JP6151827B2 - Monitoring control device, monitoring device, monitoring system, and monitoring program - Google Patents

Description

  The present invention relates to a monitoring device, a monitoring method, and a monitoring program for processing traffic data of a monitoring target device belonging to a monitoring target network.

  In recent years, with the development of communication networks, a large amount of traffic is generated. Monitoring fluctuations in the amount of traffic on a communication network is an important technology that contributes to discovery of abnormal traffic, network resource layout design, and the like.

  Conventionally, when monitoring traffic, a technique of setting a monitoring probe at each node in the network, which is a monitoring target point, has been common. This monitoring method is realized by, for example, dedicated software or hardware. There is also a method of providing a monitoring device for collecting monitoring data from each node in the network for each network to be monitored. In this method, one monitoring apparatus centrally monitors the traffic of one network to be monitored.

  For example, there is a method of monitoring traffic by providing software and hardware as an integrated appliance box (see Non-Patent Document 1, for example). There is also a method for monitoring traffic via a network (see, for example, Non-Patent Document 2).

NTT Communications, “Provision of Operation System“ Traffic Analysis Tool ”for IP Network Operators”, [online], [searched on September 18, 2012], Internet <http://www.ntt.com/release/ monthNEWS / detail / 20080804.html> NTT Communications, “Starting the provision of“ Traffic Analysis Tool / Network ”with Global IP Network Service”, [online], [Searched on September 18, 2012], Internet <http://www.ntt.com/ serviceinfo / monthinfo / detail / 20090706.html>

  However, in the traffic monitoring methods described in Non-Patent Document 1 and Non-Patent Document 2, since it is necessary to provide a monitoring device for each network to be monitored, there is a problem that the installation of the monitoring device is expensive. Even if a monitoring device is mounted using a general computer, software for realizing the monitoring function is required, so such software is installed for each node of the monitoring target network or for each network. It will be. Therefore, there has been a problem that the cost burden due to the license cost of these software is increased for the user. Furthermore, there is a problem that the cost for maintenance of the apparatus becomes enormous regardless of whether it is realized by hardware or software.

Accordingly, an object of the present invention is to provide a monitoring control device, a monitoring device, a monitoring system, and a monitoring program for monitoring traffic of a plurality of communication networks.

In order to solve the above-described problem, a first feature of the present invention relates to a monitoring device that processes traffic data of a monitoring target device belonging to a monitoring target network. That is, the monitoring device according to the first aspect of the present invention includes a storage device that stores access right data in which a user identifier is associated with an identifier of a monitoring target network to which the user can refer to traffic analysis data;
A processing unit that receives traffic data from a monitoring target device belonging to the monitoring target network, associates the identifier of the monitoring target network with the received traffic data, and stores the traffic data in the traffic storage data; The traffic data is extracted every time, the analysis means for storing the traffic analysis data generated from the extracted traffic data in association with the identifier of the monitored network, and the analysis data reference request are inputted together with the user identifier And analysis providing means for outputting traffic analysis data associated with the identifier of the monitored network corresponding to the input user identifier based on the access right data.

  Here, the processing means may include an agent for each monitored network. Each agent is given an address as a destination of traffic data transmitted from the corresponding monitored network.

  The storage device stores processing address data in which the identifier of the monitoring target network is associated with the address used when transmitting to the monitoring target network, and the processing unit stores the data in the monitoring target device of the monitoring target network. When transmitting, the processing address data may be read and the data may be transmitted to an address corresponding to the monitoring target network.

  Furthermore, the storage device further stores monitoring target data in which the identifier of the monitoring target network is associated with the identifier of the monitoring target device belonging to the monitoring target network, and the processing unit receives traffic data from the monitoring target device. Read the monitoring target data, extract the identifier of the monitoring target network corresponding to the identifier of the monitoring target device of the transmission source, and correspond the identifier of the monitoring target network, the address of the monitoring target device, and the received traffic data Then, it may be stored in the traffic accumulation data.

  Further, the address of the monitoring target device may be an address in a private address space.

  The second feature of the present invention relates to a monitoring method for processing traffic data of monitored devices belonging to a monitored network. That is, the monitoring method according to the second aspect of the present invention includes a step in which each of a plurality of monitoring target devices belonging to a plurality of monitoring target networks transmits the traffic data of the monitoring target device to the monitoring device; Receiving the traffic data, associating the received traffic data with the identifier of the monitored network to which the monitored device to which the monitored device that sent the traffic data belongs is stored in the traffic accumulation data, and the monitoring device The traffic data is extracted for each monitoring target network, the traffic analysis data generated from the extracted traffic data is stored in association with the identifier of the monitoring target network, and the monitoring device analyzes with the user identifier Data reference request entered The identifier of the monitored network corresponding to the input user identifier is based on the access right data that associates the identifier of the user with the identifier of the monitored network that the user can refer to the traffic analysis data. Outputting correlated traffic analysis data.

  Here, the monitoring device may include an agent provided for each monitoring target network, and each agent may be given an address as a destination of traffic data transmitted from the corresponding monitoring target network. In this case, in the step of transmitting the traffic data to the monitoring device, each of the plurality of monitored devices transmits the traffic data to the monitoring device with the address of the agent corresponding to the monitored network to which the monitored device belongs as the destination. To do.

  In addition, when transmitting data to the monitoring target device of the monitoring target network, processing address data in which the identifier of the monitoring target network is associated with the address used when transmitting to the monitoring target network is read, and the monitoring target network The method may further include a step of transmitting data to an address corresponding to.

  Further, in the step of storing in the traffic accumulation data, when the traffic data is received from the monitoring target device, the monitoring target data in which the identifier of the monitoring target network is associated with the identifier of the monitoring target device belonging to the monitoring target network is read. The identifier of the monitoring target network corresponding to the identifier of the monitoring target device of the transmission source is extracted, and the identifier of the monitoring target network, the address of the monitoring target device, and the received traffic data are associated with each other and stored in the traffic accumulation data. May be.

  Further, the address of the monitoring target device may be an address in a private address space.

  A third feature of the present invention relates to a monitoring program for processing traffic data of a monitoring target device belonging to a monitoring target network. Here, the computer includes a storage device that stores access right data in which a user identifier is associated with an identifier of a monitoring target network to which the user can refer to traffic analysis data. According to a third aspect of the present invention, a monitoring program receives traffic data from a monitoring target device belonging to a monitoring target network, associates the identifier of the monitoring target network with the received traffic data, and accumulates traffic. Analysis that extracts traffic data for each monitored network from processing means that stores data and accumulated traffic data, and stores traffic analysis data generated from the extracted traffic data in association with the identifier of the monitored network When the analysis data reference request is input together with the means and the user identifier, the traffic analysis data associated with the monitored network identifier corresponding to the input user identifier is output based on the access right data. Provide analysis To function as a stage.

ADVANTAGE OF THE INVENTION According to this invention, the monitoring control apparatus, monitoring apparatus, monitoring system, and monitoring program which monitor the traffic of a some communication network can be provided.

It is a figure explaining the system configuration | structure of the monitoring system which concerns on embodiment of this invention. It is a sequence diagram explaining the process in the case of transmitting traffic data from the monitoring object network in the monitoring system which concerns on embodiment of this invention. In the monitoring system which concerns on embodiment of this invention, it is a sequence diagram explaining the process in the case of transmitting downlink data from a monitoring apparatus to a monitoring object network. It is a figure explaining the hardware constitutions and functional block of the monitoring apparatus which concerns on embodiment of this invention. It is a figure explaining an example of data structure and data of monitoring object data concerning an embodiment of the invention. It is a figure explaining an example of a data structure and data of processing address data concerning an embodiment of the invention. It is a figure explaining an example of a data structure and data of traffic accumulation data concerning an embodiment of the invention. It is a figure explaining an example of a data structure and data of access right data concerning an embodiment of the invention.

  Next, embodiments of the present invention will be described with reference to the drawings. In the following description of the drawings, the same or similar parts are denoted by the same or similar reference numerals.

(Monitoring system)
A monitoring system 3 according to an embodiment of the present invention will be described with reference to FIG. The monitoring system 3 includes a monitoring device 1, a monitoring control device 2, a first monitoring target network 10a, a second monitoring target network 10b, a first terminal 21a, a second terminal 21b, a third terminal 21c, and a fourth. Terminal 21d. In the example illustrated in FIG. 1, a case is described in which the monitoring device 1 monitors two networks, the first monitoring target network 10a and the second monitoring target network 10b, but the number of networks monitored by the monitoring device 1 is as follows. Not limited to this.

  The monitoring device 1 and the monitoring control device 2 are connected so that they can communicate with each other. The monitoring apparatus 1 is connected to the first monitoring target network 10a via the first encryption network 15a so as to be able to communicate with each other, and is connected to the second monitoring target via the second encryption network 15b. The network 10b is connected to be communicable with each other. These monitored networks are owned by individual users or under different management, and may be, for example, a corporate intranet or a public network provided by a communication company.

  In the embodiment of the present invention, when the first monitoring target network 10a and the second monitoring target network 10b are not particularly distinguished, they may be simply referred to as the monitoring target network 10. In addition, when the first terminal 21a, the second terminal 21b, the third terminal 21c, and the fourth terminal 21d are not particularly distinguished, they may be simply referred to as the terminal 21. When the first encryption network 15a and the second encryption network 15b are not particularly distinguished, they may be simply referred to as the encryption network 15.

  The encryption network 15 is a secure communication path secured using an existing virtual leased line technology such as VPN. More specifically, the encryption network 15 can use a protocol for encryption communication such as IPSec. In the monitoring system 3 according to the embodiment of the present invention, the monitoring target network 10 and the monitoring device 1 are connected by the encryption network 15. Thereby, the monitoring device 1 is installed outside the monitoring target network 10, and the monitoring device 1 realizes monitoring of the plurality of monitoring target networks 10.

  In the embodiment of the present invention, the encrypted network 15 transmits only the traffic data related to the header portion of the data without transmitting the actual data of the data communication. Therefore, the encryption network 15 only needs to have a security level suitable for transmission of traffic data that does not include actual data.

  In the monitoring system 3 according to the embodiment of the present invention, the monitoring device 1 processes the traffic data of the monitoring target device 11 belonging to the monitoring target network 10. The monitoring device 1 is implemented by a server on a so-called network cloud, and collects and monitors traffic data of each of a plurality of monitoring target devices 11 in the plurality of monitoring target networks 10. The monitoring device 1 may be a physically single server, or may be a server in which a plurality of devices are physically configured in the cloud. The monitoring device 1 is realized by installing a software program for executing predetermined processing on such a server.

  The monitoring control device 2 is a device managed by a business operator that provides a monitoring service for the monitoring target network 10 in the monitoring system 3. The monitoring control device 2 inputs instructions such as various settings of the monitoring device 1 and responses to abnormalities, and displays management-related information such as display of the operating status of the monitoring device 1. In addition, when a monitoring target network 10 or a monitoring target device 11 is newly added, the monitoring control device 2 inputs the information to the monitoring device 1. The monitoring device 1 updates data or increases the number of agents based on the input information. As described above, the monitoring control device 2 is responsible for manually inputting / outputting data to / from the monitoring device 1 and can easily realize setting management of the monitoring device 1 using the GUI.

  The monitoring target network 10 is monitored by the monitoring device 1 by providing a communication network service to the terminal 21 and transmitting traffic data.

  The first monitoring target network 10a includes a first monitoring target device 11a and a first relay device 14a. The first monitoring target network 10a may include a plurality of other monitoring target devices. The first monitoring target device 11a and these monitoring target devices are devices to be monitored for traffic by the monitoring device 1, and are, for example, routers. The first monitoring target device 11a of the first monitoring target network 10a and these monitoring target devices use addresses “NWD — 11”, “NWD — 12”, and “NWD — 13” when transmitting and receiving to and from the monitoring device 1, respectively. The addresses “NWD — 11”, “NWD — 12”, and “NWD — 13” are addresses uniquely identified in the first monitored network 10a.

  The first relay device 14 a is a device that relays traffic data when the first monitoring target device 11 a and these monitoring target devices transmit traffic data to the monitoring device 1, respectively. When receiving the traffic data addressed to the monitoring device 1 from each monitoring target device, the first relay device 14a encrypts the data with a predetermined algorithm and sends the data to the first encrypted network 15a. Further, when the first relay device 14a receives from the monitoring device 1 data destined for each monitored device in the first monitored network 10a, the first relay device 14a decrypts the data with a predetermined algorithm and transmits it to each monitored device.

  Each device of the second monitored network 10b also has the same configuration as each device of the first monitored network 10a. The second monitoring target device 11b of the second monitoring target network 10b and these monitoring target devices use addresses “NWD — 21”, “NWD — 22”, and “NWD — 23” when transmitting and receiving to and from the monitoring device 1, respectively. The addresses “NWD — 21”, “NWD — 22”, and “NWD — 23” are addresses uniquely identified in the second monitored network 10b.

  In the embodiment of the present invention, when the first relay device 14a of the first monitored network 10a and the second relay device 14b of the second monitored network 10b are not distinguished, they are simply described as the relay device 14. There is a case. In addition, when the first monitoring target device 11a, the second monitoring target device 11b, and other monitoring target devices are not particularly distinguished, they may be simply referred to as the monitoring target device 11.

  Each monitored device 11 may be given a plurality of addresses. When providing a network service to the terminal 21, each monitored device 11 uses, for example, a global address for the front side network in order to provide the network service. When transmitting traffic data or the like to the monitoring device 1, the monitored device 11 uses, for example, a private address for the back side network.

  In the embodiment of the present invention, it is assumed that the address of the monitoring target device 11 viewed from the monitoring target device 11 side can be uniquely identified at least within each monitoring target network 10. The monitoring system 3 according to the embodiment of the present invention is an address uniquely identified in one predetermined monitoring target network 10, and even if there are overlapping addresses in the plurality of monitoring target networks 10, Can respond.

  The relay device 14 collects traffic data of each node from each node in the monitoring target network 10. The traffic data includes, for example, (1) the number of packets passing through each monitored device 11, (2) statistical information such as the number of packets for each source address or destination address, and (3) the header information of all packets. It is one or more of a part or all of (4) part or all of the header information of a partially sampled packet among the packets passing through each monitored device 11.

  As a method for collecting the traffic data, it is possible to use an existing network analysis management protocol such as NetFlow or sFlow. Monitored devices 11 that support these protocols are also widespread. Each monitoring target device 11 generates traffic data according to a predetermined procedure, and inputs the traffic data to the monitoring device 1 via the encryption network 15. At this time, for example, each monitoring target device 11 samples a packet passing through the node at a predetermined sampling rate, and further generates only header information of the sampled packet as traffic data. Here, the relay device 14 may input the header information of the packet as it is to the monitoring device 1 as traffic data, or the traffic data generated by analyzing or encrypting the header information is sent to the monitoring device 1. You may enter.

  Here, the sampling rate of the monitoring target device 11 of the monitoring target network 10 is appropriately set as appropriate. For example, the sampling rate is determined within a range in which the quality of traffic monitoring is maintained depending on the amount of traffic flowing through the monitoring target device 11, the capacity of the encryption network 15, the nature of the monitoring target network, the request from the user, and the like. When the sampling rate is low, it is impossible to follow a steep change in traffic, and the quality of traffic monitoring deteriorates. For this reason, the sampling rate of the monitoring target device 11 of the monitoring target network 10 in which a sudden traffic change is assumed, or the monitoring target device 11 of the monitoring target network 10 that needs to respond immediately to a traffic abnormality such as a failure or hacking, Set high. Thereby, monitoring quality can be improved. On the other hand, when the purpose is to monitor long-term traffic fluctuations such as seasonal traffic fluctuations, the sampling rate is set low for the nodes of the monitoring target network 10. Thereby, long-term fluctuation monitoring can be handled at low cost.

  The terminal 21 is a user terminal of the monitoring target network 10. The terminal 21 may be connected to the monitoring device 1 via the monitoring target network 10 or may be connected to the monitoring device 1 via a communication network different from the monitoring target network 10. The terminal 21 enjoys the service of the front side network provided by the monitored network. Furthermore, the terminal 21 may browse the traffic analysis data 144 of the monitoring target network 10 to which the user has access rights depending on the attribute of the user who operates the terminal 21. For example, it is assumed that the first monitored network 10a and the second monitored network 10b are networks managed by the same company, one being an American network and the other being a Japanese network. When the user of the first terminal 21a can view the traffic analysis data 144 of both the US and Japanese networks, the monitoring device 1 provides both of the traffic analysis data 144 to the first terminal 21a. When the third terminal 21c can browse only one of the traffic analysis data 144, the monitoring device 1 provides the traffic analysis data 144 that can be browsed to the third terminal 21c.

(Monitoring method)
The monitoring method according to the embodiment of the present invention will be described with reference to FIGS.

  In FIG. 2, the traffic data of the first monitored device 11a of the first monitored network 10a and the traffic data of the second monitored device 11b of the second monitored network 10b are transmitted to the monitoring device 1. The case where it does is demonstrated. Here, the first monitoring target device 11a of the first monitoring target network 10a uses the address “NWD — 11” when connecting to the monitoring device 1. The second monitoring target device 11b of the second monitoring target network 10b uses the address “NWD — 21” when connecting to the monitoring device 1.

  In addition, the monitoring device 1 includes a first processing unit 121a and a second processing unit 121b. The address “NWP_1” is assigned to the first processing unit 121a, and the first processing unit 121a processes the traffic data of the first monitored network 10a. The address “NWP_2” is assigned to the second processing unit 121b, and the second processing unit 121b processes the traffic data of the second monitored network 10b.

  First, in step S101, the first monitoring target device 11a transmits traffic data to the first relay device 14a. At this time, the source address of the traffic data is “NWD — 11” and the destination address is “NWP — 1”. This traffic data is data of the header part of the traffic of the first monitoring target device 11a, or data obtained by sampling or analyzing the header part.

  When the first relay device 14a of the first monitored network 10a receives traffic data from the first monitored device 11a, in step S102, the first relay device 14a encrypts the received traffic data. In step S103, the first relay device 14a transmits the encrypted traffic data to the monitoring device 1 via the first encrypted network 15a.

  When the monitoring device 1 receives the encrypted traffic data from the first monitored network 10a, the transmission / reception means 100 decrypts the data in step S104. In step S105, the transmission / reception unit 100 inputs the decrypted data to the first processing unit 121a corresponding to the destination address “NWP_1” of the received data.

  When the first processing unit 121a receives the decrypted data, the first processing unit 121a stores the data in the traffic accumulation data 143 in step S106. The first processing unit 121a associates the identifier of the first monitoring target network 10a with the address “NWD_11” of the first monitoring target device 11a and the received traffic data, and stores them in the traffic accumulation data 143. .

  In step S107, the second monitoring target device 11b transmits the traffic data to the second relay device 14b. At this time, the source address of the traffic data is “NWD — 21” and the destination address is “NWP — 2”. This traffic data is data of the header part of the traffic of the second monitoring target device 11b, or data obtained by sampling or analyzing the header part.

  When the second relay device 14b of the second monitored network 10b receives the traffic data from the second monitored device 11b, in step S108, the second relay device 14b encrypts the received traffic data. In step S109, the second relay device 14b transmits the encrypted traffic data to the monitoring device 1 via the second encrypted network 15b.

  When the monitoring device 1 receives the encrypted traffic data from the second monitoring target network 10b, the transmission / reception means 100 decrypts the data in step S110. In step S111, the transmission / reception unit 100 inputs the decrypted data to the second processing unit 121b corresponding to the destination address “NWP_2” of the received data.

  When receiving the decrypted data, the second processing unit 121b stores the data in the traffic accumulation data 143. The second processing unit 121b associates the identifier of the second monitoring target network 10b with the address “NWD — 21” of the second monitoring target device 11b and the received traffic data, and stores them in the traffic accumulation data 143. .

  With reference to FIG. 3, the case where the monitoring apparatus 1 transmits downlink data to the first monitoring target device 11a and the second monitoring target device 11b will be described. In the example shown in FIG. 3, the transmission / reception means 100 of the monitoring apparatus 1 includes a first transmission means 102a and a second transmission means 102b. The first transmission means 102a is given an address “RD_1” for transmission to the first monitored network 10a. The second transmission means 102b is given an address “RD_2” for transmission to the second monitored network 10b. The downlink data is, for example, information such as a sampling rate and header analysis method in the monitoring target device 11.

  First, when transmitting the downlink data to the first monitored device 11a of the first monitored network 10a, the first processing unit 121a designates “NWD — 11” as the destination address in step S201, To the transmission means 102a. In step S202, the first transmission means 102a encrypts the input downlink data and transmits it to the first relay device 14a via the first encryption network 15a in step S203.

  When receiving the encrypted downlink data from the monitoring device 1, the first relay device 14a decrypts the data in step S204. Further, in step S205, the first relay device 14a inputs the decoded downlink data to the first monitoring target device 11a corresponding to the destination address “NWD_11”. The first monitoring target device 11a performs processing such as changing the sampling rate based on the received downlink data.

  In addition, when the second processing unit 121b transmits downlink data to the second monitored device 11b of the second monitored network 10b, the second processing unit 121b specifies “NWD — 21” as the destination address in step S206, and sets the second data To the transmission means 102b. In step S207, the second transmission means 102b encrypts the input downlink data and transmits it to the second relay device 14b via the second encryption network 15b in step S208.

  When receiving the encrypted downlink data from the monitoring device 1, the second relay device 14b decrypts the data in step S209. Further, in step S210, the second relay device 14b inputs the decoded downlink data to the second monitoring target device 11b corresponding to the destination address “NWD — 21”. The second monitoring target device 11b performs processing such as changing the sampling rate based on the received downlink data.

  2 and FIG. 3 are implementation examples that can cope with the case where the addresses of the monitoring target devices 11 as viewed from the monitoring device 1 overlap, specifically, the case where “NWD — 11” and “NWD — 21” are the same. . In the example illustrated in FIG. 2, each monitoring target device 11 specifies, as a destination, an address given to a processing unit that processes the monitoring target network 10 to which the monitoring target device 11 belongs. In the example shown in FIG. 3, the transmission / reception means 100 has a transmission means for each monitored network 10, and each processing means inputs downlink data to a predetermined transmission means. The embodiment of the present invention can solve the duplication of the address of the monitoring target device 11 and collect the traffic data for each monitoring target network 10.

(Monitoring device)
With reference to FIG. 4, the monitoring apparatus 1 which concerns on embodiment of this invention is demonstrated. The monitoring device 1 is a general computer that includes a central processing control device 120, a storage device 140, and transmission / reception means 100. The transmission / reception unit 100 may be a unit that virtualizes transmission / reception devices such as communication interfaces.

  The storage device 140 stores a monitoring program and also stores monitoring target data 141, processing address data 142, traffic accumulation data 143, traffic analysis data, and access right data 145.

  The monitoring target data 141 is data in which the identifier of the monitoring target network 10 is associated with the identifier of the monitoring target device 11 belonging to the monitoring target network 10. As shown in FIG. 5, the monitoring target data 141 stores the monitoring target network ID “NW_1” and the monitoring target device ID “NWD — 11” belonging to this network in association with each other. In the example shown in FIG. 5, the monitoring target network ID “NW_1” is an identifier of the first monitoring target network ID shown in FIG. 1, and the monitoring target device ID “NWD — 11” is the first monitoring target shown in FIG. This is the address of the device 11a.

  The processing address data 142 is data that the monitoring device 1 refers to when transmitting / receiving data to / from each monitoring target network 10. The processing address data 142 associates an address used when processing upstream data with an address used when processing downstream data, using the identifier of the monitored network 10 as a key.

  Here, the uplink processing address used when processing the uplink data is the destination address of the traffic data transmitted from the monitored device 11. This upstream address is an address assigned to the processing means for processing the traffic data of the monitored network 10 to which the monitored device 11 belongs. The uplink processing address is also held by the monitoring target device 11 of the corresponding monitoring target network 10. Specifically, the first processing unit 121a processes the traffic of the first monitoring target device 11a of the first monitoring target network 10a. Therefore, the address “NWP_1” of the first processing unit 121a is associated with the first monitoring target network “NW_1”. The first monitored device 11a holds the address “NWP_1” of the first processing unit 121a in advance, and transmits traffic data to the first processing unit 121a using this address.

  The downlink processing address used when processing downlink data is the identifier of the monitoring target network 10 and the address of the transmission / reception means 100 used when transmitting to the monitoring target network 10. Specifically, when transmitting downlink data to the first monitoring target device 11a of the first monitoring target network 10a, the first processing unit 121a transmits the downlink data to the first transmission unit 102a of the transmission / reception unit 100. input. Therefore, the address “RD_1” of the first transmission unit 102a is associated with the first monitoring target network “NW_1”.

  The traffic accumulation data 143 is data in which the traffic data received from the monitored device 11 is associated with the identifier of the monitored device 11 and the identifier of the monitored network 10 to which the monitored device 11 belongs. As shown in FIG. 7, the traffic accumulation data 143 stores the monitoring target network ID “NW_1”, the monitoring target device ID “NWE — 12”, and the traffic data received from the monitoring target device 11 in association with each other. The monitoring target network ID “NW_1” is an identifier of the first monitoring target network 10a shown in FIG. The monitoring target device ID “NWD — 11” is the address of the monitoring target device 11 belonging to the first monitoring target network 10a shown in FIG. The traffic accumulation data 143 may further associate the reception time of the traffic data in order to identify each record.

  The traffic analysis data 144 is data obtained by analyzing the traffic data stored in the traffic storage data 143 for each monitoring target network 10. Therefore, the traffic analysis data 144 associates the identifier of the monitoring target network 10 with the analysis data of the monitoring target network 10. The analysis data is generated from the traffic data of the monitoring target device 11 belonging to the monitoring target network 10.

  The access right data 145 is referred to in order to output the traffic analysis data 144 that can be referred to based on the access right of the inquired user when receiving an inquiry to refer to the traffic analysis data 144. As shown in FIG. 8, the access right data 145 is data in which a user ID is associated with a network ID that can be referred to by the user. Here, the network ID is an identifier of the monitoring target network 10. In the example illustrated in FIG. 8, the user with the user ID “UID — 001” can refer to only the traffic analysis data 144 related to the first monitoring target network 10a. This indicates that the user with the user ID “UID — 003” can refer to the traffic analysis data 144 regarding the first monitoring target network 10a and the second monitoring target network 10b.

  The transmission / reception unit 100 receives a connection from the monitoring target network 10 and inputs the connection to the processing unit 121, and returns the processing result of the processing unit 121. The transmission / reception unit 100 includes a reception unit 101, a first transmission unit 102a, a second transmission unit 102b,..., An nth transmission unit 102n.

  The receiving unit 101 inputs the data received from the monitoring target network 10 to the processing unit 121 according to the destination. Specifically, since the destination of the traffic data received from the monitored device 11 of the first monitored network 10a via the first encrypted network 15a is the first processing unit 121a, the received traffic Data is input to the first processing means 121a. Similarly, the receiving unit 101 inputs one of the first processing unit 121a, the second processing unit 121b,..., And the nth processing unit 121n according to the destination of the received traffic data.

  Here, when encrypted traffic data is transmitted from each monitored network 10, the receiving unit 101 decrypts and inputs the decrypted traffic data to the processing unit.

  The first transmission unit 102a transmits the data input from the central processing control device 120 to the first monitoring target network 10a via the first encryption network 15a. As the destination of the data transmitted by the first transmission unit 102a, the address of any one of the monitoring target devices 11 belonging to the first monitoring target network 10a is set. The monitored network 10 transmits the data received via the first processing unit 121a, the first transmitting unit 102a, and the first encrypted network 15a to the monitored device 11 according to the destination. In the processing address data 142 shown in FIG. 6, the first transmission means 102a is associated with the address “RD_1”.

  The same applies to the second transmission unit 102b and other transmission units.

  Here, the processing of the receiving means 101, the first transmitting means 102a, the second transmitting means 102b,..., The nth transmitting means 102n of the transmitting / receiving means 100 may not be physically separate means, but logically. It does not matter even if it is set to. For example, it may be realized by a virtualization technique, or the processing of each unit may be realized by distributing one transmission / reception device in terms of time.

  In addition, when encrypted data is transmitted from each monitoring target network 10, the transmission / reception unit 100 decrypts and inputs the decrypted data to the processing unit 121. Further, the transmission / reception unit 100 encrypts the data output from the processing unit 121 as necessary, and transmits the encrypted data to each monitored network 10.

  The control device interface 150 is an interface for the monitoring device 1 to communicate with the monitoring control device 2. The control device interface 150 inputs information input from the monitoring control device 2 to the central processing control device 120.

  The analysis providing interface 160 is an interface for the monitoring apparatus 1 to communicate with the terminal 21. Here, the terminal 21 can refer to the traffic analysis data 144 of the monitored network 10 that can be browsed by the user using the terminal 21 via the analysis providing interface 160. Here, the monitoring device 1 may provide a portal site accessible by the terminal 21 and allow the user to log in via the portal site to provide the traffic analysis data 144 according to the access right of the user.

  The central processing control device 120 includes processing means 121, analysis means 122, and analysis providing means 123.

  The processing unit 121 receives traffic data from the monitoring target device 11 belonging to the monitoring target network 10, and stores the traffic data by associating the identifier of the monitoring target network 10, the address of the monitoring target device 11, and the received traffic data. Store in data 143. Here, in the embodiment of the present invention, when the traffic data is received from the monitoring target device 11, the processing unit 121 reads the monitoring target data 141 and monitors the monitoring target network 10 corresponding to the identifier of the transmission source monitoring target device 11. Extract the identifier of. The processing unit 121 stores the identifier of the monitoring target network 10, the address of the monitoring target device 11 of the transmission source, and the received traffic data in the traffic accumulation data 143 in association with each other. This method is suitable when traffic data is received from the monitored device 11 whose address does not overlap with that of the other monitored device 11.

  In the embodiment of the present invention, the processing unit 121 includes an agent for each monitored network 10, and each agent is given an address as a destination of traffic data transmitted from the corresponding monitored network 10. Here, the address given to each agent may be an IP address or a combination of an IP address and a port number. It suffices if the monitoring target device 11 can uniquely identify the destination when the traffic data is transmitted.

  Specifically, the processing unit 121 includes a plurality of agents such as a first processing unit 121a, a second processing unit 121b,... An nth processing unit 121n. Here, each process of the first processing unit 121a, the second processing unit 121b,..., The n-th processing unit 121n of the processing unit 121 does not have to be a physically separate unit and is logically set. It doesn't matter. For example, the processing of each unit may be realized by sorting and executing in time.

  The first processing unit 121a receives traffic data of the monitoring target device 11 belonging to the first monitoring target network 10a. In the embodiment of the present invention, the address “NWP_1” is assigned to the first processing means 121a. The monitored device 11 belonging to the first monitored network 10a transmits the traffic data to the address “NWP_1”, so that the first processing unit 121a causes the monitored device 11 of the first monitored network 10a. Receive traffic data sent by. The first processing unit 121a associates the received traffic data with the identifier of the first monitoring target network 10a, the identifier of the monitoring target device 11 of the transmission source, and the received traffic data. Store in the accumulated data 143. Here, the identifier of the transmission source first monitoring target device 11a may be a private address that can be uniquely identified in the first monitoring target network 10a. The first processing unit 121a can uniquely identify all the monitoring target devices 11 of the monitoring device 1 by associating the identifier of the first monitoring target network 10a with such a private address.

  The second processing unit 121b receives the traffic data of the monitoring target device belonging to the second monitoring target network 10b. In the embodiment of the present invention, the address “NWP_2” is assigned to the second processing unit 121b. The monitored device 11 belonging to the second monitored network 10b transmits the traffic data to the address “NWP_2”, whereby the second processing unit 121b causes the monitored device 11 of the second monitored network 10b to be monitored. Receive traffic data sent by. The second processing unit 121b associates the received traffic data with the identifier of the second monitoring target network 10b, the identifier of the monitoring target device 11 of the transmission source, and the received traffic data. Store in the accumulated data 143. Here, the identifier of the transmission target monitored device 11 may be a private address that can be uniquely identified in the second monitored network 10b. The second processing unit 121b can uniquely identify all the monitoring target devices 11 of the monitoring apparatus 1 by associating the identifier of the second monitoring target network 10b with such a private address.

  For example, in the example illustrated in FIG. 1, the first monitoring target device 11a of the first monitoring target network 10a is assigned the address “NWD — 11”, and the second monitoring target device 11b of the second monitoring target network 10b is An address “NWD — 21” is assigned. Here, consider a case where the addresses “NWD — 11” and “NWD — 21” are the same. Even if the monitoring apparatus 1 receives traffic data from such a monitoring target device 11, it cannot determine from which monitoring target device the same transmission source address is received.

  Therefore, the first monitored device 11a belonging to the first monitored network 10a transmits the traffic data to the first processing unit 121a. As a result, the monitoring apparatus 1 can recognize that the first processing unit 121a receives the traffic data and the transmission source of the traffic data is the first monitoring target device 11a belonging to the first monitoring target network 10a. it can. The same applies to the second monitored device 11b belonging to the second monitored network 10b. The second monitored device 11b belonging to the second monitored network 10a transmits the traffic data to the second processing unit 121b. Thereby, the monitoring apparatus 1 can grasp | ascertain the transmission source of the traffic data which the 2nd process means 121b received as the 2nd monitoring object apparatus 11b which belongs to the 2nd monitoring object network 10b.

  Furthermore, the processing unit 121 associates the identifier of the monitoring target network 10 to which the monitoring target device 11 belongs with the address of the monitoring target device 11 that is the transmission source of the traffic data, and stores them in the traffic accumulation data. Thereby, even when the addresses of the monitoring target devices 11 are duplicated, it is possible to uniquely identify which monitoring target device 11 outputs the traffic data in the traffic accumulation data 143.

  As described above, the method in which the processing unit 121 includes a plurality of agents is suitable for receiving traffic data from the monitoring target device 11 having the same address as that of the other monitoring target device 11. As another embodiment, a method in which the processing unit 121 includes a plurality of agents for processing regardless of the presence or absence of address duplication with other monitored devices 11 may be applied.

  When the processing unit 121 transmits data to the monitoring target device 11, the first processing unit 121 a, the second processing unit 121 b,..., The nth processing unit 121 n is monitored by the monitoring target device 11 of each monitoring target network 10. To enter. For example, when an abnormality occurs in the monitoring target network 10 by the analysis unit 122 described later, the processing unit 121 transmits alarm information to the administrator of the monitoring target network 10. Further, in response to a request from a terminal 21 belonging to each monitored network 10, the processing unit 121 provides traffic analysis data 144 that can be viewed on the terminal 21. Further, the processing unit 121 transmits data such as a sampling rate setting instruction for obtaining appropriate traffic data to the monitoring target device 11 of the monitoring target network 10.

  When such a processing unit 121 transmits data to the monitoring target device 11 of the monitoring target network 10, the processing address data 142 is read and the data is transmitted to an address corresponding to the monitoring target network. Specifically, when the first processing unit 121a transmits data to the first monitoring target device 11a of the first monitoring target network 10a, the processing address data 142 corresponds to the first monitoring target network 10a. The downstream processing address “RD_1” is extracted. The first processing unit 121a inputs data to the transmission unit corresponding to the address “RD_1” of the transmission / reception unit 100, specifically, the first transmission unit 102a. When data is input to the first transmission unit 102a, the first transmission unit 102a transmits the data to the first monitoring target network 10a via the first encryption network 15a.

  The analysis unit 122 analyzes the traffic data collected by the processing unit 121 for each monitoring target network and stores the traffic data in the traffic analysis data 144. The analysis unit 122 extracts traffic data for each monitoring target network 10 from the traffic accumulation data 143, and stores the traffic analysis data 144 generated from the extracted traffic data in association with the identifier of the monitoring target network 10. The analysis unit 122 extracts the traffic data associated with the identifier of the first monitoring target network 10a from the traffic accumulation data 143, and analyzes it by a predetermined method. The traffic analysis data 144 obtained as a result is stored in the storage device 140 in association with the identifier of the first monitoring target network 10a.

  The analysis unit 122 can be used as basic data for new network design by analyzing various types of traffic fluctuations. The analysis unit 122 can also obtain a traffic pattern according to the type of failure or hacking by accumulating data and analyzing the pattern when the traffic is abnormal. The traffic analysis data 144 output in this way can be expected to have a wide range of applications, for example, for use in demand fluctuation prediction.

  When an analysis data reference request is input together with a user identifier, the analysis providing unit 123 is configured to receive traffic associated with the identifier of the monitoring target network 10 corresponding to the input user identifier based on the access right data 145. The analysis data 144 is output. In the example shown in FIG. 8, when there is a reference request from the user with the user ID “UID — 001”, the analysis providing unit 123 provides only the traffic analysis data 144 related to the first monitored network 10a. When there is a reference request from the user with the user ID “UID_003”, the analysis providing unit 123 provides the traffic analysis data 144 regarding the first monitored network 10a and the second monitored network 10b.

  Such a monitoring system 3 according to the embodiment of the present invention collects traffic information of a plurality of monitoring target devices 11 in each of the plurality of monitoring target networks 10 in the monitoring device 1 on the server on the network. Further, the monitoring system 3 monitors the monitoring target network 10 by collecting and analyzing the traffic of the plurality of monitoring target devices 11 belonging to the predetermined monitoring target network 10 in units of the monitoring target network 10.

  In such a monitoring system 3 according to the embodiment of the present invention, a single monitoring device 1 can monitor a plurality of monitoring target networks 10. Compared to the case where one monitoring device is required for each individual monitoring target network 10 as in the prior art, the introduction cost can be reduced for the user of the monitoring target network 10 compared to the conventional case. In addition, the monitoring system 3 according to the embodiment of the present invention does not require easy hardware and software for a conventional monitoring device, and can reduce maintenance costs.

  Further, the monitoring target device 11 of the monitoring target network 10 sends only header information and header analysis information without including actual data related to the user's communication contents. Thereby, traffic data can be transmitted to the monitoring apparatus 1 outside the monitoring target network 10 by realizing the security between the monitoring target network 10 and the monitoring apparatus 1 with a relatively inexpensive security system. Accordingly, the business operator can provide the service at a low cost while ensuring the security required by the user.

  In addition, since the provider who provides the monitoring apparatus 1 can monitor a plurality of monitoring target networks 10 in a centralized manner, it can be expected that the operation cost and the maintenance cost are greatly reduced. Further, by collecting and collecting traffic data from a plurality of networks, the monitoring device 1 can easily analyze a large amount of communication traffic data. Thereby, it becomes possible to contribute to basic data for new network design.

  As described above, the monitoring system 3 according to the embodiment of the present invention can be expected to have a great effect that cannot be obtained by the conventional technology for both the user of the monitoring target network 10 and the service provider.

(Modification)
In the embodiment of the present invention, the case has been described in which the address of the monitoring target device 11 of each monitoring target network 10 may be duplicated across the monitoring target network 10 in the private address space. On the other hand, in the modified example, a case where the addresses of the monitoring target devices 11 do not overlap will be described.

  In the modification of the present invention, it is assumed that the addresses “NWD — 11”, “NWD — 12”, “NWD — 13”, “NWD — 21”, “NWD — 22”, and “NWD — 23” in the example shown in FIG. Further, in the modification of the present invention, as shown in FIG. 4, the transmission / reception unit 100 does not need to include a plurality of virtualization units, and the processing unit 121 does not need to include a plurality of agents. In the modification, it is sufficient that one address is given to the monitoring device 1.

  The monitoring target device 11 of the monitoring target network 10 sets the address of the monitoring device 1 as a destination address and transmits traffic data. When receiving the traffic data from the monitoring target device 11, the processing unit 121 of the monitoring device 1 reads the monitoring target data 141 and extracts the identifier of the monitoring target network 10 corresponding to the identifier of the transmission source monitoring target device 11. Further, the processing unit 121 stores the identifier of the monitoring target network 10, the address of the monitoring target device, and the received traffic data in association with each other in the traffic accumulation data 143.

  Further, when the monitoring apparatus 1 transmits data to the monitoring target device 11, the data may be transmitted to the address of the monitoring target device 11 via the transmission / reception unit 100.

  As another embodiment, when the monitoring apparatus 1 and the monitoring target network 10 are connected by VPN, the processing unit 121 identifies the monitoring target network 10 of the transmission source by the identifier of the VPN to which the data is transmitted. May be. Specifically, when the processing unit 121 receives traffic data via the first encrypted network 15a, the processing unit 121 can recognize that the transmission-target monitored device 11 belongs to the first monitored network 10a. it can. Further, when the monitoring device 1 transmits data to the monitoring target device 11, the data may be transmitted to the address of the monitoring target device 11 via the transmission / reception unit 100.

(Other embodiments)
As described above, the embodiments of the present invention have been described. However, it should not be understood that the descriptions and drawings constituting a part of this disclosure limit the present invention. From this disclosure, various alternative embodiments, examples, and operational techniques will be apparent to those skilled in the art.

  For example, the service control apparatus described in the embodiment of the present invention may be configured on a single piece of hardware as shown in FIG. 3, or may be configured on a plurality of pieces of hardware according to the functions and the number of processes. May be.

  It goes without saying that the present invention includes various embodiments not described herein. Therefore, the technical scope of the present invention is defined only by the invention specifying matters according to the scope of claims reasonable from the above description.

DESCRIPTION OF SYMBOLS 1 Monitoring apparatus 2 Monitoring control apparatus 3 Monitoring system 10 Monitoring target network 11 Monitoring target apparatus 14 Relay apparatus 15 Encryption network 21 Terminal 100 Transmission / reception means 101 Reception means 102 Transmission means 120 Central processing control apparatus 121 Processing means 122 Analysis means 123 Analysis provision Means 140 Storage device 141 Monitored data 142 Processing address data 143 Traffic accumulation data 144 Traffic analysis data 145 Access right data

Claims (10)

A monitor control device connected to a monitoring device for processing traffic data for a plurality of the plurality respectively belonging to the monitored network monitoring target device,
The monitoring device
A storage device that stores access right data in which a user identifier is associated with an identifier of a monitored network to which the user can refer to traffic analysis data;
Receives traffic data from said plurality of monitored devices belonging to each of the plurality of the monitored network, and processing means for storing the traffic stored data and the identifier of the monitored network, and a traffic data received in association with,
Analyzing means for extracting the traffic data for each monitored network from the traffic accumulation data, and storing traffic analysis data generated from the extracted traffic data in association with an identifier of the monitored network;
When the analysis data reference request is inputted together with the user identifier, the analysis provision is made to output the traffic analysis data associated with the identifier of the monitored network corresponding to the inputted user identifier based on the access right data. Means and
The monitoring and control apparatus inputs the newly added monitoring target network data or monitoring target device data to the monitoring apparatus. The processing means of the monitoring device includes an agent for each monitored network,
The monitoring control apparatus according to claim 1, wherein each agent is assigned an address that is a destination of traffic data transmitted from a corresponding monitoring target network. The storage device of the monitoring device stores processing address data in which an identifier of a monitoring target network is associated with an address used when transmitting to the monitoring target network,
The processing means of the monitoring device reads the processing address data and transmits the data to an address corresponding to the monitoring target network when transmitting data to the monitoring target device of the monitoring target network. The monitoring control device according to claim 1 or 2. The storage device of the monitoring device further stores monitoring target data in which the identifier of the monitoring target network is associated with the identifier of the monitoring target device belonging to the monitoring target network,
When receiving the traffic data from the monitoring target device, the processing unit of the monitoring device reads the monitoring target data, extracts an identifier of the monitoring target network corresponding to the identifier of the transmission source monitoring target device, and The monitoring control device according to any one of claims 1 to 3, wherein the identifier of the target network, the address of the monitoring target device, and the received traffic data are associated with each other and stored in the traffic accumulation data. The monitoring control apparatus according to claim 4, wherein the address of the monitoring target device is an address in a private address space. A monitoring device for processing traffic data of a plurality of monitored devices belonging to each of the plurality of monitored network,
When the monitored network and the monitoring device are connected via a communication path,
A storage device for storing access right data in which a user identifier is associated with an identifier of a communication path connected to a monitoring target network to which the user can refer to traffic analysis data;
Receiving said traffic data from a plurality of said plurality of monitored devices belonging respectively to the monitored network, and stores the traffic data stored in association with the identifier of the channel to be connected to the monitored network, and a traffic data received Processing means;
An analysis for extracting the traffic data for each monitored network from the traffic accumulation data and storing the traffic analysis data generated from the extracted traffic data in association with an identifier of a communication path connected to the monitored network Means,
When the analysis data reference request is input together with the user identifier, the traffic analysis data associated with the identifier of the communication path connected to the monitored network corresponding to the input user identifier based on the access right data An analysis providing means for outputting the monitoring device. A monitoring system comprising a monitoring device, a monitoring control device connected to the monitoring device for processing traffic data of a plurality of monitored devices belonging to each of the plurality of monitored network,
The monitoring device
A storage device that stores access right data in which a user identifier is associated with an identifier of a monitored network to which the user can refer to traffic analysis data;
Receives traffic data from said plurality of monitored devices belonging to each of the plurality of the monitored network, and processing means for storing the traffic stored data and the identifier of the monitored network, and a traffic data received in association with,
Analyzing means for extracting the traffic data for each monitored network from the traffic accumulation data, and storing traffic analysis data generated from the extracted traffic data in association with an identifier of the monitored network;
When the analysis data reference request is inputted together with the user identifier, the analysis provision is made to output the traffic analysis data associated with the identifier of the monitored network corresponding to the inputted user identifier based on the access right data. Means and
The monitoring control apparatus inputs the newly added monitoring target network data or monitoring target device data to the monitoring apparatus. A monitoring device for processing traffic data of a plurality of monitored devices belonging to each of the plurality of monitored network,
Receives traffic data from said plurality of monitored devices belonging to each of the plurality of the monitored network, and processing means for storing the traffic stored data and the identifier of the monitored network, and a traffic data received in association with,
Analyzing means for extracting the traffic data for each monitored network from the traffic accumulation data, and storing traffic analysis data generated from the extracted traffic data in association with an identifier of the monitored network;
A monitoring apparatus comprising: an analysis providing unit that outputs, when an analysis data reference request is inputted, a traffic analysis data to which a user who has input the reference request has an access right. 9. The monitoring apparatus according to claim 8, wherein the traffic data received from the monitoring target device is packet data sampled at a predetermined sampling rate in the monitoring target device. A monitoring program for processing traffic data of a plurality of monitored devices belonging to each of the plurality of monitored network,
Computer
Receives traffic data from said plurality of monitored devices belonging to each of the plurality of the monitored network, and processing means for storing the traffic stored data and the identifier of the monitored network, and a traffic data received in association with,
Analyzing means for extracting the traffic data for each monitored network from the traffic accumulation data, and storing traffic analysis data generated from the extracted traffic data in association with an identifier of the monitored network;
When the analysis data reference request is inputted, the monitoring request program functions as an analysis providing means for outputting traffic analysis data to which a user who has inputted the reference request has access right.

Images