JP7789526B2 - Estimation device, estimation method, and estimation program - Google Patents

Description

The present invention relates to an estimation device, an estimation method, and an estimation program.

For telecommunications carriers and corporate information system administrators, analyzing the purpose and usage of communications flowing over networks is important for network maintenance and operation. Traditionally, methods using DPI (Deep Packet Inspection) devices, which directly analyze the payload inside packets, have been widely used to analyze the usage and purpose of communications flowing over networks.

Japanese Patent Application Laid-Open No. 2020-141236

This DPI device is not only costly, but also unsuitable for processing large amounts of traffic due to its ability to analyze the inside of packets, making it a bottleneck in network configuration.

In addition, in the past, the purpose of communications was estimated by introducing collection and analysis devices such as DPI devices, but if packets cannot be analyzed directly, the method using the DPI device cannot estimate the purpose.

Therefore, in the absence of a DPI device, the purpose of communication had to be determined by conducting cumbersome processes such as asking the user (or network administrator) about the purpose, or having an expert infer the purpose from traffic waveforms, etc.

The present invention has been made in consideration of the above, and aims to provide an estimation device, estimation method, and estimation program that can easily estimate the communication use of the line being processed.

To solve the above-mentioned problems and achieve the objectives, the estimation device of the present invention is characterized by having a first decomposition unit that converts traffic on a line to be processed into a spectrogram using frequency decomposition; a second decomposition unit that fixes one factor to a template of time component factors corresponding to a predetermined use that has been acquired in advance, and decomposes the time component of the spectrogram converted by the first decomposition unit into time tensors using non-negative tensor factorization; and an estimation unit that estimates the time use of the line to be processed based on the decomposition results by the second decomposition unit.

This invention makes it possible to easily estimate the communication use of the line being processed.

FIG. 1 is a block diagram illustrating an example of a configuration of an estimation device according to an embodiment. FIG. 2 is a diagram showing an example of the data structure of template data. FIG. 3 is a diagram illustrating the flow of processing by the pre-processing unit. FIG. 4 is a diagram illustrating the flow of processing by the estimation unit. FIG. 5 is a flowchart showing the procedure of the pre-processing according to the embodiment. FIG. 6 is a flowchart illustrating a processing procedure of the estimation process according to the embodiment. FIG. 7 is a diagram showing another example of the data structure of template data. FIG. 8 is a diagram illustrating a computer that executes a program.

Embodiments of the estimation device, estimation method, and estimation program according to the present application are described in detail below with reference to the accompanying drawings. Note that the estimation device, estimation method, and estimation program according to the present application are not limited to these embodiments.

In the following embodiment, we will explain the estimation device and estimation process flow in the embodiment, and finally explain the effects of the embodiment.

[Embodiment]
First, an embodiment will be described. In this embodiment, the purpose of communication at each time is estimated based on the waveform of communication volume, rather than estimating the purpose from packet or flow (5-tuple) information. In this embodiment, traffic is decomposed into several factors by non-negative tensor factorization, and the purpose is estimated from the characteristics of the factors after the decomposition.

In this embodiment, one factor is fixed to a template of time component factors corresponding to a predetermined application that has been acquired in advance, and the time component of the traffic spectrogram is decomposed into time tensors using non-negative tensor factorization.

In this way, in this embodiment, non-negative tensor factorization is performed while the template for the application to be analyzed is fixed, separating the waveform into factors for the application to be analyzed and factors for other applications. Then, in this embodiment, based on the results of this separation, it is determined for each time period whether the factor for the application to be analyzed or the factor for other applications is dominant, thereby estimating the application at that time.

[Configuration of the estimation device]
1 is a block diagram showing an example of the configuration of an estimation device according to an embodiment.

As shown in FIG. 1, the estimation device 10 in this embodiment has a communication unit 11, an input/output unit 12, a memory unit 13, and a control unit 14.

The communication unit 11 is a communication interface that sends and receives various information to and from other devices connected via a network (e.g., network devices such as transfer devices).

The input/output unit 12 accepts information input through operation by a user of the estimation device 10, and displays and outputs the information to present it to the user. The input/output unit 12 is, for example, an input/output device such as a display, speaker, keyboard, mouse, microphone, or touch panel.

The storage unit 13 is a storage device such as a hard disk drive (HDD), solid state drive (SSD), or optical disk. The storage unit 13 may also be a rewritable semiconductor memory such as random access memory (RAM), flash memory, or non-volatile static random access memory (NVSRAM). The storage unit 13 stores traffic data 131, including traffic collected for template registration or usage estimation, and template data 132.

Template data 132 includes templates of time component factors for various uses. Figure 2 is a diagram showing an example of the data structure of template data 132. Template data 132 has a template field for storing templates, and a field for uses corresponding to the templates.

For example, template T1 corresponds to applications for human processing, specifically business processing, specifically general business use by humans, and is a component that includes the characteristic of being active during the day. Furthermore, for example, template T2 corresponds to applications for data processing by machines other than humans, specifically batch processing by machines and communications at set times (updates, etc.), and is a component that includes the characteristic of being active regardless of whether it is day or night.

The control unit 14 controls the entire estimation device 10. The control unit 14 is, for example, an electronic circuit such as a CPU (Central Processing Unit) or MPU (Micro Processing Unit), or an integrated circuit such as an ASIC (Application Specific Integrated Circuit) or FPGA (Field Programmable Gate Array). The control unit 14 also has internal memory for storing programs that define various processing procedures and control data, and executes each process using the internal memory. The control unit 14 also functions as various processing units when various programs are run. The control unit 14 has a pre-processing unit 141 and an estimation unit 142.

The pre-processing unit 141 performs processing to pre-register templates of time component factors according to a predetermined application. The pre-processing unit 141 has a first collection unit 1411, a first frequency decomposition unit 1412 (third decomposition unit), a first non-negative tensor factorization unit 1413 (fourth decomposition unit), a registration information reception unit 1414 (reception unit), and a template registration unit 1415 (registration unit). Figure 3 is a diagram explaining the processing flow of the pre-processing unit 141.

The first collection unit 1411 collects traffic from multiple lines for template registration. For example, the first collection unit 1411 collects traffic from multiple lines over a certain period of time ((1) in Figure 3). Here, it is desirable that the multiple lines are lines that are used for various purposes.

The first frequency decomposition unit 1412 converts the traffic of multiple lines collected by the first collection unit 1411 into a spectrogram by frequency decomposition. The first frequency decomposition unit 1412 normalizes the collected traffic and then converts it into a spectrogram by frequency decomposition (Figure 3 (2)). Here, the final data format is expressed as a tensor with line axis x frequency axis x time axis. Note that the time axis may be divided into multiple axes such as date, hour, month, and year. This is because traffic activity generally changes with time rather than with date.

The first nonnegative tensor factorization unit 1413 decomposes the time components of the spectrogram transformed by the first frequency decomposition unit 1412 into time tensors using nonnegative tensor factorization. Nonnegative tensor factorization is a method for extracting patterns from nonnegative tensor data. A tensor represents a multidimensional array. Nonnegative tensor factorization represents the data structure as a second-order or higher tensor, thereby factorizing the traffic spectrogram at the granularity of line, frequency, and time.

The first nonnegative tensor factorization unit 1413 decomposes each component into multiple factors as a line tensor, a frequency tensor, and a time tensor using nonnegative tensor factorization ((3) in Figure 3). The first nonnegative tensor factorization unit 1413 outputs the line tensor, the frequency tensor, and the time tensor as the factorization results from the input/output unit 12.

The registration information receiving unit 1414 receives input of specific information that identifies a time component factor corresponding to a specific application from the decomposed time tensor. For example, an expert analyzes the time tensor output from the estimation device 10 and identifies factor W1 among the factors as a factor with an activity pattern that is thought to be a business application by humans ((4) in Figure 3). The expert then inputs specific information that identifies factor W1 as a template for a time component factor corresponding to human processing (business processing) to the estimation device 10 via the input/output unit 12.

Based on the specific information received by the registration information receiving unit 1414 as input, the template registration unit 1415 registers a time component factor corresponding to a predetermined application as a template for the time component factor corresponding to the predetermined application. Specifically, the template registration unit 1415 registers factor W1 (see Figure 3) in the template data 132 as template T1 for a time component factor corresponding to human processing (business processing) ((4) in Figure 3). Furthermore, if it is desired to separate applications involving machine batch processing, the expert can identify in advance a factor with an activity pattern that is thought to be associated with machine batch processing, and register this factor in the estimation device 10 as template T2 corresponding to machine batch processing.

The estimation unit 142 uses a template for a predetermined use to separate the line to be processed into factors for the predetermined use and factors for other uses, and estimates whether the use at each time point is the predetermined use or other uses. The estimation unit 142 has a second collection unit 1421, a use selection unit 1422, a second frequency decomposition unit 1423 (first decomposition unit), a second non-negative tensor factorization unit 1424 (second decomposition unit), and a use estimation unit 1425 (estimation unit). Figure 4 is a diagram explaining the processing flow of the estimation unit 142.

The second collection unit 1421 collects traffic from the line to be processed. The second collection unit 1421 collects traffic from a particular line over a certain period of time ((1) in Figure 4).

The application selection unit 1422 accepts the selection of the application to be separated for the line to be processed. The application selection unit 1422 selects a factor template corresponding to the accepted application from the template data 132 and incorporates and fixes it as the initial value for non-negative tensor factorization.

For example, if a user of the estimation device 10 wants to check whether the line to be processed is being used for human business processing, the user inputs "human business processing" as the purpose. This causes the purpose selection unit 1422 to select a factor template T1 corresponding to human business processing from the template data 132, and incorporate and fix it as the initial value for non-negative tensor factorization. Furthermore, if the user inputs "data processing by non-humans" as the purpose in order to check the components of machine-based batch processing, the purpose selection unit 1422 selects template T2, and incorporates and fixes it as the initial value for non-negative tensor factorization.

The second frequency decomposition unit 1423 converts the traffic of the line to be processed, collected by the second collection unit 1421, into a spectrogram by frequency decomposition. Similar to the first frequency decomposition unit 1412, the second frequency decomposition unit 1423 normalizes the collected traffic and then converts it into a spectrogram by frequency decomposition ((2) in Figure 4). The data converted by the second frequency decomposition unit 1423 is represented as a frequency x time tensor.

The second non-negative tensor factorization unit 1424 fixes one factor to a template of time component factors corresponding to a predetermined application that has been acquired in advance, and decomposes the time component of the spectrogram transformed by the second frequency decomposition unit into time tensors using non-negative tensor factorization.

When the second nonnegative tensor factorization unit 1424 decomposes the spectrogram into multiple factors using nonnegative tensor factorization, it fixes the template selected by the application selection unit 1422 (e.g., template T1 intended for human business processing) as the initial value and performs the decomposition ((3) in Figure 4). As a result, factor W11 of template T1 saved as human business processing is separated as a factor intended for human business processing ((4) in Figure 4). Furthermore, factor W12 other than factor W11 is separated as a factor intended for non-human business processing, i.e., machine data processing ((5) in Figure 4).

The usage estimation unit 1425 estimates the usage of the line being processed at each time point based on the decomposition results from the second nonnegative tensor factorization unit 1424, and outputs the estimation results. Specifically, the usage estimation unit 1425 reconstructs traffic for each factor decomposed by the second nonnegative tensor factorization unit 1424 for the line being processed ((6) in Figure 4).

The usage estimation unit 1425 estimates the dominant factor at each time as the usage at that time ((7) in Figure 4). For example, at a time when factor W11 of template T1 saved as business processing by a human is dominant, the usage estimation unit 1425 estimates that the line to be processed was used for business processing by a human. Furthermore, at a time when factor W12 is dominant, the usage estimation unit 1425 estimates that the line to be processed was used for data processing by a non-human. For example, the usage estimation unit 1425 estimates that the line to be processed was used for business purposes from 8:00 to 18:00 on a certain date and time, and for data processing purposes at other times.

The usage estimation unit 1425 estimates the usage of communication for each time period ((8) in Figure 4). The usage estimation unit 1425 then associates the estimated usage for each time period with this reconstructed traffic and outputs it.

For example, the usage estimation unit 1425 displays, as an estimation result, graph G1, which is color-coded according to the time of human business processing and the time of machine data processing from the reconstructed traffic waveform, via the input/output unit 12 ((9) in Figure 4). By examining this graph G1, the user can determine at what time the line being processed was used for either human business processing or machine data processing.

[Pre-processing procedure]
Next, a description will be given of the procedure of the pre-processing by the pre-processing unit 141. Fig. 5 is a flowchart showing the procedure of the pre-processing in this embodiment.

As shown in FIG. 5, in the pre-processing unit 141, the first collection unit 1411 collects traffic from multiple lines (step S1). The first frequency decomposition unit 1412 converts the traffic from multiple lines collected by the first collection unit 1411 into a spectrogram by frequency decomposition (step S2).

The first nonnegative tensor factorization unit 1413 decomposes the time components of the spectrogram transformed by the first frequency decomposition unit 1412 into time tensors using nonnegative tensor factorization (step S3). The first nonnegative tensor factorization unit 1413 outputs the factorization results from the input/output unit 12 (step S4).

The registration information receiving unit 1414 receives input of specific information that identifies the time component factors corresponding to the specified application from the decomposed time tensor (step S5). Based on the specific information received by the registration information receiving unit 1414, the template registration unit 1415 registers the time component factors corresponding to the specified application as templates for the time component factors according to the specified application (step S6).

[Procedure of Estimation Processing]
Next, a description will be given of the procedure of the pre-processing performed by the estimation unit 142. Fig. 6 is a flowchart showing the procedure of the estimation process according to the embodiment.

As shown in FIG. 6, the estimation unit 142 collects traffic data for the line to be processed (step S11). The usage selection unit 1422 accepts a selection of usages to be separated for the line to be processed (step S12), selects a factor template corresponding to the accepted usage, and incorporates and fixes it as the initial value for nonnegative tensor factorization (step S13).

The second frequency decomposition unit 1423 converts the traffic of the line to be processed collected by the second collection unit 1421 into a spectrogram by frequency decomposition (step S14).

The second non-negative tensor factorization unit 1424 fixes one factor to the factor template selected by the application selection unit 1422, and decomposes the time component of the spectrogram transformed by the second frequency decomposition unit into time tensors using non-negative tensor factorization (step S15).

The usage estimation unit 1425 estimates the usage of the line being processed at each time point based on the decomposition results from the second nonnegative tensor factorization unit 1424 (step S16) and outputs the estimation results (step S17).

[Effects of the embodiment]
In the embodiment, the traffic of the line to be processed is converted into a spectrogram by frequency decomposition, one factor is fixed to a template of a time component factor corresponding to a predetermined use that has been acquired in advance, the converted spectrogram is decomposed into time tensors by non-negative tensor factorization, and the use of the line to be processed by time is estimated based on the decomposition results.

In other words, in this embodiment, the time component factors corresponding to a predetermined use are acquired in advance as a template, and one factor is fixed to this template. By simply performing non-negative tensor factorization on the traffic spectrogram, it is possible to automatically estimate whether the use is the predetermined use or something else. Therefore, according to this embodiment, in order to obtain the communication use of a line, there is no need to perform cumbersome processing such as asking users about the use or having experts estimate the use from traffic waveforms, etc.

Furthermore, in this embodiment, it is sufficient to register a template for the time component factors corresponding to a specific use only once for each use, making it possible to easily estimate the use of a line by time.

Furthermore, in this embodiment, rather than estimating usage from packet or flow (5-tuple) information, the communication usage at each time is estimated based on the waveform of communication volume. As a result, this embodiment does not require a network device such as a DPI device, and can estimate the line usage at each time with a simple configuration.

Furthermore, in the embodiment, the factors corresponding to a specific application can be separated simply by obtaining the time component factors corresponding to the specific application as a template in advance and performing non-negative tensor factorization. This makes it possible to easily and quickly estimate the communication application at each time point without performing computationally intensive processing using a supervised learning model.

In the embodiment, an example has been described in which templates T1 and T2 are registered according to the purpose of processing by humans and the purpose of processing by non-humans. However, multiple templates that are active in different time periods for the same purpose may also be registered. The second non-negative tensor factorization unit 1424 can use multiple templates that are active in different time periods for a specific purpose as fixed templates.

Figure 7 is a diagram showing another example of the data configuration of template data 132. As shown in Figure 7, the pre-processing unit 141, for example, divides human processing into patterns of business processing use that are active during the daytime hours of 8:00 to 18:00, and patterns of business processing use that are active on days other than Saturday and Sunday, and registers templates T1-1 and T1-2. When the estimation unit 142 receives a selection of a business processing use by a human, it may combine and fix template T1-1 and template T1-2, and perform non-negative tensor factorization.

Furthermore, as shown in FIG. 7, the pre-processing unit 141 divides non-human processing into patterns of data processing applications such as batch processing that are active between midnight and 6:00, and patterns of application updater processing that are active between 8:00 and 12:00 on a specific day of the week (for example, Wednesday), and registers templates T2-1 and T2-2. When the estimation unit 142 receives a selection of a non-human data processing application, it may combine and fix template T2-1 and template T2-2, and perform non-negative tensor factorization.

In addition, in an embodiment, the estimation device 10 may automatically identify templates. In this case, the estimation device 10 stores in advance identification rules that indicate, for example, activity patterns that are considered for business use by humans and activity patterns that are considered for batch processing by machines.

The estimation device 10 then refers to this specific rule to identify, from among the factors decomposed by nonnegative tensor factorization, factors with activity patterns that are thought to be for business use by humans, and registers these factors as templates for factors corresponding to business processing use by humans. Alternatively, by referring to this specific rule, it identifies, from among the factors decomposed by nonnegative tensor factorization, factors with activity patterns that are thought to be for batch processing by machines, and registers the child factors as templates for factor patterns corresponding to batch processing use by machines.

[System configuration, etc.]
Furthermore, the components of each device shown in the figures are functional concepts and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figures, and all or part of the devices can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU or GPU and a program analyzed and executed by the CPU or GPU, or can be realized as hardware using wired logic.

Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[program]
It is also possible to create a program in which the processing performed by the estimation device 10 described in the above embodiment is written in a language executable by a computer. For example, it is also possible to create a program in which the processing performed by the estimation device 10 in the above embodiment is written in a language executable by a computer. In this case, the same effects as those of the above embodiment can be obtained by having a computer execute the program. Furthermore, such a program may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read and executed by a computer to realize processing similar to that of the above embodiment.

Figure 8 is a diagram showing a computer that executes a program. As illustrated in Figure 8, the computer 1000 includes, for example, memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070, and these components are connected by a bus 1080.

As illustrated in FIG. 8, the memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090 as illustrated in FIG. 8. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

Here, as illustrated in FIG. 8, the hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. In other words, the above programs are stored, for example, on the hard disk drive 1090 as program modules that describe instructions to be executed by the computer 1000.

The various data described in the above embodiments are stored as program data, for example, in memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program modules 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed, and executes various processing procedures.

The program module 1093 and program data 1094 related to the program do not necessarily have to be stored on the hard disk drive 1090, but may be stored on a removable storage medium, for example, and read by the CPU 1020 via a disk drive or the like. Alternatively, the program module 1093 and program data 1094 related to the program may be stored in another computer connected via a network (such as a LAN (Local Area Network) or WAN (Wide Area Network)), and read by the CPU 1020 via the network interface 1070.

The above embodiments and their variations are included in the technology disclosed in this application, as well as in the scope of the invention described in the claims and their equivalents.

REFERENCE SIGNS LIST 10 Estimation device 11 Communication unit 12 Input/output unit 13 Storage unit 14 Control unit 131 Traffic data 132 Template data 141 Pre-processing unit 142 Estimation unit 1411 First collection unit 1412 First frequency decomposition unit 1413 First non-negative tensor factorization unit 1414 Registration information reception unit 1415 Template registration unit 1421 Second collection unit 1422 Usage selection unit 1423 Second frequency decomposition unit 1424 Second non-negative tensor factorization unit 1425 Usage estimation unit

Claims (7)

a first decomposition unit that converts traffic of a line to be processed into a spectrogram by frequency decomposition;
a second decomposition unit that fixes one factor to a template of a time component factor according to a predetermined application acquired in advance, and decomposes the time component into a time tensor by non-negative tensor factorization of the spectrogram transformed by the first decomposition unit;
an estimation unit that estimates a usage for each time period of the line to be processed based on the decomposition result by the second decomposition unit;
An estimation device comprising: a third decomposition unit that converts traffic of a plurality of lines into a spectrogram by frequency decomposition;
a fourth decomposition unit that decomposes the spectrogram transformed by the third decomposition unit into time tensors by non-negative tensor factorization;
a receiving unit that receives input of specific information that identifies a factor of a time component corresponding to the predetermined application from the decomposed time tensor;
a registration unit that registers a factor of a time component corresponding to the predetermined use as a template of a factor of a time component according to the predetermined use based on the specific information received by the reception unit;
2. The estimation device according to claim 1, further comprising: 3. The estimation device according to claim 1, wherein the estimation unit reconstructs traffic for each factor decomposed by the second decomposition unit for the line to be processed, and outputs the reconstructed traffic in association with the estimated use for each time period. An estimation device according to any one of claims 1 to 3, characterized in that the specified use is a business use by humans or a data processing use by machines. As the template, a plurality of templates active in different time periods for the same purpose are registered,
5. The estimation device according to claim 1, wherein the second decomposition unit uses, as fixed templates, a plurality of templates active during different time periods for the predetermined use. An estimation method executed by an estimation device,
a first decomposition step of converting traffic of a line to be processed into a spectrogram by frequency decomposition;
a second decomposition step of fixing one factor to a template of a time component factor corresponding to a predetermined application obtained in advance, and decomposing the time component into a time tensor by non-negative tensor factorization of the spectrogram transformed in the first decomposition step;
an estimation step of estimating the usage of the line to be processed for each time period based on the decomposition result in the second decomposition step;
An estimation method comprising: a first decomposition step of converting traffic of a line to be processed into a spectrogram by frequency decomposition;
a second decomposition step of fixing one factor to a template of a time component factor according to a predetermined application obtained in advance, and decomposing the time component into a time tensor by non-negative tensor factorization of the spectrogram transformed in the first decomposition step;
an estimation step of estimating a usage for each time period of the line to be processed based on the decomposition result in the second decomposition step;
An estimation program for causing a computer to execute the above.