JP6418638B2 - Communication identification method and apparatus - Google Patents

Description

  The present invention relates to a communication identification method and apparatus for identifying communication traffic, and more particularly to a communication identification method and apparatus for identifying communication performed by a communication terminal in the foreground and communication performed in the background.

  A technique for identifying the contents of communication executed by a communication terminal has been studied. Patent Document 1 discloses a technique for calculating periodicity from a time series change of communication traffic volume or data using Fourier transform or the like. Patent Document 2 discloses a technique for identifying and identifying an application (type of communication service) from a flow by measuring and aggregating communication traffic for each flow and applying cepstrum analysis, which is a frequency analysis method, from the traffic characteristics of each flow. Is disclosed.

  Patent Document 3 discloses a technique for measuring and aggregating communication traffic for each flow, calculating feature amounts from traffic characteristics for each flow, and applying machine learning to identify the type (application) of a communication service from the flow. Is disclosed.

  In addition, various services have emerged due to the explosive spread of mobile terminals in recent years, and not only foreground communication caused by terminal user communication request operations, but also applications regardless of terminal user communication request operations. Background communication that communicates with a server or the like at an arbitrary timing convenient for itself has been started.

  Each communication method differs in importance, urgency, data size, tolerance for delay and jitter, influence on the subjective evaluation of the terminal user, and so on, so that each communication method can be used for various purposes if it can be identified.

  However, in Patent Document 1, the purpose is abnormality detection, that is, trend change detection from normal times, and foreground / background communication cannot be identified. Patent Documents 2 and 3 are technologies aimed at identifying applications and communication services, and cannot identify foreground / background communication.

  In response to such a technical problem, the inventors of the present invention classify each session observed on the network into an SD group specific to the combination of the transmission source information and the destination information, and for each SD group. An auto-correlation for the occurrence timing of each session was calculated, and a communication identification device was invented for identifying a session having a high auto-correlation coefficient as background communication, and a patent application (Patent Document 4) was filed.

JP 2010-283668 A JP 2012-105043 A JP 2013-127504 A Japanese Patent Application No. 2014-37083

  According to Patent Document 4, user-derived / led foreground communication and background communication can be identified by low-cost and only a small number of measurement points by passive packet capture.

  However, a TCP / HTTP session may continue for a long time, or may be disconnected at irregular or irregular timing due to disturbances such as network conditions or user movement. In such a case, the session occurrence time and periodicity are destroyed, and the original situation cannot be observed, and therefore the time correlation (periodicity) may not be detected.

  An object of the present invention is to solve the above technical problem and to establish communication between a communication terminal establishing a session in the foreground and a communication establishing a session in the background depending on network conditions or user movement. An object of the present invention is to provide a communication identification method and apparatus capable of accurately identifying even when the periodicity of time is disturbed.

In order to achieve the above object, the present invention is characterized in that a communication identification apparatus for identifying communication traffic as either foreground communication or background communication has the following configuration .

  (1) Means for classifying communication traffic observed on the network into SD groups, means for analyzing time-series fluctuations of traffic characteristics for each SD group, and correlation calculation means for calculating correlation of time-series fluctuations of traffic characteristics And communication identification means for identifying communication traffic based on the correlation of traffic characteristics.

  (2) The correlation calculation means includes an autocorrelation calculation means for calculating the autocorrelation of traffic characteristics for each SD group, and the communication identification means sets communication traffic having an autocorrelation exceeding a predetermined first threshold as background communication. It was made to identify.

  (3) The correlation calculation means includes a cross-correlation calculation means for calculating a cross-correlation between the traffic characteristics of one SD group and the traffic characteristics of communication traffic identified as background communication in the other SD group, The communication identifying means identifies communication traffic whose cross-correlation exceeds a predetermined second threshold as background communication.

  (4) It is provided with characteristic sequence generation means for discretizing the traffic characteristics time series variation for each bin of unit time width to generate a traffic characteristic sequence, and the correlation calculation means calculates the correlation characteristic of the traffic characteristic sequence. .

  (5) The communication identification means makes a new determination for communication traffic that has not been determined to be background communication based on one traffic characteristic, based on the other traffic characteristic, and determines a plurality of scheduled traffic characteristics. Regarding at least one, communication traffic whose correlation exceeds a predetermined threshold is determined as background communication.

According to the present invention, the following effects are achieved.
(1) Of the communications executed by the communication terminal, communication traffic with high autocorrelation of traffic characteristics is identified as background communication that is automatically and mechanically executed by the OS and applications regardless of user operations. Even if the periodicity of the session occurrence time is disturbed due to network conditions or user movement, foreground and background communication originating from the user and background communication can be identified with low cost and a small number of measurement points by passive packet capture become.

  (2) Since communication traffic that has a high cross-correlation with communication traffic identified as background communication and is likely to be background communication can be identified as background communication, background communication can be reliably identified. .

  (3) Even if autocorrelation is low, communication traffic with high cross-correlation is identified as background communication, so communication that repeats session establishment in the same procedure with multiple servers within the same background processing Can be identified as background communication regardless of autocorrelation.

  (4) Since the time series of traffic characteristics is discretized to form a characteristic sequence and the correlation is calculated, quantitative calculation of the correlation coefficient is facilitated.

  (5) Even if the correlation with respect to one traffic characteristic is low, if the correlation with respect to another traffic characteristic is high, it can be identified as background communication. Traffic can also be identified as background communication.

It is the figure which showed the structure of the network to which the communication identification method of this invention is applied. It is the functional block diagram which showed the structure of one Embodiment of a capture apparatus. It is the figure which showed the measuring method of the traffic characteristic in a TCP connection. It is the figure which showed the measuring method of the traffic characteristic in HTTP session. It is the flowchart which showed the calculation procedure of the autocorrelation. It is the flowchart which showed the calculation procedure of the cross correlation. It is the flowchart which showed the 1st communication identification procedure. It is the flowchart which showed the 2nd communication identification procedure.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a network to which the communication identification method of the present invention is applied.

  A radio base station BS is installed in each area of the service providing range, and a radio mobile terminal MN (for example, a smartphone or a tablet terminal) in the area is accommodated in each radio base station BS. Each radio base station BS is connected to a radio access network RAN, and the radio access network RAN is connected to a gateway (GW) of the core network. The core network is connected to the Internet at the Internet Exchange (IX).

  Various servers that provide services in response to requests from each MN are connected to the Internet. In the present embodiment, the capture device 1 as a communication identification device is connected to a line L that connects the radio access network RAN and the core network as a line that can aggregate traffic between each MN and each server.

  FIG. 2 is a functional block diagram showing the configuration of the main part of one embodiment of the capture device 1. Here, the configuration unnecessary for the description of the present invention is omitted. The capture device 1 of the present invention can be configured by mounting an application (program) for realizing each function on a general-purpose computer or server. Alternatively, it can be configured as a dedicated machine or a single-function machine in which a part of the application is implemented in hardware or ROM.

  The communication traffic detection unit 101 captures packets transmitted and received on the line L, and logs various traffic information including the session type (TCP, HTTP, UDP, etc.), transmission source information, and destination information to a log information management unit 102.

  The session classification unit 103 classifies each session into one of the SD groups based on the combination of the transmission source information (S) and the destination information (D). That is, sessions with the same transmission source information (S) and destination information (D) are classified into the same SD group, and different sessions are classified into different SD groups. In this embodiment, a transmission source IP address is adopted as transmission source information, and a destination IP address and a port number are adopted as destination information.

  The occurrence timing of each session is represented by the arrival time of the HTTP Request packet if it is an HTTP session, and is represented by the arrival time of a Syn packet that is sent and received in a three-handshake that is executed when the session is established for a TCP session. If so, it is represented by the arrival time of the packet observed for the first time in the session.

  The traffic characteristic analysis unit 104 calculates the unit traffic characteristic by totaling the traffic information of the same SD group accumulated in the log information management unit 102 for each predetermined time width (bin).

  In this embodiment, as unit traffic characteristics, (1) download (DL) data transfer amount or number of packets, (2) upload (UL) data transfer amount or number of packets, (3) throughput characteristics, (4) various types Traffic delay characteristics (server side RTT delay, client side RTT delay, TCP connection delay, etc.) can be adopted.

  Further, (5) the ratio of DL transfer data amount to UL transfer data amount (DL / UL) and (6) the ratio of DL packet number to UL packet number (DL / UL) can also be adopted as unit traffic characteristics. That is, in the user-driven foreground communication, for example, when browsing the Web, DL such as content browsing is mainly used, so DL / UL >> 1. Also, even with user-initiated communications, DL / UL << 1 because SNS is mainly responsible for uploading images. On the other hand, in background communication, for example, a small amount of data is mainly transmitted and received, and DL / UL≈1. Therefore, these traffic characteristics can be a highly discriminating index.

  Furthermore, (7) ratio of hold time (HoldTime) and response time (RespTime), (8) time-series fluctuation tendency of various traffic characteristics and its statistics (total sum of observed multiple or all bin values) (9) The number of occurrences of a session may be adopted as a unit traffic characteristic. That is, in the user-driven foreground communication, for example, when browsing the Web, the DL time after connection is greater than the connection delay, so the ratio of the hold time to the response time (HoldTime / RespTime) is sufficiently greater than 1. growing. In web browsing, content of various types and sizes are subject to access and acquisition, so the time-series fluctuation of traffic characteristics increases, while background communication has a small amount of data transmission and reception and a push notification standby system. Since it is the main body, time series fluctuations are reduced. Therefore, these traffic characteristics can also be a highly discriminating index.

  The characteristic number sequence generation unit 105 generates a specific number sequence for each SD group using the unit traffic characteristics obtained for each bin as time-series elements. The correlation calculation unit 106 generates an autocorrelation unit 106a that calculates an autocorrelation (intra-SD group autocorrelation coefficient) of a traffic characteristic sequence generated for each SD group, and is generated for each SD group having the same transmission source and different. A cross-correlation calculating unit 106b for calculating a cross-correlation (tra-correlation coefficient between SD groups) of the traffic characteristic sequence. That is, the calculation target of the cross correlation in the present embodiment is the SD group having the same transmission source user.

  The communication identification unit 107 compares the autocorrelation and cross-correlation calculation results with a predetermined threshold, and identifies each SD group session as either background communication or foreground communication based on the comparison results.

  FIG. 3 is a diagram for explaining a traffic characteristic analysis method by the traffic characteristic analysis unit 104. Here, a connection that can be captured from a SYN packet of a TCP_3way handshake executed between a client and a server when a TCP connection is established will be described as an example.

  For the TCP connection, the difference between the arrival time (connection occurrence time) t1 of the SYN packet first transmitted from the terminal MH to the server and the arrival time t2 of the SYN + ACK packet returned from the server to the terminal MH (t2- The server side RTT (round trip) delay is calculated based on t1).

  The client-side RTT delay is calculated based on the difference (t3-t2) between the arrival time t2 of the SYN + ACK packet and the arrival time t3 of the ACK packet last transmitted from the terminal MH to the server. Further, the TCP connection delay is calculated based on the difference (t4-t1) between the arrival time t1 of the first SYN packet and the arrival time t4 of the data packet first transmitted from the terminal MH to the server after the 3-way handshake. . Such a delay characteristic is discretized for each bin, converted into a characteristic number sequence, and a correlation coefficient is obtained, so that it can be used as one of indices for foreground communication determination and background communication determination.

  Also, based on the difference (t5-t4) from the arrival time t4 of the first data transmitted from the terminal MH after the 3-way handshake to the arrival time t5 of the FIN or RST packet, and the amount of transmitted / received data captured within the difference time Thus, the throughput characteristic of the TCP connection is calculated.

  Such throughput characteristics can also be used as one of the indicators of foreground communication determination and background communication determination by discretizing and binarizing the characteristics for each bin of a predetermined width and obtaining the correlation coefficient.

  Also, the DL or UL transfer data amount, the number of packets or the ratio of DL and UL observed from the data arrival time t4 to the FIN or RST packet arrival time t5 is discretized for each bin of a predetermined width. By obtaining a characteristic number sequence and obtaining its correlation coefficient, it can be used as one of indices for foreground communication determination and background communication determination. Here, the amount of transfer data and the number of packets adopted as an index of traffic characteristics are not limited to the payload data as described above, and may be the total amount of transfer data or the total number of packets including various control packets.

  When packet capture is started from the middle of the connection, only possible analysis is selectively performed from the obtained arrival time. For example, if the capture is started from the SYN + ACK packet, only the client-side RTT delay is calculated based on the difference (t3-t2) from the arrival time t2 to the arrival time t3 of the ACK packet.

  Further, the throughput characteristics and TCP connection time required for the TCP connection depend not only on the client side delay but also on the server side delay, so these characteristics calculated when the server side delay is large are Cannot accurately represent the communication quality on the other side. Therefore, when the server-side RTT delay exceeds a predetermined threshold, or when the packet arrival interval such as data or ACK that can represent the server-side delay exceeds a predetermined threshold, TCP characteristics and TCP connection It is desirable to exclude the time required from quality analysis.

  FIG. 4 is a sequence flow for explaining a method for measuring quality characteristics for an HTTP session. An HTTP request (# 1) packet arrival time t1 and an HTTP response (# 1) The time difference (t2−t1) from the packet arrival time t2 is the HTTP response delay (RespTime). Further, the time difference (t3−t1) between the arrival time t1 of the first HTTP request (# 1) packet and the arrival time t3 of the last HTTP response (# 1) packet is set as the HTTP hold time (HoldTime). Such a ratio between RespTime and HoldTime can also be used as one of the indicators for foreground communication determination and background communication determination by discretizing each bin to form a characteristic number sequence and obtaining a correlation coefficient thereof.

  Also, the time difference (t2-t1) between the arrival time t2 of the first HTTP response (# 1) packet and the arrival time t3 of the last HTTP response (# 1) packet is taken as the HTTP response hold time and downloaded during that time The total data amount is the HTTP communication data amount. Furthermore, the time difference (t5-t4) between the arrival time t4 of the first HTTP request (# 2) packet and the arrival time t5 of the last HTTP request (# 2) packet is the HTTP request hold time, and the amount of data between them is The amount of HTTP request data. Such HTTP communication data amount and HTTP request data amount can also be used as one of the indicators of foreground communication determination and background communication determination by discretizing each bin to form a characteristic number sequence and obtaining the correlation coefficient thereof.

  FIG. 5 is a flowchart showing the calculation procedure of the intra-SD group autocorrelation, and is mainly executed for each SD group by the characteristic sequence generator 105 and the autocorrelation calculator 106a.

  In step S101, one of the traffic characteristics is discretized (binarized) with a period τ seconds of a predetermined width, and a traffic characteristic number sequence having the traffic characteristics (unit traffic characteristics) of each bin as an element is generated. For example, when attention is paid to the number of DL packets as traffic characteristics, a characteristic number sequence having the number of DL packets observed in each period τ as a time-series element is generated. In step S102, the same τ seconds as the period are set as the lag value (delay time) j for calculating the autocorrelation.

  In step S103, the autocorrelation coefficient AC (j) corresponding to the current lag value j is calculated based on the following equation (1). In the present embodiment, the autocorrelation coefficient AC (j) is obtained by calculating the sum of products by shifting the same characteristic sequence by j. Note that i is an element identifier of the sequence, SD (i) is the value of the i-th element of the sequence, and N is the sequence length.

  In step S104, the current autocorrelation coefficient AC (j) calculation result is divided by the autocorrelation coefficient AC (0) when the lag value j = 0, as shown in the following equation (2). Thus, the autocorrelation coefficient AC (j) is normalized.

  In step S105, it is determined whether or not the lag value j has reached a predetermined upper limit value jmax. If j ≧ jmax, the process proceeds to step S106 to extend the lag value j by the period τ seconds, and then returns to step S103 to calculate and normalize the autocorrelation coefficient AC (j) corresponding to the updated lag value j Is repeated.

  FIG. 6 is a flowchart showing a cross-correlation calculation procedure. All SDs having the same source information (S) and different destination information (D) are mainly generated by the characteristic sequence generator 105 and the cross-correlation calculator 106b. Repeat for group pairs. Here, a case where the traffic characteristics of the SD group SD1 are identified based on the relationship with the traffic characteristics of another SD group SD2 having different destination information (D) will be described as an example.

  In step S201, the traffic characteristics of the two SD groups SD1 and SD2 to be calculated this time are discretized (BINed) at a predetermined period τ, and the traffic characteristics observed in each period are converted into a time series. Is done. In step S202, τ seconds is set as the lag value j for calculating the cross-correlation.

  In step S203, the cross-correlation coefficient CC (j) corresponding to the current lag value j is calculated based on the following equation (3). In the present embodiment, the cross-correlation coefficient is obtained by calculating the sum of products by shifting two number sequences by τ.

  In step S204, the calculation result of the current cross-correlation coefficient CC (j) is calculated from the autocorrelation coefficients AC1 (0), AC2 (when the lag value j = 0, as shown in the following equation (4). The cross-correlation coefficient CC (j) is normalized by dividing by the square root of the product of (0).

  In step S205, it is determined whether or not the lag value j has reached a predetermined upper limit value jmax. If j ≧ jmax, the process proceeds to step S206 to extend the lag value j by the period τ seconds and then return to step S203 to calculate and normalize the cross-correlation coefficient CC (j) corresponding to the updated lag value j Is repeated. Such calculation of autocorrelation coefficient CC (j) is repeated while switching the calculation target to another SD group when there is another SD group having the same transmission source information.

  Next, a procedure in which the correlation calculation unit 106 and the communication identification unit 107 cooperate to identify each SD group session as either foreground communication or background communication will be described.

  FIG. 7 is a flowchart showing the first communication identification method. In step S301, the traffic information collected from the network is grouped into SD groups by the session classification unit 103 based on the transmission source information and destination information. Is done. In step S302, one of the traffic characteristics is selected as the current identification index. Here, the description will be continued assuming that the number of DL packets is selected.

  In step S303, the traffic characteristic analysis unit 104 and the characteristic number sequence generation unit 105 collect and discretize the number of DL packets for each bin, and generate a characteristic number sequence having each discrete value as an element. In step S304, the autocorrelation coefficient AC of the characteristic number sequence is calculated for each lag value j by the autocorrelation calculation unit 106a of the correlation calculation unit 106.

  In step S305, each autocorrelation coefficient AC (j) calculated for each lag value j is compared with a predetermined background determination threshold (first threshold) ACref. If there is even one autocorrelation coefficient AC (j) exceeding the first threshold ACref, the process proceeds to step S306, and the session of the SD group is identified as background communication.

  On the other hand, if there is no autocorrelation coefficient AC (j) exceeding the first threshold ACref, the process proceeds to step S307, and whether or not the determination using other traffic characteristics as the index other than the number of DL packets is completed. Is determined. If the determination using all scheduled traffic characteristics as an index has not been completed, the process returns to step S302, and the above-described processing is repeated while switching the traffic characteristics of interest to, for example, the throughput characteristics or various delay characteristics.

  In this way, even if all the determinations using each scheduled traffic characteristic as an index are completed, if the background communication is not still determined, the process proceeds to step S308, and the session of the focused SD group is determined to be the foreground communication. Is done.

  In the embodiment described above, the autocorrelation coefficient AC is calculated in step S304. However, the present invention is not limited to this, and the traffic characteristics identified in the background communication in advance. The cross-correlation coefficient CC may be calculated. In this case, in step S304, the cross-correlation coefficient CC is compared with a predetermined background determination threshold value (second threshold value) CCref.

  According to the present embodiment, a session having a high autocorrelation of traffic characteristics is identified as background communication automatically and mechanically executed by the OS and application regardless of user operation. Thus, even when the periodicity of the occurrence time of the session is disturbed, the foreground communication and the background communication originating from the user and the background communication can be identified with a low cost and a small number of measurement points by passive packet capture.

  Further, according to the present embodiment, even if autocorrelation is low, a session that has a high cross-correlation with the characteristic sequence of communication traffic identified as background communication and is likely to be background communication is used for background communication. Since it can be identified, background communication can be reliably identified.

  Furthermore, according to the present embodiment, even if the correlation with respect to one traffic characteristic is low, it is identified as background communication if the correlation with respect to another traffic characteristic is high. Therefore, it is possible to reliably identify background communication having a high correlation.

  FIG. 8 is a flowchart showing the second communication identification method. In step S401, the traffic information collected from the network is grouped into SD groups by the session classification unit 103 based on the transmission source information and destination information. Is done. In step S402, one of the traffic characteristics is selected as the current identification index. Here, the description is continued assuming that the number of DL packets is selected.

  In step S403, the traffic characteristic analysis unit 104 and the characteristic number sequence generation unit 105 collect and discretize the number of DL packets for each bin, and generate a characteristic number sequence having each discrete value as an element. In step S404, the autocorrelation calculation unit 106a of the correlation calculation unit 106 calculates the autocorrelation coefficient AC of the characteristic sequence for each lag value j.

  In step S405, each autocorrelation coefficient AC (j) calculated for each lag value j is compared with a predetermined background determination threshold ACref. If there is even one autocorrelation coefficient AC (j) exceeding the threshold ACref, the process proceeds to step S406, and the session of the SD group is identified as background communication.

  On the other hand, if there is no autocorrelation coefficient AC (j) exceeding the threshold ACref, the process proceeds to step S407, and it is determined whether or not the determination using other traffic characteristics other than the number of DL packets as an index is completed. Determined. If the determination using all scheduled traffic characteristics as an index has not been completed, the process returns to step S402, and the above-described processes are repeated while switching the traffic characteristics of interest.

  In this way, even if all the determinations using each scheduled traffic characteristic as an index are completed, if it is still not determined to be background communication, the process proceeds to step S408, and the traffic characteristics that have been determined as background communication so far are determined. One is noted.

  In step S409, one of the traffic characteristics is selected as the current identification index. In step S410, the traffic characteristic analysis unit 104 and the characteristic number sequence generation unit 105 collect and discretize the number of DL packets for each bin, and generate a characteristic number sequence having each discrete value as an element.

  In step S411, the correlation calculation unit 106 generates a cross-correlation coefficient CC (j) between the generated characteristic number sequence and the characteristic number sequence of communication traffic identified in the background communication by the cross-correlation calculation unit 106b. Calculated for each lag value j.

  In step S412, each cross-correlation coefficient CC (j) calculated for each lag value j is compared with a predetermined background determination threshold CCref. If there is even one cross-correlation coefficient CC (j) exceeding the threshold value CCref, the process proceeds to step S414, and the session of the SD group is identified as background communication.

  On the other hand, if there is no cross-correlation coefficient CC (j) exceeding the threshold value CCref, the process proceeds to step S413, and whether or not all determinations using other traffic characteristics other than the number of DL packets as an index have been completed. Is determined. If there remains an undetermined index, the process returns to step S409, and the above-described processes are repeated while switching the traffic characteristics of interest.

  In this way, even if all the determinations using each scheduled traffic characteristic as an index are completed, if the background communication is still not determined, the process proceeds to step S415 and the foreground communication is determined.

  According to the present embodiment, even if autocorrelation is low, a session with high cross-correlation is identified as background communication. Therefore, session establishment is performed in the same procedure with multiple servers within the same background processing. Communication that repeats can be identified as background communication regardless of autocorrelation.

  In each of the above embodiments, the lag value j is described as a fixed value. However, the present invention is not limited to this, and the time width during which autocorrelation and cross-correlation increase is adaptively calculated. However, it is possible to use a value at which the rate at which the correlation coefficient exceeds a predetermined threshold is a predetermined amount or more, or a distribution value (80% ile value, 90% ile value, etc.) or likelihood is a predetermined value or more. You may make it utilize the value which becomes.

  DESCRIPTION OF SYMBOLS 1 ... Capture apparatus, 101 ... Communication traffic detection part, 102 ... Log information management part, 103 ... Session classification part, 104 ... Traffic characteristic analysis part, 105 ... Characteristic sequence generation part, 106 ... Correlation calculation part, 106a ... Autocorrelation calculation , 106b ... cross-correlation calculator, 107 ... communication identification unit

Claims (8)

In a communication identification device that identifies communication traffic as either foreground communication or background communication,
Classification means for classifying communication traffic observed on the network into an SD group specific to the combination of the source information and the destination information,
Traffic characteristic analysis means for analyzing time series fluctuations in traffic characteristics for each SD group ;
Characteristic sequence generation means for generating a traffic characteristic sequence by discretizing the time-series variation of the traffic characteristics for each bin of unit time width;
Correlation calculating means for calculating correlation characteristics of the traffic characteristic sequence ;
A communication identification device comprising communication identification means for identifying communication traffic based on the correlation characteristic. The correlation calculation means comprises an autocorrelation calculation means for calculating an autocorrelation of traffic characteristics for each SD group,
The communication identification device according to claim 1, wherein the communication identification unit identifies communication traffic having an autocorrelation exceeding a predetermined first threshold value as background communication. The correlation calculation means comprises a cross-correlation calculation means for calculating a cross-correlation between the traffic characteristics of one SD group and the traffic characteristics of communication traffic identified as background communication in the other SD group,
The communication identification device according to claim 2, wherein the communication identification unit identifies communication traffic whose cross-correlation exceeds a predetermined second threshold as background communication. The correlation calculation means comprises a cross-correlation calculation means for calculating a cross-correlation between the traffic characteristics of one SD group and the traffic characteristics of another SD group identified in the background communication ,
The communication identifying means is a communication in which the autocorrelation of traffic characteristics does not exceed the first threshold value, and the cross-correlation with the traffic characteristics of another SD group identified in the background communication exceeds a predetermined second threshold value. The communication identification apparatus according to claim 2, wherein traffic is identified as background communication.   The characteristic number sequence generation means includes download transfer data amount, upload transfer data amount, ratio of download and upload transfer data amount, download packet number, upload packet number, download and upload packet number ratio, It is characterized by calculating at least one of throughput characteristics, traffic delay characteristics, ratio between hold time and response time, traffic characteristics time-series fluctuation tendency, and the number of session occurrences for each bin as a time-series element of the characteristic sequence. The communication identification device according to any one of claims 1 to 4.   The communication identifying means further makes a determination based on another traffic characteristic for communication traffic that has not been determined to be background communication based on one traffic characteristic, and at least one of a plurality of scheduled traffic characteristics. The communication identification device according to claim 1, wherein the background communication is determined when the correlation characteristic exceeds a predetermined threshold.   The communication identification device according to claim 6, wherein the communication identification unit determines that communication traffic that has not been determined as background communication for all of the plurality of scheduled traffic characteristics is foreground communication. In a communication identification method in which a computer identifies communication traffic as either foreground communication or background communication,
A procedure for classifying communication traffic observed on the network into an SD group specific to the combination of the source information and destination information,
A procedure for analyzing time series fluctuations in traffic characteristics for each SD group,
A procedure for generating a traffic characteristic sequence by discretizing the time-series fluctuation of the traffic characteristic for each bin of unit time width;
Calculating a correlation characteristic of the traffic characteristic sequence ;
A communication identification method comprising: identifying communication traffic based on the correlation characteristic.