JP6743585B2 - Communication analysis device and communication analysis program - Google Patents

Description

The present invention relates to a communication analysis device and a communication analysis program, and can be applied to, for example, a flow type determination device that collects communication information of a communication device and analyzes/determines the communication state.

Generally, the conventional communication analysis/determination device has a statistical characteristic value (minimum value) of characteristics (packet size, packet arrival interval transfer time, transfer packet number, transfer byte number) obtained from a communication flow at arbitrary timing. (0% value), median value (50% value), maximum value (100% value), average value, and variance value) are calculated, and the degree of approximation to the characteristic vegetation learned in advance in the same environment as the measurement environment is calculated. The communication state is discriminated using a discriminator that performs discrimination based on the above (for example, Patent Document 1).

JP, 2005-50473, A

By the way, in the apparatus having the above configuration, in order to improve the accuracy of flow discrimination, the timing at which the discrimination rate is expected to be the highest is adjusted in advance, and the transfer time and the number of transfer packets depending on the content such as the type of data to be transferred and the data size are transferred. It is necessary to prepare learning data in advance by designing so as to make a determination using values such as the number of transfer bytes and the value of RTT (Round Trip Time) that changes according to the communication environment. Met.

However, in the device configured as described above, the accuracy of determination may be reduced when the data to be acquired is deviated at an arbitrary timing due to the retransmission of communication due to the influence of packet loss or the like, or the difference in the operation for each advertisement type or each user. There is a possibility that the feature value may change depending on the feature value.If the discriminant accuracy decreases, or if the network characteristics such as the change of the communication line or the route change in the Internet changes, the discriminant system will decrease because it deviates from the learned feature value. There were cases.

In addition, the device having the above-described configuration uses the quadratic value (0%, 25%, 50%, 75%, 100%) that is often used in the statistical value as the characteristic value, but the characteristic value is calculated with this granularity. In particular, the values of 25%, 50%, and 75% may change abruptly depending on the timing of the operation, and there is also a problem that the determination accuracy is lowered.

Therefore, a communication analysis device and a communication analysis program that can efficiently determine the communication state regardless of changes in the communication environment or the user environment are desired.

A communication analysis device according to a first aspect of the present invention is arranged between a first communication network and a second communication network, and analyzes a flow that is a set of packets transmitted and received between these two networks. In (1) the storage unit that stores flow data for each flow, and (2) the number of packets of the flow to be analyzed that is stored in the storage unit is a predetermined number of packets for analyzing the flow from the flow start point. A drive interrupt unit that gives a notification at the timing when the number of packets is reached, and (3) when the notification is received from the drive interrupt unit, obtains the flow data for the number of analyzed packets from the start point of the flow to be analyzed, A segment division and feature value calculation unit that divides the acquired flow data in time series and calculates feature values for data in a plurality of calculation segments from the flow start point to each division point, (4) the segment And a flow type determination unit that determines the flow type based on the similarity between all or a part of the data set of the feature values calculated by the division and feature value calculation unit and the pre-learned teacher data. To do.

The communication analysis program according to the second aspect of the present invention is arranged between the first communication network and the second communication network, and analyzes the flow that is a set of packets transmitted and received between these two networks. The computer installed in (1) the storage unit for storing the flow data for each flow, and (2) the number of packets of the flow to be analyzed stored in the storage unit have a predetermined number for analyzing the flow from the flow start point. A drive interrupt unit that gives a notification at the timing when the number of analysis packets is the number of packets, and Acquiring data, dividing the acquired flow data in time series, a section division and a characteristic value calculation unit that calculates characteristic values for data in a plurality of calculation sections from the flow start point to each division point, (4) Functions as a flow type determination unit that determines the flow type based on the similarity between all or a part of the feature value data set calculated by the section division and feature value calculation unit and pre-learned teacher data It is characterized in that

According to the present invention, the communication state can be efficiently determined regardless of changes in the communication environment, the user environment, and the like.

It is a block diagram showing the functional composition of the flow classification discriminating device concerning an embodiment. It is the block diagram shown about the example of the connection structure of the flow classification determination apparatus periphery which concerns on embodiment. It is a figure showing an example of a packet transmitted and received between a terminal and a communication apparatus via a router concerning an embodiment. It is a figure showing an example of a flow feature value calculation section concerning an embodiment. It is a figure showing an example of a feature value calculation section divided using a section division parameter concerning an embodiment. It is a figure showing an image of a packet size and a characteristic value calculation of a packet arrival interval concerning an embodiment. It is a figure showing an example of a flow feature value calculation section concerning other embodiments. It is the figure which showed an example of the feature value calculation area divided using the area division parameter which concerns on other embodiment.

(A) Main Embodiment Hereinafter, one embodiment of a communication analysis device and a communication analysis program according to the present invention will be described in detail with reference to the drawings. Hereinafter, an example in which the communication analysis device and the communication analysis program of the present invention are applied to a flow type determination device will be described.

(A-1) Configuration of Embodiment FIG. 2 is a block diagram showing an example of a connection configuration around a flow type determination device according to the embodiment.

As shown in FIG. 2, the flow type determination device 10 of this embodiment acquires information regarding network traffic from the router 30 and performs analysis processing.

As shown in FIG. 2, it is assumed that the router 30 is a gateway that relays between the network N1 and the network N2. As shown in FIG. 2, it is assumed that one terminal 20 is connected to the network N1. Further, as shown in FIG. 2, it is assumed that one communication device 40 is connected to the network N2. The number of devices connected to the networks N1 and N2 is not limited. Further, the network configuration from the router 30 to the terminal 20 and the network configuration from the router 30 to each communication device 40 are not limited.

The terminal 20 is assumed to be a computer (for example, a PC, a tablet, a smart phone, etc.) in which an application connected to the communication device 40 is installed. The number and types of applications installed in the terminal 20 are not limited. The terminal 20 is, for example, a terminal used by a user (subscriber) connected to a telecommunications carrier.

The flow type determination device 10 regards the terminal 20 as one user and performs network monitoring (analysis of communication traffic).

The communication device 40 is a device that communicates with the terminal 20. Although the configuration of the communication device 40 is not limited, for example, a server (computer) that provides various services (for example, Web service, database service, etc.) to the terminal 20, or an IP that performs telephone communication with the terminal 20. Telephone terminals etc. are applicable.

In this embodiment, the router 30 is assumed to have at least three interfaces 31, 32, 33. The specifications of the interfaces 31, 32, and 33 are not limited, and various Ethernet (registered trademark) interfaces can be applied, for example. In the example of this embodiment, in the router 30, the interface 31 is an interface connected to the network on the terminal 20 side, the interface 32 is an interface connected to the communication device 40 side, and the interface 33 is connected to the flow type determination device 10. Interface. Note that, in FIG. 2, only traffic between the terminal 20 and the communication device 40 is shown as traffic relayed by the router 30 for simplicity of description, but the router 30 does not communicate between other nodes. It goes without saying that it may be configured to relay.

In this embodiment, the router 30 is configured to copy the traffic (packet) of the interface 31 (or the interface 32) to the interface 33 in real time by the mirroring function or the like (for example, the port mirroring function). It is assumed that it has been set). As a result, the flow type determination device 10 can acquire the traffic (packet) data of the router 30 (interface 31, interface 32). The configuration for the flow type determination device 10 to acquire traffic data is not limited to the configuration in FIG. For example, the flow type determination device 10 may be arranged in the preceding stage of the router 30 (between the router 30 and the terminal 20) to copy the traffic (packet) input/output by the router 30 (interface 31). The signal supplied from the terminal 20 to the router 30 is branched by a tap (splitter) or the like so that the traffic (packet) input/output to/from the router 30 (interface 31) is supplied to the flow type determination device 10. You may Further, the interface between the router 30 and the flow type determination device 10 does not have to be Ethernet, and if the function of the flow type determination device 10 can be incorporated, the interface is installed as software inside the router 30 and the flow is The data may be received on the memory of the router.

Next, the internal configuration of the flow type determination device 10 will be described with reference to FIG.

The flow type determination device 10 includes a reception unit 11, a flow data temporary storage unit 12, an engine drive interrupt unit 13, a section division/feature value calculation unit 14, a flow type determination unit 15, and a transmission unit 16.

The flow type determination device 10 may be realized by, for example, installing a program (including the communication analysis program according to the embodiment) in a computer having a processor and a memory. Further, in the flow type determination device 10, part or all of the processing may be realized by hardware (for example, a dedicated semiconductor chip or the like).

The receiving unit 11 is a communication unit that receives the traffic (packet) of the router 30.

The flow data temporary storage unit 12 is a database that temporarily stores (stores) the packets received by the reception unit 11. The flow data temporary storage unit 12 may store packet data including a data body (payload), or may store only packet communication information.

The engine drive interrupt unit 13 monitors the update of the flow data temporary storage unit 12 and notifies the section division and characteristic value calculation unit 14 at the timing when the predetermined number of packets is stored in the flow data temporary storage unit 12. The engine drive interrupt unit 13 has an interval division parameter m that is a parameter for dividing a time-series flow, and a granularity parameter n that determines the granularity of n-minute values. Details of both parameters will be clarified in the operation section.

The engine drive interrupt unit 13 uniquely identifies the flow when the section division and the characteristic value calculation unit 14 are notified, for example, 5tuples (source IP address, destination IP address, source port number, destination port number). , Parameter), interval division parameter m, and granularity parameter n.

The section division/feature value calculation unit 14 acquires the flow information (flow data) of the packet from the flow start to the interrupt timing from the flow data temporary storage unit 12 based on the parameters acquired from the engine drive interrupt unit 13. The section division/feature value calculation unit 14 divides each of the flows in the three directions (bidirectional, upstream, and downstream) using the section division parameter m, and the characteristics of each section (packet size, packet size in this embodiment, And the packet arrival interval are used, but other features may be used) to calculate the feature value (n-minute value, average value, variance value). The section division/feature value calculation unit 14 sends the calculated feature value data set (data set) to the flow type determination unit 15. The detailed operation of the section division/feature value calculation unit 14 will be described in detail in the operation section.

When the flow data temporary storage unit 12 has a statistical calculation capability (when it has the function of the section division and feature value calculation unit 14 described above), the section division and feature value calculation unit 14 calculates the information to be calculated above. May be inquired to the flow data temporary storage unit 12 to receive the characteristic value. Alternatively, when the statistical value to be calculated does not change, for example, when the data is input to the flow data temporary storage unit 12, it is calculated at the same time and each characteristic value is held as data, and the section division and characteristic value calculation unit 14 May collect the data and send it to the flow type determination unit 15.

The flow type determination unit 15 identifies the most similar flow type based on the data set acquired from the section division/feature value calculation unit 14 and the teacher data learned in advance.

The transmission unit 16 is a communication unit that transmits the determination result of the flow type determination unit 15 to another device (not shown).

(A-2) Operation of Embodiment Next, the operation of the flow type determination device 10 of the first embodiment having the above configuration will be described.

The operation of the flow type determination device 10 will be described with reference to FIGS. 1 and 2.

In the following, it is assumed that an application is operated by a user operation on the terminal 20 and traffic (packet transmission/reception) is generated between the terminal 20 and the communication device 40. FIG. 3 shows an example of packets transmitted and received between the terminal 20 and the communication device 40 via the router 30. In FIG. 3, uplink packets Pu (Pu1 to Pu9) transmitted from the terminal 20 to the communication device 40 and downlink packets Pd (Pd1 to Pd17) transmitted from the communication device 40 to the terminal 20 are shown. Note that the numbers of the upstream packets Pu and the downstream packets Pd are merely examples, and the number is not limited to this.

When traffic occurs between the terminal 20 and the communication device 40, the traffic (packet) of the router 30 (interface 31 connected to the terminal 20 side) is sent to the flow type determination device 10 (reception unit 11) via the interface 33. Will be supplied.

When the traffic is supplied, the reception unit 11 of the flow type determination device 10 supplies the traffic (packet) to the flow data temporary storage unit 12. The flow data temporary storage unit 12 stores the supplied packet.

The engine drive interrupt unit 13 refers to the update information of the flow data temporary storage unit 12 to monitor the flow status.

The engine drive interrupt unit 13 sequentially analyzes the flows newly stored in the flow data temporary storage unit 12, and when the number of packets of the analyzed flow becomes an arbitrary number (or when a predetermined time has elapsed). Sends a flow specifying parameter such as 5-tuples capable of uniquely specifying a flow, a section dividing parameter m, and a granularity parameter n (setting parameter) to the section dividing and feature value calculating unit 14.

The section division/feature value calculation unit 14 is an aggregate of an arbitrary number (x) of packets from the flow data temporary storage unit 12 based on the flow identification parameter and the setting parameter acquired from the engine drive interrupt unit 13. Get flow data.

The section division and characteristic value calculation unit 14 treats the acquired flow data as time-series data (FIG. 4) and calculates characteristic values (statistical values) for flows in three directions (bidirectional, upstream, downstream). To do.

In FIG. 4, timing t1 is the start point of the section (bidirectional flow characteristic value calculation section I1, upstream flow characteristic value calculation section I2) for calculating the characteristic value of the bidirectional flow (upstream flow). The timing t1 is also a timing when the router 30 (flow type determination device 10) is supplied with the upstream packet Pu1 which is the first packet of the flow. Timing t2 is a start point of a section (downstream flow characteristic value calculation section I3) for calculating a downstream flow characteristic value. The timing t2 is also a timing when the router 30 (flow type determination device 10) is supplied with the downlink packet Pd1 which is the first packet in the downlink direction.

Timing t3 is the end point of the upstream flow characteristic value calculation section I2 (in the example of FIG. 4, the timing at which the upstream packet Pua is supplied). Further, the timing t4 is the end point of the bidirectional flow feature value calculation section I1 (downstream flow feature value calculation section I3) (in the example of FIG. 4, the timing at which the downlink packet Pd(x-a) is supplied).

In the bidirectional flow characteristic value calculation section I1, the x packet, which is the total value of the a number of upstream packets Pu and the x−a number of downstream packets Pd, is the target of the characteristic value calculation. Further, in the upstream flow characteristic value calculation section I2, a number of upstream packets Pu are the target of characteristic value calculation. Further, in the downlink flow characteristic value calculation section I3, xa downlink packets Pd are the target of the characteristic value calculation.

The section division and characteristic value calculation unit 14 subdivides the inside of the bidirectional flow characteristic value calculation section I1, the upstream flow characteristic value calculation section I2, and the downstream flow characteristic value calculation section I3 using the section division parameter m.

FIG. 5 is a diagram showing an example of the feature value calculation section divided using the section division parameter m. In FIG. 5(A), the characteristic value calculation section I corresponds to any of the bidirectional flow characteristic value calculation section I1, the upstream flow characteristic value calculation section I2, and the downstream flow characteristic value calculation section I3 described above. Further, in FIG. 5, y packets are illustrated, but the value of y corresponds to x of a bidirectional flow, a of an upstream flow, or x-a of a downstream flow.

FIG. 5A shows an example in which the characteristic value calculation section I (the section from the first packet (P#1) to the yth packet (P#y)) is divided into m pieces. In addition, in FIG. 5B, a section S1 to a section Sm (m sections) for calculating the feature value in the feature value calculation section I are illustrated. For example, the calculation section of the section S1 is 1 to y/m, and the calculation section of the section Sm is 1 to y.

The feature value of the flow (flow data) acquired from the flow data temporary storage unit 12 by the processing of the section division and the feature value calculation unit 14 up to this point is 3 (three-direction flow)*m (m section) variations. Will have.

Further, the section division and characteristic value calculation unit 14 calculates the characteristic value of the packet size and the packet arrival interval for the 3*m variations using the granularity parameter n.

FIG. 6 is an explanatory diagram showing an image of calculating feature values of the packet size and the packet arrival interval. FIG. 6A shows an image of a data set of a packet size calculated as a feature value and a packet arrival interval.

FIG. 6(B) shows the n-minute value, the average value, and the variance value that are the characteristic values of the packet size and the packet arrival interval. In FIG. 6B, the value of n of the n-minute value is determined by the value of the set granularity parameter n.

For example, when the particle size parameter n=20, the n-minute value is 0% value (minimum value), 5% value, 10% value, 15% value, ..., 50% value (median value), ..., 90% value. , 95% value, 100% value (maximum value). When the value of the granularity parameter n is not divisible by 100, for example, n=12, the n-minute value is 0% value (minimum value), 12% value, 24% value, 36% value,... .., 72% value, 84% value, 96% value, etc., and if there is corresponding learning data, it can be applied regardless of the value.

Up to this point, by using the granularity parameter n, (n+1 (0% to 100% value (or the closest value))+2 (average value, variance value))*2 with respect to the packet size and the packet arrival interval. The element of (packet size, packet arrival interval) is calculated as the characteristic value.

Then, the interval division/feature value calculation unit 14 finally obtains an n-minute value or the like for the m-divided data in the flow 3 direction, so as shown in FIG. (N+1 (0% to 100% value) + 2 (average value, variance value) *2 (packet size, packet arrival interval) *m (number of sections) *2 * (packet size, packet arrival interval) *3 (flow direction )) element is calculated as a feature value.

The section division and characteristic value calculation unit 14 sends the aggregate (data set) of all or a part of the calculated characteristic values (parameters) to the flow type determination unit 15.

The flow type determination unit 15 calculates the degree of approximation between the data set acquired from the section division/feature value calculation unit 14 and the data set (teacher data) that has been learned in advance, and determines the flow type considered to be close to each other. Determine.

The flow type determination unit 15 transmits the determination result of the flow type to another device via the transmission unit 16. Further, the flow type determination unit 15 may provide the determination result to a user interface such as a display in order to provide information to an operator who operates the device, an analyst, or the like.

(A-3) Effects of the Embodiment According to this embodiment, the following effects can be achieved.

The flow type determination device 10 is provided with the section division and characteristic value calculation unit 14 so that the characteristic value data set at each division point of the time-series flow data divided into m pieces and the characteristic value data of the statistical n-minute value. It became possible to newly generate a set and determine the flow. This uses only the packet size and the packet arrival interval without using the conventional environment-dependent data set, the connected web server, or the content-dependent data set that is affected by the difference in operation of each user. This means that it is possible to make a distinction. The flow type determination device 10 of this embodiment has an effect of enabling the identification of a general-purpose flow type that does not depend on a specific environment or usage method.

Further, conventionally, after installing a device having a function similar to that of the flow type determination device, it was necessary to learn a sufficient amount of the learning data set under the environment. There is also an effect that learning according to is unnecessary.

(B) Other Embodiments The present invention is not limited to the above-described embodiments, and can include modified embodiments as exemplified below.

(B-1) In the above embodiment, the section division/feature value calculation unit 14 matches the flow feature value calculation sections at the timing of the bidirectional flow, as shown in FIG. 4 described above. In other words, the section division/feature value calculation unit 14 adjusts the flow feature value calculation section at the timing when the sum of the upstream packet Pu and the downstream packet Pd received by the router 30 (flow type determination device 10) is the xth packet. Was there. As a modified example, the section division/feature value calculation unit 14 adjusts each flow feature value calculation section at the timing of the x-th packet in each of the three directions (bidirectional, uplink, and downlink reports), and the x-packet It may be processed as a flow. FIG. 7 is an explanatory diagram showing an example of a flow feature value calculation section according to another embodiment.

In FIG. 7, in the bidirectional flow feature value calculation section I1, from the timing t1 which is the flow start point (bidirectional), x packets, which are the total of a number of upstream packets Pu and b number of downstream packets Pd, are received. The characteristic value is calculated up to the timing (timing t3). In the upstream flow characteristic value calculation section I2, the characteristic value is calculated from the timing t1 which is the flow start point (upstream) to the timing (timing t5) when x pieces of upstream packets Pu are received. Further, in the downstream flow characteristic value calculation section I3, the characteristic value is calculated from the timing t2, which is the flow start point (downstream), to the timing (timing t4) when x pieces of downstream packets Pd are received.

(B-2) Further, in the above embodiment, the section division/feature value calculation unit 14 divides the flow feature value calculation section into m divisions from the first packet as shown in FIG. 5 described above. The calculation interval was up to each point. As a modified example, the section division/feature value calculation unit 14 may set each of the m-divided sections as a feature value calculation section. FIG. 8 is an explanatory diagram showing an example of the feature value calculation section divided using the section division parameter m according to another embodiment. In FIG. 8B, a section S1 to a section Sm (m sections) for calculating the feature value in the feature value calculation section I are illustrated. For example, the calculation section of the section S1 is 1 to y/m, and the calculation section of the section S2 is y/m to 2y/m.

10... Flow type determination device, 11... Receiving unit, 12... Flow data temporary storage unit, 13... Engine drive interrupting unit, 14... Feature value calculating unit, 15... Flow type determining unit, 16... Transmitting unit, 20... Terminal, 30... Router, 31-33... Interface,
40... Communication device, I (I1 to I3)... Feature value calculation section, I1... Bidirectional flow feature value calculation section, N1, N2... Network, Pu... Upstream packet, Pd... Downstream packet, Pu... Upstream packet, m... Interval division parameter. n... granularity parameter, t... timing.

Claims (9)

In a communication analysis device arranged between a first communication network and a second communication network, for analyzing a flow that is an aggregate of packets transmitted and received between these two networks,
A storage unit that stores flow data for each flow,
A drive interrupt unit that performs notification at a timing when the number of packets of the flow to be analyzed stored in the storage unit is the number of analysis packets, which is a predetermined number of packets for analyzing the flow from the flow start point,
When the notification is received from the drive interrupt unit, the flow data for the number of analysis packets is acquired from the start point of the flow to be analyzed, the acquired flow data is divided in time series, and the flow start point is calculated. A section division and feature value calculation unit that calculates a feature value for data in a plurality of calculation sections up to each division point,
A flow type discriminating unit for discriminating the flow type based on the similarity between all or a part of the data set of the characteristic values calculated by the section division and characteristic value calculating unit and the pre-learned teacher data. Characteristic communication analysis device. The communication analysis device according to claim 1, wherein the section division and characteristic value calculation unit calculates an arbitrary percentile value of data in each section from the flow start point to each division point as a characteristic value. The section division and characteristic value calculation unit includes, in the flow data acquired from the storage unit, data in a first direction from the second communication network toward the first communication network, and the first communication network. The communication analysis device according to claim 1 or 2, wherein characteristic values for data in a second direction from the second communication network to the second communication network and bidirectional data transmitted and received in both networks are calculated. 4. The calculation section in which the section division and the characteristic value calculation unit calculates the characteristic value is each section obtained by dividing the flow data acquired from the storage unit in time series. The communication analysis device according to claim 1. The drive interrupt unit performs a notification at a timing when the analysis elapsed time is reached when a predetermined time has elapsed from the start point of the flow for analysis stored in the storage unit,
The section division and feature value calculation unit, when notified from the drive interrupt unit, collects the flow data from the start point of the flow to be analyzed to the final packet stored in the storage unit by the analysis elapsed time. It acquires, The communication analysis apparatus in any one of Claims 1-4 characterized by the above-mentioned. The communication analysis device according to claim 1, wherein the characteristic value calculated by the section division and characteristic value calculation unit is a characteristic value regarding a packet size and a packet arrival interval. The storage unit is a database that can statistically calculate the flow data,
The section division/feature value calculation unit divides the flow data in time series from the start point of the flow to be analyzed into the storage unit when the storage unit receives a notification from the drive interrupt unit. Then, issue an inquiry statement to calculate the feature value for the data in the plurality of calculation sections from the flow start point to each division point,
The section division and characteristic value calculation unit acquires the characteristic value for the data in the plurality of calculation sections from the flow start point to each division point, which is the result of the inquiry statement from the storage unit. The communication analysis device according to claim 1. The storage unit is a database that can statistically calculate the flow data,
The storage unit time-sequentially divides the flow data for the number of packets from the flow start point to the present time at the timing when the flow data is stored, and performs a plurality of calculations from the flow start point to each division point. Calculate the feature value for the data in the section, store the calculated feature value as feature value data,
When the section division and characteristic value calculation unit receives a notification from the drive interrupt unit, the characteristic value data corresponding to the flow data for the number of analysis packets from the start point of the flow to be analyzed from the storage unit. The communication analysis device according to any one of claims 1 to 6, characterized in that. A computer mounted on a communication analysis device that is arranged between the first communication network and the second communication network and that analyzes a flow that is an aggregate of packets transmitted and received between these two networks;
A storage unit that stores flow data for each flow,
A drive interrupt unit that performs notification at a timing when the number of packets of the flow to be analyzed stored in the storage unit is the number of analysis packets, which is a predetermined number of packets for analyzing the flow from the flow start point,
When the notification is received from the drive interrupt unit, the flow data for the number of analysis packets is acquired from the start point of the flow to be analyzed, the acquired flow data is divided in time series, and the flow start point is calculated. A section division and feature value calculation unit that calculates a feature value for data in a plurality of calculation sections up to each division point,
It functions as a flow type determination unit that determines the flow type based on the similarity between all or a part of the feature value data set calculated by the section division and feature value calculation unit and pre-learned teacher data. A communication analysis program characterized by the above.

Images