ₁ , Δt ₂ ,..., Δt _n , and the distribution is more dispersed. Therefore, the larger the deviation from the normal distribution, the larger the deviation.

As a result, the value of the period stability S _T (if anxiety about AS _T is zero) If the query generation time interval is the most stable, is one. On the other hand, as the query generation time interval is likely to vary from the query generation cycle T _q, it approaches zero. By performing the estimation of the terminal information (terminal number, etc.) by introducing the value of such a cycle stability S _T, thereby enabling more accurate estimation.

The period stability _{S T} is not limited to those specified in (6a) and (6b). It is also preferable to be determined from a predetermined average other than the above with respect to variance V _q , kurtosis K _q and skewness S _q , or determined from variance V _q alone (for example, S _T = 1−N [V _q ]) Is also possible.

According to FIG. 3 (C), the the query cycle table 113 t, the query name _N for each _d (the query name software for each type corresponding to _{N d),} the query cycle information (total observation time, frequency _f q of DNS queries, Query generation cycle T _q , variance V _q , kurtosis K _q , skewness S _q , and cycle stability S _T ) are recorded and updated. Specifically, in each of the software types (OS type OS _i and application type AP _j ) installed in the plurality of terminals 2 registered in the terminal information registration unit 112 (terminal information table 112t), a corresponding inquiry is made. column name N _d, query cycle information is recorded, it is sequentially updated.

Also, the query cycle table 113 t, further query name hardware type of the terminal 2 corresponding to the N _d (terminal manufacturer, model, etc.) for each query cycle information is recorded sequentially updated.

Update data in the query cycle table 113 t (collection and analysis of DNS query) is carried out by a total observation time _{T me} DNS queries that are set in advance. Data query cycle table 113t, the total observation updated during the time _{T me,} after _{T me} lapse, is finally determined. This total observation time T _me is set, for example, for 24 hours to several months.

  Returning to FIG. 2, the determination rule generation unit 114 inputs, from the generation cycle calculation unit 113, a query cycle table 113 t having data determined after the update is completed. The determination rule generation unit 114 collects the query cycle table 113t and creates a determination rule 114t (FIG. 4).

According to FIG. 4, the determination rule 114t, software type (OS type OS _i, application type AP _j) for each and query name _{N d,} query type _{t q,} query generation period _{T q,} and the cycle stability _{S T} is It is recorded.

In the determination rule 114t, jOS, which is one of the OS types, has three corresponding query names N _d (abc.xxxupdate.com, efg.clients.com, and hij.klmno.com). . That is, from the terminal 2 equipped with Jos, 3 kinds of DNS query containing these three query name N _d respectively are generated with a respective query generation period T _q and the cycle stability S _T.

Here, after (using S609 in FIG. 6) as will be described in detail, also by using the data corresponding to any of the query name N _d (query generation period T _q), calculates the number of devices with jOS be able to. However, by using the cycle stability S _T according to the present invention, three terminal number calculated, it is possible to estimate the more number of accurate terminal.

For this reason, in the determination rule 114t, 1 single to software type have been always a plurality of query name N _d record, query generation cycle T _q and the cycle stability independent for each query name N _d It is preferable that _ST is defined.

  As a recent trend, there are an increasing number of cases where a polling application is employed in an OS installed in a mobile terminal. For this reason, it is easy to specify a plurality of query names for one software type.

Incidentally, in the determination rule 114t, the query name N _d, the query name is a unique character string to a specific software type that has N _d, and it can not be considered, a plurality of software type in the query name N _d There is a case where corresponds. For example, according to the determination rule 114t shown in FIG. 4, two OS types: NbdOS and OSyy correspond to the query name N _d : klm.bqq.com. In this case, even if the number of queries including the query name N _d : klm.bqq.com is counted in the terminal information estimation device 6 using this determination rule 114t, is the count number originally the number of terminals related to NbdOS? Alternatively, it cannot be determined whether the number of terminals is related to OSyy.

However, the query generation period in the case of NbdOS is 538.7 seconds, whereas the query generation period in the case of OSyy is 171850.1 seconds, which is an order of magnitude longer. As a result, in the terminal information estimation device 6, with the expectation that the ratio between the number of terminals 7 equipped with NbdOS and the number of terminals 7 equipped with OSyy is within a predetermined range, the query name N _d : klm.bqq It is possible to approximate the count number of queries including .com corresponding to the number of terminals related to NbdOS. Thus, by registering also determination rule query name N _d not become the specific string to a specific software type, there are cases where it is possible to effectively utilize the estimation of the total number (number of terminals).

Furthermore, the determination rule 114t, because query name N _d query occurs every period T _q and the cycle stability S _T is defined, a high periodicity of the reliability (the variance of the cycle is small) query name N _d , Heading, checking, and further sorting. For example, a query name N _d whose cycle stability _ST is not more than a predetermined value (for example, not more than 0.2) may not be used for terminal information calculation / estimation. Actually, in estimating terminal information, it is very important to select which query name _Nd (how much) to obtain highly accurate terminal information (number of terminals). In this respect, the periodic stability _ST is a powerful index for the determination.

Returning to FIG. 2, the determination rule 114 t is transmitted to the terminal information estimation apparatus 6 via the communication interface 101. The terminal information estimation device 6 calculates the number of terminals connected to the network 4 from the number of DNS queries per unit time transmitted from a large number of terminals 7 using the query generation period T _q recorded in the received determination rule 114t. To do. Also, to estimate the number of terminals with higher accuracy by using the determination rule period recorded in 114t stability S _T.

[Judgment rule generation method]
FIG. 5 is a flowchart showing an embodiment of the determination rule generation method according to the present invention.

(S500) First, the software type (OS type OS _i , application type AP _j ) installed in the terminal 2 is registered in advance for each source IP address assigned to the plurality of terminals 2.

(S501) A DNS query information collection loop (steps S501 to S508) is started. The total observation time (collection time) is T _me .
(S502) The DNS queries transmitted from the terminal 2 are collected.
(S503) The query name _Nd and the source IP address included in the collected DNS query are extracted.

(S504) The DNS query occurrence time is recorded in association with the extracted query name _Nd and the source address. The occurrence time can be time information extracted from the DNS query.
(S505) It is determined whether or not the extracted query name _Nd is new.
(S506a) If the extracted query name _{N d} is new, entry to the newly query period table 113t this query name _{N d.}
(S507a) then (for each query name _{N d)} as a value corresponding to the query name _{N d,} for each source IP address query, calculating the query generation cycle _{T q} and the cycle stability _{S T,} the query Record in the period table 113t.

(S506b) On the other hand, if the extracted query name N _d is not a novel, referring to the query name N _d that are already entries.
(S507b) then (for each query name _{N d)} as a value corresponding to the query name _{N d,} for each source IP address query, calculating the query generation cycle _{T q} and the cycle stability _{S T,} the query These values recorded in the period table 113t are updated.

(S508) After starting the DNS query information collection loop, it is determined whether or not the set total observation time T _me has elapsed. If it has elapsed, this loop (DNS query collection / analysis) is terminated. To do. On the other hand, if it has not elapsed, the process returns to S501 to continue this loop.

(S509) for each query name N _d, and software type corresponding to the query name N _d are registered corresponding to the source IP address query containing the query name N _d, finally determined query generating a determination rule 114t which records the occurrence period _{T q} and the cycle stability _{S T.}
(S510) The generated determination rule 114t is output. At this time, the determination rule 114t may be transmitted to the terminal information estimation device 6, or displayed on a display, output as a medium such as paper, or output to an external device as data.

In this embodiment (steps S500 to S510) of the determination rule generation method, if “terminal type” is adopted instead of “software type”, determination rules relating to the terminal types of the plurality of terminals 2 can be generated. it can. In this case, the determination rule becomes that every query name N _d and terminal type, the finally determined query generation period T _q and the cycle stability S _T were recorded.

[Terminal information estimation example using a query generation cycle T _q and the cycle stability S _T]
FIG. 6 is a flowchart illustrating an example of estimating terminal information using the determination rule 114t according to the present invention. This terminal information estimation method is implemented in the terminal information estimation apparatus 6 (FIG. 1).

(S600) The generated determination rule 114t is input.
(S601) Software type entered in the determination rule 114t, that is,
OS type {OS ₁ , OS ₂ ,..., OS _i ,..., OS _os }, and application type {AP ₁ , AP ₂ ,..., AP _{j ,.}
Is registered in advance. Next, the initial value of the count number n _osi of the OS type OS _i and the initial value of the count number n _apj of the application type AP _j are each set to zero.
n _osi = 0 (i = 1, 2,..., os) and n _apj = 0 (j = 1, 2,..., sp)

(S602) A loop for counting the number of DNS queries while analyzing the collected DNS queries is started. Here, it is assumed that the count time of the number of queries is t _co .
(S603) Collect packets addressed to the DNS server 3.
(S604) the collected packets, determines whether the DNS query containing a query name _{N d} corresponding to the OS type registered OS _i or application type AP _j.

(S605a) at step S604, the time of collection packet is a determination that the DNS query containing a query name _{N d} corresponding to the OS type OS _i registered has been made, the count number _{n osi} of OS type OS _i 1 Only increase.
(8) n _{os i} = n _{os i} +1
(S605b) in step S604, the time of collection packet is a determination that the DNS query containing a query name _{N d} corresponding to the application type AP _j registered has been made, the count number _{n apj} of application type AP _j 1 Only increase.
(9) n _apj = n _apj +1
On the other hand, in step S604, the collected packets, when a determination not a DNS query including query name N _d corresponding to the software type that is registered has been made, the process proceeds to step S606.

(S606) It is determined whether or not the set count time _tco has elapsed since the start of the query count loop, and if this has elapsed, this loop is terminated. On the other hand, if it has not elapsed, the process returns to S602, and this loop (DNS query count loop for each software type) is continued.

Here, the count time t _co is set to, for example, several minutes to several hours. This means that by using the determination rule according to the present invention, highly accurate terminal information (number of terminals) can be obtained even by counting queries in a short time.

(S607) Number of queries for each OS type {n _os1 , n _os2 ,..., N _osi ,..., N _osos }, and number of queries for each application type {n _ap1 , n _{ap2,. apj} ,..., n _apap }
Record.
(S608) The total number estimation loop for calculating the total number of each software type (OS _i , AP _j ) is entered.

(S609) For each software type (OS _i , AP _j ), the total number of the software type is
(10) N _{os i} = n _{os i} * Tq (OS _i ) / (60 * t _co )
(11) N _apj = n _apj × Tq (AP _j ) / (60 × t _co )
Calculate as Here, Tq (OS _i ) (seconds) and Tq (AP _j ) (seconds) are query generation periods corresponding to OS _i and AP _j , respectively, read from the input determination rule 114t. The unit of the count time t _co is minutes.

For example, in Apple iOS, the update confirmation time interval (query generation cycle) T _q = 12 (time) = 43200 (seconds). _Here, the t co = 10 (min), the count number of DNS queries the iphone-ld.apple.com an update confirmation destination iOS and referral _{N d} is, assuming that a n = 100 (times) , The total number of iOS (and hence the total number of devices equipped with iOS) N is
N = 100 × 43200 / (60 × 10) = 7200
It becomes. That is, the number of terminals connected to the provider network 4 is estimated to be 7200.

Further, as shown in the determination rule 114t of FIG. 4, there are a plurality of query names Nd _k corresponding to one OS type OSa (jOS in FIG. 4) (abc.xxxupdate.com, efg.clients.com in FIG. 4). , and three) when present in Hij.Klmno.Com, by utilizing the periodicity stability S _T, it is possible to estimate the number of terminals with higher accuracy.

The query generation period and the period stability associated with each of the plurality of query names Nd _k corresponding to the OS type OSa are _defined as Tq _k and ST _k , respectively. In this case, the total number of OSa (therefore, the total number of terminals equipped with OSa) N _osa is expressed by the following equation (12-1) N _osa = Σ (N (OSa) _k × ST _k ) / ΣST _k
(12-2) N (OSa) _k = n _k × Tq _k / (60 × t _co )
Can be used to calculate. Here, n _k is the count number of queries including the query name Nd _k . In addition, each of the two Σs in the equation (12-1) is a summation about k (in the case of jOS in FIG. 4, the summation of k = 1, 2, 3).

For example, in the case of jOS in FIG. 4, t _co = 10 (minutes), count number n ₁ = 1672 related to abc.xxxupdate.com, count number n ₂ = 7 related to efg.clients.com, and hij.klmno. com count number n ₃ = 8,
N (jOS) ₁ = 1672 × 35.7 / (60 × 10) = about 977.28
N (jOS) ₂ = 7 × 86405.5 / (60 × 10) = about 1008.06
N (jOS) ₃ = 8 × 86389.2 / (60 × 10) = about 1151.86
_Therefore , the more accurate total number N _jos considering the periodic stability is
_{N jos = (977.28 × 0.42 +} 1008.06 × 0.31 + 1151.86 × 0.75) / (0.42 + 0.31 + 0.75) = about 1072
Is calculated.

(S610) The total number estimation loop is repeated until the total number is estimated for all the identified software types (OS type OS _i and application type AP _i ).

(S611) Total number for each OS type {N _os1 , N _os2 ,..., N _osi ,..., N _osos }, and total number for each application type {N _ap1 , N _{ap2 ,.} ..., _Napap }
Accumulate.
(S612) The data accumulated in step S612 is displayed or output.

In the present embodiment of the terminal information estimating method (Step S600～S612), using the determination rule that records the query name N _d and the query generation cycle for each terminal type T _q and cycle stability S _T, "software type If “terminal type” is adopted instead of “OS type and software type”, terminal information (number of terminals) related to the terminal types of the plurality of terminals 2 can also be estimated.

  As described above, by using the determination rule according to the present invention, the software type and the total number (the number of installed terminals) in the entire network can be calculated from the query generation period associated with each inquiry name and software type. it can. Further, it is possible to estimate the total number (number of terminals) with higher accuracy from the calculated total number by using the periodic stability associated with each inquiry name and software type. That is, according to the present invention, it is possible to generate a determination rule used to estimate terminal information including software types in the entire network with high accuracy in a short time.

  In particular, since the number of terminals can be estimated in consideration of periodic stability, including frequently occurring character strings (query names), a highly accurate terminal can be used from a smaller number of query observations (in a shorter time). The number can be estimated. That is, according to the present invention, it is possible to generate a determination rule that is not easily affected by movement of the mobile terminal between communication areas or inside and outside the communication area.

  Furthermore, the terminal information estimated using the determination rule according to the present invention described above is very important for the network administrator, for example, to maintain stable operation of the network. In other words, by grasping these terminal information, it is possible to prevent user actions that cause communication failures, to grasp traffic offload status, and to predict the degree of future traffic increase, and to establish necessary communication facilities. Or the like can be increased.

  However, in the network, new applications and OSs are always used one after another, and the number of users of various software greatly fluctuates. Even in such a situation, according to the present invention, a determination rule suitable for the current communication situation / usage situation can be appropriately created and utilized. As a result, the network administrator can obtain more accurate terminal information with higher accuracy, and can take more appropriate measures.

  For the various embodiments of the present invention described above, various changes, modifications, and omissions in the technical idea and scope of the present invention can be easily made by those skilled in the art. The above description is merely an example, and is not intended to be restrictive. The invention is limited only as defined in the following claims and the equivalents thereto.

DESCRIPTION OF SYMBOLS 1 Determination rule production | generation apparatus 100a Wireless interface 100b Wired interface 101 Communication interface 102 Input part 103 Output part 110 Query collection part 111 Query information acquisition part 111t Query information table 112 Terminal information registration part 112t Terminal information table 113 Generation period calculation part 113t Query period Table 114 Determination rule generator 114t Determination rule 2, 7 Terminal 3 DNS server 4 Provider network 5 Internet 6 Terminal information estimation device

Claims (9)

A determination rule generating device that generates a determination rule for estimating terminal information in a large number of terminals that transmit a query including a query name to a DNS (Domain Name System) server,
Terminal information registration means for preregistering in association with the software type installed in the terminal related to the source address, for each source address assigned to a plurality of connected terminals;
Query collection means for collecting the query transmitted from the plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A generation cycle calculation means for sequentially calculating and updating the cycle stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability And a determination rule generating means for generating a determination rule recording the above. It further includes query information acquisition means for extracting the query name and source address included in each collected query, and recording the query occurrence time and the query name and source address in association with each other,
For each of the query names, the generation period calculation means calculates the query generation period as an average of the generation time intervals of the queries including the query name for each of the extracted source addresses. The determination rule generation device according to claim 1, wherein the variance is calculated as a variance in the distribution. The software type is an OS (Operating System) type and / or an application type,
The determination rule according to claim 1, wherein the inquiry name includes a connection destination address when confirming software update in the OS type and / or application type, or when requesting information necessary for processing execution. Generator. The determination rule generation means calculates the number of one software type installed in a terminal connected to the network from the number of queries per unit time transmitted from the multiple terminals using the query generation period, 4. A determination rule that enables estimation of the number of terminals equipped with the software type by using the periodic stability as a weight with respect to the calculated number of the software type. The determination rule generation device according to any one of the above. The terminal information registration means pre-registers for each source address assigned to the plurality of terminals, in further association with the terminal type of the terminal related to the source address ,
Wherein the determination rule generation means, each said query name, query originator and the terminal type corresponding to the query name has been registered in advance in association to address, finally determined the query including the query name The determination rule generation device according to any one of claims 1 to 4, further generating a determination rule in which the generation period and the periodic stability are recorded.   6. The determination according to claim 1, wherein the periodic stability is determined from a predetermined average of variance, kurtosis, and skewness in a distribution of generation time intervals of the query. Rule generator. A router equipped with a function of generating a determination rule for estimating terminal information in a large number of terminals that send a query including a query name via a network to a DNS server,
Terminal information registration means for preregistering in association with the software type installed in the terminal related to the source address, for each source address assigned to a plurality of connected terminals;
Query collection means for collecting the query transmitted from the plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A generation cycle calculation means for sequentially calculating and updating the cycle stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability And a determination rule generating means for generating a determination rule in which is recorded. A determination rule generation program for causing a computer to function to generate a determination rule for estimating terminal information in a large number of terminals that send a query including a query name via a network to a DNS server,
Terminal information registration means for preregistering in association with the software type installed in the terminal related to the source address, for each source address assigned to a plurality of connected terminals;
Query collection means for collecting the query transmitted from the plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A generation cycle calculation means for sequentially calculating and updating the cycle stability;
For each query name, the software type corresponding to the query name registered in advance corresponding to the source address of the query including the query name, the query generation cycle and the cycle determined finally A determination rule generation program that causes a computer to function as a determination rule generation unit that generates a determination rule that records stability. A determination rule generation method for generating a determination rule for estimating terminal information in a large number of terminals that send a query including a query name to a DNS server via a network,
For each source address assigned to a plurality of connected terminals, using terminal information registration means that pre-registers in association with the software type installed in the terminal related to the source address ,
A first step of collecting the queries transmitted from the plurality of terminals;
For each query name of the query, for each source address of the query, it is determined from the query generation cycle, which is the cycle in which the query including the query name is generated, and at least the distribution in the distribution of the cycle in which the query is generated A second step of sequentially calculating and updating the periodic stability;
Each said query name, and software type corresponding to the query name has been registered in advance in association to the source address of the query including the query name, finally determined the query generation cycle and the cycle stability And a third step of generating a determination rule in which is recorded.

Images