Collection device, collection method and collection program

Abstract

To enable an event desired to be monitored to be closely monitored while considering network constraints.SOLUTION: A collection device 10 specifies a traffic path on the basis of flow information during a normal time. The collection device 10 discriminates a network device on the specified path about a traffic about a designated event. The collection device 10 instructs to collect flow statistical information from the discriminated network device.SELECTED DRAWING: Figure 3

Description

Technical Field

[0001] The present invention relates to a collection device, a collection method, and a collection program.

Background Art

[0002] NetFlow is known as a technology for sending flow statistical information in a network (see Non-Patent Document 1).

Prior Art Documents

Non-Patent Documents

[0003]

Non-Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, according to the prior art, it is difficult to focus on monitoring events to be monitored while taking into account network constraints. For example, for a complex and large-scale carrier network, the communication path to the data lake for storing flow statistical information is not abundant, so it is necessary to reduce the collection granularity of flow statistical information, and it is difficult to detect failures and security threats in a timely manner. On the other hand, in order to monitor events such as important user reports, DDoS attacks, OS updates, and OTT (Over The Top) failures, it is necessary to collect information on all events, and the amount of information is huge, so it is difficult to focus on monitoring the traffic of necessary events.

[0005] The present invention has been made in view of the above, and aims to focus on monitoring events to be monitored while taking into account network constraints.

Means for Solving the Problems

[0006] In order to solve the above-described problems and achieve the object, the collection device according to the present invention includes a specifying unit that specifies a traffic path based on normal flow information, a discriminating unit that discriminates network devices on the specified path for traffic related to a specified event, and an instructing unit that instructs collection of flow statistical information from the discriminated network devices.

Effects of the Invention

[0007] According to the present invention, it is possible to focus on monitoring events to be monitored while taking into account network constraints.

Brief Description of the Drawings

[0008]

Figure 1

Figure 2

Figure 3

Figure 4

Figure 5

Figure 6

Mode for Carrying Out the Invention

[0009] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited by this embodiment. In the description of the drawings, the same parts are denoted by the same reference numerals.

[0010] [Overview of the Collection Device] FIG. 1 is a diagram for explaining the overview of the collection device of the present embodiment. When events such as important user reports, DDoS attacks, OS updates, and OTT failures occur, the collection device 10 focuses on monitoring network devices 2 (NE, Network Element) such as routers and IFs (Interfaces) arranged on the traffic exchange.

[0011] Specifically, the collection device 10 resolves the traffic path in advance based on the flow information obtained during normal times and stored in the data lake 4. When an event occurs, the collection device 10 determines the routers and IFs through which the traffic of the corresponding user passes as monitoring targets, increases the sampling rate of the IF of the corresponding user, and controls to collect flow statistical information from the xFlow conversion device 3.

[0012] Thereby, the collection device 10 can collect the flow statistical information to be intensively monitored to the maximum extent while reducing information as a whole, and can capture events with low occurrence frequencies. Assuming that the number of combinations of all routers and IFs is N and the number of combinations of routers and IFs through which traffic related to an event passes is K, the information reduction effect is K / N.

[0013] [Configuration of the Collection System] FIG. 2 is a diagram for explaining the configuration of the collection system including the collection device. As shown in FIG. 2, the collection system 1 includes, in addition to the collection device 10, a router 2 on the VPN, an xFlow conversion device 3, and a data lake 4.

[0014] The router 2 has an additional function of an external device 2b related to the collection process compared to the function of the conventional router 2a. The external device 2b is realized using an NP (Network Processor) or the like, and as will be described later, in response to an instruction from the collection device 10, it changes settings such as output / stop of the flow statistical information to be collected for the router 2a.

[0015] The xFlow conversion device 3 collects flow statistical information from the router 2a and stores the collected flow statistical information in the data lake 4. At this time, the xFlow conversion device 3 collects the flow statistical information at the sampling rate specified in the collection process described later. The data lake 4 is realized by a database device or the like and stores the collected flow statistical information.

[0016] As will be described later, the collection device 10 resolves the traffic path in advance using the normal flow statistical information acquired from the data lake 4. In addition, when the collection device 10 receives event information and user information of an event to be monitored, it identifies the traffic path related to the event, discriminates the router 2 on the path, and sets it as the collection target of important flow statistical information. Then, the collection device 10 instructs the external device 2b of the router 2 that is the collection target of the flow statistical information to change the setting according to the collection position such as output / stop of the flow statistical information to be collected.

[0017] [Configuration of the collection device] FIG. 3 is a schematic diagram illustrating the schematic configuration of the collection device. As illustrated in FIG. 3, the collection device 10 of the present embodiment is realized by a general-purpose computer such as a personal computer and includes an input unit 11, an output unit 12, a communication control unit 13, a storage unit 14, and a control unit 15.

[0018] The input unit 11 is realized using an input device such as a keyboard or a mouse, and inputs various instruction information such as start of processing to the control unit 15 in response to an input operation by an operator. The output unit 12 is realized by a display device such as a liquid crystal display, a printing device such as a printer, or the like. For example, the result of the collection process described later is displayed on the output unit 12.

[0019] The communication control unit 13 is implemented by a NIC (Network Interface Card) or the like, and controls communication between an external device and the control unit 15 via a telecommunications line such as a LAN (Local Area Network) or the Internet. For example, the communication control unit 13 controls communication between the router 2, the xFlow conversion device 3 that outputs the flow statistical information of the router 2, the data lake 4, etc. and the control unit 15.

[0020] The storage unit 14 is implemented by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 14 stores in advance a processing program for operating the collection device 10, data used during the execution of the processing program, etc., or temporarily stores them each time processing is performed. Note that the storage unit 14 may be configured to communicate with the control unit 15 via the communication control unit 13.

[0021] The control unit 15 is implemented using a CPU (Central Processing Unit) or the like, and executes a processing program stored in a memory. As a result, the control unit 15 functions as an acquisition unit 15a, a specification unit 15b, a determination unit 15c, and an instruction unit 15d as illustrated in FIG. 3. Note that these functional units may be implemented on different hardware, either individually or in part. For example, the acquisition unit 15a may be implemented as a device different from the other functional units. Also, the control unit 15 may include other functional units.

[0022] The acquisition unit 15a acquires past flow information. For example, the acquisition unit 15a acquires the normal-time flow information stored in the data lake 4 via the input unit 11 or the communication control unit 13.

[0023] The acquisition unit 15a may store the acquired past flow information in the storage unit 14 prior to the collection process described later. Alternatively, the acquisition unit 15a may transfer this information to the specification unit 15b described below without storing it in the storage unit 14.

[0024] The specific part 15b identifies the traffic path based on past flow information. Specifically, the specific part 15b resolves the traffic path for the normal-time flow information obtained from the data lake 4.

[0025] The discrimination part 15c discriminates the router 2 on the identified path for the traffic related to the specified event. Specifically, when the information specifying the event to be monitored is input via the input part 11 or the communication control part 13, the discrimination part 15c discriminates the router 2 and the IF on the traffic path related to the event identified by the specific part 15b. For example, as illustrated in FIG. 1, the discrimination part 15c discriminates the router 2 and the IF of the traffic of UserB of the event.

[0026] The instruction part 15d instructs the collection of the flow statistical information from the discriminated router 2. Specifically, the instruction part 15d instructs, via the communication control part 13, the external device 2b of the discriminated router 2 to change the settings so as to output the flow statistical information to the xFlow conversion device 3.

[0027] For example, in the example shown in FIG. 1, the instruction part 15d instructs the external device 2b of the router 2 in which UserB is accommodated to output the flow statistical information. On the other hand, the instruction part 15d instructs the external device 2b of the router 2 in which UserA and UserC are accommodated to stop the output of the flow statistical information. Thereby, the collection system 1 can collect the flow statistical information limited to UserB related to the event.

[0028] Further, the instruction part 15d may instruct the collection so that the collection granularity of the flow statistical information from the discriminated router 2 is higher than the collection granularity of the flow statistical information from the routers 2 other than this router 2. Specifically, the instruction part 15d designates to the xFlow conversion device 3 so that the sampling rate from the discriminated router 2 is higher than the sampling rate of the other routers 2.

[0029] As a result, the collection system 1 can focus on collecting the flow statistical information of the traffic to be monitored and minimize the collection of the flow statistical information of other traffic. In this way, it is possible to collect the flow statistical information of the traffic to be monitored to the maximum extent while taking into account the network constraints.

[0030] [Collection Process] Next, with reference to FIG. 4, the collection process by the collection device 10 according to the present embodiment will be described. FIG. 4 is a flowchart showing the collection process procedure. The flowchart in FIG. 4 starts, for example, at the timing when a user performs an operation input instructing start.

[0031] First, the acquisition unit 15a acquires the normal flow information from the data lake 4. Also, the specifying unit 15b specifies the traffic path based on the acquired normal flow information (step S1).

[0032] When information specifying an event is input, the specifying unit 15b specifies the traffic path related to the event, and the discrimination unit 15c discriminates the router 2 and the IF on the traffic path (step S2).

[0033] Then, the instruction unit 15d instructs the collection of the flow statistical information from the discriminated router 2 (step S3). Specifically, the instruction unit 15d instructs the external device 2b of the discriminated router 2 to output the flow statistical information to the xFlow conversion device 3 via the communication control unit 13. Also, the instruction unit 15d instructs the external devices 2b of the other routers 2 to stop the output of the flow statistical information to the xFlow conversion device 3.

[0034] Alternatively, the instruction unit 15d designates the sampling rate from each router 2 to the xFlow conversion device 3. At that time, the instruction unit 15d designates the sampling rate from the discriminated router 2 to the xFlow conversion device 3 to be higher than the sampling rates of the other routers 2. Thereby, a series of collection processes is completed.

[0035] After that, the xFlow conversion device 3 focuses on collecting the flow statistical information from the identified router 2 and stores it in the data lake 4.

[0036] [Effect] As described above, in the collection device 10 of the present embodiment, the specifying unit 15b specifies the traffic path based on past flow information. The discriminating unit 15c discriminates the network device (router) 2 on the specified path for the traffic related to the specified event.

[0037] Here, FIG. 5 is a diagram for explaining the conventional technology. As illustrated in FIG. 5, according to the conventional xFlow including NetFlow, it was difficult to change the sampling rate of the flow statistical information to be collected for each user. Therefore, even if there is an event related to a user to be intensively monitored, since the amount of information to be collected is huge, it was difficult to monitor it carefully.

[0038] On the other hand, according to the collection device 10 of the present embodiment, it is possible to discriminate the router 2 through which the traffic related to the event passes as the router 2 to be intensively monitored. Therefore, while reducing the information as a whole, it is possible to collect the flow statistical information to be intensively monitored to the maximum extent and capture events with a low occurrence frequency. In this way, it is possible to intensively monitor the events to be monitored while taking into account the network constraints.

[0039] In addition, the instruction unit 15d instructs the collection of the flow statistical information from the discriminated router 2. Thereby, the collection device 10 can collect the flow statistical information limited to the events to be intensively monitored.

[0040] Further, the instruction unit 15d instructs the collection of the flow statistical information from the determined router 2 with a collection granularity higher than that of the flow statistical information from routers 2 other than the router 2. Thereby, it becomes possible to focus on collecting the flow statistical information of the traffic to be monitored and minimize the collection of the flow statistical information of other traffic. In this way, according to the collection device 10, it becomes possible to collect the flow statistical information of the traffic to be monitored to the maximum extent in consideration of the network constraints.

[0041] [Program] It is also possible to create a program that describes the processing executed by the collection device 10 according to the above embodiment in a computer-executable language. As one embodiment, the collection device 10 can be implemented by installing a collection program that executes the above collection processing as package software or online software on a desired computer. For example, by causing the information processing device to execute the above collection program, the information processing device can function as the collection device 10. The information processing device mentioned here includes desktop or notebook personal computers. In addition, the information processing device also includes mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone System), and further includes slate terminals such as PDAs (Personal Digital Assistant) within its scope. Also, the functions of the collection device 10 may be implemented on a cloud server.

[0042] FIG. 6 is a diagram showing an example of a computer that executes a collection program. The computer 1000 has, for example, a memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0043] Memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1031. The disk drive interface 1040 is connected to a disk drive 1041. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1041. For example, a mouse 1051 and a keyboard 1052 are connected to the serial port interface 1050. For example, a display 1061 is connected to the video adapter 1060.

[0044] Here, the hard disk drive 1031 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. Each piece of information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0045] Also, the collection program is stored in the hard disk drive 1031 as a program module 1093 in which instructions executed by the computer 1000 are described. Specifically, the program module 1093 in which each process executed by the collection device 10 described in the above embodiment is described is stored in the hard disk drive 1031.

[0046] Also, the data used for information processing by the collection program is stored, for example, in the hard disk drive 1031 as program data 1094. Then, the CPU 1020 reads out the program module 1093 and the program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed, and executes each of the above-described procedures.

[0047] Note that the program module 1093 and program data 1094 related to the collection program are not limited to being stored in the hard disk drive 1031. For example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the collection program may be stored in another computer connected via a network such as a LAN or WAN (Wide Area Network), and read by the CPU 1020 via the network interface 1070.

[0048] As described above, the embodiments to which the invention made by the present inventor is applied have been described. However, the present invention is not limited by the description and drawings that form a part of the disclosure of the present invention according to this embodiment. That is, all other embodiments, examples, operation techniques, etc. made by those skilled in the art based on this embodiment are included in the scope of the present invention.

Description of Reference Numerals

[0049] 1 Collection system 2, 2a Network device (router) 2b External device 3 xFlow conversion device 4 Data lake 10 Collection device 11 Input unit 12 Output unit 13 Communication control unit 14 Storage unit 15 Control unit 15a Acquisition unit 15b Identification unit 15c Discrimination unit 15d Instruction unit

Claims

1. a specifying unit that specifies a traffic path based on normal-time flow information; a discriminating unit that discriminates network devices on the specified path for traffic related to a specified event; an instructing unit that instructs collection of flow statistical information from the discriminated network devices; A collection device, characterized by comprising the above.

2. The collection device according to claim 1, wherein the instructing unit instructs collection such that the collection granularity of flow statistical information from the discriminated network devices is higher than the collection granularity of flow statistical information from network devices other than the network devices.

3. The collection device according to claim 1 or 2, wherein the instructing unit instructs to stop collection of flow statistical information from the network devices that have not been discriminated.

4. A collection method executed by a collection device, comprising: a specifying step of specifying a traffic path based on normal-time flow information; a discriminating step of discriminating network devices on the specified path for traffic related to a specified event; an instructing step of instructing collection of flow statistical information from the discriminated network devices. A collection method, characterized by including the above.

5. a specifying step of specifying a traffic path based on normal-time flow information; a discriminating step of discriminating network devices on the specified path for traffic related to a specified event; an instructing step of instructing collection of flow statistical information from the discriminated network devices; A collection program for causing a computer to execute the above.

Images