JP7520319B2 - Network scanning device, a program for causing a computer to execute the program, and a computer-readable recording medium having the program recorded thereon - Google Patents

Description

Application of Article 30, Paragraph 2 of the Patent Act Teng Rui, Shiroyuki Araki, Kazuto Yano, and Yoshinori Suzuki published "Statistical Study on Response Delay Characteristics of Network Scan to IoT Devices" in the Technical Report of the Institute of Electronics, Information and Communication Engineers, vol. 119, no. 344, NS2019-142, pp. 45-49, December 2019.

Application of Article 30, Paragraph 2 of the Patent Act Teng Rui, Yano Kazuto, and Suzuki Yoshinori published "Identification of IoT Network Type Based on the Response Delay Property" by Teng Rui, Yano Kazuto, and Suzuki Yoshinori at the International Conference on Advanced Communications Technology (ICACT), pp. 319-323.

This invention relates to a network scanning device, a program for causing a computer to execute the program, and a computer-readable recording medium on which the program is recorded.

As the fifth generation mobile communication (5G) system comes into practical use, many devices, such as mobile terminals, computers, sensors, and webcams, will be connected to the Internet. Such mobile terminals and computers connected to the Internet are called IoT (Internet of Things) devices.

In the IoT era, the number of IoT devices connected to communication networks is expected to increase rapidly. Among these, IoT devices that perform wireless communication are expected to be used illegally without sufficient security measures in order to increase the number of cases where they are exploited in cyber attacks such as distributed denial of service (DDoS) attacks.

To avoid such a situation, it is necessary to conduct network scans of IoT devices connected to communication networks and investigate whether security measures are in place for each IoT device.

Network scanning is an important method to investigate and detect network connection status and vulnerable devices (Non-Patent Documents 1, 2). Through network scanning, a scanner obtains information of targeted IoT devices, such as response delay and port usage status. These network scan results then support network administrators to monitor network devices, check congestion status, and identify vulnerable IoT devices.

K. Yano, N. Egashira, T. Kurihara, S. Shimizu, and Y. Suzuki, “Research and Development on Wide Area Network Scan Techniques for IoT Wireless Equipment,” IEICE Tech. Rep., pp.203-208, NS2019 -85, 2019. R. Das, N. Baranasuriya, V. Padmanabhan, C. Rodbro, and S. Gilbert, “Informed Bandwidth Adaptation in Wi-Fi Networks using Ping-Pair,” Proc. CoNEXT 2017, pp.376-388, Dec 2017. F. Adelantado, X. Vilajosana, P. Tuset-Peiro, B. Martinez, J. Melia-Segui and T. Watteyne, “Understanding the Limits of LoRaWAN,” IEEE Commun. Mag., vol.55, Issue 9, pp .34-40, Sept 2017. H. Harada, K. Mizutani, J. Fujikawa, K. Mochizuki, K. Obata,and R. Okumura, “IEEE 802.15.4g Based Wi-SUN Communication Systems,” IEICE Trans. Commun., vol.E100B, pp. 1032-1043, 2017.

However, large-scale network scans cause a lot of scanning overhead to survey a large number of IoT devices. The impact of network scan traffic on IoT devices varies depending on the type of IoT network. For example, IoT devices in wired LAN (Local Area Network) and LPWA (Low Power, Wide Area) networks have different communication resources, data rates, energy consumption efficiency, and background traffic (Non-Patent Documents 3, 4). When a network scan is performed, the IoT network and IoT devices suffer communication interruptions. Also, wireless IoT devices are more affected than wired IoT devices due to the limited radio resources available in wireless IoT networks.

Therefore, identifying the type of IoT network is one key challenge to successfully schedule and run a network scan.

Therefore, according to an embodiment of the present invention, a network scanning device is provided that determines the type of network that is the target of a network scan.

In addition, according to an embodiment of the present invention, a program is provided for causing a computer to determine the type of network that is the target of a network scan.

Furthermore, according to an embodiment of the present invention, a computer-readable recording medium is provided that stores a program for causing a computer to determine the type of network that is the target of a network scan.

(Configuration 1)
According to an embodiment of the present invention, a network scanning device includes a transmitting means, a receiving means, a measuring means, a computing means, and a determining means. The transmitting means transmits a scan packet, which is a packet for performing a network scan, in a multi-stage network that transmits information to a terminal device via a plurality of routers. The receiving means receives a scan response, which is a response to the scan packet, in the multi-stage network. The measuring means measures a scan response delay from when the transmitting means transmits the scan packet to when the receiving means receives the scan response. The computing means calculates a transmission delay in a target network that has one router and is the target of a network scan, based on the scan response delay and the number of routing control stages, which is the number of stages from the network scanning device to a nearest router that is the router that has returned a scan response among a plurality of routers and is closest to the terminal device. The determining means determines the type of the target network based on the transmission delay calculated by the computing means.

(Configuration 2)
In configuration 1, the calculation means calculates a route delay, which is the delay time caused by routers between the network scanning device and the target network, based on the number of route control stages, and calculates a transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 3)
In configuration 2, the calculation means sets the number of stages smaller than the number of stages of the multi-stage network included in the scan response as the number of route control stages, calculates the delay time per hop by dividing the route control response delay, which is the scan response delay to the nearest router, by the number of route control stages, calculates the route delay by multiplying the calculated delay time per hop by the number of stages from the network scan device to the router located closest to the terminal device or the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 4)
In configuration 3, the delay time per hop is an average value of multiple delay times per hop calculated for multiple terminal devices that are targets of a network scan. The calculation means calculates a path delay by multiplying the average value by the number of stages or the number of routing control stages from the network scan device to the router located closest to the terminal device, and calculates a transmission delay by subtracting the calculated path delay from the scan response delay.

(Configuration 5)
In any of configurations 1 to 4, the determination means performs a provisional determination to compare the transmission delay with a threshold determined according to the type of network, and determines the type of network corresponding to the threshold value having the closest transmission delay as the type of target network, and determines the type for which the provisional determination is performed the most times as the type of target network.

(Configuration 6)
In configuration 5, the threshold comprises a minimum scan response delay that is the minimum value of the scan response delay.

(Configuration 7)
In the fifth or sixth configuration, the determining means determines that the type of the target network is unknown when there are a plurality of types for which the number of provisional determinations is the same.

(Configuration 8)
In any one of configurations 1 to 7, the network scanning device further includes a schedule creation means. The schedule creation means executes a schedule creation process to extract a target network whose network type has been determined based on the determination result by the determination means, calculate an amount of time resources required for one network scan in the extracted target network, calculate an amount of resources required for the network scan in a time period based on the length of the time period during which the network scan is performed and the congestion level in the time period, and create a schedule for the network scan based on the amount of time resources so as not to exceed the amount of resources.

(Configuration 9)
In the eighth configuration, the schedule creation means calculates the amount of time resources by multiplying the average value of the scan response delay in the target network by a margin coefficient in the schedule creation process.

(Configuration 10)
In the eighth or ninth configuration, when a plurality of target networks are extracted based on the determination result by the determining means, the schedule creating means executes a schedule creating process for all of the plurality of target networks.

(Configuration 11)
According to an embodiment of the present invention, the program further comprises:
A first step in which a transmission means transmits a scan packet, which is a packet for performing a network scan, in a multi-stage network in which information is transmitted to a terminal device via a plurality of routers;
a second step of receiving, by a receiving means, a scan response in the multi-stage network, the scan response being a response to the scan packet;
a third step in which a measurement means measures a scan response delay from when the scan packet is transmitted in the first step to when the scan response is received in the second step;
a fourth step in which the calculation means calculates a transmission delay in a target network having one router and being a target of a network scan based on a route control step number, which is the number of steps to a nearest router that has returned a scan response from the network scanning device and is closest to the terminal device, and a scan response delay;
and a fifth step in which the determining means determines the type of the target network based on the transmission delay calculated in the fourth step.

(Configuration 12)
In configuration 11, in the fourth step, the calculation means calculates a route delay, which is the delay time caused by a router between the network scanning device and the target network, based on the number of route control stages, and calculates a transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 13)
In configuration 12, in the fourth step, the calculation means sets the number of stages smaller than the number of stages of the multi-stage network included in the scan response as the number of route control stages, calculates the delay time per hop by dividing the route control response delay, which is the scan response delay to the nearest router, by the number of route control stages, calculates the route delay by multiplying the calculated delay time per hop by the number of stages from the network scanning device to the router located closest to the terminal device or the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 14)
In configuration 13, the delay time per hop is an average value of a plurality of delay times per hop calculated for a plurality of terminal devices that are targets of a network scan;
In the fourth step, the calculation means multiplies the average value by the number of stages or the number of route control stages from the network scanning device to the router located closest to the terminal device to calculate the route delay, and subtracts the calculated route delay from the scan response delay to calculate the transmission delay.

(Configuration 15)
In any of configurations 11 to 14, in the fifth step, the determination means performs a provisional determination to compare the transmission delay with a threshold determined according to the type of network, and determines the type of network corresponding to the threshold value having the closest transmission delay as the type of target network, and determines the type having the greatest number of provisional determinations as the type of target network.

(Configuration 16)
In configuration 15, the threshold comprises a minimum scan response delay that is the minimum value of the scan response delay.

(Configuration 17)
In configuration 15 or 16, the determining means determines in the fifth step that the type of the target network is unknown when there are a plurality of types for which the number of provisional determinations is the same.

(Configuration 18)
The program further causes the computer to execute a sixth step of a schedule creation process in which the schedule creation means extracts a target network whose network type has been determined based on the determination result by the determination means, calculates the amount of time resources required for one network scan in the extracted target network, calculates the amount of resources required for network scanning in a time period based on the length of the time period during which the network scan is performed and the degree of congestion in that time period, and creates a network scan schedule based on the amount of time resources so as not to exceed the amount of resources.

(Configuration 19)
In configuration 18, in the schedule creation process of the sixth step, the schedule creation means calculates the amount of time resource by multiplying the average value of the scan response delay in the target network by a margin coefficient.

(Configuration 20)
In configuration 18 or 19, when a plurality of target networks are extracted based on the determination result by the determination means in the sixth step, the schedule creation means executes a schedule creation process for all of the plurality of target networks.

(Configuration 21)
Furthermore, according to an embodiment of the present invention, a recording medium is a computer-readable recording medium having the program according to any one of the eleventh to twentieth configurations recorded thereon.

You can determine the type of network being scanned.

1 is a schematic diagram of a communication system according to an embodiment of the present invention. FIG. 2 is a schematic diagram of the network scanning device shown in FIG. 1 according to a first embodiment. FIG. 3 is a conceptual diagram of a host information database shown in FIG. 2 . FIG. 2 is a conceptual diagram of a scan schedule. FIG. 11 is a diagram for explaining a method for calculating a one-hop delay time. FIG. 13 is a diagram showing a correspondence table of network type, minimum scan response delay, and average scan response delay. 11 is a diagram illustrating the relationship between the scan response delay and the number of network scans when the network type is a Wired LAN. FIG. 13 is a diagram showing a probability distribution function of a scan response delay when the network type is a Wired LAN. 11 is a diagram showing the relationship between the scan response delay and the number of network scans when the network types are WLAN, Wi-SUN, and LoRa. FIG. 13 is a diagram showing a probability distribution function of a scan response delay when the network type is a WLAN. FIG. 13 is a diagram showing the probability distribution function of scan response delay when the network type is Wi-SUN. FIG. 13 is a diagram showing the probability distribution function of the scan response delay when the network type is LoRa. 10 is a flowchart illustrating an operation of determining a network type. 14 is a flowchart for explaining a detailed operation of step S4 in FIG. 13. 14 is a flowchart for explaining a detailed operation of step S5 in FIG. 13. 13 is another flowchart illustrating the operation of determining a network type. FIG. 13 is a diagram showing the results of an experiment to determine the network type when the minimum scan response delay is used as a threshold value. 13A and 13B are diagrams illustrating experimental results for determining a network type when the average scan response delay is used as a threshold value. 10 is a schematic diagram of a network scanning device according to a second embodiment of the present invention; FIG. FIG. 11 is a diagram illustrating an example of the amount of time resources required for one network scan. 20 is a flowchart for explaining the operation of the network scanning device shown in FIG. 19 . 20 is another flowchart for explaining the operation of the network scanning device shown in FIG. 19 .

The embodiment of the present invention will be described in detail with reference to the drawings. Note that the same or corresponding parts in the drawings are given the same reference numerals and their description will not be repeated.

Figure 1 is a schematic diagram of a communication system according to an embodiment of the present invention. Referring to Figure 1, a communication system 10 according to an embodiment of the present invention includes a network scanning device 1, an Internet provider ISP, base stations BS1 to BS4, and terminal devices TM1 to TM5.

The network scanning device 1, the Internet service provider ISP (Internet Service Provider), base stations BS1 to BS4, and terminal devices TM1 to TM5 are placed in the communication space.

The Internet provider ISP is the telecommunications carrier of network NW1. Base stations BS1 to BS4 are base stations of networks NW2 to NW5, respectively. Network NW1 is, for example, a wired LAN, network NW2 is, for example, a wireless LAN (WLAN), network NW3 is, for example, a Wi-SUN (Wireless Smart Utility Network), network NW4 is, for example, LoRa (Long Range), and network NW5 is, for example, LTE (Long Term Evolution). Networks NW1 to NW5 communicate according to mutually different communication standards.

The terminal devices TM1 to TM5 are placed in the networks NW1 to NW5, respectively, and communicate with the Internet provider ISP and the base stations BS1 to BS4.

Note that in FIG. 1, one terminal device is shown in each of networks NW1 to NW5, but in reality, multiple terminal devices exist in each of networks NW1 to NW5.

In an embodiment of the present invention, each of the terminal devices TM1 to TM5 may be a wireless terminal, or some of the terminal devices TM1 to TM5 may be wireless terminals and the rest may be wired terminals.

The terminal device TM1 is connected to the Internet provider ISP via a wired connection.

The terminal devices TM2 to TM5 communicate with the base stations BS1 to BS4, respectively, via wireless communication.

The network scanning device 1 performs a network scan on the terminal devices TM1 to TM5 using the method described below, and determines the type of the networks NW1 to NW5.

[First embodiment]
Fig. 2 is a schematic diagram of the first embodiment of the network scanning device 1 shown in Fig. 1. Referring to Fig. 2, the network scanning device 1 includes a network scanner 11, a scan analysis manager 12, a host information database 13, and a scan scheduler 14.

The network scanner 11 receives a scan schedule from the scan scheduler 14. The network scanner 11 then generates g scan packets (e.g., Ping packets) each including a TTL (Time To Live) set to one of the values 1, 2, 3, ..., g (g is an integer equal to or greater than 3). The network scanner 11 then transmits the g Ping packets based on the scan schedule, and performs a network scan on the terminal devices connected to the network 20 to be scanned.

Then, the network scanner 11 receives a scan response of the network scan from a terminal device connected to the network 20, and outputs the received scan response to the user (comprising network security, etc.) 30 and the scan analysis manager 12.

The scan analysis manager 12 receives a scan response from the network scanner 11 and receives a communication log during the network scan. The scan analysis manager 12 then generates a scan result that associates the address of the terminal device to be scanned with the scan response based on the scan response, and creates or updates the host information database 13 by storing the generated scan result in the host information database 13.

The scan analysis manager 12 also determines the type of network 20 (networks NW1 to NW5) based on the scan response delay of a network scan targeting multiple terminal devices using a method described below.

The host information database 13 stores the scan results.

The scan scheduler 14 reads the scan results from the host information database 13. The scan scheduler 14 also receives scan requirements from the user 30. The scan scheduler 14 holds in advance the global IP addresses and domain names of all terminal devices present in the area (e.g., Japan) where the network scan is to be performed.

Then, based on the scan requirements and the scan results, the scan scheduler 14 creates a scan schedule that associates the scan timings of the network scan with the terminal devices that are the targets of the network scan at each scan timing, using a method described below. The scan scheduler 14 then outputs the scan schedule to the network scanner 11 and controls the network scanner 11 to execute a network scan according to the scan schedule.

Fig. 3 is a conceptual diagram of the host information database 13 shown in Fig. 2. Referring to Fig. 3, the host information database 13 includes a time t, an IP address Add _i (i = 1 to I, I is the total number of terminal devices), a domain name DN _i , a base station, a scan response SR _i , a scan response delay RTT _i , a provisional judgment, the number of provisional judgments, and a final judgment. The time t, the IP address Add _i , the domain name DN _i , the base station, the scan response SR _i , the scan response delay RTT _i , the provisional judgment, the number of provisional judgments, and the final judgment are associated with one another.

Time t is expressed as YYYY/MM/DD/hh/mm/ss (year/month/day/hour/minute/second). Time t represents the time when a Ping packet in a network scan is sent to the terminal device that is the target of the network scan.

The IP address Add _i is composed of the global IP address of the terminal device that is the target of the network scan, and the IP address of a router that exists between the network scanning device 1 and the terminal device that is the target of the network scan. For example, in IP addresses Add ₁ , Add ₁₁ , Add ₁₂ , ..., the IP address Add ₁ represents the global IP address of the terminal device, and the IP addresses Add ₁₁ , Add ₁₂ , ... represent the IP addresses of the routers that exist between the network scanning device 1 and the terminal device (=IP address Add ₁ ) that is the target of the network scan. The same is true for the other IP addresses Add ₂ , Add ₂₁ , Add ₂₂ , ... to Add _I-1 , Add _I-11 , Add _I-12 , ..., Add _I , Add _I1 , Add _I2 , ....

The domain name DN _i is converted based on the IP address Add _i using a PTR (Pointer record).

The base station, the scan response SR _i , the scan response delay RTT _i , the tentative decision, the number of tentative decisions, and the final decision are provided corresponding to the IP address Add _i of the terminal device i.

The scan response SR _i is set to "1" when a scan response is returned, and set to "0" when no scan response is returned. A network scan is usually performed for each port number of terminal device i, but in this embodiment of the invention, since it is desired to know the results of a network scan for each IP address Add _i of terminal device i, the scan response SR _i is associated with the IP address Add _i of terminal device i. Therefore, when a scan response is returned from at least one of the multiple port numbers of terminal device i, the scan response SR _i is set to 1, and when no scan response is returned from any of the multiple port numbers of terminal device i, the scan response SR _i is set to 0.

3, for scan responses SR _i returned from a terminal device, the number of scan responses SR _i returned is stored in the host information database 13. As described above, a network scan is performed by sending g Ping packets, so a maximum of g scan responses SR _i are returned. If at least one scan response SR _{i out of the g scan responses SR i} is returned, then the number of scan responses SR _i returned is not stored in the host information database 13 as "1 _" , indicating that a scan response has been returned, but rather.

In the scan responses SR ₁ , SR ₁₁ , SR ₁₂ , ..., the scan response SR ₁ represents the scan response returned from the terminal device (=IP address Add ₁ ), the scan response SR ₁₁ represents the scan response returned from the router closest to the network scanning device 1 among the routers existing between the network scanning device 1 and the terminal device (=IP address Add ₁ ), and the scan response SR ₁₂ represents the scan response returned from the router second closest to the network scanning device 1 among the routers existing between the network scanning device 1 and the terminal device (=IP address Add ₁ ). The same is true for the scan responses SR ₃ , SR ₃₁ , SR ₃₂ , ... to SR _I - ₁ , SR _I-11 , SR _I -12, ... other than the scan responses SR 1, SR ₁₁ , SR ₁₂ , ....

The scan response delay RTT _i is the time from the time when a Ping packet is transmitted to the time when a scan response SR _i is returned. Since the scan response delay RTT _i is measured based on the return of the scan response SR _i , the host information database 13 stores the same number of scan response delays RTT _i as the number of returned scan responses SR _i . Therefore, for example, the scan response delays RTT ₁ , RTT ₁₁ , RTT ₁₂ , ... are associated with the scan responses SR ₁ , SR ₁₁ , SR ₁₂ , ... respectively. The same is true for the scan response delays RTT ₃ , RTT ₃₁ , RTT ₃₂ , _... to RTT _{I-1, RTT I-11} , RTT I- ₁₂ , ... other than the scan response delays RTT ₁ , RTT ₁₁ , RTT ₁₂ , ....

In the scan response delays RTT ₁ , RTT ₁₁ , RTT ₁₂ , ..., the scan response delay RTT ₁ represents the scan response delay when the scan response SR ₁ is returned from the terminal device (= IP address Add ₁ ), the scan response delay RTT ₁₁ represents the scan response delay when the scan response SR ₁₁ is returned from the router closest to the network scanning device 1 among the routers between the network scanning device 1 and the terminal device (= IP address _Add 1), and the scan response delay RTT ₁₂ represents the scan response delay when the scan response SR ₁₂ is returned from the router second closest to the network scanning device 1 among the routers between the network scanning device 1 and the terminal device (= IP address Add ₁ ). The same is true for the scan response delays RTT ₃ , RTT ₃₁ , RTT ₃₂ , . . . to RTT _I-1 , RTT _I-11 , RTT _I-12 , .

The tentative determination is made based on the type of network determined by the method described below. The type can be one of types 1 to 5. Type 1 is Wired LAN, Type 2 is WLAN, Type 3 is Wi-SUN, Type 4 is LoRa, and Type 5 is LTE.

The provisional judgment count consists of one or more provisional judgment counts associated with one or more types included in the provisional judgment. The provisional judgment count consists of the number of times the type of the target network was provisionally judged to be a Type (any of Types Type 1 to Type 5). For example, the provisional judgment count Nd_11 consists of the number of times the type of the target network was provisionally judged to be Type 3. The same applies to the other provisional judgment counts Nd_12, Nd_13, Nd_31, Nd_32, Nd_51, Nd_I-11, Nd_I-12, Nd_I-13, and Nd_I-14.

The final judgments are respectively associated with the IP addresses Add ₁ to Add _I of the terminal device. The final judgments are made up of the provisional judgments associated with the largest number of provisional judgments. For example, the final judgment made up of the type Type 3 associated with the IP address Add ₁ is made up of the type Type 3 associated with the provisional judgment count Nd_11, which has the largest number of provisional judgments among the types Type 1, Type 3, and Type 4. The reason why the final judgment made up of the IP address Add _I-1 is "unknown" is because the provisional judgment counts of the provisional judgment counts Nd_I-11, Nd_I-12, Nd_I-13, and Nd_I-14 are the largest and are the same number. In this way, when there are multiple network types with the same number of provisional judgments, the network type is determined to be "unknown". Incidentally, "unknown" indicates that the type of the network is unknown. Furthermore, the final verdict associated with IP address Add _I consists of "-----", indicating that the operation to determine the type of target network could not be performed because not all scan responses SR _I were returned.

4 is a conceptual diagram of a scan schedule, and the scan schedule SCSHD has a total scan time length T _{S_total} and includes T _S (T _S is an integer equal to or greater than 1) scan timings 1 _S to T _S .

The total scan time length T _{S_total} is set to, for example, one day, and each of scan timings 1 _S to T _S has a time length of, for example, one hour. Scan timings t _S (t _S =1 _S to T _S ) include a start time t _start , an end time t _end , and target addresses Add ₁ to Add _n (n is an integer between 1 and I).

The start time t _start represents the time when the network scan starts at the scan timing t _S , and the end time t _end represents the time when the network scan ends at the scan timing t _S. Therefore, the network scanner 11 ends the network scan when the end time t _end arrives at the scan timing t _S.

Each of the target addresses Add ₁ to Add _n is _a global IP address, and represents n terminal devices that _are targets of the network scan.

Each of the scan timings 1 _S to (t−1) _S and (t+1) _S to T _S other than the scan timing t _S has the same configuration as the scan timing t _S shown in FIG.

The scan timings _1S to _TS may have the same time length (=t _end -t _start ) or may have different time lengths (=t _end -t _start ). Also, the scan timings _1S to _TS may have the same number of IP addresses or may have different numbers of IP addresses.

Moreover, the scan timing _tS does not mean a single time, but is a concept having a predetermined time length from the start time _tstart to the _end time tend.

Explains how to determine the type of network being scanned.

When the scan analysis manager 12 finishes a network scan at one scan timing _tS , it refers to the host information database 13 and reads out the scan response SR _i and the scan response delay RTT _i associated with one IP address Add _i .

Then, the scan analysis manager 12 detects TTL _i included in the scan response SR _i . In this case, the scan analysis manager 12 detects TTL ₁ , TTL ₁₁ , TTL ₁₂ , ... from the scan responses SR ₁ , SR ₁₁ , SR ₁₂ , ... associated with the IP address Add ₁ , for example.

TTL indicates the number of hops a Ping packet must make before returning from the terminal device to the network scanning device 1. Since one hop is added each time a Ping packet passes through a router, TTL is a value indicating the number of routers the Ping packet passed through before returning from the terminal device to the network scanning device 1 + 1.

When scan analysis manager 12 detects TTL ₁ , TTL ₁₁ , TTL ₁₂ , ..., it detects scan response delays STT ₁ , RTT ₁₁ , RTT ₁₂ , ... that are respectively associated with scan responses SR ₁ , SR ₁₁ , SR ₁₂ , .... Then, scan analysis manager 12 calculates a one-hop delay time based on TTL ₁ , TTL ₁₁ , TTL ₁₂ , ... and the scan response delays STT ₁ , RTT ₁₁ , RTT ₁₂ , ....

The scan analysis manager 12 similarly calculates one-hop delay times for the IP addresses Add ₂ to Add _I other than the IP address Add ₁ .

Figure 5 is a diagram for explaining a method for calculating one-hop delay time. Referring to Figure 5, there are K (K is an integer equal to or greater than 1) routers between the network scanning device 1 and the terminal device that is the target of the network scan.

A Ping packet containing TTL=1 reaches Router 1, a Ping packet containing TTL=2 reaches Router 2, and so on. A Ping packet containing TTL=K-1 reaches Router K-1, a Ping packet containing TTL=K reaches Router K, and a Ping packet containing TTL=K+1 reaches the terminal device.

When the terminal device receives the Ping packet, it transmits a scan response SR _i consisting of a Ping packet. The scan response SR _i reaches the network scanning device 1 via various routes between the terminal device and the network scanning device 1. When the scan response SR _i reaches the network scanning device 1, it includes a TTL consisting of the number of routers that it has passed through.

Therefore, in this embodiment of the invention, the minimum TTL included in the scan response that arrives at the network scanning device 1 from the terminal device is set as the number of stages in the network path. In FIG. 5, the minimum TTL is set to "K+1".

Then, the scan analysis manager 12 detects the scan response delay RTT associated with the scan response SR from the router K one stage before the terminal device from the host information database 13, and sets the detected scan response delay RTT as the last hop RTT. In other words, the last hop RTT is the scan response delay for the router K that is one stage before the number of network stages K+1 represented by the TTL included in the Ping packet that arrived at the network scanning device 1 from the terminal device.

K routers 1 to K arranged between the network scanning device 1 and the terminal device control the route when a Ping packet is transmitted between the network scanning device 1 and the terminal device. Therefore, if the router among the K routers 1 to K that returned a scan response SR and is closest to the terminal device is defined as the "nearest router," then the number of route stages when passing through one or more routers from router 1 to the nearest router is defined as the "route control stages." As a result, the one or more routers from router 1 to the nearest router usually consist of K routers 1 to K, and the number of route control stages when passing through K routers 1 to K is K.

The scan analysis manager 12 calculates the delay time for one hop using formula (1).

One-hop delay time=(Last hop RTT)/(Number of routing stages) (1)
The "Last hop RTT" in formula (1) may be an average value of multiple "scan response delays to router K" obtained by transmitting Ping packets to router K multiple times.

The reason for using the last hop RTT to calculate the delay time for one hop is that when a packet containing the information to be sent is sent to a destination terminal device, the destination terminal device ultimately receives the packet via one router, so the network consisting of router K and the terminal device is treated as the target network for the network scan. In addition, after a Ping packet containing TTL=K+1 reaches router K, the scan response SR that passes through router K was sent by the terminal device, and it is not possible to distinguish between the scan response delay RTT from the network scanning device 1 to router K and the scan response delay RTT from the network scanning device 1 to the terminal device.

As a result, the delay time for one hop is the average delay time of the delay times at K routers 1 to K.

The delay time per hop may also be the average value of multiple delay times per hop calculated for multiple terminal devices.

Thus, in this embodiment of the invention, the network scan is performed in a multi-stage network in which there are multiple routers between the network scanning device 1 and the terminal device that is the target of the network scan.

When the scan analysis manager 12 calculates the one-hop delay time, it multiplies the one-hop delay time by the number of route control stages, K, which is one stage smaller than the number of route stages (= K + 1) in the network, to calculate the route delay RRTT (= one-hop delay time × number of route control stages K).

The reason why the last hop RTT is divided by the number of routing stages K in formula (1) to calculate the delay time of one hop, and the route delay RRTT is calculated by multiplying the delay time of one hop by the number of routing stages K, is as follows.

The last hop RTT actually varies, so the last hop RTT is divided by the number of routing stages K to calculate the average delay time when passing through one router as the delay time per hop, and the calculated delay time per hop is multiplied by the number of routing stages K to calculate the route delay RRTT, thereby rounding off the variation in the last hop RTT.

Then, if the scan response SR _i is not returned from the router K, the scan response delay RTT _i from when the network scanning device 1 transmits a Ping packet until when the scan response SR _i is received from the router K-1 may be set as the last hop RTT, and the route delay RRTT may be calculated by the above-mentioned method, and if the scan response SR _i is not returned from the routers K-1 and K, the scan response delay RTT i from when the network scanning device 1 transmits a Ping packet until when the scan response SR _i is received from the router K-2 may be set as the last hop RTT, and the route delay RRTT may be calculated by the above-mentioned method. Therefore, in general, the scan response delay RTTT _i from when the scan response SR _i is received from the closest router among the multiple routers ₁ to K may be set as the last hop RTT, and the route delay RRTT may be calculated by the above-mentioned method.

After calculating the route delay RRTT, the scan analysis manager 12 detects the scan response delay RTT associated with the scan response SR from the terminal device from the host information database 13. Then, the scan analysis manager 12 subtracts the route delay RRTT (= delay time of one hop × number of route control stages K) from the scan response delay RTT to calculate the transmission delay ARTT of the access system portion (= scan response delay RTT - route delay RRTT (= delay time of one hop × number of route control stages K)).

If the scan response SR _i is not returned from router K, the one-hop delay time may be calculated using the above-mentioned method, and the calculated one-hop delay time may be multiplied by a value obtained by subtracting 1 from the number of stages in the multistage network (i.e., the number of network stages from the network scanning device 1 to router K (= the router located closest to the terminal device)) to calculate the route delay RRTT. In this way, even if the scan response SR _i is not returned from router K, the delay from router K to the terminal device can be found as the transmission delay ARTT of the access system portion.

Figure 6 shows a table showing the correspondence between network type, minimum scan response delay, and average scan response delay.

Referring to FIG. 6, correspondence table TBL1 includes network type, minimum scan response delay, and average scan response delay. The minimum scan response delay and the average scan response delay are associated with the network type.

Network types include Wired LAN, WLAN, Wi-SUN, LoRa and LTE.

The minimum scan response delay of 0.310 ms and the average scan response delay of 0.41 ms are associated with Wired LAN. The minimum scan response delay of 0.839 ms and the average scan response delay of 2.16 ms are associated with WLAN. The minimum scan response delay of 180 ms and the average scan response delay of 460.4 ms are associated with Wi-SUN. The minimum scan response delay of 3808 ms and the average scan response delay of 5250 ms are associated with LoRa. The minimum scan response delay of 12.5 ms and the average scan response delay of 19.3 ms are associated with LTE.

Thus, Wired LAN, WLAN, Wi-SUN, LoRa and LTE have different minimum or average scan response delays.

The minimum or average scan response delay constitutes a threshold value DT_th for determining the type of the target network. More specifically, the minimum or average scan response delay of Wired LAN constitutes a threshold value DT_th1, the minimum or average scan response delay of WLAN constitutes a threshold value DT_th2, the minimum or average scan response delay of Wi-SUN constitutes a threshold value DT_th3, the minimum or average scan response delay of LoRa constitutes a threshold value DT_th4, and the minimum or average scan response delay of LTE constitutes a threshold value DT_th5.

The scan analysis manager 12 holds a correspondence table TBL1. Then, when the scan analysis manager 12 calculates the transmission delay ARTT, it compares the calculated transmission delay ARTT with a threshold value DT_th, and provisionally determines that the network type associated with the threshold value DT_th that is closest to the transmission delay ARTT is the type of the target network.

Figure 7 shows the relationship between scan response delay and the number of network scans when the network type is Wired LAN.

In Figure 7, the vertical axis represents the scan response delay, and the horizontal axis represents the number of network scans. Figure 7 also shows the relationship between the measured scan response delay and the number of network scans.

Referring to Figure 7, in a wired LAN, the scan response delay is generally distributed between 0.30 ms and 0.55 ms for up to 1,000 network scans.

Figure 8 shows the probability distribution function of scan response delay when the network type is Wired LAN.

In Figure 8, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to Figure 8, the average scan response delay is 0.41 [ms], the minimum scan response delay is 0.310 [ms], and the maximum scan response delay is 0.560 [ms].

Figure 9 shows the relationship between scan response delay and the number of network scans when the network types are WLAN, Wi-SUN, and LoRa.

In Figure 9, the vertical axis represents the scan response delay, and the horizontal axis represents the number of network scans. Figure 9 also shows the relationship between the measured scan response delay and the number of network scans.

Referring to Figure 9, the scan response delay differs significantly between WLAN, Wi-SUN, and LoRa for up to 1500 network scans. The scan response delay is smallest for WLAN, second smallest for Wi-SUN, and largest for LoRa.

Figure 10 shows the probability distribution function of scan response delay when the network type is WLAN.

In FIG. 10, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to FIG. 10, the average scan response delay is 2.16 [ms], and the minimum scan response delay is 0.839 [ms].

Figure 11 is a diagram showing the probability distribution function of the scan response delay when the network type is Wi-SUN. In Figure 11, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to Figure 11, the average scan response delay is 460.4 [ms], and the minimum value of the scan response delay is 180 [ms].

Figure 12 is a diagram showing the probability distribution function of the scan response delay when the network type is LoRa. In Figure 12, the vertical axis represents the probability distribution function, and the horizontal axis represents the scan response delay. Referring to Figure 12, the average scan response delay is 5250 [ms], and the minimum value of the scan response delay is 3808 [ms].

When the network type is LTE, the minimum scan response delay and average scan response delay values were determined based on the distribution of the measured scan response delays in the same manner as for Wired LAN, WLAN, Wi-SUN, and LoRa described above.

The scan analysis manager 12 repeatedly performs the tentative judgment until the termination condition is satisfied. The termination condition is either the following termination condition 1 or termination condition 2.

(Termination condition 1)
When the provisional determination is performed a predetermined number of times M, M is, for example, 10 times.

(Termination condition 2)
When the number of provisional judgments for a certain network type becomes dominant: For example, when the number of provisional judgments for a certain network type becomes M/2 or more.

In addition, when using termination condition 1, if the number of provisional judgments does not reach M within a specified time, the scan analysis manager 12 judges the network type to be "unknown."

Fig. 13 is a flowchart for explaining the operation of determining the network type. Note that in Fig. 13, the operation of determining the network type is explained on the assumption that scan responses SR ₁ to SR _I have been returned from all terminal devices (=IP addresses Add ₁ to Add _I ) that are targets of the network scan.

Referring to FIG. 13, when the operation to determine the network type is started, the scan analysis manager 12 sets i=1 (step S1). Then, the network scanner 11 sends a Ping packet to perform a network scan (step S2).

Then, the scan analysis manager 12 measures the scan response delay (step S3).

Next, the scan analysis manager 12 calculates the transmission delay _ARTTi of the access system portion based on the number of network path stages and the scan response delay (step S4).

Then, the scan analysis manager 12 compares the transmission delay _ARTTi with a threshold value and provisionally determines the network type (step S5).

The scan analysis manager 12 then determines whether the conditions for terminating the provisional judgment are met (step S6).

If it is determined in step S6 that the termination condition for the provisional judgment is not met, the series of operations proceeds to step S2, and steps S2 to S6 are repeatedly executed until it is determined in step S6 that the termination condition for the provisional judgment is met.

If it is determined in step S6 that the condition for ending the provisional judgment is met, the scan analysis manager 12 determines whether the number of provisional judgments has reached M within a predetermined time (step S7).

When it is determined in step S7 that the number of provisional judgments has not reached M within the predetermined time, the scan analysis manager 12 sets "unknown" as the final judgment result of the terminal device i (step S8).

On the other hand, when it is determined in step S7 that the number of provisional judgments has reached M within the predetermined time, the scan analysis manager 12 sets the provisional judgment result with the greatest number of judgments as the final judgment result for the terminal device i (step S9).

Then, after step S8 or step S9, the scan analysis manager 12 determines whether i=I (step S10).

If it is determined in step S10 that i is not equal to I, the scan analysis manager 12 sets i to i+1 (step S11). After that, the series of operations proceeds to step S2, and steps S2 to S11 are repeatedly executed until it is determined in step S10 that i is equal to I.

If it is determined in step S10 that i=I, the scan analysis manager 12 records the final determination result in the host information database 13 (step S12). After step S12, the operation of determining the network type ends.

In addition, in order to determine the type of the target network including terminal devices (=IP address Add _i ) from which a scan response SR was not returned according to the flowchart shown in FIG. 13, a "step of determining whether or not the scan response SR _i is "1"" can be inserted between steps S2 and S3, and when it is determined that the scan response SR _i is "1", the process proceeds to step S3, and when it is determined that the scan response SR _i is not "1", the process proceeds to step S10.

Fig. 14 is a flow chart for explaining the detailed operation of step S4 in Fig. 13. Referring to Fig. 14, after step S3 in Fig. 13, scan analysis manager 12 detects TTL _i included in scan response SR _i from terminal device i, and sets the value K+1 of the detected TTL _i as the number of route stages in the network (step S41).

Then, the scan analysis manager 12 detects the scan response delay RTT _iK corresponding to the scan response SR _iK from the router K located immediately upstream of the terminal device i (step S42).

Thereafter, the scan analysis manager 12 calculates one-hop delay time by dividing the scan response delay RTT _iK by the number of routing stages K, which is the number of hops from the network scanning device to the router K (step S43).

The scan analysis manager 12 then multiplies the one-hop delay time by the number of route control stages K from the network scanning device to router K to calculate the route delay (step S44).

Then, the scan analysis manager 12 calculates the transmission delay ARTT _i by subtracting the path delay from the scan response delay RTT _i associated with the scan response SR _i from the terminal device i (step S45). After that, the series of operations proceeds to step S5 in FIG.

14, in step S42, the scan response delay RTT _iKcls corresponding to the scan response SR _iKcls from the nearest router Kcls of terminal device i may be detected, and in step S43, the scan response delay RTT _iKcls may be divided by the number of routing control stages, which is the number of hops from the network scanning device to the nearest router Kcls, to calculate the delay time of one hop. Here, in the scan response SR _iKcls and the scan response delay RTT _iKcls , the subscript "i" corresponds to the IP address Add _i , and the subscript "Kcls" corresponds to the nearest router Kcls.

Figure 15 is a flowchart explaining the detailed operation of step S5 in Figure 13.

Referring to FIG. 15, after step S4 in FIG. 13, the scan analysis manager 12 reads out thresholds DT_th1 to DT_th5 for the Wired LAN, WLAN, Wi-SUN, LoRa, and LTE networks from the correspondence table TBL1 that it holds (step S51).

In this case, the scan analysis manager 12 reads out threshold value DT_th1 as the threshold value for Wired LAN, threshold value DT_th2 as the threshold value for WLAN, threshold value DT_th3 as the threshold value for Wi-SUN, threshold value DT_th4 as the threshold value for LoRa, and threshold value DT_th5 as the threshold value for LTE.

The scan analysis manager 12 also reads out the minimum scan response delay or average scan response delay from the correspondence table TBL1 as thresholds DT_th1 to DT_th5.

After step S51, the scan analysis manager 12 sets j=1 (step S52), and calculates the absolute value |ARTT _i -DT_thj| of the difference between the transmission delay ARTT _i and the threshold value DT_thj (step S53).

Then, the scan analysis manager 12 determines whether j= _{N_NW} (step S54), where _{N_NW} is the total number of networks.

When it is determined in step S54 that j=N _NW is not true, scan analysis manager 12 sets j=j+1 (step S55). After that, the series of operations proceeds to step S53, and steps S53 to S55 are repeatedly executed until it is determined in step S54 that j=N _NW is true.

If it is determined in step S54 that j= _NNW , the scan analysis manager 12 detects the minimum value from among the multiple absolute values |ARTT _i -DT_thj| (step S56).

The scan analysis manager 12 then determines whether there are multiple minimum values (step S57).

If it is determined in step S57 that there are multiple minimum values, the scan analysis manager 12 provisionally determines that the type of the target network is "unknown" (step S58).

On the other hand, if it is determined in step S57 that there are not multiple minimum values, the scan analysis manager 12 provisionally determines that the network type corresponding to the threshold value DT_thj used to calculate the minimum value is the type of the target network (step S59).

Then, after step S58 or step S59, the scan analysis manager 12 records the tentative judgment result and the number of tentative judgments in the host information database 13 (step S60). After that, the series of operations proceeds to step S6 in FIG. 13.

Fig. 16 is another flowchart for explaining the operation of determining the network type. Note that in Fig. 16, the operation of determining the network type is explained on the assumption that scan responses _SR1 to _SR1 have been returned from all terminal devices (=IP addresses _Add1 to _AddI ) that are targets of the network scan.

The flowchart shown in FIG. 16 is the same as the flowchart shown in FIG. 13, except that steps S7 to S9 of the flowchart shown in FIG. 13 are replaced with steps S13 to S17.

Referring to FIG. 16, when the operation to determine the network type is started, steps S1 to S6 described above are executed in sequence.

Then, when it is determined in step S6 that the conditions for terminating the provisional judgment are not met, the scan analysis manager 12 determines whether a predetermined time has elapsed (step S13).

When it is determined in step S13 that the predetermined time has elapsed, the scan analysis manager 12 sets "unknown" as the final judgment result of the terminal device i (step S14).

On the other hand, if it is determined in step S13 that the predetermined time has not elapsed, the series of operations proceeds to step S2, and steps S2 to S6 and S13 are repeatedly executed until it is determined in step S6 that the termination condition for the provisional judgment is met before the predetermined time has elapsed.

Then, if it is determined in step S6 that the condition for terminating the provisional judgment is met, the scan analysis manager 12 determines whether the number of provisional judgments is dominant (step S15).

When it is determined in step S15 that the number of provisional judgments is dominant, the scan analysis manager 12 sets the provisional judgment result in which the number of provisional judgments has become dominant as the final judgment result for the terminal device i (step S16).

On the other hand, when it is determined in step S15 that the number of provisional judgments is not dominant, the scan analysis manager 12 sets the provisional judgment result with the greatest number of judgments as the final judgment result for the terminal device i (step S17).

Then, the scan analysis manager 12 sequentially executes the above-mentioned steps S10 to S12 after any of steps S14, S16, and S17. In this case, when the scan analysis manager 12 determines in step S10 that i=I is not satisfied, it executes the above-mentioned step S11. After that, the series of operations proceeds to step S2, and steps S2 to S6 and S13 to S17 are repeatedly executed until it is determined in step S10 that i=I is satisfied.

If it is determined in step S10 that i=I, then step S12 described above is executed, and the operation of determining the network type is completed.

In the flowchart shown in FIG. 16, the detailed operation of step S4 is performed according to the flowchart shown in FIG. 14, and the detailed operation of step S5 is performed according to the flowchart shown in FIG. 15.

Furthermore, in order to determine the type of target network including terminal devices (=IP address Add _i ) from which a scan response SR was not returned according to the flowchart shown in FIG. 16 , a “step of determining whether or not the scan response SR _i is “1”” can be inserted between steps S2 and S3, and when it is determined that the scan response SR _i is “1”, the process proceeds to step S3, and when it is determined that the scan response SR _i is not “1”, the process proceeds to step S10.

Figure 17 shows the results of an experiment to determine the network type when the minimum scan response delay is used as the threshold.

In Figure 17, the network types used were WLAN, Wi-SUN, and LoRa. The number of experimental trials was 200 for each network type.

Referring to FIG. 17, as a result of determining the network type according to the flowchart shown in FIG. 13 (including the flowcharts shown in FIG. 14 and FIG. 15), the number of times the type of the target network was determined to be WLAN, the number of times the type of the target network was determined to be Wi-SUN, and the number of times the type of the target network was determined to be LoRa were all 200 times.

In this way, it was found that when the minimum scan response delay is used as the threshold value Dt_thj, it is possible to determine with 100% probability that the type of the target network is either WLAN, Wi-SUN, or LoRa.

Figure 18 shows the results of an experiment to determine network type when the average scan response delay is used as a threshold.

In Figure 18, WLAN, Wi-SUN, and LoRa were used as network types, and the number of experimental trials was 200 for each network type.

Referring to FIG. 18, as a result of determining the network type according to the flowchart shown in FIG. 13 (including the flowcharts shown in FIG. 14 and FIG. 15), the number of times that the type of the target network was determined to be WLAN was 200. In addition, the number of times that the type of the target network was determined to be Wi-SUN was 194, and the number of times that the type of the target network was determined to be WLUN was 6. In addition, the number of times that the type of the target network was determined to be LoRa was 200.

In this way, when the average scan response delay is used as the threshold Dt_thj, it was found that the type of the target network can be determined with a 100% probability for WLAN and LoRa networks, and with a 97% probability for Wi-SUN networks.

The experimental results shown in Figures 17 and 18 show that the method of determining the network type using the flowchart shown in Figure 13 (including the flowcharts shown in Figures 14 and 15) can determine the type of the target network with a high probability. It was also found that by using the minimum scan response delay as the threshold value DT_thj, the probability of determining the type of the target network can be improved to 100%.

Therefore, the scan analysis manager 12 preferably reads out the minimum scan response delays from the correspondence table TBL1 as thresholds DT_th1 to DT_th5 in step S51 of FIG. 15.

As described above, the type of the target network can be accurately determined by determining the network type according to the flowchart shown in FIG. 13 (including the flowcharts shown in FIG. 14 and FIG. 15).

In the first embodiment, the operation of the network scanning device 1 may be realized by software. In this case, the network scanning device 1 includes a CPU (Central Processing Unit), a ROM (Read Only Memory), and a RAM (Random Access Memory). The ROM stores a program Prog_A consisting of the steps of the flowchart shown in FIG. 13 (including the flowcharts shown in FIG. 14 and FIG. 15), or a program Prog_B consisting of the steps of the flowchart shown in FIG. 16 (including the flowcharts shown in FIG. 14 and FIG. 15).

The CPU reads out the program Prog_A or the program Prog_B from the ROM and executes the read out program Prog_A or the program Prog_B to determine the type of the target network. The RAM temporarily stores the calculated one-hop delay time, the route delay, the transmission delay ARTT _i , the multiple absolute values |ARTT _i -DT_thj|, and the minimum value of the multiple absolute values |ARTT _i -DT_thj|.

In addition, program Prog_A or program Prog_B may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium on which program Prog_A or program Prog_B is recorded is inserted into a computer, the computer reads program Prog_A or program Prog_B from the recording medium and executes it to determine the type of the target network.

Therefore, a recording medium on which the program Prog_A or the program Prog_B is recorded is a computer-readable recording medium.

[Embodiment 2]
FIG. 19 is a schematic diagram of the network scanning device shown in FIG. 1 according to a second embodiment.

Referring to FIG. 19, the network scanning device 1A in the second embodiment is the same as the network scanning device 1, except that the scan scheduler 14 in the network scanning device 1 shown in FIG. 2 has been replaced with a scan scheduler 14A.

The scan scheduler 14A creates a scan schedule for a network scan according to the type of the target network, using a method described below, based on the result of the determination of the type of the target network by the scan analysis manager 12. Then, the scan scheduler 14A outputs the created scan schedule to the network scanner 11, and controls the network scanner 11 to execute a network scan according to the scan schedule.

We will explain how to create a scan schedule according to the network type. The scan scheduler 14A detects the network type from the final determination of the host information database 13.

Then, the scan scheduler 14A calculates the amount of time resources RSC_Time required for one network scan for each detected network type.

Furthermore, the scan scheduler 14A detects the time length _{L_tS} of one scan timing of the network scan (i.e., the scan timing _tS shown in FIG. 4).

Furthermore, the scan scheduler 14A holds in advance a communication congestion degree CNG_t _S at one scan timing (i.e., scan timing t _S shown in FIG. 4) for all of the networks. The congestion degree CNG_t _S is a real number in the range of 0 to 1.

Then, if the amount of resources available for network scanning at one scan timing (i.e., scan timing t _S shown in FIG. 4 ) is RSC_t _S , the scan scheduler 14A calculates the amount of resources available for network scanning at one scan timing (i.e., scan timing t _S shown in FIG. 4 ) RSC_t _S = (1 - CNG_t _{S )} × L_t _S.

Then, the scan scheduler 14A creates a scan schedule based on the time resource amount RSC_Time so as not to exceed the resource amount _{RSC_tS} .

Figure 20 shows an example of the amount of time resources RSC_Time required for one network scan.

Referring to FIG. 20, the time resource amount RSC_Time is 0.49 [ms] in Wired LAN, 2.59 [ms] in WLAN, 552 [ms] in Wi-SUN, 6300 [ms] in LoRa, and 23.16 [ms] in LTE.

The scan scheduler 14A multiplies the average scan response delay shown in FIG. 6 by a margin coefficient (e.g., 1.2) to calculate the time resource amount RSC_Time shown in FIG. 20 for each network. Note that the margin coefficient may be determined within a range that does not exceed the standard deviation of the scan response delay for each network type.

The scan scheduler 14A divides the resource amount RSC_t _S by the time resource amount RSC_Time to calculate the division result N_DIV. The resource amount RSC_t _S is calculated by (1-CNG_t _S )×L_t _S , and since the unit of the congestion degree CNG_t _S is dimensionless, the unit of the resource amount RSC_t _S is [ms]. As a result, the division result N_DIV indicates the maximum number of terminal devices (IP address Add _i ) that can perform a network scan at one scan timing (i.e., the scan timing t _S shown in FIG. 4 ).

Therefore, creating a scan schedule so as not to exceed the resource amount _{RSC_tS} corresponds to determining the number of terminal devices (IP address Add _i ) that perform a network scan at one scan timing (i.e., scan timing t _S shown in FIG. 4 ) so as not to exceed the division result N_DIV.

Figure 21 is a flowchart explaining the operation of the network scanning device 1A shown in Figure 19.

In addition, in FIG. 21, the operation of the network scanning device 1A will be described on the assumption that the congestion degree _{CNG_tS} of each network at each scan timing _tS has been acquired in advance.

Referring to Fig. 21, when the operation of the network scanning device 1A is started, the network scanner 11 and the scanner analysis manager 12 execute the flowchart shown in Fig. 13 (including the flowcharts shown in Figs. 14 and 15) to determine the type of the target network (step S61). Note that in step S61, the type of the target network may also be determined by executing the flowchart shown in Fig. 16 (including the flowcharts shown in Figs. 14 and 15).

Then, the scan scheduler 14A refers to the host information database 13 to obtain the network type determination result (step S62).

Then, the scan scheduler 14A obtains the number N_NW of networks for which a scan schedule is to be created (step S63).

The scan scheduler 14A then sets w=1 (step S64) and calculates the amount of time resources RSC_Time_w required for one network scan in the network NW_w (step S65).

Then, the scan scheduler 14A calculates the amount of resources available for network scanning RSC_tS = (1 - CNG_tS_w _{) x L_tS} based on the congestion degree _{CNG_tS_w} of the time period when the network scan is performed in the network NW_w and the duration _{L_tS} of the time _period when the network scan is performed (step S66).

Then, the scan scheduler 14A creates a scan schedule SCH_w for a network scan based on the time resource amount RSC_Time_w so as not to exceed the resource amount _{RSC_tS} (step S67).

Then, the scan scheduler 14A determines whether w = N_NW (step S68).

If it is determined in step S68 that w is not equal to N_NW, the scan scheduler 14A sets w to w+1 (step S69). After that, the series of operations proceeds to step S65, and steps S65 to S69 are repeatedly executed until it is determined in step S68 that w is equal to N_NW.

Then, when it is determined in step S68 that w=N_NW, the scan scheduler 14A outputs the scan schedules SCH_1 to SCH_N_NW to the network scanner 11 and controls the network scanner 11 to execute a network scan based on the scan schedules SCH_1 to SCH_N_NW. The network scanner 11 executes a network scan in the networks NW_1 to NW_N_NW based on the scan schedules SCH_1 to SCH_N_NW received from the scan scheduler 14A (step S70). This ends the operation of the network scanning device 1A.

Figure 22 is another flowchart for explaining the operation of the network scanning device 1A shown in Figure 19.

The flowchart shown in FIG. 22 is the same as the flowchart shown in FIG. 21, except that steps S63 to S70 in the flowchart shown in FIG. 21 are replaced with steps S71 to S80.

Referring to FIG. 22, when the operation of the network scanning device 1A is started, the above-mentioned steps S61 and S62 are executed in sequence. In this case, in step S61, the type of the target network may be determined by executing the flowchart shown in FIG. 16 (including the flowcharts shown in FIG. 14 and FIG. 15).

Then, after step S62, the scan scheduler 14A determines whether the determined result is a wireless network (step S71).

In step S71, when it is determined that the result is a wireless network, the scan scheduler 14A obtains the number of wireless networks N_RF (step S72).

Then, the scan scheduler 14A sets f=1 (step S73). After that, the scan scheduler 14A acquires the measured congestion degree _{CNG_ts_f} in the time period of the scan timing _ts from the base station of the wireless network NR_f (step S74). Here, the measured congestion degree _{CNG_ts_f} is a division result obtained by dividing the number of terminal devices that perform wireless communication with the base station at one scan timing _ts by the total number of terminal devices present within the communication range of the base station. Since the base station can detect the total number of terminal devices present within its own communication range, it counts the number of terminal devices that perform wireless communication with itself at one scan timing _ts , divides the counted number of terminal devices by the total number of terminal devices present within its own communication range, and transmits the congestion degree resulting from the division to the network scanning device 1A. Therefore, the scan scheduler 14A can obtain the congestion degree CNG_t _S _f measured in the time period of the scan timing t _S from the base station of the wireless network NR_f.

After step S74, the scan scheduler 14A calculates the amount of time resources RSC_Time_f required for one network scan in the wireless network NR_f (step S75).

Then, the scan scheduler 14A calculates the amount of resources available for network scanning RSC_tS = (1 - _{CNG_tS_f} ) x _{L_tS} based on the congestion degree CNG_tS_f of the time period when the network scan is performed in the wireless network NR_f and the duration _{L_tS} of _{the time} period when the network scan is performed (step S76).

Then, the scan scheduler 14A creates a scan schedule SCH_f for a network scan based on the time resource amount RSC_Time_f so as not to exceed the resource amount _{RSC_tS} (step S77).

Then, the scan scheduler 14A determines whether f = N_RF (step S78).

If it is determined in step S78 that f is not equal to N_RF, the scan scheduler 14A sets f to f+1 (step S79). After that, the series of operations proceeds to step S75, and steps S75 to S79 are repeatedly executed until it is determined in step S78 that f is equal to N_RF.

Then, when it is determined in step S78 that f=N_RF, the scan scheduler 14A outputs the scan schedules SCH_1 to SCH_N_RF to the network scanner 11 and controls the network scanner 11 to execute a network scan based on the scan schedules SCH_1 to SCH_N_RF. The network scanner 11 executes a network scan in the wireless networks NR_1 to NR_N_RF based on the scan schedules SCH_1 to SCH_N_RF received from the scan scheduler 14A (step S80). Then, when it is determined in step S71 that none of the networks is a wireless network, or after step S80, the operation of the network scanning device 1A ends.

In the second embodiment, the operation of the network scanning device 1A may be realized by software. In this case, the network scanning device 1A includes a CPU, a ROM, and a RAM. The ROM stores a program Prog_C consisting of the steps of the flowchart shown in FIG. 21 (including the flowchart shown in FIG. 13 (including the flowcharts shown in FIG. 14 and FIG. 15) or the flowchart shown in FIG. 16 (including the flowcharts shown in FIG. 14 and FIG. 15)) or a program Prog_D consisting of the steps of the flowchart shown in FIG. 22 (including the flowchart shown in FIG. 13 (including the flowcharts shown in FIG. 14 and FIG. 15) or the flowchart shown in FIG. 16 (including the flowcharts shown in FIG. 14 and FIG. 15)).

The CPU reads out the program Prog_C or the program Prog_D from the ROM, and executes the read out program Prog_C or the program Prog_D to determine the type of the target network, and executes a network scan according to a scan schedule created according to the determined type of the target network. The RAM temporarily stores the calculated one-hop delay time, route delay, transmission delay ARTT _i , a plurality of absolute values |ARTT _i -DT_thj|, the minimum value of the plurality of absolute values |ARTT _i -DT_thj|, a time resource amount RSC_Time, and a resource amount RSC_t _S.

In addition, the program Prog_C or the program Prog_D may be distributed in a form recorded on a recording medium such as a CD or a DVD. When the recording medium on which the program Prog_C or the program Prog_D is recorded is attached to a computer, the computer reads and executes the program Prog_C or the program Prog_D from the recording medium, determines the type of the target network, and executes a network scan according to a scan schedule created according to the determined type of the target network.

Therefore, the recording medium on which the program Prog_C or the program Prog_D is recorded is a computer-readable recording medium.

The rest of the explanation in embodiment 2 is the same as the explanation in embodiment 1.

In this embodiment of the invention, when the router that returns the scan response SR among K routers 1 to K and is the closest to the terminal device is defined as the "nearest router," the scan response delay RTT from the nearest router constitutes the "route control response delay."

In addition, in this embodiment of the invention, TTL constitutes the "stage number index."

Furthermore, in this embodiment of the invention, the network scanner 11 that transmits the Ping packets constitutes the "transmission means."

Furthermore, in this embodiment of the invention, the network scanner 11 that receives the scan response SR constitutes a "receiving means."

Furthermore, in this embodiment of the invention, the scan analysis manager 12 that measures the scan response delay RTT constitutes a "measurement means."

Furthermore, in this embodiment of the invention, the scan analysis manager 12, which determines the type of the target network, constitutes a "determination means."

Furthermore, in this embodiment of the invention, the scan scheduler 14A, which creates a scan schedule according to the type of target network, constitutes a "schedule creation means."

In the above-mentioned embodiment 1, a network scanning device 1 was described which calculates the transmission delay ARTT in the target network that is the subject of a network scan based on the scan response delay from a terminal device (IP address Add _i ) and determines the type of the target network based on the calculated transmission delay ARTT.

Furthermore, in the second embodiment, in addition to determining the type of the target network as in the first embodiment, a network scanning device 1A is described that creates a scan schedule for a network scan according to the result of determining the type of the target network.

Therefore, according to an embodiment of the present invention, the network scanning device may have the following configurations 1 to 10.

(Configuration 1)
The network scanning device includes a transmitting means, a receiving means, a measuring means, a computing means, and a determining means. The transmitting means transmits a scan packet, which is a packet for performing a network scan, in a multi-stage network that transmits information to a terminal device via a plurality of routers. The receiving means receives a scan response, which is a response to the scan packet, in the multi-stage network. The measuring means measures a scan response delay from when the transmitting means transmits the scan packet to when the receiving means receives the scan response. The computing means calculates a transmission delay in a target network that has one router and is the target of a network scan, based on the scan response delay and the number of routing control stages, which is the number of stages from the network scanning device to a nearest router that is closest to the terminal device and that has returned a scan response among a plurality of routers. The determining means determines the type of the target network based on the transmission delay calculated by the computing means.

(Configuration 2)
In configuration 1, the calculation means calculates a route delay, which is the delay time caused by routers between the network scanning device and the target network, based on the number of route control stages, and calculates a transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 3)
In configuration 2, the calculation means sets the number of stages smaller than the number of stages of the multi-stage network included in the scan response as the number of route control stages, calculates the delay time per hop by dividing the route control response delay, which is the scan response delay to the nearest router, by the number of route control stages, calculates the route delay by multiplying the calculated delay time per hop by the number of stages from the network scan device to the router located closest to the terminal device or the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 4)
In configuration 3, the delay time per hop is an average value of multiple delay times per hop calculated for multiple terminal devices that are targets of a network scan. The calculation means calculates a path delay by multiplying the average value by the number of stages or the number of routing control stages from the network scan device to the router located closest to the terminal device, and calculates a transmission delay by subtracting the calculated path delay from the scan response delay.

(Configuration 5)
In any of configurations 1 to 4, the determination means performs a provisional determination to compare the transmission delay with a threshold determined according to the type of network, and determines the type of network corresponding to the threshold value having the closest transmission delay as the type of target network, and determines the type for which the provisional determination is performed the most times as the type of target network.

(Configuration 6)
In configuration 5, the threshold comprises a minimum scan response delay that is the minimum value of the scan response delay.

(Configuration 7)
In the fifth or sixth configuration, the determining means determines that the type of the target network is unknown when there are a plurality of types for which the number of provisional determinations is the same.

(Configuration 8)
In any one of configurations 1 to 7, the network scanning device further includes a schedule creation means. The schedule creation means executes a schedule creation process to extract a target network whose network type has been determined based on the determination result by the determination means, calculate an amount of time resources required for one network scan in the extracted target network, calculate an amount of resources required for the network scan in a time period based on the length of the time period during which the network scan is performed and the congestion level in the time period, and create a schedule for the network scan based on the amount of time resources so as not to exceed the amount of resources.

(Configuration 9)
In the eighth configuration, the schedule creation means calculates the amount of time resources by multiplying the average value of the scan response delay in the target network by a margin coefficient in the schedule creation process.

(Configuration 10)
In the eighth or ninth configuration, when a plurality of target networks are extracted based on the determination result by the determining means, the schedule creating means executes a schedule creating process for all of the plurality of target networks.

Furthermore, according to an embodiment of the present invention, the program may have the following configurations 11 to 20.

(Configuration 11)
The program includes:
A first step in which a transmission means transmits a scan packet, which is a packet for performing a network scan, in a multi-stage network in which information is transmitted to a terminal device via a plurality of routers;
a second step of receiving, by a receiving means, a scan response in the multi-stage network, the scan response being a response to the scan packet;
a third step in which a measurement means measures a scan response delay from when the scan packet is transmitted in the first step to when the scan response is received in the second step;
a fourth step in which the calculation means calculates a transmission delay in a target network having one router and being a target of a network scan based on a route control step number, which is the number of steps to a nearest router that has returned a scan response from the network scanning device and is closest to the terminal device, and a scan response delay;
and a fifth step in which the determining means determines the type of the target network based on the transmission delay calculated in the fourth step.

(Configuration 12)
In configuration 11, in the fourth step, the calculation means calculates a route delay, which is the delay time caused by a router between the network scanning device and the target network, based on the number of route control stages, and calculates a transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 13)
In configuration 12, in the fourth step, the calculation means sets the number of stages smaller than the number of stages of the multi-stage network included in the scan response as the number of route control stages, calculates the delay time per hop by dividing the route control response delay, which is the scan response delay to the nearest router, by the number of route control stages, calculates the route delay by multiplying the calculated delay time per hop by the number of stages from the network scanning device to the router located closest to the terminal device or the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay.

(Configuration 14)
In configuration 13, the delay time per hop is an average value of a plurality of delay times per hop calculated for a plurality of terminal devices that are targets of a network scan;
In the fourth step, the calculation means multiplies the average value by the number of stages or the number of route control stages from the network scanning device to the router located closest to the terminal device to calculate the route delay, and subtracts the calculated route delay from the scan response delay to calculate the transmission delay.

(Configuration 15)
In any of configurations 11 to 14, in the fifth step, the determination means performs a provisional determination to compare the transmission delay with a threshold determined according to the type of network, and determines the type of network corresponding to the threshold value having the closest transmission delay as the type of target network, and determines the type having the greatest number of provisional determinations as the type of target network.

(Configuration 16)
In configuration 15, the threshold comprises a minimum scan response delay that is the minimum value of the scan response delay.

(Configuration 17)
In configuration 15 or 16, the determining means determines in the fifth step that the type of the target network is unknown when there are a plurality of types for which the number of provisional determinations is the same.

(Configuration 18)
The program further causes the computer to execute a sixth step of a schedule creation process in which the schedule creation means extracts a target network whose network type has been determined based on the determination result by the determination means, calculates the amount of time resources required for one network scan in the extracted target network, calculates the amount of resources required for network scanning in a time period based on the length of the time period during which the network scan is performed and the degree of congestion in that time period, and creates a network scan schedule based on the amount of time resources so as not to exceed the amount of resources.

(Configuration 19)
In configuration 18, in the schedule creation process of the sixth step, the schedule creation means calculates the amount of time resource by multiplying the average value of the scan response delay in the target network by a margin coefficient.

(Configuration 20)
In configuration 18 or 19, when a plurality of target networks are extracted based on the determination result by the determination means in the sixth step, the schedule creation means executes a schedule creation process for all of the plurality of target networks.

(Configuration 21)
The recording medium is a computer-readable recording medium having the program according to any one of configurations 11 to 20 recorded thereon.

The embodiments disclosed herein should be considered to be illustrative and not restrictive in all respects. The scope of the present invention is indicated by the claims, not by the description of the embodiments above, and is intended to include all modifications within the meaning and scope of the claims.

This invention applies to a network scanning device, a program for causing a computer to execute the program, and a computer-readable recording medium on which the program is recorded.

1, 1A network scanning device, 10 communication system, 11 network scanner, 12 scan analysis manager, 13 host information database, 14, 14A scan scheduler, 20 network to be scanned, 30 user.

Claims (21)

A transmission means for transmitting a scan packet, which is a packet for performing a network scan, to a terminal device connected to a target network having one router in a multi-stage network in which information is transmitted to a terminal device via a plurality of routers, the target network having one router and being a target of the network scan ;
a receiving means for receiving a scan response from the terminal device in the multi-stage network, the scan response being a response to the scan packet;
a measuring means for measuring a scan response delay from when the transmitting means transmits the scan packet to the terminal device until when the receiving means receives the scan response from the terminal device ;
a calculation means for calculating a transmission delay in the target network based on a route control step number, which is the step number from a network scanning device to a nearest router that is one of the plurality of routers to which the scan response has been returned and that is closest to the terminal device, and the scan response delay;
a determination unit that determines a type of the target network based on the transmission delay calculated by the calculation unit. 2. The network scanning device according to claim 1, wherein the calculation means calculates a route delay, which is a delay time caused by a router between the network scanning device and the target network, based on the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay. 3. The network scanning device of claim 2, wherein the calculation means sets the route control stage number to a stage number smaller than the number of stages of the multi-stage network included in the scan response, divides the route control response delay, which is the scan response delay to the nearest router, by the route control stage number to calculate a delay time per hop consisting of an average value of multiple delay times per hop calculated for multiple terminal devices, calculates the route delay by multiplying the calculated delay time per hop by the number of stages from the network scanning device to the router located closest to the terminal device or the route control stage number, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay measured by the measurement means . 4. The network scanning device according to claim 3, wherein the calculation means calculates the route delay by multiplying the average value by the number of stages from the network scanning device to the router located closest to the terminal device or the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay. The network scanning device according to any one of claims 1 to 4, wherein the determination means performs a provisional determination to compare the transmission delay with a threshold determined according to the type of network, determine the type of network corresponding to the threshold with which the transmission delay is closest as the type of the target network, and determine the type with the greatest number of provisional determinations as the type of the target network. The network scanning device of claim 5, wherein the threshold value is a minimum scan response delay that is a minimum value of the scan response delay. The network scanning device according to claim 5 or 6, wherein the determination means determines that the type of the target network is unknown when there are multiple types with the same number of provisional determinations. 8. The network scanning device according to claim 1, further comprising a schedule creation means for executing a schedule creation process that extracts the target network whose network type has been determined based on the determination result by the determination means, calculates the amount of time resources required for one network scan in the extracted target network, calculates the amount of resources available for the network scan in a time period based on the length of the time period in which the network scan is performed and the degree of congestion in the time period, and creates a schedule for the network scan based on the amount of time resources so as not to exceed the amount of available resources. The network scanning device according to claim 8, wherein the schedule creation means calculates the amount of time resources by multiplying the average scan response delay in the target network by a margin coefficient in the schedule creation process. The network scanning device according to claim 8 or claim 9, wherein the schedule creation means executes the schedule creation process for all of the multiple target networks when multiple target networks are extracted based on the determination result by the determination means. A first step in which a transmission means transmits a scan packet, which is a packet for performing a network scan, to a terminal device connected to a target network having one router and being a target of the network scan in a multi-stage network in which information is transmitted to a terminal device via a plurality of routers ;
a second step of receiving, by a receiving means, a scan response which is a response to the scan packet from the terminal device in the multi-stage network;
a third step in which a measurement means measures a scan response delay from when the scan packet is transmitted to the terminal device in the first step until when the scan response is received from the terminal device in the second step;
a fourth step in which a calculation means calculates a transmission delay in the target network based on a number of routing control stages, which is a number of stages to a nearest router that is a router from the network scanning device that has returned the scan response and is closest to the terminal device, and the scan response delay;
a fifth step in which a determination means determines the type of the target network based on the transmission delay calculated in the fourth step. The program for causing a computer to execute the program described in claim 11, wherein in the fourth step, the calculation means calculates a route delay, which is a delay time caused by a router between the network scanning device and the target network, based on the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay. 13. The program for causing a computer to execute the program described in claim 12, wherein in the fourth step, the calculation means sets the route control stage number to a stage number smaller than the stage number of the multi-stage network included in the scan response, divides the route control response delay, which is the scan response delay to the nearest router, by the route control stage number to calculate a delay time per hop consisting of an average value of multiple delay times per hop calculated for multiple terminal devices, multiplies the calculated delay time per hop by the number of stages from the network scan device to the router located closest to the terminal device or the route control stage number to calculate the route delay, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay measured in the third step. 14. The program for causing a computer to execute the program described in claim 13, wherein in the fourth step, the calculation means calculates the route delay by multiplying the average value by the number of stages from the network scanning device to the router located closest to the terminal device or the number of route control stages, and calculates the transmission delay by subtracting the calculated route delay from the scan response delay. The program for causing a computer to execute the program according to any one of claims 11 to 14, wherein in the fifth step, the determination means performs a provisional determination to determine the type of the network corresponding to the threshold value to which the transmission delay is closest as the type of the target network, and determines the type for which the provisional determination is performed the most frequently as the type of the target network. The program for causing a computer to execute the program according to claim 15, wherein the threshold value is a minimum scan response delay that is a minimum value of the scan response delay. The program for causing a computer to execute the program according to claim 15 or claim 16, wherein the determination means, in the fifth step, determines that the type of the target network is unknown when there are multiple types for which the number of tentative determinations is the same. 18. A program for causing a computer to execute the program described in any one of claims 11 to 17, further comprising a sixth step of executing a schedule creation process in which the schedule creation means extracts the target network whose network type has been determined based on the determination result by the determination means, calculates the amount of time resources required for one network scan in the extracted target network, calculates the amount of resources available for the network scan in a time period based on the length of the time period in which the network scan is performed and the degree of congestion in the time period, and creates a schedule for the network scan based on the amount of time resources so as not to exceed the amount of available resources. The program for causing a computer to execute the program according to claim 18, wherein the schedule creation means calculates the amount of time resources by multiplying the average scan response delay in the target network by a margin coefficient in the schedule creation process of the sixth step. The program for causing a computer to execute the program according to claim 18 or claim 19, wherein the schedule creation means executes the schedule creation process for all of the plurality of target networks when the plurality of target networks are extracted based on the determination result by the determination means in the sixth step. A computer-readable recording medium having recorded thereon the program according to any one of claims 11 to 20.

Images