JP7623930B2 - Network monitoring device, network monitoring method and computer program - Google Patents

Description

The present invention relates to a network monitoring device, a network monitoring method, and a computer program.

In recent years, with the advancement of AI (Artificial Intelligence) technology, techniques for analyzing the state of communication networks using machine learning such as deep learning have been attracting attention, but in machine learning, it is important to ensure a sufficient amount and diversity of data to be used for learning. Regarding the data items to be collected from communication networks, various data items are specified for each device, such as the MIB (Management Information Base) of SNMP (Simple Network Management Protocol). In addition, in CNF (Cloud-native Network Function), which is expected to become widespread in the future due to the advancement of virtualization technology, various data can be collected via agents for each application by utilizing monitoring software such as "Prometheus", which has been developed mainly in the cloud industry, so the number of collectable data items increases. On the other hand, by periodically collecting data from a communication network to monitor the communication network, a monitoring load is placed on the communication bandwidth and resources of the communication network side. For this reason, it is important to collect data from the communication network by limiting it to the data items necessary for analyzing the communication network state.

Patent documents 1, 2, and 3 are known as examples of communication network status analysis techniques that take into account the monitoring load. The technique described in patent document 1 periodically collects equipment information such as failure history and communication data volume from managed network devices, and changes the collection interval, for example by shortening the collection interval only for equipment information from network devices with many failures, based on the obtained equipment information. The technique described in patent document 2 predicts future traffic from traffic information collected at multiple measurement intervals, and determines an appropriate traffic information measurement interval from the bandwidth load required for collecting traffic information and the cost information required for equipment expansion based on the traffic prediction. The technique described in patent document 3 reduces the load on data collection by calculating and sorting the traffic volume for each user terminal, and extracting log data only from user terminals with a predetermined traffic volume or more.

JP 2005-18120 A JP 2015-207795 A JP 2020-102776 A

However, the technology described in Patent Document 1 does not take into account the usefulness of the collected data items in the analysis. Moreover, the technologies described in Patent Documents 2 and 3 do not take into account data items other than those related to traffic. For this reason, it is difficult to appropriately determine the data items to be collected from a communication network in order to analyze the communication network state using these technologies.

The present invention was made in consideration of these circumstances, and its purpose is to appropriately determine a monitoring setting pattern that indicates multiple data items to be included in monitoring data collected from a communication network to analyze the communication network state.

(1) One aspect of the present invention is a network monitoring device that includes a collection setting unit that sets data collection settings for a monitored communication network corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from the monitored communication network in order to analyze a communication network state; a data collection unit that collects the monitoring data from the monitored communication network; a load information acquisition unit that acquires load information indicating the load placed on the monitored communication network when collecting the monitoring data; an analysis unit that acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquires the importance of each of the data items in the analysis of the communication network state; and an aggregation unit that generates aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information was acquired.
(2) One aspect of the present invention is the network monitoring device of (1) above, which generates the aggregated data for each of a plurality of types of the monitoring setting patterns.

(3) One aspect of the present invention is a network monitoring method including: a collection setting step in which a network monitoring device performs data collection settings on a communication network to be monitored that correspond to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from the communication network to be monitored in order to analyze the communication network state; a data collection step in which the network monitoring device collects the monitoring data from the communication network to be monitored; a load information acquisition step in which the network monitoring device acquires load information indicating the load on the communication network to be monitored when collecting the monitoring data; an analysis step in which the network monitoring device acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm and acquires the importance of each of the data items in the analysis of the communication network state; and an aggregation step in which the network monitoring device generates aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information is acquired.

(4) One aspect of the present invention is a computer program for causing a computer to execute the following steps: a collection setting step of performing, on the communication network to be monitored, a data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from the communication network to be monitored in order to analyze the communication network state; a data collection step of collecting the monitoring data from the communication network to be monitored; a load information acquisition step of acquiring load information indicating the load placed on the communication network to be monitored when collecting the monitoring data; an analysis step of acquiring an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm and acquiring the importance of each of the data items in the analysis of the communication network state; and an aggregation step of generating aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information is acquired.

The present invention has the advantage of being able to appropriately determine a monitoring setting pattern that indicates multiple data items to be included in monitoring data collected from a communication network to analyze the communication network state.

1 is a block diagram showing an example of the configuration of a network monitoring device according to an embodiment; 1 is a block diagram showing an example of the configuration of a collection design unit according to an embodiment. FIG. 1 is a flowchart illustrating an example of a procedure of a network monitoring method according to an embodiment. 13 is a diagram illustrating an example of a configuration of a data item list according to an embodiment. 4 is a diagram illustrating an example of the configuration of load information according to an embodiment. 13 is a diagram illustrating an example of a configuration of importance according to an embodiment. 1 is a diagram illustrating an example of a configuration of aggregated data according to an embodiment.

Hereinafter, an embodiment of the present invention will be described with reference to the drawings.
Fig. 1 is a block diagram showing an example of the configuration of a network monitoring device according to an embodiment. In Fig. 1, the network monitoring device 1 collects monitoring data of a plurality of data items from a communication network (monitored network) NW to be monitored, analyzes the state of the monitored network NW (communication network state) based on the collected monitoring data, and outputs the analysis result of the communication network state.

As an example of this embodiment, the monitored network NW uses CNF (cloud native network function) and includes multiple CNF nodes 110 and a CNF management system 120. Note that the monitored network NW is not limited to one that uses CNF, and may be any communication network capable of collecting monitoring data.

The network monitoring device 1 comprises a collection setting unit 11, a data collection unit 12, an analysis unit 20, and a collection design unit 30.

The functions of the network monitoring device 1 are realized by the network monitoring device 1 having computer hardware such as a CPU (Central Processing Unit) and memory, and the CPU executing a computer program stored in the memory. The network monitoring device 1 may be configured using a general-purpose computer device, or may be configured as a dedicated hardware device. For example, the network monitoring device 1 may be configured using a server computer connected to a communication network such as the Internet. The functions of the network monitoring device 1 may also be realized by cloud computing. The network monitoring device 1 may also be realized by a single computer, or may be realized by distributing the functions of the network monitoring device 1 among multiple computers. The network monitoring device 1 may also be configured to set up a website using, for example, a WWW system.

The collection setting unit 11 performs data collection settings corresponding to the monitoring setting pattern on the monitored network NW. The monitoring setting pattern indicates multiple data items to be included in the monitoring data collected from the monitored network NW to analyze the communication network state.

The data collection unit 12 collects monitoring data from the monitored network NW.

The analysis unit 20 includes a database 21 and a communication network state analysis model 22. The database 21 accumulates data for analyzing the communication network state. The communication network state analysis model 22 is a model for analyzing the communication network state, constructed using a predetermined machine learning algorithm.

The analysis unit 20 analyzes the communication network state of the monitored network NW using the monitoring data collected by the data collection unit 12. The analysis unit 20 obtains the analysis results of the communication network state from the monitoring data using the communication network state analysis model 22, and obtains the importance of each data item in the analysis of the communication network state. The importance can be easily obtained by using a machine learning algorithm that uses a decision tree, such as "RandomForest" or "XGBoost".

The analysis unit 20 outputs the analysis results of the communication network state of the monitored network NW. The analysis unit 20 also outputs the importance of each data item in the analysis of the communication network state to the collection design unit 30.

Figure 2 is a block diagram showing an example of the configuration of the collection design unit according to this embodiment. In Figure 2, the collection design unit 30 includes a pattern selection unit 31, a load information acquisition unit 32, and an aggregation unit 33.

The pattern selection unit 31 accepts input of a monitoring setting pattern A from the user terminal 3 used by the user. The monitoring setting pattern A indicates multiple data items and monitoring-related setting items to be included in the monitoring data collected from the monitored network NW to analyze the communication network state. Examples of data items include information on traffic, resources, and routing. Also, examples of setting items include data collection intervals and communication protocols. The pattern selection unit 31 makes a data collection setting request B to the collection setting unit 11 to collect monitoring data using the monitoring setting pattern A.

In response to request B from the pattern selection unit 31, the collection setting unit 11 performs data collection settings for each CNF node 110 and CNF management system 120 in the monitored network NW to collect monitoring data using monitoring setting pattern A. In the example of the monitored network NW in FIG. 1, the collection setting unit 11 performs data collection settings for each CNF node 110 and CNF management system 120. As a result, each CNF node 110 and CNF management system 120 in the monitored network NW outputs monitoring data using monitoring setting pattern A.

The data collection unit 12 collects monitoring data from each CNF node 110 in the monitored network NW and the CNF management system 120. This collected monitoring data corresponds to the data collection setting of the monitoring setting pattern A that the collection setting unit 11 has set in the monitored network NW. The data collection unit 12 outputs the monitoring data C collected from the monitored network NW to the analysis unit 20 and the collection design unit 30.

The load information acquisition unit 32 acquires load information E indicating the load on the monitored network NW when collecting the monitoring data C based on the monitoring data C acquired from the data collection unit 12. Examples of the load information E include information on traffic, CPU, memory, etc. The method of acquiring the load information E is set in advance.

The load information acquisition unit 32 also acquires a list of data items (data item list) F included in the monitoring data C. The data item list F may be acquired from the monitoring data C, or may be acquired from the monitoring setting pattern A.

The load information acquisition unit 32 outputs the load information E and the data item list F to the aggregation unit 33. The aggregation unit 33 records the load information E and the data item list F acquired from the load information acquisition unit 32.

When multiple types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...) are input from the user terminal 3, the load information acquisition unit 32 makes a request D to the collection setting unit 11 for data collection setting of the next monitoring setting pattern A. As a result, the collection setting unit 11 performs data collection setting of the next monitoring setting pattern A for each CNF node 110 and the CNF management system 120 of the monitored network NW, then the data collection unit 12 collects monitoring data corresponding to the data collection setting of the next monitoring setting pattern A, and then the load information acquisition unit 32 acquires load information E and a data item list F related to the next monitoring setting pattern A and outputs them to the aggregation unit 33.

The analysis unit 20 accumulates the monitoring data C acquired from the data collection unit 12 in the database 21. In the model learning stage, the analysis unit 20 uses the monitoring data C accumulated in the database 21 as learning data to learn the communication network state analysis model 22 using a predetermined machine learning algorithm. The learned communication network state analysis model 22 is used to analyze the communication network state of the monitored network NW.

In the communication network state analysis stage, the analysis unit 20 uses the communication network state analysis model 22 to acquire the analysis results of the communication network state from the monitoring data C acquired from the data collection unit 12, and acquires the importance G of each data item in the analysis of the communication network state. The analysis unit 20 outputs the importance G of each data item to the aggregation unit 33. The aggregation unit 33 records the importance G of each data item acquired from the load information acquisition unit 32.

The aggregation unit 33 generates aggregated data H that associates the load information E with the importance G corresponding to the monitoring data C at the time the load information E was acquired. The aggregation unit 33 transmits the aggregated data H to the user terminal 3.

Next, the network monitoring method according to this embodiment will be described with reference to FIG. 3. FIG. 3 is a flowchart showing an example of the steps of the network monitoring method according to this embodiment.

(Step S1) The collection setting unit 11 performs data collection settings for each CNF node 110 and CNF management system 120 in the monitored network NW to collect monitoring data using monitoring setting pattern A.

(Step S2) The data collection unit 12 collects monitoring data C from each CNF node 110 and the CNF management system 120 in the monitored network NW. This collected monitoring data C is monitoring data that corresponds to the data collection settings of the monitoring setting pattern A that was set in the monitored network NW in step S1.

(Step S3) Based on the monitoring data C collected in step S2, the load information acquisition unit 32 acquires load information E indicating the load on the monitored network NW when collecting the monitoring data C. The load information acquisition unit 32 also acquires a data item list F of the data items included in the monitoring data C.

(Step S4) The analysis unit 20 uses the communication network state analysis model 22 to obtain an analysis result of the communication network state from the monitoring data C collected in step S2, and obtains the importance G of each data item in the analysis of the communication network state.

(Step S5) The aggregation unit 33 generates aggregated data H that associates the load information E and data item list F acquired in step S3 with the importance G acquired in step S4. The aggregation unit 33 transmits the aggregated data H to the user terminal 3.

When the network monitoring device 1 receives multiple types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...) from the user terminal 3, it executes the process of FIG. 3 described above for each monitoring setting pattern A. In addition, in the learning stage of the communication network state analysis model 22, the communication network state analysis model 22 may be learned using the monitoring data C of the multiple types of monitoring setting patterns A as learning data.

Figure 4 shows an example of the configuration of a data item list according to this embodiment. In the example of Figure 4, multiple data items constituting the monitoring data for each of multiple types of monitoring setting patterns A (pattern A1, pattern A2, ...) are shown in data item list F. Note that the data items for each monitoring setting pattern A shown in Figure 4 are for convenience of explanation.

Figure 5 is an example of the configuration of load information according to this embodiment. In the example of Figure 5, the value of each load item is included in the load information E for each of multiple types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...). Also, in the example of Figure 5, in one monitoring setting pattern A, for each load item, the total value obtained by combining the values of the load items of all the CNF nodes 110 and the CNF management system 120 in that monitoring setting pattern A is included in the load information E. Examples of the total value include the average value and the median value. Note that the values of each load item shown in Figure 5 are for convenience of explanation.

Figure 6 shows an example of the importance configuration according to this embodiment. In the example of Figure 6, the importance G of each data item is shown in descending order of importance. Also, in the example of Figure 6, there is a one-to-one correspondence between the features and the data items in the communication network state analysis model 22. Note that the importance values shown in Figure 6 are for convenience of explanation.

Figure 7 is an example of the configuration of aggregated data according to this embodiment. In the example of Figure 7, in aggregated data H, load information E and importance G are associated with each of multiple types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...). Also, in the example of Figure 7, in one monitoring setting pattern A, the aggregated data H includes an overall value that is the result of aggregating the importance G of all data items in that monitoring setting pattern A. Examples of this overall value include an average value and a sum. Note that the values of each load item and each importance shown in Figure 7 are for convenience of explanation.

The aggregated data H illustrated in FIG. 7 is transmitted from the network monitoring device 1 to the user terminal 3. The aggregated data H illustrated in FIG. 7 allows the user to recognize the relationship between load information and importance for each of multiple types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...) and determine an appropriate monitoring setting pattern A. For example, it is possible to determine the monitoring setting pattern A that maximizes the overall importance value under load conditions that satisfy CPU usage of x% or less and memory (MEM) usage of y megabytes (MB) or less. For example, it is possible to determine the monitoring setting pattern A that maximizes the overall importance value from among the monitoring setting patterns A in which CPU usage, memory usage, and communication delay are all below their respective thresholds.

The user notifies the network monitoring device 1 of the monitoring setting pattern A (target monitoring setting pattern A) that the user judges to be appropriate by using the user terminal 3. The network monitoring device 1 monitors the monitored network NW (analyzes the communication network state) using the target monitoring setting pattern A notified by the user. Specifically, the collection setting unit 11 performs data collection setting for each CNF node 110 and CNF management system 120 of the monitored network NW to collect monitoring data by the target monitoring setting pattern A. Next, the data collection unit 12 collects monitoring data C (target monitoring data C) from each CNF node 110 and CNF management system 120 of the monitored network NW. This target monitoring data C is monitoring data corresponding to the data collection setting of the target monitoring setting pattern A. Next, the analysis unit 20 acquires the analysis result of the communication network state from the target monitoring data C using the communication network state analysis model 22. This analysis result of the communication network state is output from the network monitoring device 1.

According to this embodiment, the user can appropriately determine, based on the aggregated data H, a monitoring setting pattern indicating multiple data items to be included in the monitoring data collected from the monitored network NW to analyze the communication network state.

This will, for example, make it possible to improve the overall service quality of telecommunications network monitoring systems, thereby contributing to Goal 9 of the United Nations' Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

The above describes an embodiment of the present invention in detail with reference to the drawings, but the specific configuration is not limited to this embodiment and includes design modifications and the like that do not deviate from the gist of the present invention.

Also, a computer program for implementing the functions of each of the above-mentioned devices may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed. Note that the "computer system" referred to here may include hardware such as an OS and peripheral devices. In addition, if a WWW system is used, the "computer system" also includes the homepage providing environment (or display environment).
In addition, the term "computer-readable recording medium" refers to a storage device such as a flexible disk, a magneto-optical disk, a ROM, a writable non-volatile memory such as a flash memory, a portable medium such as a DVD (Digital Versatile Disc), or a hard disk built into a computer system.

Furthermore, the term "computer-readable recording medium" includes devices that retain a program for a certain period of time, such as volatile memory (e.g., DRAM (Dynamic Random Access Memory)) within a computer system that serves as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line.
The program may be transmitted from a computer system in which the program is stored in a storage device or the like to another computer system via a transmission medium, or by a transmission wave in the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line.
The program may be for implementing some of the functions described above, or may be a so-called differential file (differential program) that can implement the functions described above in combination with a program already recorded in the computer system.

1...Network monitoring device, 11...Collection setting unit, 12...Data collection unit, 20...Analysis unit, 30...Collection design unit, 21...Database, 22...Communication network status analysis model, 31...Pattern selection unit, 32...Load information acquisition unit, 33...Aggregation unit, NW...Monitored network

Claims (4)

a collection setting unit that performs data collection setting on a communication network to be monitored, the data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data to be collected from the communication network to be monitored in order to analyze a state of the communication network;
a data collection unit that collects the monitoring data from the communication network to be monitored;
a load information acquisition unit that acquires load information indicating a load placed on the communication network to be monitored when collecting the monitoring data;
an analysis unit that acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquires the importance of each of the data items in the analysis of the communication network state;
an aggregator that generates aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information is acquired;
A network monitoring device comprising: generating the aggregated data for each of the plurality of types of monitoring setting patterns;
The network monitoring device according to claim 1 . a collection setting step in which a network monitoring device performs data collection setting on a communication network to be monitored, the data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data to be collected from the communication network to be monitored in order to analyze a communication network state;
a data collection step in which the network monitoring device collects the monitoring data from the communication network to be monitored;
a load information acquisition step of the network monitoring device acquiring load information indicating a load applied to the communication network to be monitored when collecting the monitoring data;
an analysis step in which the network monitoring device acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquires the importance of each of the data items in the analysis of the communication network state;
an aggregation step of generating aggregated data in which the load information is associated with the importance corresponding to the monitoring data at the time when the load information is acquired by the network monitoring device;
A network monitoring method comprising: On the computer,
a collection setting step of performing a data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from a communication network to be monitored in order to analyze a communication network state, on the communication network to be monitored;
a data collection step of collecting the monitoring data from the communication network to be monitored;
a load information acquisition step of acquiring load information indicating a load applied to the communication network to be monitored when the monitoring data is collected;
an analysis step of acquiring an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquiring the importance of each of the data items in the analysis of the communication network state;
an aggregating step of generating aggregated data in which the load information is associated with the importance corresponding to the monitoring data at the time when the load information is acquired;
A computer program for executing the above.

Images