JP7513251B2 - Network scanning device, a program for causing a computer to execute the program, and a computer-readable recording medium having the program recorded thereon - Google Patents

Description

Article 30, paragraph 2 of the Patent Act is applicable. Published on December 12, 2019, in the Technical Report of the Institute of Electronics, Information and Communication Engineers, Vol. 119, No. 344, NS2019-142, pages 44-49.

Article 30, paragraph 2 of the Patent Act applies. Published on February 16, 2020 at the International Conference on Advanced Communications Technology (ICACT), pp. 319-323.

This invention relates to a network scanning device, a program for causing a computer to execute the program, and a computer-readable recording medium on which the program is recorded.

As the fifth generation mobile communication (5G) system comes into practical use, many devices, such as mobile terminals, computers, sensors, and webcams, will be connected to the Internet. Such mobile terminals and computers connected to the Internet are called IoT (Internet of Things) devices.

In the IoT era, the number of IoT devices connected to communication networks is expected to increase rapidly. Among these, IoT devices that perform wireless communication are expected to be used illegally without sufficient security measures in order to increase the number of cases where they are exploited in cyber attacks such as distributed denial of service (DDoS) attacks.

To avoid such a situation, it is necessary to conduct network scans of IoT devices connected to communication networks and investigate whether security measures are in place for each IoT device.

Network scanning is an important method to investigate and detect network connection status and vulnerable devices (Non-Patent Documents 1, 2). Through network scanning, a scanner obtains information of targeted IoT devices, such as response delay and port usage status. These network scan results then help network administrators to monitor network devices, check congestion status, and identify vulnerable IoT devices.

K. Yano, N. Egashira, T. Kurihara, S. Shimizu, and Y. Suzuki, “Research and Development on Wide Area Network Scan Techniques for IoT Wireless Equipment,” IEICE Tech. Rep., pp.203-208, NS2019-85, July 2019. R. Das, N. Baranasuriya, V. Padmanabhan, C. Rodbro, and S. Gilbert, “Informed Bandwidth Adaptation in Wi-Fi Networks using Ping-Pair,” Proc. CoNEXT 2017, pp.376-388, Dec 2017.

However, conventionally, a scan schedule is created when performing a network scan without considering the scheduling for multi-hop terminal devices. As a result, a network scan for a multi-hop terminal device requires more wireless resources than is assumed for a network scan for a single-hop terminal device, resulting in problems such as congestion in the wireless section, network scan failure, or scan packet retransmission. In particular, since Wi-SUN (Wireless Smart Utility Network) is premised on multi-hop communication, performing a network scan without considering the scheduling for a multi-hop terminal device results in problems such as network scan failure or scan packet retransmission.

Therefore, according to an embodiment of the present invention, a network scanning device is provided that can reduce wireless resources when performing a network scan using multi-hop communication.

In addition, according to an embodiment of the present invention, a program is provided for causing a computer to reduce wireless resources when performing a network scan using multi-hop communication.

Furthermore, according to an embodiment of the present invention, a computer-readable recording medium is provided that stores a program for causing a computer to reduce wireless resources when performing a network scan using multi-hop communication.

(Configuration 1)
According to an embodiment of the present invention, a network scanning device is a network scanning device that estimates the number of hops in a wireless communication section of a plurality of first networks used when performing a network scan, and includes a scanning means, a recording means, an estimating means, and a schedule creating means. The scanning means performs a network scan by transmitting a scan packet to a plurality of IP addresses of a plurality of terminal devices using the plurality of first networks. The recording means measures a scan response delay, which is a time from transmitting a scan packet to receiving a scan response, and performs a recording process for all of the plurality of terminal devices, in which the measured measured scan response delay is associated with an IP address and recorded. The estimating means performs an estimation process for all of the plurality of terminal devices, in which a first subtraction result obtained by subtracting a delay in the wired communication section in the second network from the measured scan response delay, assuming a second network in which a wired communication section and a wireless communication section consisting of one hop exist between the network scanning device and the terminal devices, is compared with a minimum delay in the wireless communication section in the second network to estimate the number of hops. The schedule creation means creates a scan schedule for the network scan by setting the communication speed of the scan packets in the network scan to a first communication speed when the number of hops estimated by the estimation means is a first hop number, and by setting the communication speed of the scan packets to a second communication speed lower than the first communication speed when the number of hops estimated by the estimation means is a second hop number greater than the first hop number. Then, the scan means executes the network scan in accordance with the scan schedule created by the schedule creation means.

(Configuration 2)
In configuration 1, in the estimation process, the estimation means subtracts the delay of the wired communication section in the second network from the minimum value of the measured scan response delay to calculate a first minimum value of the subtraction results, calculates a plurality of threshold values based on the minimum delay of the wireless communication section in the second network, and compares the minimum value of the first subtraction result with the plurality of threshold values to estimate the number of hops.

(Configuration 3)
In configuration 2, the multiple thresholds consist of Th ₁ to Th _N (N is an integer equal to or greater than 2). In the estimation process, the estimation means sets the minimum delay of the wireless communication section in the second network as a reference value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay of the wireless communication section in the second network, calculates multiple thresholds by Th _N = (reference value) + (second subtraction result) × N, and estimates the number of hops by comparing the minimum value of the first subtraction result with the calculated multiple thresholds.

(Configuration 4)
In configuration 1, in the estimation process, the estimation means calculates a minimum value of a first subtraction result by subtracting an average delay of the wired communication section in the second network from a minimum value of the measured scan response delay, sets the minimum delay of the wireless communication section in the second network as a first threshold value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay of the wireless communication section in the second network, calculates a second threshold value by adding the second subtraction result to the first threshold value, calculates a third subtraction result by subtracting the first threshold value from the minimum value of the first subtraction results, and calculates a fourth subtraction result by subtracting the first threshold value from the second threshold value, estimates the number of hop stages to be “1” when the third subtraction result is negative, and estimates an addition result obtained by dividing the third subtraction result by the fourth subtraction result, and adding 1 to the integer obtained by rounding up the division result as the number of hop stages when the third subtraction result is equal to or greater than zero.

(Configuration 5)
In configuration 1, in the estimation process, the estimation means subtracts the delay of the wired communication section in the second network from the average value of the measured scan response delays to calculate an average value of a first subtraction result, calculates a plurality of threshold values based on the minimum delay of the wireless communication section in the second network, and compares the average value of the first subtraction result with the plurality of threshold values to estimate the number of hops.

(Configuration 6)
In configuration 5, the multiple thresholds include Th ₁ to Th _N (N is an integer equal to or greater than 2). In the estimation process, the estimation means sets the midpoint between the minimum delay of the wireless communication section in the second network and twice the minimum delay of the wireless communication section in the second network as a reference value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay of the wireless communication section in the second network, calculates multiple thresholds by Th _N = (reference value) + (second subtraction result) × N, and estimates the number of hops by comparing an average value of the first subtraction result with the calculated multiple thresholds.

(Configuration 7)
In the configuration 1, the estimation means, in the estimation process, calculates an average value of first subtraction results by subtracting an average delay of the wired communication section in the second network from an average value of the measured scan response delays, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from a minimum delay of the wireless communication section in the second network, calculates a first threshold value by adding the calculated second subtraction result to a reference value formed of a midpoint between the minimum delay of the wireless communication section in the second network and twice the minimum delay of the wireless communication section in the second network, calculates a first threshold value by adding the second subtraction result to the first threshold value, calculates a second threshold value by subtracting the first threshold value from an average value of the first subtraction results to calculate a third subtraction result, calculates a fourth subtraction result by subtracting the first threshold value from the second threshold value, estimates the number of hops to be “1” when the third subtraction result is negative, and estimates the number of hops to be “ ₁ ” when the third subtraction result is equal to or greater than zero. ) by the fourth subtraction result (D ₂ ), round up the division result, and add 1 to the resulting integer to estimate the number of hops.

(Configuration 8)
In any one of configurations 1 to 7, the network scanning device further includes a determination means for determining types of the plurality of first networks as attributes of the plurality of terminal devices, and the estimation means, in the estimation process, compares a first subtraction result obtained by subtracting a delay in a wired communication section in the second network from a measured scan response delay corresponding to the attribute of the terminal device with a minimum delay in a wireless communication section in the second network to estimate the number of hops.

(Configuration 9)
In any of configurations 1 to 8, the schedule creation means further creates a scan schedule for the network scan by maintaining the communication speed of the scan packets or setting it to a third communication speed higher than the first communication speed when a ratio of the number of measured scan response delays that are equal to or greater than a third threshold value divided by the number of scan responses is not greater than a fourth threshold value.

(Configuration 10)
According to an embodiment of the present invention, a program causes a computer to estimate a number of hops in a wireless communication section of a plurality of first networks used when performing a network scan, the program comprising:
A first step in which a scanning means executes a network scan by transmitting scan packets to a plurality of IP addresses of a plurality of terminal devices using a plurality of first networks;
a second step in which a recording means measures a scan response delay, which is a time from transmitting a scan packet to receiving a scan response, and records the measured scan response delay in association with an IP address for all of the multiple terminal devices;
a third step in which the estimation means executes an estimation process for all of the multiple terminal devices, in which the estimation means estimates the number of hops by comparing a first subtraction result (α) obtained by subtracting a delay in the wired communication section in the second network from the measured scan response delay, assuming a second network in which a wired communication section and a wireless communication section consisting of one hop exist between the network scanning device and the terminal device, with a minimum delay in the wireless communication section in the second network;
a fourth step in which the schedule creation means creates a scan schedule for the network scan by setting a communication speed of the scan packet in the network scan to a first communication speed when the number of hops estimated in the third step is a first hop number, and by setting a communication speed of the scan packet to a second communication speed lower than the first communication speed when the number of hops estimated by the estimation means is a second hop number greater than the first hop number;
The scanning means is a program for causing a computer to execute, in the first step, a network scan in accordance with the scan schedule created in the fourth step.

(Configuration 11)
In configuration 10, in the estimation process of the third step, the estimation means subtracts the delay of the wired communication section in the second network from the minimum value of the measured scan response delay to calculate a first minimum value of the subtraction results, calculates a plurality of threshold values based on the minimum delay of the wireless communication section in the second network, and compares the minimum value of the first subtraction result with the plurality of threshold values to estimate the number of hops.

(Configuration 12)
In configuration 11, the multiple thresholds consist of Th ₁ to Th _N (N is an integer equal to or greater than 2). In the estimation process of the third step, the estimation means sets the minimum delay of the wireless communication section in the second network as a reference value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay of the wireless communication section in the second network, calculates multiple thresholds by Th _N = (reference value) + (second subtraction result) × N, and estimates the number of hops by comparing the minimum value of the first subtraction result with the multiple calculated thresholds.

(Configuration 13)
In configuration 10, in the estimation process of the third step, the estimation means subtracts an average delay of the wired communication section in the second network from a minimum value of the measured scan response delay to calculate a minimum value of a first subtraction result, sets the minimum delay of the wireless communication section in the second network to a first threshold value, subtracts the average delay of the wired communication section in the second network from the minimum delay of the wireless communication section in the second network to calculate a second subtraction result, and sets the first threshold value the second subtraction result is added to the first threshold value to calculate a second threshold value, the first threshold value is subtracted from the minimum value of the first subtraction results to calculate a third subtraction result, and the first threshold value is subtracted from the second threshold value Th2 to calculate a fourth subtraction result. If the third subtraction result is negative, the number of hop stages is estimated to be "1". If the third subtraction result is equal to or greater than zero, the third subtraction result is divided by the fourth subtraction result, the division result is rounded up, and 1 is added to the resulting integer, and this is estimated to be the number of hop stages.

(Configuration 14)
In configuration 10, in the estimation process of the third step, the estimation means subtracts the delay of the wired communication section in the second network from the average value of the measured scan response delays to calculate an average value of first subtraction results, calculates a plurality of threshold values based on the minimum delay of the wireless communication section in the second network, and compares the average value of the first subtraction results with the plurality of threshold values to estimate the number of hops.

(Configuration 15)
In configuration 14, the multiple thresholds consist of Th ₁ to Th _N (N is an integer equal to or greater than 2). In the estimation process of the third step, the estimation means sets the midpoint between the minimum delay of the wireless communication section in the second network and twice the minimum delay of the wireless communication section in the second network as a reference value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay of the wireless communication section in the second network, calculates multiple thresholds by Th _N = (reference value) + (second subtraction result) × N, and estimates the number of hops by comparing an average value of the first subtraction result with the multiple calculated thresholds.

(Configuration 16)
In the configuration 10, in the estimation process of the third step, the estimation means calculates an average value of first subtraction results by subtracting an average delay of the wired communication section in the second network from an average value of the measured scan response delays, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from a minimum delay of the wireless communication section in the second network, and calculates the calculated second subtraction result from a midpoint between the minimum delay of the wireless communication section in the second network and twice the minimum delay of the wireless communication section in the second network. the first threshold value is added to a reference value that is equal to or greater than the first threshold value to calculate a first threshold value, the second subtraction result is added to the first threshold value to calculate a second threshold value, the first threshold value is subtracted from an average value of the first subtraction results to calculate a third subtraction result, and the first threshold value is subtracted from the second threshold value to calculate a fourth subtraction result, and if the third subtraction result is negative, the number of hop stages is estimated to be "1", and if the third subtraction result is equal to or greater than zero, the third subtraction result is divided by the fourth subtraction result (to obtain an integer, and then 1 is added to the resulting integer, and this is estimated to be the number of hop stages.

(Configuration 17)
In any one of configurations 10 to 16, the program further causes the computer to execute a fifth step in which the determining means determines types of the plurality of first networks as attributes of the plurality of terminal devices;
In the estimation process of the third step, the estimation means compares a first subtraction result obtained by subtracting the delay of the wired communication section in the second network from the measured scan response delay corresponding to the attribute of the terminal device with the minimum delay of the wireless communication section in the second network to estimate the number of hops.

(Configuration 18)
In any of configurations 10 to 17, in the fourth step, the schedule creation means further creates a scan schedule for the network scan by maintaining the communication speed of the scan packets or setting it to a third communication speed higher than the first communication speed when the ratio of the number of measured scan response delays that are equal to or greater than a third threshold value divided by the number of scan responses is not greater than a fourth threshold value.

(Configuration 19)
Furthermore, according to an embodiment of the present invention, a recording medium is a computer-readable recording medium having the program according to any one of configurations 10 to 18 recorded thereon.

This reduces the use of wireless resources when performing network scans using multi-hop communication.

1 is a schematic diagram of a communication system according to an embodiment of the present invention. FIG. 2 is a schematic diagram of the network scanning device shown in FIG. 1 . 3 is a conceptual diagram of a correspondence table stored in the host information database shown in FIG. 2. 3 is a conceptual diagram of another correspondence table stored in the host information database shown in FIG. 2. 5 is a conceptual diagram of a correspondence table stored in the correspondence table shown in FIG. 4 . FIG. 2 is a conceptual diagram of a scan schedule. FIG. 11 is a diagram for explaining a method for calculating a one-hop delay time. FIG. 13 is a diagram showing a correspondence table of network type, minimum scan response delay, and average scan response delay. 11 is a diagram illustrating the relationship between the scan response delay and the number of network scans when the network type is a Wired LAN. FIG. 13 is a diagram showing a probability distribution function of a scan response delay when the network type is a Wired LAN. 11 is a diagram showing the relationship between the scan response delay and the number of network scans when the network types are WLAN, Wi-SUN, and LoRa. FIG. 13 is a diagram showing a probability distribution function of a scan response delay when the network type is a WLAN. FIG. 13 is a diagram showing the probability distribution function of scan response delay when the network type is Wi-SUN. FIG. 13 is a diagram showing the probability distribution function of the scan response delay when the network type is LoRa. FIG. 1 is a conceptual diagram of a network. FIG. 2 is a conceptual diagram of delay times in networks NW1-1 and NW2-1. FIG. 2 is a conceptual diagram of delay times in networks NW1-2 and NW2-2. FIG. 13 is a conceptual diagram of a threshold value Th _{i_N} . 11 is a diagram for explaining a method for calculating a threshold value Th _{i_N} . FIG. FIG. 13 is a diagram for explaining another method for calculating the threshold value Th _{i_N} . 11 is a diagram for explaining a method of estimating the number of hops using a threshold value Th _{i_N} . FIG. FIG. 13 is a diagram for explaining a method of calculating the number of hops using α _i and thresholds Th _{i — 1} and Th _{i — 2} . FIG. 13 is a conceptual diagram of a list LS1. FIG. 13 is a conceptual diagram of list LS2. FIG. 13 is a conceptual diagram of list LS3. FIG. 13 is a conceptual diagram of list LS4. 11 is a diagram for explaining a method for controlling the communication speed of a scan packet. FIG. FIG. 13 is a conceptual diagram showing control of the communication speed of a scan packet. 3 is a flowchart for explaining the operation of the network scanning device shown in FIG. 2 . 30 is a flowchart for explaining a detailed operation of step S1 in FIG. 29. 31 is a flowchart for explaining a detailed operation of step S14 in FIG. 30. 31 is a flowchart for explaining a detailed operation of step S15 in FIG. 30. 30 is a flowchart for explaining a detailed operation of step S2 in FIG. 29. 34 is a flowchart for explaining a detailed operation of step S34 in FIG. 33. 34 is another flowchart for explaining the detailed operation of step S34 in FIG. 33. 30 is another flowchart for explaining the detailed operation of step S2 of FIG. 29. 37 is a flowchart for explaining the detailed operation of step S34A in FIG. 36. 37 is another flowchart for explaining the detailed operation of step S34A in FIG. 36. 30 is a flowchart for explaining a detailed operation of step S3 in FIG. 29. 2 is another schematic diagram of the network scanning device shown in FIG. 1. FIG. 1 illustrates the cumulative distribution function of scan response delay SRTT _i in multiple networks. 13 is a conceptual diagram of a correspondence table TBL5 showing the relationship between the communication speed of a scan packet and the network type. 41 is a flowchart for explaining the operation of the network scanning device shown in FIG. 40. 44 is a flowchart for explaining a detailed operation of step S3A shown in FIG. 43. 45 is a flowchart for illustrating a detailed operation of step S3-3A shown in FIG. 44. FIG. 13 is a diagram showing the results of an experiment to determine the network type when the minimum scan response delay is used as a threshold value. 13A and 13B are diagrams illustrating experimental results for determining a network type when the average scan response delay is used as a threshold value.

The embodiment of the present invention will be described in detail with reference to the drawings. Note that the same or corresponding parts in the drawings are given the same reference numerals and their description will not be repeated.

Figure 1 is a schematic diagram of a communication system according to an embodiment of the present invention. Referring to Figure 1, a communication system 10 according to an embodiment of the present invention includes a network scanning device 1, an Internet provider ISP, base stations BS1 to BS4, and terminal devices TM1 to TM5.

The network scanning device 1, the Internet service provider ISP (Internet Service Provider), base stations BS1 to BS4, and terminal devices TM1 to TM5 are placed in the communication space.

The Internet provider ISP is the telecommunications carrier of network NW1. Base stations BS1 to BS4 are base stations of networks NW2 to NW5, respectively. Network NW1 is, for example, a wired LAN (Wired LAN), network NW2 is, for example, a wireless LAN (WLAN), network NW3 is, for example, a Wi-SUN (Wireless Smart Utility Network), network NW4 is, for example, LoRa (Long Range), and network NW5 is, for example, LTE (Long Term Evolution). Networks NW1 to NW5 communicate according to mutually different communication standards.

The terminal devices TM1 to TM5 are placed in the networks NW1 to NW5, respectively, and communicate with the Internet provider ISP and the base stations BS1 to BS4.

Note that in FIG. 1, one terminal device is shown in each of networks NW1 to NW5, but in reality, multiple terminal devices exist in each of networks NW1 to NW5.

In an embodiment of the present invention, each of the terminal devices TM1 to TM5 may be a wireless terminal, or some of the terminal devices TM1 to TM5 may be wireless terminals and the rest may be wired terminals.

The terminal device TM1 is connected to the Internet provider ISP via a wired connection.

The terminal devices TM2 to TM5 communicate with the base stations BS1 to BS4, respectively, via wireless communication.

The network scanning device 1 performs a network scan on the terminal devices TM1 to TM5 using a method described below, and determines the type of the networks NW1 to NW5. The network scanning device 1 also estimates the number of hops in the wireless communication section to the terminal devices TM1 to TM5 using a method described below, and creates a scan schedule according to the estimated number of hops to perform the network scan.

Figure 2 is a schematic diagram of the network scanning device 1 shown in Figure 1. Referring to Figure 2, the network scanning device 1 includes a network scanner 11, a scan analysis manager 12, a host information database 13, and a scan scheduler 14.

The network scanner 11 receives a scan schedule from the scan scheduler 14. The network scanner 11 then generates g scan packets (e.g., Ping packets) each including a TTL (Time To Live) set to one of the values 1, 2, 3, ..., g (g is an integer equal to or greater than 3). The network scanner 11 then transmits the g Ping packets based on the scan schedule, and performs a network scan on the terminal devices connected to the network 20 to be scanned.

Then, the network scanner 11 receives a scan response of the network scan from a terminal device connected to the network 20, and outputs the received scan response to the user (comprising network security, etc.) 30 and the scan analysis manager 12.

The scan analysis manager 12 receives a scan response from the network scanner 11 and receives a communication log during the network scan. The scan analysis manager 12 then generates a scan result that associates the address of the terminal device to be scanned with the scan response based on the scan response, and creates or updates the host information database 13 by storing the generated scan result in the host information database 13.

The scan analysis manager 12 also determines the type of network 20 (networks NW1 to NW5) based on the scan response delay of a network scan targeting multiple terminal devices using a method described below.

Furthermore, the scan analysis manager 12 estimates the number of hops in the wireless communication section to the terminal device based on the scan response delay using a method described below.

The host information database 13 stores the scan results.

The scan scheduler 14 reads the scan results from the host information database 13. The scan scheduler 14 also receives scan requirements from the user 30. The scan scheduler 14 holds in advance the global IP addresses and domain names of all terminal devices present in the area (e.g., Japan) where the network scan is to be performed.

Then, based on the scan requirements and the scan results, the scan scheduler 14 creates a scan schedule that associates the scan timings of the network scan with the terminal devices that are the targets of the network scan at each scan timing, using a method described below. The scan scheduler 14 then outputs the scan schedule to the network scanner 11 and controls the network scanner 11 to execute a network scan according to the scan schedule.

Figure 3 is a conceptual diagram of a correspondence table stored in the host information database 13 shown in Figure 2. Note that correspondence table TBL1 is a correspondence table used when determining the network type.

3, correspondence table TBL1 includes a time t, an IP address Add _i (i=1 to m, m is the total number of terminal devices), an IP address Add _{i_j} , a domain name DN _i , a base station, a scan response SR _i , a scan response delay SRTT _i , a provisional judgment, a provisional judgment count, and a final judgment. The time t, IP address Add _i , IP address Add _{i_j} , domain name DN _i , base station, scan response SR _i , scan response delay SRTT _i , provisional judgment, provisional judgment count, and final judgment are associated with each other.

Time t is expressed as YYYY/MM/DD/hh/mm/ss (year/month/day/hour/minute/second). Time t represents the time when a Ping packet in a network scan is sent to the terminal device that is the target of the network scan.

The IP address Add _i consists of the global IP address of the terminal device that is the target of the network scan.

IP address Add _{i_j} is composed of the IP addresses of routers existing between the network scanning device 1 and the terminal device (terminal device having IP address Add _i ) that is the target of the network scan. IP addresses Add _{1_1} and Add _{1_2} are associated with IP address Add ₁ and represent routers existing between the network scanning device 1 and the terminal device having IP address Add _1. IP addresses Add _{2_1} , Add _{2_2} and Add _{2_3} are associated with IP address Add ₂ and represent routers existing between the network scanning device 1 and the terminal device having IP address Add _2. IP address Add _{3_1} is associated with IP address Add ₃ and represents a router existing between the network scanning device 1 and the terminal device having IP address Add ₃ . The same applies to IP addresses Add _{4_1} , Add _{4_2} , ..., IP addresses Add _{m-1_1} and IP address Add _{m_1} . Therefore, "j" in IP address Add _{i_j} is a positive integer. Also, IP addresses Add _{1_1} , Add _{1_2} and IP addresses Add _{2_1} , Add _{2_2} , Add _{2_3} may match each other, may partially match each other, or may be different from each other. The same is true for the IP addresses Add _{1_1} , Add _{1_2} of the router shown in FIG. 3; IP addresses Add _{2_1} , Add _{2_2} , Add _{2_3} ; IP address Add _{3_1} ; IP addresses Add _{4_1} , Add _{4_2} ; ...; and between any multiple IP addresses of IP address Add _{m-1_1} and IP address Add _{m_1} (between IP addresses Add _{2_1} , Add _{2_2} , Add _{2_3} and IP addresses Add _{4_1} , Add _{4_2} , and between IP addresses Add _{4_1} , Add _{4_2} and IP address Add _{m-1_1} , etc.).

The domain name DN _i is converted based on the IP address Add _i using a PTR (Pointer record).

The base station, the scan response SR _i , the scan response delay SRTT _i , the tentative decision, the number of tentative decisions, and the final decision are provided corresponding to the IP address Add _i of the terminal device i.

The scan response SR _i is associated with the IP address Add _i of the terminal device i. In the correspondence table TBL1, the scan responses SR _{1_1} , SR _{1_2} , ... represent the scan responses from the IP address Add ₁ of the terminal device 1, the scan responses SR _{3_1} , SR _{3_2} , ... represent the scan responses from the IP address Add ₃ of the terminal device 3, and the scan responses SR _{m-1_1} , SR _{m-1_2} , ... represent the scan responses from the IP address Add _m-1 of the terminal device m-1. Note that the reason that there are multiple scan responses _{SR i for} one IP address Add i is because a network scan is performed on multiple ports of one IP address Add _i .

Each of the scan responses SR _{1_1} , SR _{1_2} , ...; the scan responses SR _{3_1} , SR _{3_2} , ...; the scan responses SR _{m-1_1} , SR _{m-1_2} , ... is "1" when a scan response is returned, and is "0" when no scan response is returned.

In this embodiment of the present invention, since it is desired to know the results of the network scan for each IP address Add _i of terminal device i, as described above, the scan response SR _i is associated with the IP address Add _i of terminal device i. Therefore, when a scan response is returned from at least one of the multiple port numbers of terminal device i, the scan response SR _i is 1, and when a scan response is not returned from any of the multiple port numbers of terminal device i, the scan response SR _i is 0.

3, for scan responses SR _i returned from a terminal device, the number of scan responses SR _i returned is stored in the host information database 13. As described above, a network scan is performed by sending g Ping packets, so a maximum of g scan responses SR _i are returned. If at least one scan response SR _{i out of the g scan responses SR i} is returned, then the number of scan responses SR _i returned is stored in correspondence table TBL1 instead of "1 _" indicating that a scan response has been returned.

The scan response delay SRTT _i is the time from when a Ping packet is transmitted until a scan response SR _i is returned. In the correspondence table TBL1, the scan response delays SRTT _{1_1} , SRTT _{1_2} , ... represent the scan response delays when a network scan is executed for the IP address Add ₁ of the terminal device 1, the scan response delays SRTT _{3_1} , SRTT _{3_2} , ... represent the scan response delays when a network scan is executed for the IP address Add ₃ of the terminal device 3, and the scan response delays SRTT _{m-1_1} , SRTT _{m-1_2} , ... represent the scan response delays when a network scan is executed for the IP address Add _m-1 of the terminal device m-1. Since the scan response delay SRTT _i is measured based on the return of the scan response SR _i , the same number of scan response delays SRTT _i as the number of returned scan responses SR _i are stored in the correspondence table TBL1. Therefore, for example, the scan response delays SRTT _{1_1} , SRTT _{1_2} , ... are associated with the scan responses SR _{1_1} , SR _{1_2} , ..., respectively. The same is true for the scan response delays SRTT _{3_1} , SRTT _{3_2} , ... other than the scan response delays SRTT _{1_1} , SRTT _{1_2} , ....

The tentative determination is made based on the type of network determined by the method described below. The type can be one of types 1 to 5. Type 1 is Wired LAN, Type 2 is WLAN, Type 3 is Wi-SUN, Type 4 is LoRa, and Type 5 is LTE.

The provisional judgment count is made up of one or more provisional judgment counts associated with one or more types included in the provisional judgment. The provisional judgment counts Nd_1_1, Nd_1_2, and Nd_1_3 represent the provisional judgment counts of the network type when a network scan is performed on the IP address Add ₁ of the terminal device 1, the provisional judgment counts Nd_3_1 and Nd_3_2 represent the provisional judgment counts of the network type when a network scan is performed on the IP address Add ₃ of the terminal device 3, and the provisional judgment counts Nd_m-1_1, Nd_m-1_2, Nd_m-1_3, and Nd_m-1_4 represent the provisional judgment counts of the network type when a network scan is performed on the IP address Add _m-1 of the terminal device m-1. The provisional judgment count is made up of the number of times the type of the target network is provisionally judged to be a type Type (any of types Type 1 to Type 5). For example, the provisional determination count Nd_1_1 is the number of times the type of the target network is provisionally determined to be Type 3. The same is true for the other provisional determination counts Nd_1_2, Nd_1_3, Nd_3_1, Nd_3_2, Nd_m-1_1, Nd_m-1_2, Nd_m-1_3, and Nd_m-1_4.

The final judgment is made up of the provisional judgment associated with the largest number of provisional judgments. For example, the final judgment made up of the type Type 3 is made up of the type Type 3 associated with the provisional judgment count Nd_1_1 having the largest number of provisional judgments among the types Type 1, Type 3, and Type 4. The reason why the final judgment associated with the IP address Add _m-1 is "unknown" is because the provisional judgment counts Nd_m-1_1, Nd_m-1_2, Nd_m-1_3, and Nd_m-1_4 are the largest and are the same number. In this way, when there are multiple network types with the same number of provisional judgments, the network type is determined to be "unknown". Note that "unknown" indicates that the type of the network is unknown.

Figure 4 is a conceptual diagram of another correspondence table stored in the host information database 13 shown in Figure 2. Note that correspondence table TBL2 is a correspondence table used when estimating the number of hops in a wireless communication section of a network.

Referring to FIG. 4, correspondence table TBL2 includes the number of scans s (s=1 to S) and correspondence table TBL3_s. The number of scans s and correspondence table TBL3_s are associated with each other.

The number of scans s indicates the number of times a network scan has been performed. The number of scans S indicates the number of scans performed at the time the number of hops is estimated. The number of scans 1 to S-1 indicates the number of times a network scan has been performed in the past.

Correspondence table TBL2 always contains S (S is an integer equal to or greater than 2) correspondence tables TBL3_1 to TBL3_S. When correspondence table TBL3_S+1, which is newer than correspondence table TBL3_S, is stored in correspondence table TBL2, the oldest correspondence table TBL3_1 is deleted.

Fig. 5 is a conceptual diagram of correspondence table TBL3 stored in correspondence table TBL2 shown in Fig. 4. Referring to Fig. 5, correspondence table TBL3 includes time t', IP address _Add'i , port number _PNr , scan response _SRi , scan response delay _SRTTi , _αi , minimum value _{αi_MIN} , average value _{αi_AVE} , attribute _ATBi , average delay _{RRTTi_AVE} of the wired communication section, minimum delay _{WRTTi_MIN} of the wireless communication section, and number of hops _Ni .

Time t', IP address Add' _i , port number PN _r , scan response SR _i , scan response delay SRTT _i , α _i , minimum value α _{i _MIN} , average value α _{i _AVE} , attribute ATB _i , average delay of wired communication section RRTT _{i _AVE} , minimum delay of wireless communication section WRTT _{i _MIN} and number of hops N _i are mutually associated.

In the correspondence table TBL3, the domain name DN _i and the base station are not stored, but in reality, the domain name DN _i and the base station are also stored.

Time t' is expressed as YYYY/MM/DD/hh/mm/ss (year/month/day/hour/minute/second). Time t' represents the time when a Ping packet in a network scan is sent to the terminal device that is the target of the network scan.

The IP address _Add'i consists of the global IP address of the terminal device that is the target of the network scan.

The port number PN _r is the port number of the IP address Add' _i . The scan response SR _i and the scan response delay SRTT _i are as described in Fig. 3. In the correspondence table TBL3, the scan response SR _i and the scan response delay SRTT _i are associated with the port number PN _r .

α _i is the result of subtracting the average delay RRTT _{i_AVE} in the wired communication section from the scan response delay SRTT _i , and _is associated with the port number PN _r . In correspondence table TBL3, α _{1_1} and α _{1_2} represent the α _i when a network scan is performed on IP address Add' ₁ , α _{2_1} and α _{2_2} represent the α _i when a network scan is performed on IP address Add' ₂ , α _{3_1} , α _{3_2} , and α _{3_3} represent the α _i when a network scan is performed on IP address Add' ₃ , α _{m-1_1} , α _{m-1_2} , and α _{m-1_3} represent the α _i when a network scan is performed on IP address Add' _m-1 , and α _{m_1} , α _{m_2} , and α _{m_3} represent the α _i when a network scan is performed on IP address Add' _m .

α _{i _MIN} is the minimum value of α _i and is associated with the IP address Add' _i . The minimum value α _{i _MIN} is determined by selecting the index of α _i having the minimum value among one or more α _i associated with the port number PN _r . That is, when there are a plurality of α _i associated with the port number PN _r , such as α ₁ , α ₂ , α ₃ (for example, α ₂ is the minimum value), the minimum value α _{i _MIN} is made up of the minimum value α ₂ having the index "2" among the plurality of α _i (α ₁ , α ₂ , α ₃ ). In this case, when there are a plurality of minimum values (for example, α ₁ , α ₂ are the minimum values) among the plurality of α _i (α ₁ , α ₂ , α ₃ ), the minimum value α _{i _MIN} is made up of any one of the plurality of minimum values (=α ₁ , α ₂ ). On the other hand, when there is one α _i associated with the port number PN _r , the minimum value α _{i _MIN} is made up of that one α _i .

The minimum value _{αi_MIN} is always updated when the first network scan is performed. When a network scan is performed for the second or subsequent times, the minimum value _{αi_MIN} is calculated by comparing the _αi calculated based on the scan response delay _SRTTi obtained in the newly performed network scan with the minimum value _{αi_MIN} already recorded in the correspondence table TBL3, and if _αi is smaller than the recorded minimum value _{αi_MIN} , the recorded minimum value _{αi_MIN} is replaced with the newly calculated _αi to update the minimum value _{αi_MIN} . On the other hand, if the newly calculated _αi is equal to or larger than the recorded minimum value _{αi_MIN} , the minimum value _{αi_MIN} is not updated.

α _{i _AVE} is the average value of α _i and corresponds to the IP address Add′ _i . The average value α _{i _AVE} is made up of D ^S _{α _ave} calculated by the following formula.

In formula (1), D ^S _{α_ave} is the average value of α _i when the Sth network scan is performed. Furthermore, D ^s _{α_q} is α _i corresponding to the qth (q is a positive integer) scan response when the sth network scan is performed. Furthermore, N ^s _α is the number of α _i when the sth network scan is performed. In correspondence table TBL3, α _i is associated with port number PN _r , so N ^s _α ranges from 1 to P _total (P _total is the total number of ports). And the denominator in formula (1) represents the total number of α _i when Sth network scans are performed.

In this way, the average value α _{i _AVE} is made up of the average value of α _i in the past (1st to S−1th) network scans and α _i in the network scan when the number of hops is estimated.

Note that calculating the average value α _{i _AVE} (D ^S _{α — ave} =) using equation (1) corresponds to updating the average value α _{i _AVE} .

Attribute ATBi consists of the final judgment stored in the correspondence table TBL1 in Figure 3.

The average delay RRTT _{i_AVE} in the wired communication section is the average delay in the wired communication section in the network assumed by the network scanning device 1 described later. The average delay RRTT _{i_AVE} in the wired communication section is obtained in advance by an experiment or a simulation, and is stored in the correspondence table TBL3.

The minimum delay WRTT _{i_MIN} in the wireless communication section is the minimum delay in the wireless communication section in the network assumed by the network scanning device 1 described later. The minimum delay WRTT _{i_MIN} in the wireless communication section is obtained in advance by an experiment or a simulation, and is stored in the correspondence table TBL3.

The number of hops N _i is an estimated number of hops in a wireless communication section in a network when a network scan is actually performed on a terminal device. If the number of hops N _i has not been estimated, an initial value that is an invalid value is stored in N _i .

Note that each of the correspondence tables TBL3_1 to TBL3_S shown in FIG. 4 is made up of the correspondence table TBL3 shown in FIG. 5.

6 is a conceptual diagram of a scan schedule, and the scan schedule SCSHD has a total scan time length T _S _total, and includes T _S (T _S is an integer equal to or greater than 1) scan timings 1 _S to T _S .

The total scan time length T _S _total is set to, for example, one day, and each of scan timings 1 _S to _TS has a time length of, for example, one hour. The scan timings t _S (t _S =1 _S to _TS ) include a start time t _start , an end time t _end , target addresses Add ₁ to Add _m (m is an integer equal to or greater than 1), and communication speeds V ₁ to V _m .

The start time t _start represents the time when the network scan starts at the scan timing t _S , and the end time t _end represents the time when the network scan ends at the scan timing t _S. Therefore, the network scanner 11 ends the network scan when the end time t _end arrives at the scan timing t _S.

Each of the target addresses Add ₁ to Add _m is _a global IP address, and represents m terminal devices that _are targets of the network scan.

The communication speeds V ₁ to V _{m are the communication speeds of scan packets when a network scan is performed, and correspond to the target addresses Add 1 to Add m} , respectively.

Therefore, when the network scanner 11 performs a network scan at a scan timing _tS , it transmits g scan packets to the target addresses Add ₁ to Add _m at communication speeds V ₁ to V _m , respectively.

Each of the scan timings 1 _S to (t−1) _S and (t+1) _S to T _S other than the scan timing t _S has the same configuration as the scan timing t _S shown in FIG.

The scan timings _1S to _TS may have the same time length (=t _end -t _start ) or may have different time lengths (=t _end -t _start ). Also, the scan timings _1S to _TS may have the same number of IP addresses or may have different numbers of IP addresses.

Moreover, the scan timing _tS does not mean a single time, but is a concept having a predetermined time length from the start time _tstart to the _end time tend.

Explains how to determine the type of network being scanned.

When the scan analysis manager 12 finishes a network scan at one scan timing _tS , it refers to the correspondence table TBL1 of the host information database 13 and reads out the scan response SR _i and the scan response delay SRTT _i associated with one IP address Add _i .

Then, the scan analysis manager 12 detects TTL _i included in the scan response SR _i . In this case, the scan analysis manager 12 detects TTL ₁₁ , TTL ₁₂ , ... from the scan responses SR ₁₁ , SR ₁₂ , ... associated with the IP address Add ₁ , respectively.

TTL indicates the number of hops a Ping packet must make before returning from the terminal device to the network scanning device 1. Since one hop is added each time a Ping packet passes through a router, TTL is a value indicating the number of routers the Ping packet passed through before returning from the terminal device to the network scanning device 1 + 1.

When scan analysis manager 12 detects _TTL11 , _TTL12 , ..., it detects scan response delays _SRTT11 , _SRTT12 , ... associated with scan responses _SR11 , _SR12 , .... Then, scan analysis manager 12 calculates one-hop delay time based on _TTL11 , _TTL12 , ... and scan response delays _SRTT11 , _SRTT12 , ....

Figure 7 is a diagram for explaining a method for calculating one-hop delay time. Referring to Figure 7, there are K (K is an integer equal to or greater than 1) routers between the network scanning device 1 and the terminal device that is the target of the network scan.

A Ping packet containing TTL=1 reaches Router 1, a Ping packet containing TTL=2 reaches Router 2, and so on. A Ping packet containing TTL=K-1 reaches Router K-1, a Ping packet containing TTL=K reaches Router K, and a Ping packet containing TTL=K+1 reaches the terminal device.

When the terminal device receives the Ping packet, it transmits a scan response SR _i consisting of a Ping packet. The scan response SR _i reaches the network scanning device 1 via various routes between the terminal device and the network scanning device 1. When the scan response SR _i reaches the network scanning device 1, it includes a TTL consisting of the number of routers that it has passed through.

Therefore, in this embodiment of the invention, the minimum TTL among the TTLs included in the scan response that arrives at the network scanning device 1 from the terminal device is set as the number of stages in the network path. In FIG. 7, the minimum TTL is set to "K+1".

Then, the scan analysis manager 12 detects the scan response delay SRTT associated with the scan response SR from the router K one stage before the terminal device from the correspondence table TBL1 of the host information database 13, and sets the detected scan response delay SRTT as the last hop RTT. In other words, the last hop RTT is the scan response delay for the router K that is one stage before the number of network stages K+1 represented by the TTL included in the Ping packet that arrived at the network scanning device 1 from the terminal device.

K routers 1 to K arranged between the network scanning device 1 and the terminal device control the route when a Ping packet is transmitted between the network scanning device 1 and the terminal device. Therefore, if the router among the K routers 1 to K that returned a scan response SR and is closest to the terminal device is defined as the "nearest router," then the number of route stages when passing through one or more routers from router 1 to the nearest router is defined as the "route control stages." As a result, the one or more routers from router 1 to the nearest router usually consist of K routers 1 to K, and the number of route control stages when passing through K routers 1 to K is K.

The scan analysis manager 12 calculates the delay time for one hop using formula (1).

One-hop delay time=(Last hop RTT)/(Number of routing stages) (1)
The reason for calculating the one-hop delay time using the last hop RTT is that when a packet containing information to be transmitted is transmitted to a destination terminal device, the destination terminal device ultimately receives the packet via one router, and therefore the network consisting of router K and the terminal device is treated as the target network that is the target of the network scan. Also, after a Ping packet containing TTL=K+1 reaches router K, the scan response SR that passes through router K was transmitted by the terminal device, and it is not possible to distinguish between the scan response delay RTT from the network scanning device 1 to router K and the scan response delay RTT from the network scanning device 1 to the terminal device.

As a result, the delay time for one hop is the average delay time of the delay times at K routers 1 to K.

The delay time per hop may also be the average value of multiple delay times per hop calculated for multiple terminal devices.

Thus, in this embodiment of the invention, the network scan is performed in a multi-stage network in which there are multiple routers between the network scanning device 1 and the terminal device that is the target of the network scan.

After calculating the one-hop delay time, the scan analysis manager 12 multiplies the one-hop delay time by a number of route control stages, K of which is one stage smaller than the number of route stages (= K + 1) in the network, to calculate the route delay _{RRTT_TYPE} (= one-hop delay time × number of route control stages K).

The reason why the last hop RTT is divided by the number of routing stages K in formula (1) to calculate the delay time of one hop, and the route delay RRTT is calculated by multiplying the delay time of one hop by the number of routing stages K, is as follows.

Since the last hop RTT actually varies, the last hop RTT is divided by the number of routing stages K to calculate the average delay time when passing through one router as the delay time of one hop, and the calculated delay time of one hop is multiplied by the number of routing stages K to calculate the route delay _{RRTT_TYPE} , thereby rounding off the variation in the last hop RTT.

Then, if the scan response SR _i is not returned from the router K, the scan response delay RTT _i from when the network scanning device 1 transmits a Ping packet until when it receives the scan response SR _i from the router K-1 may be set as the last hop RTT, and the route delay RRTT _{_TYPE} may be calculated by the above-mentioned method, and if the scan response SR _i is not returned from the routers K-1 and K, the scan response delay RTT i from when the network scanning device 1 transmits a Ping packet until when it receives the scan response SR _i from the router K-2 may be set as the last hop RTT, and the route delay RRTT _{_TYPE} may be calculated by the above-mentioned method. Therefore, in general, the scan response delay RTTT _i returned from the closest router among the multiple routers 1 to K may be set as the last hop _RTT , and the route delay RRTT _{_TYPE} may be calculated by the above-mentioned method.

After calculating the route delay _{RRTT_TYPE} , the scan analysis manager 12 detects the scan response delay SRTT associated with the scan response SR from the terminal device from the correspondence table TBL1 of the host information database 13. Then, the scan analysis manager 12 subtracts the route delay _{RRTT_TYPE} (= delay time of one hop × number of route control stages K) from the scan response delay SRTT to calculate the transmission delay ARTT of the access system portion (= scan response delay RTT - route delay _{RRTT_TYPE} (= delay time of one hop × number of route control stages K)).

If the scan response SR _i is not returned from the router K, the one-hop delay time may be calculated using the above-mentioned method, and the calculated one-hop delay time may be multiplied by a value obtained by subtracting 1 from the number of stages in the multistage network (i.e., the number of network stages from the network scanning device 1 to the router K (= the router located closest to the terminal device)) to calculate the route delay _{RRTT_TYPE} . In this way, even if the scan response SR _i is not returned from the router K, the delay from the router K to the terminal device can be found as the transmission delay ARTT of the access system portion.

Figure 8 shows a table showing the correspondence between network type, minimum scan response delay, and average scan response delay.

Referring to FIG. 8, correspondence table TBL4 includes network type, minimum scan response delay, and average scan response delay. The minimum scan response delay and the average scan response delay are associated with the network type.

Network types include Wired LAN, WLAN, Wi-SUN, LoRa and LTE.

The minimum scan response delay of 0.310 ms and the average scan response delay of 0.41 ms are associated with Wired LAN. The minimum scan response delay of 0.839 ms and the average scan response delay of 2.16 ms are associated with WLAN. The minimum scan response delay of 180 ms and the average scan response delay of 460.4 ms are associated with Wi-SUN. The minimum scan response delay of 3808 ms and the average scan response delay of 5250 ms are associated with LoRa. The minimum scan response delay of 12.5 ms and the average scan response delay of 19.3 ms are associated with LTE.

Thus, Wired LAN, WLAN, Wi-SUN, LoRa and LTE have different minimum or average scan response delays.

Then, the minimum scan response delay or the average scan response delay constitutes a threshold value DT_th for determining the type of the target network.

The scan analysis manager 12 holds a correspondence table TBL4. Then, when the scan analysis manager 12 calculates the transmission delay ARTT, it compares the calculated transmission delay ARTT with a threshold value DT_th, and provisionally determines that the network type associated with the threshold value DT_th that is closest to the transmission delay ARTT is the type of the target network.

Figure 9 shows the relationship between scan response delay and the number of network scans when the network type is Wired LAN.

In Figure 9, the vertical axis represents the scan response delay, and the horizontal axis represents the number of network scans. Figure 9 also shows the relationship between the measured scan response delay and the number of network scans.

Referring to Figure 9, in a wired LAN, the scan response delay is generally distributed between 0.30 [ms] and 0.55 [ms] for up to 1000 network scans.

Figure 10 shows the probability distribution function of scan response delay when the network type is Wired LAN.

In FIG. 10, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to FIG. 10, the average scan response delay is 0.41 [ms], the minimum scan response delay is 0.310 [ms], and the maximum scan response delay is 0.560 [ms].

Figure 11 shows the relationship between scan response delay and the number of network scans when the network types are WLAN, Wi-SUN, and LoRa.

In Figure 11, the vertical axis represents the scan response delay, and the horizontal axis represents the number of network scans. Figure 11 also shows the relationship between the measured scan response delay and the number of network scans.

Referring to FIG. 11, the scan response delay differs significantly between WLAN, Wi-SUN, and LoRa for up to 1500 network scans. The scan response delay is smallest for WLAN, second smallest for Wi-SUN, and largest for LoRa.

Figure 12 shows the probability distribution function of scan response delay when the network type is WLAN.

In FIG. 12, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to FIG. 12, the average scan response delay is 2.16 [ms], and the minimum scan response delay is 0.839 [ms].

Figure 13 is a diagram showing the probability distribution function of the scan response delay when the network type is Wi-SUN. In Figure 13, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to Figure 13, the average scan response delay is 460.4 [ms], and the minimum value of the scan response delay is 180 [ms].

Figure 14 is a diagram showing the probability distribution function of the scan response delay when the network type is LoRa. In Figure 14, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to Figure 14, the average scan response delay is 5250 [ms], and the minimum value of the scan response delay is 3808 [ms].

When the network type is LTE, the minimum scan response delay and average scan response delay values were determined based on the distribution of the measured scan response delays in the same manner as for Wired LAN, WLAN, Wi-SUN, and LoRa described above.

The scan analysis manager 12 repeatedly performs the tentative judgment until the termination condition is satisfied. The termination condition is either the following termination condition 1 or termination condition 2.

(Termination condition 1)
When provisional determination is performed a predetermined number of times Z, Z is, for example, 10 times.

(Termination condition 2)
When the number of provisional judgments for a certain network type becomes dominant: For example, when the number of provisional judgments for a certain network type becomes Z/2 or more.

In addition, when using termination condition 1, if the number of provisional judgments does not reach Z within a specified time, the scan analysis manager 12 judges the network type to be "unknown."

The method for estimating the number of hops will now be described. Figure 15 is a conceptual diagram of a network. Referring to Figure 15(a), network NW1 includes a network scanning device 1 (= network scanner 11), a wired router 2, Wi-SUN routers 3 and 4, and a Wi-SUN terminal device 5.

Network NW1 is the network used when performing a network scan on a terminal device.

The sections between the network scanner 11 and the wired router 2 and between the wired router 2 and the Wi-SUN router 3 are wired communication sections.

The sections between Wi-SUN router 3 and Wi-SUN router 4, and between Wi-SUN router 4 and Wi-SUN terminal device 5, are wireless communication sections.

In this way, network NW1 consists of a multi-hop wired communication section and one or more hop wireless communication sections.

Referring to FIG. 15(b), the network NW2 includes a network scanning device 1 (= network scanner 11), wired routers 2 and 6, a Wi-SUN router 4, and a Wi-SUN terminal device 5.

Network NW2 is the network assumed by the network scanning device 1 (= network scanner 11).

The sections between the network scanner 11 and the wired router 2, between the wired router 2 and the wired router 6, and between the wired router 6 and the Wi-SUN router 4 are wired communication sections.

The section between the Wi-SUN router 4 and the Wi-SUN terminal device 5 is a wireless communication section.

In this way, network NW2 consists of a multi-hop wired communication section and a one-hop wireless communication section.

Network NW1 consists of networks NW1-1 and NW1-2, and network NW2 consists of networks NW2-1 and NW2-2.

Figure 16 is a conceptual diagram of delay times in networks NW1-1 and NW2-1. Referring to Figure 16, delay time SRTT_NW1-1 indicates the delay time between the network scanner 11 and the Wi-SUN terminal device 5 in network NW1-1, and delay time SRTT_NW2-1 indicates the delay time between the network scanner 11 and the Wi-SUN terminal device 5 in network NW2-1.

The delay time SRTT_NW1-1 consists of the delay time (1) between the network scanner 11 and the wired router 2, the delay time (2) between the wired router 2 and the Wi-SUN router 3, the delay time (3) between the Wi-SUN router 3 and the Wi-SUN router 4, and the delay time (4) between the Wi-SUN router 4 and the Wi-SUN terminal device 5.

The delay times (1) and (2) are the delay times RRTT of the wired communication section, and the delay times (3) and (4) are the delay times WRTT of the wireless communication section.

Therefore, the delay time SRTT_NW1-1 consists of the delay time RRTT of the two wired communication sections and the delay time WRTT of the two wireless communication sections.

The delay time SRTT_NW2-1 consists of the delay time (1) between the network scanner 11 and the wired router 2, the delay time (2) between the wired router 2 and the wired router 6, the delay time (3) between the wired router 6 and the Wi-SUN router 4, and the delay time (4) between the Wi-SUN router 4 and the Wi-SUN terminal device 5.

The delay times (1), (2), and (3) are the delay times RRTT of the wired communication section, and the delay time (4) is the delay time WRTT of the wireless communication section.

Therefore, the delay time SRTT_NW2-1 consists of the delay time RRTT of three wired communication sections and the delay time WRTT of one wireless communication section.

The delay time SRTT_NW1-1 is an actual measured value, and the delay time SRTT_NW2-1 is recognized in determining the attributes of the terminal device.

The delay times (3) and (4) of the wireless communication sections included in the delay time SRTT_NW1-1 are different from the delay time (4) of the wireless communication section included in the delay time SRTT_NW2-1.

The delay time (4) of the wireless communication section included in the delay time SRTT_NW2-1 is calculated by subtracting the delay times (1), (2), and (3) of the wired communication section included in the delay time SRTT_NW2-1 from the actually measured scan response delay SRTT (= the scan response delay SRTT _i included in the correspondence table TBL3). The result of this subtraction is α, which corresponds to the delay time (4) of the wireless communication section in the network NW2-1.

The average delay RRTT _{i_AVE} of the wired communication section included in the correspondence table TBL3 is an average delay time obtained in advance by an experiment or a simulation, so α is calculated by α=(SRTT _i -3×RRTT _{i_AVE} ).

In addition, the minimum value WRTT _{i_MIN} of the delay time WRTT in one wireless communication section (=the section between the Wi-SUN router 4 and the Wi-SUN terminal device 5) in the network NW2-1 is also obtained in advance by experiment or simulation and stored in the correspondence table TBL3. The minimum value WRTT _{i_MIN} is the minimum value of the delay time in one-hop wireless communication.

Therefore, the number of hops in the wireless communication section is estimated by comparing the calculated α with the minimum value WRTT _{i_MIN} . More specifically, the number of hops is estimated by determining how many times α is larger than the minimum value WRTT _{i_MIN} .

Figure 17 is a conceptual diagram of delay times in networks NW1-2 and NW2-2. Network NW1-2 is a network in which the wired router 2 in network NW1-1 has been replaced with a Wi-SUN router 7.

In network NW1-2, the section between network scanner 11 and Wi-SUN router 7 is a wired communication section, while the sections between Wi-SUN router 7 and Wi-SUN router 3, between Wi-SUN router 3 and Wi-SUN router 4, and between Wi-SUN router 4 and Wi-SUN terminal device 5 are wireless communication sections.

Therefore, network NW1-2 is a network consisting of a one-hop wired communication section and a three-hop wireless communication section.

Like network NW2-1, network NW2-2 consists of a three-hop wired communication section and a one-hop wireless communication section. However, the delay time (4) of the one-hop wireless communication section in network NW2-2 is greater than the delay time (4) of the one-hop wireless communication section in network NW2-1. This is for the following reasons.

For example, the delay time in a wired LAN is a minimum of 0.31 [msec], an average of 0.41 [msec], and a maximum of 0.56 [msec]. On the other hand, the delay time in a Wi-SUN is a minimum of 180 [msec], an average of 511 [msec], and a maximum of 1389 [msec].

In addition, since network NW1-2 includes one wired communication section and three wireless communication sections, and network NW1-1 includes two wired communication sections and two wireless communication sections, network NW1-2 includes more wireless communication sections than network NW1-1. As described above, the delay time of the wireless communication section (100 to 1000 [msec]) is much greater than the delay time of the wired communication section (less than 1 [msec]), so the scan response delay SRTT actually measured in network NW1-2, which replaces one wired communication section of network NW1-1 with one wireless communication section, is greater than the scan response delay SRTT actually measured in network NW1-1. Therefore, the delay time (4) of the wireless communication section of one hop in network NW2-2 is greater than the delay time (4) of the wireless communication section of one hop in network NW2-1.

Then, α is calculated by the method described in FIG. 16, and the calculated α is compared with the minimum delay WRTT _{i_MIN} to estimate the number of hops in the wireless communication section.

In the embodiment of the present invention, there are two methods for estimating the number of hops in a wireless communication section.
(I) Estimate the number of hops by comparing α _i with a threshold Th _{i — N} (N=1, 2, 3, . . . ).
(II) The number of hops is calculated using α _i and thresholds Th _{i — 1} and Th _{i — 2} .

Fig. 18 is a conceptual diagram of thresholds Th _{i_N} . Referring to Fig. 18, Th _{i_1} is a threshold between 1 hop and 2 hops, Th _{i_2} is a threshold between 2 hops and 3 hops, and Th _{i_3} is a threshold between 3 hops and 4 hops.

A sample of α _i of a terminal device communicating in one hop is compared with a threshold value Th _{i_1} , and if α _i is less than the threshold value _{Th_1} , the number of hops is estimated to be "1", and if α _i is greater than or equal to the threshold value _{Th_1} , α _i is compared with a threshold value Th _{i_2} .

If α _i is less than a threshold Th _{i — 2} , the number of hops is estimated to be “2”.

In addition, a sample of α _i of a terminal device communicating in two hops is compared with a threshold value Th _{i_2} , and if α _i is less than the threshold value Th _{i_2} , the number of hops is estimated to be "2", and if α _i is greater than or equal to the threshold value Th _{i_2} , α _i is compared with a threshold value Th _{i_3} .

Furthermore, a sample of α _i of a terminal device communicating over three hops is compared with a threshold value Th _{i_3} , and if α _i is less than the threshold value Th _{i_3} , the number of hops is estimated to be "3", and if α _i is greater than or equal to the threshold value Th _{i_3} , α _i is compared with a threshold value Th _{i_4} .

Thereafter, in a similar manner, α _i is compared with the threshold value Th _{i_N} , and when α _i satisfies Th _{i_N-1} ≦α _i <Th _{i_N} , the number of hops is estimated to be “N−1”.

When estimating the number of hops by the above (I) or (II), the minimum value α _{i _MIN} or the average value α _{i _AVE} of α _i is used.

Fig. 19 is a diagram for explaining a method for calculating the threshold value Th _{i_N} . Note that Fig. 19 explains a method for calculating the threshold value Th _{i_N} when the minimum value α _{i_MIN} of α _i is used as α _i .

19, the minimum value WRTT _{i_MIN} of the delay time WRTT _i in a wireless communication section of one hop is set as a reference value. Then, the average value RRTT _{i_AVE} of the delay time in one wired communication section is subtracted from the minimum value WRTT _{i_MIN} to calculate L _i . Here, the average value RRTT _{i_AVE} is subtracted from the minimum value WRTT _{i_MIN} in order to correct the misrecognition caused by the network scanner 11 misrecognizing the configuration of the network NW1 used in the network scan as the configuration of the network NW2.

After L _i is calculated, the calculated L _i is added to a reference value (=WRTT _{i_MIN} ) to calculate threshold value Th _{i_1} . Furthermore, L _i is added to threshold value Th _{i_1} to calculate threshold value Th _{i_2} . Furthermore, L _i is added to threshold value Th _{i_2} to calculate threshold value Th _{i_3} . Thereafter, threshold values Th _{i_4} to Th _{i_N} are calculated in a similar manner.

Therefore, the threshold value Th _{i_N} is calculated by the following formula.

When α _{i _MIN} satisfies α _{i _MIN} < Th _{i _1} , the number of hop stages is estimated to be "1", when α _{i _MIN} satisfies Th _{i _1} ≦ α _{i _MIN} < Th _{i _2} , the number of hop stages is estimated to be "2", when α _{i _MIN} satisfies Th _{i _2} ≦ α _{i _MIN} < Th _{i _3} , the number of hop stages is estimated to be "3", and similarly, when α _{i _MIN} satisfies Th _{i _N-1} ≦ α _{i _MIN} < Th _{i _N} , the number of hop stages is estimated to be "N-1".

Fig. 20 is a diagram for explaining another method for calculating the threshold value Th _{i_N} . Note that Fig. 20 explains a method for calculating the threshold value Th _{i_N} when the average value α _{i_AVE} of α _i is used as α _i .

With reference to FIG. 20, the midpoint (=1.5×RTT _{i_MIN} ) between WRTT _{i_MIN} and 2×WRTT _{i_MIN} is calculated, and the calculated midpoint (=1.5×WRTT _{i_MIN} ) is set as the reference value.

Then, L _i is added to a reference value (=1.5×WRTT _{i_MIN} ) to calculate threshold value Th _{i_1} . Also, L _i is added to threshold value Th _{i_1} to calculate threshold value Th _{i_2} . Furthermore, L _i is added to threshold value Th _{i_2} to calculate threshold value Th _{i_3} . Thereafter, threshold values Th _{i_4} to Th _{i_N} are calculated in a similar manner.

Therefore, the threshold value Th _{i_N} is calculated by the following formula.

When the average value α _{i_AVE} satisfies α _{i_AVE} < Th _{i — 1} , the number of hop stages is estimated to be "1", when the average value α _{i_AVE} satisfies Th _{i — 1} ≦ α _{i_AVE} < Th _{i —} 2, the number of hop stages is estimated to be "2", when the average value α _{i_AVE} satisfies Th _{i — 2} ≦ α _{i_AVE} < Th _{i — 3} , the number of hop stages is estimated to be "3", and similarly, when the average value α _{i_AVE} satisfies Th _{i_N-1} ≦ α _{i_AVE} < Th _{i_N} , the number of hop stages is estimated to be "N-1".

As described above, the threshold value Th _{i_N} is calculated by equation (2) or equation (3), and therefore the threshold value Th _{i_N} is generally calculated by the following equation.

In formula (4), STD is a reference value. Substituting the minimum delay WRTT _{i_MIN} into the reference value STD in formula (4) gives formula (2), and substituting 1.5×WRTT _{i_MIN} into the reference value STD in formula (4) gives formula (3). Therefore, formula (4) is a general formula for calculating the threshold value Th _{i_N} .

Fig. 21 is a diagram for explaining a method for estimating the number of hops using a threshold value Th _{i_N} . Note that in Fig. 21, the method for estimating the number of hops is explained using the scan response delay SRTT _i actually measured in the above-mentioned network NW1-2.

Referring to FIG. 21, α _i is calculated by subtracting the average delay RRTT _{i_AVE} in the wired communication section from the actually measured scan response delay SRTT _i using the method described above.

Then, α _i is compared with a threshold Th _{i_1} and it is determined that α _i is greater than the threshold Th _{i_1} . After that, α _i is compared with a threshold Th _{i_2} and it is determined that α _i is greater than the threshold Th _{i_2} . Furthermore, α _i is compared with a threshold Th _{i_3} and it is determined that α _i is smaller than the threshold Th _{i_3} . Therefore, the number of hops is estimated to be "3".

In FIG. 21, the number of hops can be estimated by the method described in FIG. 21 regardless of whether the minimum value α _{i _MIN} or the average value α _{i _AVE} of α _i is used.

Next, a method of calculating the number of hops using α _i and thresholds Th _{i — 1} and Th _{i — 2} will be described.

Fig. 22 is a diagram for explaining a method for calculating the number of hops using α _i and thresholds Th _{i_1} and Th _{i_2} . Note that Fig. 22 explains a method for estimating the number of hops using the scan response delay SRTT _i actually measured in the above-mentioned network NW1-2.

22, D _{i — 1} is calculated by subtracting a threshold value Th _{i — 1} from α _i , and D _{i — 2} is calculated by subtracting a threshold value Th _{i — 1} from a threshold value Th i — 2.

Then, it is determined whether _{Di_1} is negative. When _{Di_1} is negative, the number of hop stages is estimated to be "1". On the other hand, when _{Di_1} is not negative, the calculation result of 1 + Ceil[ _{Di_1} / _{Di_2} ] is estimated to be the number of hop stages. Here, Ceil[ _{Di_1} / _{Di_2} ] represents the output of an integer obtained by rounding up the result of dividing _{Di_1} by _{Di_2} . Therefore, in the example shown in FIG. 22, since α _i is larger than the threshold value Th _{i_2} , Ceil[ _{Di_1} / _{Di_2} ] = 2, and the number of hop stages is estimated to be "3".

In addition, in FIG. 22 as well, the number of hops can be estimated by the method described in FIG. 22 regardless of whether the minimum value α _{i _MIN} or the average value α _{i _AVE} of α _i is used.

The scan scheduler 14 creates a scan schedule by setting the communication speed of the scan packets in the network scan based on the estimated number of hops.

When estimating the number of hops in the wireless communication section of the network used in the network scan, lists LS1, LS2, LS3, and LS4 are created.

23 to 26 are conceptual diagrams of lists LS1 to LS4, respectively. Referring to Fig. 23, list LS1 includes an IP address Add' _{i_a} of a terminal device whose attribute has been determined, a minimum value α _{i_MIN_a} , and an average value α _{i_AVE_a} . The IP address Add' _{i_a} , the minimum value α _{i_MIN_a} , and the average value α _{i_AVE_a} correspond to each other. The "a" in the IP address Add' _{i_a} , the minimum value α _{i_MIN_a} , and the average value α _{i_AVE_a} indicates that the attribute has been determined.

24, list LS2 is made up of lists LS2-1 and LS2-2. List LS2-1 includes an IP address Add' _{i_up} of a terminal device whose minimum value α _{i_MIN} has been updated, and the updated minimum value α _{i_MIN_up} . The IP address Add' _{i_up} and the minimum value α _{i_MIN_up} are associated with each other. "up" in the IP address Add' _{i_up} and the minimum value α _{i_MIN_up} indicates that they have been updated.

The list LS2-2 includes an IP address Add" _{i_up} of a terminal device whose average value α _{i_AVE} has been updated, and the updated average value α _{i_AVE_up} . The IP address Add" _{i_up} and the average value α _{i_AVE_up} are associated with each other. "Up" in the IP address Add" _{i_up} and the average value α _{i_AVE_up} indicates that the address has been updated. The IP address Add" _{i_up} may be the same as the IP address _{Add'i_up} in the list LS2-1, or it may be different.

25, list LS3 includes an IP address _{Add'i_a_inv} , a minimum value _{αi_MIN_a_inv} , and an average value αi_AVE_a_inv of a terminal device whose attribute has been determined and whose number of hops is an initial value (invalid value). The IP address _{Add'i_a_inv} , the minimum value _{αi_MIN_a_inv} , and the average value _{αi_AVE_a_inv} are associated with each other. "a" in the IP address _{Add'i_a_inv} , the minimum value _{αi_MIN_a_inv , and the average value αi_AVE_a_inv indicates} that the attribute has been determined, and "inv" indicates that the number of hops is an initial value (invalid value).

26, list LS4 is made up of lists LS4-1 and LS4-2. List LS4-1 includes an IP address Add' _{i_a_up} of a terminal device whose attribute has been determined and whose minimum value α _{i_MIN} has been updated, and the updated minimum value α _{i_MIN_a_up} . The IP address Add' _{i_a_up} and the minimum value α _{i_MIN_a_up} are associated with each other. The "a" in the IP address Add' _{i_a_up} and the minimum value α _{i_MIN_a_up} indicates that the attribute has been determined, and "up" indicates that the attribute has been updated.

List LS4-2 includes an IP address Add" _{i_a_up} of a terminal device whose attribute has been determined and whose average value α _{i_AVE} has been updated, and the updated average value α _{i_AVE_a_up} . The IP address Add" _{i_a_up} and the average value α _{i_AVE_a_up} are mutually associated. In the IP address Add" _{i_a_up} and the average value α _{i_AVE_a_up} , "a" indicates that the attribute has been determined, and "up" indicates that it has been updated. The IP address Add" _{i_a_up} may be the same as the IP address _{Add'i_a_up} in list LS4-1, or it may be different.

Fig. 27 is a diagram for explaining a method of controlling the communication speed of a scan packet. Referring to Fig. 27, when the number of hop stages N _i is "2", the scan scheduler 14 controls the communication speed of the scan packet to 1/2 of the communication speed of one hop. Also, when the number of hop stages N _i is "3", the scan scheduler 14 controls the communication speed of the scan packet to 1/3 of the communication speed of one hop. Furthermore, when the number of hop stages N _i is "4", the scan scheduler 14 controls the communication speed of the scan packet to 1/4 of the communication speed of one hop. Similarly, when the number of hop stages N _i is "N", the scan scheduler 14 controls the communication speed of the scan packet to 1/N of the communication speed of one hop.

Figure 28 is a conceptual diagram showing control of the communication speed of scan packets. Referring to Figure 28, the number of hops in the wireless communication section is "2". If the communication speed of scan packets is not controlled, for example, scan packets are transmitted at a communication speed of 4 [packets/sec] in the wireless communication section (see (a) of Figure 28).

On the other hand, when the communication speed of the scan packets is controlled, for example, the scan packets are transmitted at a communication speed of 2 packets/sec in the wireless communication section (see (b) in FIG. 28).

Therefore, by controlling the communication speed of scan packets in a wireless communication section according to the number of hops, wireless resources in the wireless communication section can be reduced.

Figure 29 is a flowchart for explaining the operation of the network scanning device 1 shown in Figure 2.

Referring to FIG. 29, when operation of the network scanning device 1 is started, the scan analysis manager 12 determines the attributes of the terminal device (step S1).

Then, the scan analysis manager 12 estimates the number of multi-hop stages (step S2).

The scan scheduler 14 then creates a scan schedule reflecting the estimated number of hops (step S3), outputs the created scan schedule to the network scanner 11, and controls the network scanner 11 to execute a network scan according to the scan schedule.

The network scanner 11 receives the scan schedule from the scan scheduler 14 and executes a network scan according to the received scan schedule (step S4). This completes the operation of the network scanning device 1.

Figure 30 is a flow chart for explaining the detailed operation of step S1 in Figure 29. Referring to Figure 30, when the operation of the network scanning device 1 starts, the scan analysis manager 12 sets i = 1 (step S11). Then, the network scanner 11 transmits a Ping packet to perform a network scan (step S12).

Then, the scan analysis manager 12 measures the scan response delay (step S13).

Next, the scan analysis manager 12 calculates the transmission delay _ARTTi of the access system portion based on the number of network path stages and the scan response delay (step S14).

Then, the scan analysis manager 12 compares the transmission delay ARTT _i with a threshold value and provisionally determines the network type (step S15).

The scan analysis manager 12 then determines whether the termination condition for the provisional judgment is met (step S16). More specifically, the scan analysis manager 12 determines whether the termination condition for the provisional judgment is met by determining whether the above-mentioned termination condition 1 or termination condition 2 is met.

If it is determined in step S16 that the conditions for terminating the provisional judgment are not met, the scan analysis manager 12 determines whether a predetermined time has elapsed (step S17).

When it is determined in step S17 that the predetermined time has elapsed, the scan analysis manager 12 sets "unknown" as the final judgment result of the terminal device i (step S18).

On the other hand, if it is determined in step S17 that the predetermined time has not elapsed, the series of operations proceeds to step S12, and steps S12 to S17 are repeatedly executed until it is determined in step S16 that the termination condition for the provisional judgment is met before the predetermined time has elapsed.

Then, if it is determined in step S16 that the condition for terminating the provisional judgment is met, the scan analysis manager 12 determines whether the number of provisional judgments is dominant (step S19).

When it is determined in step S19 that the number of provisional judgments is dominant, the scan analysis manager 12 sets the provisional judgment result in which the number of provisional judgments has become dominant as the final judgment result for the terminal device i (step S20).

On the other hand, when it is determined in step S19 that the number of provisional judgments is not dominant, the scan analysis manager 12 sets the provisional judgment result with the greatest number of judgments as the final judgment result for the terminal device i (step S21).

Then, after step S18, step S20, or step S21, the scan analysis manager 12 determines whether i=m (step S22).

If it is determined in step S22 that i is not equal to m, the scan analysis manager 12 sets i to i+1 (step S23). After that, the series of operations proceeds to step S12, and steps S12 to S23 are repeatedly executed until it is determined in step S22 that i is equal to m.

If it is determined in step S22 that i=m, the scan analysis manager 12 records the final determination result in the correspondence table TBL1 of the host information database 13 (step S24). After step S24, the series of operations proceeds to step S2 in FIG. 29.

In the flowchart shown in FIG. 30, if it is determined in step S16 that the termination condition of the provisional judgment is satisfied by determining that the termination condition 2 described above (the number of provisional judgments becomes dominant) is satisfied, step S20 may be executed without executing steps S19 and S21.

Fig. 31 is a flowchart for explaining the detailed operation of step S14 in Fig. 30. Referring to Fig. 31, after step S13 in Fig. 30, scan analysis manager 12 detects TTL _i included in scan response SR _i from terminal device i, and sets the value K+1 of the detected TTL _i as the number of route stages in the network (step S141).

Then, the scan analysis manager 12 detects the scan response delay SRTT _K corresponding to the scan response SR _K from the router K located immediately upstream of the terminal device (step S142).

Thereafter, the scan analysis manager 12 divides the scan response delay SRTT _K by the number of routing stages K, which is the number of hops from the network scanning device 1 to the router K, to calculate the delay time per hop (step S143).

The scan analysis manager 12 then multiplies the one-hop delay time by the number of route control stages K from the network scanning device to router K to calculate the route delay (step S144).

Then, the scan analysis manager 12 calculates the transmission delay ARTT _i by subtracting the path delay from the scan response delay SRTT _i associated with the scan response SR _i from the terminal device i (step S145). After that, the series of operations proceeds to step S15 in FIG.

Figure 32 is a flowchart explaining the detailed operation of step S15 in Figure 30.

Referring to FIG. 32, after step S14 in FIG. 30, the scan analysis manager 12 reads out thresholds DT_th1 to DT_th5 for Wired LAN, WLAN, Wi-SUN, LoRa, and LTE networks from the correspondence table TBL4 that it holds (step S151).

In this case, the scan analysis manager 12 reads out threshold value DT_th1 as the threshold value for Wired LAN, threshold value DT_th2 as the threshold value for WLAN, threshold value DT_th3 as the threshold value for Wi-SUN, threshold value DT_th4 as the threshold value for LoRa, and threshold value DT_th5 as the threshold value for LTE.

The scan analysis manager 12 also reads the minimum scan response delay or average scan response delay from the correspondence table TBL4 as thresholds DT_th1 to DT_th5.

After step S151, the scan analysis manager 12 sets j=1 (step S152), and calculates the absolute value |ARTT _i -DT_thj| of the difference between the transmission delay ARTT _i and the threshold value DT_thj (step S153).

Then, the scan analysis manager 12 determines whether j= _{N_NW} (step S154), where _{N_NW} is the total number of networks.

When it is determined in step S154 that j is not equal to N _NW , the scan analysis manager 12 sets j to j + 1 (step S155). After that, the series of operations proceeds to step S153, and steps S153 to S155 are repeatedly executed until it is determined in step S154 that j is equal to N _NW .

If it is determined in step S154 that j= _NNW , the scan analysis manager 12 detects the minimum value from among the multiple absolute values |ARTT _i -DT_thj| (step S156).

The scan analysis manager 12 then determines whether there are multiple minimum values (step S157).

When it is determined in step S157 that there are multiple minimum values, the scan analysis manager 12 provisionally determines that the type of the target network is "unknown" (step S158).

On the other hand, when it is determined in step S157 that there are not multiple minimum values, the scan analysis manager 12 provisionally determines that the network type corresponding to the threshold value DT_thj used to calculate the minimum value is the type of the target network (step S159).

Then, after step S158 or step S159, the scan analysis manager 12 records the provisional judgment result and the number of provisional judgments in the host information database 13 (step S160). After that, the series of operations proceeds to step S16 in FIG. 30.

Figure 33 is a flowchart explaining the detailed operation of step S2 in Figure 29.

Referring to FIG. 33, after step S1 in FIG. 29, the scan analysis manager 12 creates a list LS1 of terminal devices whose attributes have been determined based on the correspondence table TBL3 in the host information database 13 (step S31). In this case, the scan analysis manager 12 creates the list LS1 of terminal devices whose attributes have been determined based on the correspondence table TBL3 (i.e., the correspondence table TBL3 at the time of estimating the number of hops) constituting the correspondence table TBL3_S in the correspondence table TBL2.

After step S31, scan analysis manager 12 updates the minimum value α MIN for all IP addresses Add i using the method described above based on correspondence table TBL3 (i.e., correspondence table TBL3 at the time of estimating the number of hops) that constitutes correspondence table _{TBL3_S} of correspondence table _TBL2 , and creates a list LS2 (= LS2-1) of terminal devices whose minimum value α _MIN has been updated (step S32).

After step S32, the scan analysis manager 12 creates a list LS3 of terminal devices whose attributes have been determined and whose hop count is the initial value (invalid value) based on list LS1 (step S33).

Then, the scan analysis manager 12 estimates the number of hops for all terminal devices included in the list LS3 (step S34).

Thereafter, the scan analysis manager 12 creates a list LS4 (=LS4-1) of terminal devices whose attributes have been determined and whose minimum value α _{i _MIN} has been updated based on the lists LS1 and LS2 (=LS2-1) (step S35).

The scan analysis manager 12 then estimates the number of hops for all terminal devices included in list LS4 (= LS4-1) (step S36). After that, the series of operations proceeds to step S3 in FIG. 29.

It should be noted that steps S35 and S36 are steps executed to update the already estimated number of hops since the minimum value α _{i _MIN} has been updated although the number of hops has already been estimated.

Fig. 34 is a flowchart for explaining the detailed operation of step S34 in Fig. 33. Note that the flowchart shown in Fig. 34 is a flowchart for estimating the number of hops by comparing the minimum value α _{i _MIN} of α with a threshold value Th _N.

34, after step S33 in Fig. 33, scan analysis manager 12 sets p=1 (step S341), where p is an argument of the updated minimum value α _{i_MIN} included in list LS3 and ranges from 1 to P, and P is the total number of updated minimum values α _{i_MIN} .

After step S341, the scan analysis manager 12 finds the minimum value α _{p_MIN} from the list LS3 (step S342), and sets N=1 (step S343), where N is the number of hops.

Thereafter, the scan analysis manager 12 detects the minimum delay WRTT _{i_MIN} of the wireless communication section and the average delay RRTT _{i_AVE} of the wired communication section from the correspondence table TBL3_S (=TBL3) at the current time, and substitutes the detected minimum delay WRTT _{i_MIN} and average delay RRTT _{i_AVE} into equation (2) to calculate the threshold value Th _N (step S344).

Then, the scan analysis manager 12 determines whether the minimum value α _{p _MIN} is equal to or greater than the threshold value Th _N (step S345).

When it is determined in step S345 that the minimum value α _{p _MIN} is equal to or greater than the threshold value Th _N , the scan analysis manager 12 sets N=N+1 (step S346). Thereafter, the series of operations proceeds to step S344, and steps S344 to S346 are repeatedly executed until it is determined in step S345 that the minimum value α _{p _MIN} is not equal to or greater than the threshold value Th _N.

If it is determined in step S345 that the minimum value α _{p_MIN} is not equal to or greater than the threshold value Th _N , the scan analysis manager 12 sets the final value of N as the number of hops (step S347).

Then, the scan analysis manager 12 records the set number of hops in the correspondence table TBL3 (current correspondence table TBL3_S) of the host information database 13 (step S348).

Then, the scan analysis manager 12 determines whether p = P (step S349).

If it is determined in step S349 that p=P is not true, the scan analysis manager 12 sets p=p+1 (step S350). The series of operations then proceeds to step S342, and steps S342 to S350 are repeatedly executed until it is determined in step S349 that p=P is true.

If it is determined in step S349 that p=P, the process proceeds to step S35 in FIG. 33.

After setting N=1 in step S343, a threshold value _Th1 is calculated in step S344. Then, if it is determined in step S345 that the minimum value α _{p_MIN} is equal to or greater than the threshold value Th1, N=1+ ₁ =2 is set in step S346. That is, the number of hops N is set to "2".

Then, after N=2 is set in step S346, threshold value _Th2 is calculated in step S344, and if it is determined in step S345 that minimum value α _{p_MIN} is equal to or greater than threshold value _Th2 , N=2+1=3 is set in step S346. That is, the number of hops N is set to "3".

Thereafter, steps S344 to S346 are repeatedly executed until it is determined in step S345 that the minimum value α _{p_MIN} is not equal to or greater than the threshold value Th ₂ (that is, until it is determined that the minimum value α _{p_MIN} is smaller than the threshold value Th _N ).

Then, in step S345, the value of N when it is determined that the minimum value α _{p_MIN} is not equal to or greater than the threshold value Th _N becomes the final value, and in step S347, the final value of N is set to the estimated number of hops.

The detailed operation of step S36 in Fig. 33 is also executed according to the flowchart shown in Fig. 34. In this case, p is the argument of the updated minimum value α _{i_MIN} included in list LS4, and P is the total number of updated minimum values α _{i_MIN} .

Fig. 35 is another flowchart for explaining the detailed operation of step S34 in Fig. 33. Note that the flowchart shown in Fig. 35 is a flowchart for estimating the number of hops by calculation using the minimum value α _{i_MIN} of α and thresholds Th ₁ and Th ₂ .

The flowchart shown in FIG. 35 is the same as the flowchart shown in FIG. 34, except that steps S343 to S347 in the flowchart shown in FIG. 34 are replaced with steps S351 to S356.

Referring to FIG. 35, after step S33 in FIG. 33, steps S341 and S342 described above are executed in sequence.

After step S342, the scan analysis manager 12 calculates the threshold values Th ₁ and Th ₂ by the formula (2) (step S351).

Then, the scan analysis manager 12 calculates D ₁ =α _{p _MIN} -Th ₁ and D ₂ =Th ₂ -Th ₁ (step S352).

Thereafter, the scan analysis manager 12 determines whether _D1 is less than "0" (step S353).

If it is determined in step S353 that _D1 is smaller than "0", the scan analysis manager 12 sets N=1 (step S354).

On the other hand, if it is determined in step S353 that _D1 is not smaller than "0", the scan analysis manager 12 sets N=1+Ceil[ _D1 / _D2 ] (step S355).

Then, after step S354 or step S355, the scan analysis manager 12 sets N to the number of hops (step S356). After that, steps S348 to S350 described above are executed in sequence, and if it is determined in step S349 that p=P, the series of operations proceeds to step S35 in FIG. 33.

Figure 36 is another flowchart for explaining the detailed operation of step S2 in Figure 29.

The flowchart shown in FIG. 36 is the same as the flowchart shown in FIG. 33, except that steps S32, S35, and S36 in the flowchart shown in FIG. 33 have been replaced with steps S32A, S35A, and S36A, respectively.

Referring to Figure 36, after step S1 in Figure 29, step S31 described above is executed.

After step S31, the scan analysis manager 12 updates the average values α i _AVE for all IP addresses Add i using the method described above based on correspondence table TBL3 (i.e., correspondence table TBL3 at the time of estimating the number of hops) that constitutes correspondence table _{TBL3_S} of correspondence table _TBL2 , and creates a list LS2 (= LS2-2) of terminal devices whose average values α _{i _AVE} have been updated (step S32A).

Then, after the above-mentioned steps S33 and S34 have been executed in sequence, the scan analysis manager 12 creates a list LS4 (= LS4-2) of terminal devices whose attributes have been determined and whose average value α _AVE has been updated based on the lists LS1 and LS2 (= LS2-2) (step S35A).

The scan analysis manager 12 then estimates the number of hops for all terminal devices included in list LS4 (= LS4-2) (step S36A). After that, the series of operations proceeds to step S3 in FIG. 29.

It should be noted that steps S35A and S36A are steps executed to update the already estimated number of hops since the average value α _{i_AVE} has been updated although the number of hops has already been estimated.

Fig. 37 is a flowchart for explaining the detailed operation of step S34A in Fig. 36. Note that the flowchart shown in Fig. 37 is a flowchart for estimating the number of hops by comparing the average value α _{i_AVE} of α with a threshold value Th _N.

The flowchart shown in FIG. 37 is the same as the flowchart shown in FIG. 34, except that steps S342, S344, and S345 in the flowchart shown in FIG. 34 have been replaced with steps S342A, S344A, and S345A, respectively.

37, the above-mentioned step S341 is executed after step S33 in Fig. 36. Then, after step S341, the scan analysis manager 12 detects the average value α _{p_AVE} from list LS3 (step S342A).

After step S342A, when the above-mentioned step S343 is executed, the scan analysis manager 12 detects the minimum delay WRTT _{i_MIN} of the wireless communication section and the average delay RRTT _{i_AVE} of the wired communication section from the correspondence table TBL3_S (=TBL3) at the current time, and substitutes the detected minimum delay WRTT _{i_MIN} and average delay RRTT _{i_AVE} into equation (3) to calculate the threshold value Th _N (step S344A).

Thereafter, the scan analysis manager 12 determines whether the average value α _{p_AVE} is equal to or greater than a threshold value Th _N (step S345A).

When it is determined in step S345A that the average value α _{p_AVE} is equal to or greater than the threshold value Th _N , the above-mentioned step S346 is executed. Then, steps S344A, S345A, and S346 are repeatedly executed until it is determined in step S345A that the average value α _{p_AVE} is not equal to or greater than the threshold value Th _N.

Then, in step S345A, if it is determined that the average value α _{p_AVE} is not greater than or equal to the threshold value Th _N , the above-mentioned steps S347 to S350 are executed in sequence, and if it is determined in step S349 that p = P, the series of operations proceeds to step S35 in Figure 36.

After setting N=1 in step S343, a threshold value _Th1 is calculated in step S344A. Then, if it is determined in step S345A that the average value α _{p_AVE} is equal to or greater than the threshold value Th1, N=1+ ₁ =2 is set in step S346. That is, the number of hops N is set to "2".

Then, after N=2 is set in step S346, a threshold value _Th2 is calculated in step S344A, and if it is determined in step S345A that the average value α _{p_AVE} is equal to or greater than the threshold value Th2, N= ₂ +1=3 is set in step S346. That is, the number of hops N is set to "3".

Thereafter, steps S344A, S345A, and S346 are repeatedly executed until it is determined in step S345A that the average value α _{p_AVE} is not equal to or greater than the threshold value Th _N (that is, until it is determined that the average value α _{p_AVE} is smaller than the threshold value Th _N ).

Then, in step S345A, the value of N when it is determined that the average value α _{p_AVE} is not equal to or greater than the threshold value _Th2 becomes the final value, and in step S347, the final value of N is set to the estimated number of hops.

The detailed operation of step S36A in Fig. 36 is also executed according to the flowchart shown in Fig. 37. In this case, p is the argument of the updated average value α _{p_AVE} included in list LS4 (=LS4-2), and P is the total number of updated average values α _{p_AVE} .

Fig. 38 is another flowchart for explaining the detailed operation of step S34A in Fig. 36. Note that the flowchart shown in Fig. 38 is a flowchart for estimating the number of hops by calculation using the average value α _{i_AVE} of α and threshold values Th ₁ and Th ₂ .

The flowchart shown in FIG. 38 is the same as the flowchart shown in FIG. 35, except that steps S342, S351, and S352 in the flowchart shown in FIG. 35 have been replaced with steps S342A, S351A, and S352A, respectively.

Referring to FIG. 38, after step S33 in FIG. 36, step S341 described above is executed.

After step S341, the scan analysis manager 12 detects the average value α _{p_AVE} from list LS3 (step S342A), and calculates threshold values Th ₁ and Th ₂ by equation (3) (step S351A).

Then, the scan analysis manager 12 calculates D ₁ =α _{p _ AVE} - Th ₁ and D ₂ = Th ₂ - Th ₁ (step S352A).

Then, the above-mentioned steps S353 to S356 and S348 to S350 are executed in sequence, and if it is determined in step S349 that p = P, the series of operations proceeds to step S35 in FIG. 33.

Figure 39 is a flowchart explaining the detailed operation of step S3 in Figure 29.

39, after step S2 in Fig. 29, the scan scheduler 14 sets i=1 (step S3-1).Then, the scan scheduler 14 refers to the correspondence table TBL3 constituting the correspondence table TBL3_S of the correspondence table TBL2, and detects the number of hops N _i corresponding to the IP address Add' _i (step S3-2).

Thereafter, the scan scheduler 14 sets the communication speed V _i of the scan packet based on the number of hops N _i (step S3-3). More specifically, the scan scheduler 14 sets the communication speed V _i of the scan packet to be (1/N _i ) times the communication speed of the scan packet for one hop.

Then, the scan scheduler 14 sets the IP address Add' _i , the start time t _{i _start} , the end time t _{i _end} , and the communication speed V _i to the scan timing t _S (step S3-4).

The scan scheduler 14 then determines whether i=m (step S3-5).

If it is determined in step S3-5 that i is not equal to m, the scan scheduler 14 sets i to i+1 (step S3-6). After that, the series of operations proceeds to step S3-2, and steps S3-2 to S3-6 are repeatedly executed until it is determined in step S3-5 that i is equal to m.

If it is determined in step S3-5 that i=m, the scan scheduler 14 outputs the scan schedule SCSHD to the network scanner 11 (step S3-7) and controls the network scanner 11 to execute a network scan in accordance with the scan schedule SCSHD. After that, the series of operations proceeds to step S4 in FIG. 29.

According to the operation of the network scanning device 1 described above, the network scanning device 1 estimates the number of hops N _i of the wireless communication section in the network used for network scanning, sets the communication speed V _i of the scan packet to be (1/N _i ) times the communication speed of the scan packet for one hop based on the estimated number of hops N _i , and transmits the scan packet at the set communication speed V _i to perform network scanning.

As a result, the amount of scan packets sent per unit time is less than when the communication speed of the scan packets is not controlled according to the number of hops.

This allows for a reduction in wireless resources compared to when the communication speed of scan packets is not controlled according to the number of hops.

Figure 40 is another schematic diagram of the network scanning device 1 shown in Figure 1. The network scanning device according to the embodiment of the present invention may be the network scanning device 1A shown in Figure 40.

Referring to FIG. 40, the network scanning device 1A is the same as the network scanning device 1 except that the scan scheduler 14 of the network scanning device 1 shown in FIG. 2 has been replaced with a scan scheduler 14A.

The scan scheduler 14A detects the scan responses SR _{i and SRTT i acquired by the first to (S-1)th network scans from the correspondence table TBL3_s (s=1 to S-1) of the correspondence table TBL2. In this case, the scan scheduler 14A detects the scan response SR i and the scan response SRTT i corresponding to} one IP address Add' _i in each of the correspondence tables TBL3_1 to TBL3_S-1. Here, the scan response SR _i is the scan response SR _i consisting of "1", and the scan response SRTT _i is the scan response SRTT _i associated with the scan response SR _i consisting of "1".

The scan scheduler 14A then counts the number _NSRi of detected scan responses _SRi , and counts the number _{NSRTTi of detected scan response delays SRTTi} that ^are equal to or greater than _a threshold ^value _rATBith , where the threshold _{value rATBith is} a threshold value determined for each network type (=attribute _ATBi ), and the scan scheduler 14A holds the threshold _value ^rATBith in advance in association with the network type (=attribute _ATBi ).

After counting the numbers _{N_SRi} and _{N_SRTTi} , the scan scheduler 14A calculates a ratio c _i (= _{N_SRTTi} / _{N_SRi} ) by dividing the number _{N_SRTTi} by the number _{N_SRi} .

Then, the scan scheduler 14A determines whether the ratio c _i (=N _SRTTi /N _SRi ) is greater than a threshold value C ^ATBi .

When the scan scheduler 14A determines that the ratio c _i (=N _SRTTi /N _SRi ) is greater than the threshold value C ^ATBi , it lowers the communication speed V _i of the scan packets. That is, the scan analysis manager 12A sets the communication speed V _i of the scan packets to be (1/N _i ) times the communication speed of the scan packets for one hop.

On the other hand, when the scan scheduler 14A determines that the ratio c _i (=N _SRTTi /N _SRi ) is not greater than the threshold value C ^ATBi , the scan scheduler 14A determines whether the ratio c _i (=N _SRTTi /N _SRi ) is zero. Note that the scan scheduler 14A holds the threshold value C ^ATBi in advance.

Then, when the scan scheduler 14A determines that the ratio c _i (=N _SRTTi /N _SRi ) is zero, it increases the communication speed V _i of the scan packets.

On the other hand, when the scan scheduler 14A determines that the ratio c _i (=N _SRTTi /N _SRi ) is not zero, it maintains the communication speed V _i of the scan packets.

The scan scheduler 14A executes the above-mentioned operation for all IP addresses _Add'i .

Scan scheduler 14A performs the same functions as scan scheduler 14.

FIG. 41 is a diagram showing the cumulative distribution function of the scan response delay SRTT _i in multiple networks.

41, the vertical axis represents the cumulative distribution function of the scan response delay SRTT _i , and the horizontal axis represents the scan response delay SRTT _i . Also, curve k1 represents the cumulative distribution function of the scan response delay SRTT _i in a Wired LAN (Local Area Network), curve k2 represents the cumulative distribution function of the scan response delay SRTT _i in a WLAN (Wireless LAN (Local Area Network)), curve k3 represents the cumulative distribution function of the scan response delay SRTT _i in LTE (Long Term Evolution), curve k4 represents the cumulative distribution function of the scan response delay SRTT _i in a Wi-SUN (Wireless Smart Utility Network), and curve k5 represents the cumulative distribution function of the scan response delay SRTT _i in LoRa (Long Range).

Referring to FIG. 41, the thresholds r ^{Wired LAN} _th , r ^WLAN _th , r ^LTE _th , r ^Wi-SUN _th , and r ^LoRa _th for LAN, WLAN, LTE, Wi-SUN, and LoRa are set to the scan response delay SRTT _i when the cumulative distribution function CDF (Cumulative Distribution Function) of the scan response delay SRTT for an uncongested wireless network is 0.95, for example.

The scan scheduler 14A holds, for example, threshold values ^rWiredLANth , _{rWLANth ,} ^rLTEth _, rWi ^-SUNth _, ^{and rLoRath} as the threshold ^value _rATBith in _advance .

Figure 42 is a conceptual diagram of the correspondence table TBL5 that shows the relationship between the communication speed of scan packets and the network type.

Referring to Figure 42, correspondence table TBL5 includes communication speeds 1 to 4 and network types A and B.

In network type A, communication speed 1 is 50 [packets/scan timing _tS ], communication speed 2 is 10 [packets/scan timing _tS ], communication speed 3 is 2 [packets/scan timing _tS ], and communication speed 4 is 1 [packet/scan timing _tS ].

In network type B, communication speed 1 is 10 [packets/scan timing _tS ], communication speed 2 is 4 [packets/scan timing _tS ], communication speed 3 is 2 [packets/scan timing _tS ], and communication speed 4 is not set.

In this way, communication speeds 1 to 4 (or communication speeds 1 to 3) are determined according to the network types A and B, and are determined by the number of scan packets sent per scan timing _tS .

In addition, in the network scanning device 1A, the correspondence table TBL5 is stored in the host information database 13.

Figure 43 is a flowchart explaining the operation of the network scanning device 1A shown in Figure 40.

The flowchart shown in FIG. 43 is the same as the flowchart shown in FIG. 29, except that step S3 in the flowchart shown in FIG. 29 has been replaced with step S3A.

Referring to FIG. 43, when the operation of the network scanning device 1A is started, the above-mentioned steps S1 and S2 are executed in sequence. In this case, the detailed operation of step S1 is executed according to the flowchart shown in FIG. 30, the detailed operation of step S14 of FIG. 30 is executed according to the flowchart shown in FIG. 31, and the detailed operation of step S15 of FIG. 30 is executed according to the flowchart shown in FIG. 32. Also, the detailed operation of step S2 is executed according to the flowchart shown in FIG. 33 or the flowchart shown in FIG. 36, the detailed operation of step S34 of FIG. 33 is executed according to the flowchart shown in FIG. 34 or the flowchart shown in FIG. 35, and the detailed operation of step S34 of FIG. 36 is executed according to the flowchart shown in FIG. 37 or the flowchart shown in FIG. 38.

After step S2, the scan scheduler 14A creates a scan schedule reflecting the estimated stage number N _i and the scan response delay SRTT _i (step S3A). Note that the detailed operation of step S3A is executed according to the flowchart shown in FIG. 44, which will be described later.

Then, after step S3A, step S4 described above is executed, and the operation of the network scanning device 1A ends.

Figure 44 is a flowchart explaining the detailed operation of step S3A shown in Figure 43.

The flowchart shown in FIG. 44 is the same as the flowchart shown in FIG. 39, except that step S3-3 in the flowchart shown in FIG. 39 has been replaced with step S3-3A.

44, after step S2 in Fig. 43, the above-mentioned steps S3-1 and S3-2 are executed in sequence. Then, after step S3-2, the scan scheduler 14A sets the communication speed V _i of the scan packet based on the hop count N _i and the scan response delay SRTT _i (step S3-3A).

Then, steps S3-4 to S3-7 described above are executed in sequence, and the series of operations proceeds to step S4 in FIG. 43.

Figure 45 is a flowchart explaining the detailed operation of step S3-3A shown in Figure 44.

Referring to FIG. 45, after step S3-2 in FIG. 44, the scan scheduler 14A sets i=1 (step S41).

Then, the scan scheduler 14A refers to the (S-1) correspondence tables TBL3 of the correspondence table TBL2 stored in the host information database 13, and detects the scan response SR _i (scan response SR _i consisting of "1") and scan response delay SRTT _i corresponding to the IP address Add' _i (step S42).

After that, the scan scheduler 14A detects the total number N _{SRi_total} of the scan responses SR _i (step S43).

Next, the scan scheduler 14A sets s=1 (step S44) and sets N _{SRTTi _ total} =0 (step S45), where s represents the number of the scan response delay SRTT _i detected from the (S-1) correspondence tables TBL3, and N _{SRDi _} total represents the total number of the scan response delay SRTT _i that is equal to or greater than the threshold value r ^ATBi _th .

After step S45, the scan scheduler 14A selects a threshold value r ^ATBi _th corresponding to the network type ATB _i , and determines whether the scan response delay SRTT _{i_s} is equal to or greater than the threshold value r ^ATBi _th (step S46).

When it is determined in step S46 that the scan response delay _{SRTTi_s} is equal to or greater than the _{threshold value} ^rATBith , the scan scheduler 14A sets _{NSRDi_total} = _{NSRDi_total} + 1 (step S47). That is, when the scan response delay SRTTi_s is equal to or greater than the _{threshold value} ^rATBith , the scan scheduler 14A increments the number _{NSRDi_total} by "1".

On the other hand, when it is determined in step S46 that the scan response delay SRTT _{i_s} is not equal to or greater than the threshold value r ^ATBi _th , the series of operations proceeds to step S48.

Then, when it is determined in step S46 that the scan response delay SRTT _{i_s} is not equal to or greater than the threshold value r ^ATBi _th , or after step S47, the scan scheduler 14A determines whether s=N _{SRi_total} (step S48). Note that the reason for determining whether "s", which represents the number of the scan response delay SRTT _i, is equal to the total number N _{SRi_total} of the scan responses SR _i is because the number of the scan responses SR _i (scan responses SR _i consisting of "1") detected in step S42 and the number of the scan response delays SRTT _i are equal to each other.

When it is determined in step S48 that s is not equal to N _{SRi_total} , the scan scheduler 14A sets s to s + 1 (step S49). After that, the series of operations proceeds to step S46, and steps S46 to S49 are repeatedly executed until it is determined in step S48 that s is equal to N _{SRi_total} .

Then, when it is determined in step S48 that s=N _{SRi — total} , the scan scheduler 14A calculates the ratio c _i by c _i =N _{SRTTi — total} /N _{SRi — total} (step S50).

Thereafter, the scan scheduler 14A selects a threshold value C ^ATBi corresponding to the network type ATB _i , and determines whether the ratio c _i is greater than the threshold value C ^ATBi (step S51).

In step S51, when it is determined that the ratio c _i is greater than the threshold value C ^ATBi , the scan scheduler 14A refers to the correspondence table shown in FIG. 27 or the correspondence table TBL5 and reduces the communication speed V _i of the scan packet by one step below the communication speed of the scan packet for one hop (step S52).

On the other hand, when it is determined in step S51 that the ratio c _i is not greater than the threshold value C ^ATBi , the scan scheduler 14A determines whether the ratio c _i is "0" (step S53).

When it is determined in step S53 that the ratio c _i is "0", the scan scheduler 14A refers to the correspondence table TBL5 and increases the communication speed V _i of the scan packet by one step from the communication speed of the scan packet for one hop (step S54).

Then, after step S52, or when it is determined in step S53 that the ratio c is not "0", or after step S54, the scan scheduler 14A determines whether i = m (step S55).

If it is determined in step S55 that i is not equal to m, the scan scheduler 14A sets i to i+1 (step S56). After that, the series of operations proceeds to step S42, and steps S42 to S56 are repeatedly executed until it is determined in step S55 that i is equal to m.

Then, if it is determined in step S55 that i=m, the sequence of operations proceeds to step S3-4 in FIG. 44.

In addition, after it is determined in step S53 that the ratio c _i is not zero, the series of operations proceeds to step S55, which corresponds to maintaining the communication speed V _i of the scan packets.

In addition, in step S52, the scan scheduler 14A may lower the communication speed V _i of the scan packet by any step, not limited to one step, and in step S54, the scan scheduler 14A may increase the communication speed V _i of the scan packet by any step, not limited to one step.

45, it may be determined whether the total number _{NSRi_total} of scan responses SR _i is zero, and when the total number _{NSRi_total} of scan responses SR _i is zero, step S52 may be executed. The total number _{NSRi_total} being zero means that when a network scan is performed for one IP address Add' _i , no scan response SR _i is returned, and therefore by lowering the communication speed _Vi of the scan packets, congestion in the network used for the network scan can be reduced, thereby improving the reliability of the results of the network scan.

According to the flowchart shown in FIG. ₄₅ , when the ratio c _i of the number N _{SRTTi_total} of scan response delays SRTT _i that are equal to or greater than a threshold value r ^ATBi th to the number N _{SRDi_total} of scan responses SR _i is not greater than a threshold value C ^ATBi , the communication speed V _i of the scan packet is not reduced below the communication speed of the scan packet for one hop (see steps S53 to S55).

Therefore, even if the number of hops N _i is large, it is possible to maintain at least the time required for a network scan for one hop, and to suppress an increase in the wireless resources required for a network scan.

Also, when the ratio c _i is zero (ie, the number N _{SRTTi —} total of scan response delays SRTT _i that are equal to or greater than the threshold value r ^ATBi _th is zero), the communication speed V _i of the scan packets is increased (YES in step S53→see step S54).

Therefore, even if the number of hops N _i is large, the time required for a network scan can be further shortened compared to the case of one hop, and the wireless resources required for a network scan can be further reduced.

Figure 46 shows the results of an experiment to determine the network type when the minimum scan response delay is used as the threshold.

In Figure 46, the network types used were WLAN, Wi-SUN, and LoRa. The number of experimental trials was 200 for each network type.

Referring to FIG. 46, as a result of determining the network type according to the flowchart shown in FIG. 30 (including the flowcharts shown in FIG. 31 and FIG. 32), the number of times the target network type was determined to be WLAN, the number of times the target network type was determined to be Wi-SUN, and the number of times the target network type was determined to be LoRa were all 200 times.

In this way, it was found that when the minimum scan response delay is used as the threshold Dt_thj, it is possible to determine with 100% probability that the type of the target network is either WLAN, Wi-SUN, or LoRa.

Figure 47 shows the results of an experiment to determine network type when the average scan response delay is used as a threshold.

In Figure 47, WLAN, Wi-SUN, and LoRa were used as network types, and the number of experimental trials was 200 for each network type.

Referring to FIG. 47, as a result of determining the network type according to the flowchart shown in FIG. 30 (including the flowcharts shown in FIG. 31 and FIG. 32), the number of times that the type of the target network was determined to be WLAN was 200. In addition, the number of times that the type of the target network was determined to be Wi-SUN was 194, and the number of times that the type of the target network was determined to be WLUN was 6. In addition, the number of times that the type of the target network was determined to be LoRa was 200.

In this way, when the average scan response delay is used as the threshold Dt_thj, it was found that the type of the target network can be determined with a 100% probability for WLAN and LoRa networks, and with a 97% probability for Wi-SUN networks.

The experimental results shown in Figures 46 and 47 show that the method of determining the network type using the flowchart shown in Figure 30 (including the flowcharts shown in Figures 31 and 32) can determine the type of the target network with a high probability. It was also found that by using the minimum scan response delay as the threshold value DT_thj, the probability of determining the type of the target network can be improved to 100%.

Therefore, the scan analysis manager 12 preferably reads out the minimum scan response delays from the correspondence table TBL1 as thresholds DT_th1 to DT_th5 in step S151 of FIG. 32.

As described above, the type of the target network can be accurately determined by determining the network type according to the flowchart shown in FIG. 30 (including the flowcharts shown in FIG. 31 and FIG. 32).

In an embodiment of the present invention, the operation of the network scanning device 1 may be realized by software. In this case, the network scanning device 1 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), and a RAM (Random Access Memory). The ROM stores a program Prog_A consisting of the steps of the flowchart shown in FIG. 29 (including the flowcharts shown in FIG. 30 to FIG. 39).

The CPU reads out a program Prog_A from the ROM and executes the read out program Prog_A to determine the type of a target network and estimate the number of hops in a wireless communication section of the target network. The RAM temporarily stores the calculated one-hop delay time, route delay, transmission delay ARTT _i , a plurality of absolute values |ARTT _i -DT_thj|, the minimum value of the plurality of absolute values |ARTT _i -DT_thj|, a threshold value Th _N , etc.

The program Prog_A may also be distributed in a form recorded on a recording medium such as a CD or DVD. When the recording medium on which the program Prog_A is recorded is inserted into a computer, the computer reads and executes the program Prog_A from the recording medium, determines the type of the target network, and estimates the number of hops in the wireless communication section of the target network.

Therefore, the recording medium on which the program Prog_A is recorded is a computer-readable recording medium.

In addition, in an embodiment of the present invention, the operation of the network scanning device 1A may be realized by software. In this case, the network scanning device 1A includes a CPU, a ROM, and a RAM. The ROM stores a program Prog_B consisting of the steps of the flowchart shown in FIG. 43 (including the flowcharts shown in FIGS. 30 to 38, 44, and 45).

The CPU reads out the program Prog_B from the ROM and executes the read out program Prog_B to determine the type of the target network and estimate the number of hops in the wireless communication section of the target network. The RAM temporarily stores the calculated one-hop delay time, route delay, transmission delay ARTT _i , a plurality of absolute values |ARTT _i -DT_thj|, the minimum value of the plurality of absolute values |ARTT _i -DT_thj|, a threshold value Th _N , etc.

The program Prog_B may also be distributed in a form recorded on a recording medium such as a CD or DVD. When the recording medium on which the program Prog_B is recorded is inserted into a computer, the computer reads and executes the program Prog_B from the recording medium, determines the type of the target network, and estimates the number of hops in the wireless communication section of the target network.

Therefore, the recording medium on which the program Prog_B is recorded is a computer-readable recording medium.

In the above, it has been explained that the communication speed V _i of the scan packet is set to (1/N _i ) times the communication speed of the scan packet for one hop depending on the hop count N _i . However, in an embodiment of the present invention, this is not limited to this, and the communication speed of the scan packet when the hop count N _i is two hops or more may be set to decrease linearly from the communication speed of the scan packet for one hop as the hop count N _i increases.

By determining the communication speed of the scan packet when the hop count N _i is two or more hops in this manner, the communication speed of the scan packet in areas where the hop count N i is large can be significantly reduced compared to controlling the communication speed of the scan packet when the hop count N _i is two or more hops to be (1/N _i ) times the communication speed of the scan packet when the hop count N _i is one hop, thereby further reducing wireless resources.

In addition, in an embodiment of the present invention, the communication speed V _i of the scan packet may be set to a first communication speed when the hop count N _i is a first value, and may be set to a second communication speed lower than the first communication speed when the hop count N _i is a second value greater than the first value.

In the above description, the number of hops N _{i in the wireless communication section of the network is estimated when the network type (= the attribute of the terminal device) is determined, but the embodiment of the present invention is not limited to this, and the number of hops N i} in the wireless communication section of the network may be estimated when the network type (= the attribute of the terminal device) is not determined. This is because the method of estimating the number of hops _{N i itself} does not change depending on the network type. Therefore, when there is one network type, the number of hops may be estimated by the above-mentioned method.

Furthermore, according to the above-described embodiment, α (=α _MIN or α _AVE ) is calculated, and the calculated α (=α _MIN or α _AVE ) is compared with a threshold value Th _N to estimate the number of hop stages N _i . Then, the threshold value Th _N is calculated by the above-described formula (4) (i.e., formula (2) or formula (3)). As a result, the threshold value Th _N is calculated based on the minimum delay WRTT _{i_MIN} . Therefore, the embodiment of the present invention is characterized in that α (=α _MIN or α _AVE ) is calculated, and the calculated α (=α _MIN or α _AVE ) is compared with the minimum delay WRTT _{i_MIN} to estimate the number of hop stages N _i of the wireless communication section in the network used for network scanning.

In this embodiment of the invention, when the router that returns the scan response SR among K routers 1 to K and is the closest to the terminal device is defined as the "nearest router," the scan response delay RTT from the nearest router constitutes the "route control response delay."

In addition, in this embodiment of the invention, TTL constitutes the "stage number index."

Furthermore, in this embodiment of the invention, the network scanner 11 that transmits the Ping packets constitutes the "transmission means."

Furthermore, in this embodiment of the invention, the network scanner 11 that receives the scan response SR constitutes a "receiving means."

Furthermore, in this embodiment of the invention, the scan analysis manager 12 that measures the scan response delay RTT constitutes a "measurement means."

Furthermore, in this embodiment of the invention, the scan analysis manager 12, which determines the type of the target network, constitutes a "determination means."

Furthermore, in this embodiment of the invention, the scan analysis manager 12, which estimates the number of hops in the wireless communication section of the network used for network scanning, constitutes an "estimation means."

Furthermore, in this embodiment of the invention, the scan scheduler 14, which sets the communication speed of the scan packets according to the estimated number of hops and creates a scan schedule, constitutes a "schedule creation means."

Furthermore, in this embodiment of the present invention, α (=α _{i_MIN} or α _{i_AVE} ) constitutes the "first subtraction result."

Furthermore, in this embodiment of the invention, the scan analysis manager 12 that creates the correspondence tables TBL1 and TBL2 (including TBL3) constitutes a "recording means."

Furthermore, in this embodiment of the invention, network NW1 constitutes a "first network," and Wired LAN, WLAN, Wi-SUN, LoRa, and LTE constitute "multiple first networks."

Furthermore, in this embodiment of the invention, network NW2 constitutes a "second network."

Furthermore, in this embodiment of the invention, the scan response delay SRTT _i stored in the correspondence table TBL constitutes a "measured scan response delay."

Furthermore, in this embodiment of the invention, (WRTT _{i_MIN} - RRTT _{i_AVE} ) or (D _{WRTT_min} - D _{RRTT_ave} ) constitutes the "second subtraction result", D ₁ constitutes the "third subtraction result", and D ₂ constitutes the "fourth subtraction result".

Furthermore, in this embodiment of the present invention, threshold value _Th1 constitutes a "first threshold value," and threshold value _Th2 constitutes a "second threshold value."

Furthermore, in this embodiment of the present invention, threshold value r ^ATBi _th constitutes a "third threshold value", and threshold value C ^ATBi constitutes a "fourth threshold value".

The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is indicated by the claims, not by the description of the embodiments above, and is intended to include all modifications within the meaning and scope of the claims.

This invention applies to a network scanning device, a program for causing a computer to execute the program, and a computer-readable recording medium on which the program is recorded.

1 Network scanning device, 10 Communication system, 11 Network scanner, 12 Scan analysis manager, 13 Host information database, 14 Scan scheduler, 20 Scan target network, 30 User.

Claims (19)

A network scanning device that estimates a number of hops in a wireless communication section of a plurality of first networks used when performing a network scan, comprising:
a scanning means for performing a network scan by transmitting scan packets to a plurality of IP addresses of a plurality of terminal devices using the plurality of first networks;
a recording means for measuring a scan response delay, which is a time from transmitting the scan packet to receiving a scan response, and for executing a recording process for recording the measured scan response delay in association with the IP address for all of the plurality of terminal devices;
an estimation means for executing, for all of the plurality of terminal devices, an estimation process for estimating the number of hops by comparing a first subtraction result obtained by subtracting a delay in the wired communication section in the second network from the measured scan response delay, with a minimum delay in the wireless communication section in the second network, assuming a second network in which a wired communication section and a wireless communication section consisting of one hop exist between the network scanning device and the terminal device;
a schedule creating means for creating a scan schedule for the network scan by setting a communication speed of a scan packet in the network scan to a first communication speed when the number of hop stages estimated by the estimation means is a first hop stage, and setting the communication speed of the scan packet to a second communication speed lower than the first communication speed when the number of hop stages estimated by the estimation means is a second hop stage greater than the first hop stage,
A network scanning device, wherein the scanning means executes the network scan in accordance with the scan schedule created by the schedule creating means. The network scanning device according to claim 1, wherein in the estimation process, the estimation means subtracts the delay of the wired communication section in the second network from the minimum value of the measured scan response delay to calculate the minimum value of the first subtraction result, calculates multiple thresholds based on the minimum delay, and estimates the number of hops by comparing the minimum value of the first subtraction result with the multiple thresholds. The plurality of threshold values are Th ₁ to Th _N (N is an integer of 2 or more),
3. The network scanning device of claim 2, wherein in the estimation process, the estimation means sets the minimum delay as a reference value, subtracts an average delay of the wired communication section in the second network from the minimum delay to calculate a second subtraction result, calculates the multiple thresholds by Th _N = (reference value) + (second subtraction result) x N, and estimates the number of hops by comparing the minimum of the first subtraction result with the calculated multiple thresholds. 2. The network scanning device according to claim 1, wherein, in the estimation process, the estimation means calculates a minimum value of the first subtraction results by subtracting an average delay of the wired communication section in the second network from a minimum value of the measured scan response delays, sets the minimum delay as a first threshold value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay, calculates a second threshold value by adding the second subtraction result to the first threshold value, calculates a third subtraction result by subtracting the first threshold value from the minimum value of the first subtraction results, and calculates a fourth subtraction result by subtracting the first threshold value from the second threshold value, estimates the number of hops to be "1" when the third subtraction result is negative, and estimates, when the third subtraction result is equal to or greater than zero, as the number of hops. The network scanning device according to claim 1, wherein in the estimation process, the estimation means subtracts the delay of the wired communication section in the second network from the average measured scan response delay to calculate an average value of the first subtraction result, calculates a plurality of threshold values based on the minimum delay, and estimates the number of hops by comparing the average value of the first subtraction result with the plurality of threshold values. The plurality of threshold values are Th ₁ to Th _N (N is an integer of 2 or more),
6. The network scanning device of claim 5, wherein in the estimation process, the estimation means sets the midpoint between the minimum delay and twice the minimum delay as a reference value, calculates a second subtraction result by subtracting an average delay of the wired communication section in the second network from the minimum delay, calculates the multiple thresholds by Th _N = (reference value) + (second subtraction result) x N, and estimates the number of hops by comparing an average value of the first subtraction result with the calculated multiple thresholds. In the estimation process, the estimation means calculates an average value of the first subtraction results by subtracting an average delay of the wired communication section in the second network from an average value of the measured scan response delays, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay, calculates a first threshold value by adding the calculated second subtraction result to a reference value consisting of a midpoint between the minimum delay and twice the minimum delay, and calculates a second threshold value by adding the second subtraction result to the first threshold value. 2. The network scanning device according to claim 1, further comprising: a first threshold value that is a first subtraction result; a second threshold value that is a first subtraction result; a third subtraction result that is a second subtraction result; a fourth subtraction result that is a second subtraction result; and a second threshold value that is a second subtraction result; when the third subtraction result is negative, the number of hop stages is estimated to be "1." When the third subtraction result is equal to or greater than zero, the number of hop stages is estimated to be an integer obtained by rounding up the result of dividing the third subtraction result by the fourth subtraction result and adding 1 to the resulting integer. a determination unit for determining types of the first networks as attributes of the terminal devices,
8. The network scanning device according to claim 1, wherein the estimation means, in the estimation process, estimates the number of hops by comparing a first subtraction result obtained by subtracting the delay of the wired communication section in the second network from the measured scan response delay corresponding to an attribute of the terminal device with a minimum delay of the wireless communication section in the second network. The network scanning device according to any one of claims 1 to 8, wherein the schedule creation means further creates a scan schedule for the network scan by maintaining the communication speed of the scan packets or setting it to a third communication speed higher than the first communication speed when the ratio of the number of the measured scan response delays equal to or greater than a third threshold value divided by the number of the scan responses is not greater than a fourth threshold value. A program for causing a computer to estimate a number of hops in a wireless communication section of a plurality of first networks used when performing a network scan, the program comprising:
a first step of a scanning means performing a network scan by transmitting a scan packet to a plurality of IP addresses of a plurality of terminal devices using the plurality of first networks;
a second step in which a recording means measures a scan response delay, which is a time from transmitting the scan packet to receiving a scan response, and records the measured scan response delay in association with the IP address for all of the plurality of terminal devices;
a third step in which an estimation means executes an estimation process for all of the plurality of terminal devices, the estimation process being performed by subtracting a delay in the wired communication section in the second network from the measured scan response delay, assuming a second network in which a wired communication section and a wireless communication section consisting of one hop exist between the network scanning device that executes the network scan and the terminal device, and comparing the result with a minimum delay in the wireless communication section in the second network to estimate the number of hops;
a fourth step in which a schedule creation means creates a scan schedule for the network scan by setting a communication speed of a scan packet in the network scan to a first communication speed when the number of hop stages estimated in the third step is a first hop stage, and by setting a communication speed of the scan packet to a second communication speed lower than the first communication speed when the number of hop stages estimated in the third step is a second hop stage that is greater than the first hop stage;
The scanning means, in the first step, executes the network scan in accordance with the scan schedule created in the fourth step. The program for causing a computer to execute the program according to claim 10, wherein the estimation means, in the estimation process of the third step, subtracts the delay of the wired communication section in the second network from the minimum value of the measured scan response delay to calculate the minimum value of the first subtraction result, calculates a plurality of threshold values based on the minimum delay, and compares the minimum value of the first subtraction result with the plurality of threshold values to estimate the number of hops. The plurality of threshold values are Th ₁ to Th _N (N is an integer of 2 or more),
12. The program for causing a computer to execute the program according to claim 11, wherein, in the estimation process of the third step, the estimation means sets the minimum delay as a reference value, subtracts an average delay of the wired communication section in the second network from the minimum delay to calculate a second subtraction result, calculates the plurality of threshold values by _ThN = (reference value) + (second subtraction result) x N, and estimates the number of hops by comparing a minimum value of the first subtraction result with the calculated plurality of threshold values. 11. The program for causing a computer to execute the program according to claim 10, wherein, in the estimation process of the third step, the estimation means calculates a minimum value of the first subtraction results by subtracting an average delay of the wired communication section in the second network from a minimum value of the measured scan response delays, sets the minimum delay as a first threshold value, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay, calculates a second threshold value by adding the second subtraction result to the first threshold value, calculates a third subtraction result by subtracting the first threshold value from the minimum value of the first subtraction results, and calculates a fourth subtraction result by subtracting the first threshold value from the second threshold value, estimates the number of hops to be "1" when the third subtraction result is negative, and estimates, when the third subtraction result is equal to or greater than zero, an addition result obtained by rounding up a division result of the third subtraction result by the fourth subtraction result and adding 1 to the integer obtained as the number of hops as the number of hops. The program for causing a computer to execute the program according to claim 10, wherein the estimation means, in the estimation process of the third step, subtracts the delay of the wired communication section in the second network from the average value of the measured scan response delays to calculate an average value of the first subtraction results, calculates a plurality of threshold values based on the minimum delay, and compares the average value of the first subtraction results with the plurality of threshold values to estimate the number of hops. The plurality of threshold values are Th ₁ to Th _N (N is an integer of 2 or more),
15. The program for causing a computer to execute the program according to claim 14, wherein in the estimation process of the third step, the estimation means sets the midpoint between the minimum delay and twice the minimum delay as a reference value, calculates a second subtraction result by subtracting an average delay of the wired communication section in the second network from the minimum delay, calculates the multiple thresholds by _ThN = (reference value) + (second subtraction result) x N, and estimates the number of hops by comparing an average value of the first subtraction result with the calculated multiple thresholds. The estimation means, in the estimation process of the third step, calculates an average value of the first subtraction results by subtracting an average delay of the wired communication section in the second network from an average value of the measured scan response delays, calculates a second subtraction result by subtracting the average delay of the wired communication section in the second network from the minimum delay, calculates a first threshold value by adding the calculated second subtraction result to a reference value consisting of a midpoint between the minimum delay and twice the minimum delay, and calculates a second threshold value by adding the second subtraction result to the first threshold value. 11. A program for causing a computer to execute the program of claim 10, which calculates a threshold value, subtracts the first threshold value from an average value of the first subtraction results to calculate a third subtraction result, subtracts the first threshold value from the second threshold value to calculate a fourth subtraction result , and when the third subtraction result is negative, estimates the number of hop stages to be "1", and when the third subtraction result is zero or greater, estimates as the number of hop stages an addition result obtained by rounding up the division result of the third subtraction result by the fourth subtraction result and adding 1 to the integer obtained. a fifth step in which a determination means determines types of the plurality of first networks as attributes of the plurality of terminal devices;
17. A program for causing a computer to execute the program according to claim 10, wherein, in the estimation process of the third step, the estimation means estimates the number of hops by comparing a first subtraction result obtained by subtracting the delay of the wired communication section in the second network from the measured scan response delay corresponding to an attribute of the terminal device with a minimum delay of the wireless communication section in the second network. The program for causing a computer to execute the program according to any one of claims 10 to 17, wherein in the fourth step, the schedule creation means further creates a scan schedule for the network scan by maintaining the communication speed of the scan packets or setting it to a third communication speed higher than the first communication speed when the ratio of the number of the measured scan response delays equal to or greater than a third threshold value divided by the number of the scan responses is not greater than a fourth threshold value. A computer-readable recording medium having recorded thereon the program according to any one of claims 10 to 18.

Images