Network analysis system, network analysis method, and network analysis program

Abstract

We conduct analysis on specific communication networks and create detailed advice. [Solution] One aspect of the present invention is a network analysis system comprising: an input unit for inputting performance data of a target network device; a processing unit for generating processed data by processing the performance data based on the performance data and a threshold; an analysis unit for inputting the processed data to a first machine learning model trained on a training dataset including network configuration data of the network device, processed data, and analysis results showing past trends and future trends, and acquiring analysis results output from the first machine learning model; and a generation unit for inputting the analysis results acquired by the analysis unit to a second machine learning model trained on training data including analysis results and information indicating countermeasures, and generating advice information based on countermeasures information output from the second machine learning model.

Description

Technical Field

[0001] The present invention relates to a network analysis system, a network analysis method, and a network analysis program.

Background Art

[0002] Techniques for analyzing a communication network and coping with changes in the communication network are known. For example, as described in Patent Document 1, this type of technique predicts the network load in a prediction period from a reference time point to a predetermined time after the reference time point based on the performance index values before the reference time point related to the communication network, and determines whether the magnitude of the predicted value of the network load in the prediction period meets a predetermined condition according to the prediction of the network load. In this technique, determination is performed for each of two or more prediction periods in which at least a part of periods with different reference time points overlaps, and when the determination that the predetermined condition is satisfied is made a predetermined number or more times, scale-out of elements included in the communication network is executed. That is, the technique described in Patent Document 1 aims to automatically cope with problems that occur in the huge network of a communication carrier.

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, in the technique described in Patent Document 1 mentioned above, since it aims to automatically cope with problems in the huge network service of a communication carrier, there is a problem that, for example, it is impossible to give detailed advice for specific communication networks such as enterprise - oriented WAN and LAN. Furthermore, there are products available that report management data related to network performance. However, many of these products analyze and score performance data, and analyzing what actions are needed and proposing solutions still requires manual intervention.

[0005] This invention has been made in consideration of these circumstances, and one of its objectives is to provide a network analysis system, a network analysis method, and a network analysis program that can perform analysis on a specific communication network and generate detailed advice. [Means for solving the problem]

[0006] One aspect of the present invention is a network analysis system comprising: an input unit for inputting performance data of a target network device; a processing unit for generating processed data by processing the performance data based on the performance data and a threshold; an analysis unit for inputting the processed data to a first machine learning model trained on a training dataset including network configuration data of the network device, processed data, and analysis results showing past trends and future trends, and acquiring analysis results output from the first machine learning model; and a generation unit for inputting the analysis results acquired by the analysis unit to a second machine learning model trained on training data including analysis results and information indicating countermeasures, and generating advice information based on countermeasures information output from the second machine learning model.

[0007] One aspect of the present invention is a network analysis method comprising the steps of: inputting performance data of a target network device into a computer; generating processed data by processing the performance data based on the performance data and a threshold; inputting the processed data into a first machine learning model trained with a training dataset including network configuration data of the network device, processed data, and analysis results showing past trends and future trends, and obtaining analysis results output from the first machine learning model; and inputting the obtained analysis results into a second machine learning model trained with training data including analysis results and information indicating countermeasures, and generating advice information based on countermeasures information output from the second machine learning model.

[0008] One aspect of the present invention is a network analysis program that causes a computer to perform the following steps: input performance data of a target network device; generate processed data by processing the performance data based on the performance data and a threshold; input the processed data into a first machine learning model trained with a training dataset including network configuration data of the network device, processed data, and analysis results showing past trends and future trends, and obtain analysis results output from the first machine learning model; and input the obtained analysis results into a second machine learning model trained with training data including analysis results and information indicating countermeasures, and generate advice information based on countermeasures information output from the second machine learning model. [Effects of the Invention]

[0009] According to one aspect of this invention, it is possible to perform an analysis on a specific communication network and generate detailed advice. [Brief explanation of the drawing]

[0010] [Figure 1]This figure shows an example of the configuration of a corporate network system 1 in the first embodiment. [Figure 2] This is a block diagram showing an example of the functional configuration of the network analysis system 120 in the first embodiment. [Figure 3] This figure shows an example of performance data D11 in the first embodiment. [Figure 4] This figure shows an example of part-specific data D12 in the first embodiment. [Figure 5] This figure shows an example of the threshold value D21 in the first embodiment. [Figure 6] This figure shows an example of processed data D31 for traffic data in the first embodiment. [Figure 7] This figure shows an example of processed data D32 for CPU memory data in the first embodiment. [Figure 8] This figure shows an example of processed data D33 for error data in the first embodiment. [Figure 9] This figure shows an example of generated data D41 for IN traffic data in the first embodiment. [Figure 10] This figure shows an example of generated data D41 for OUT traffic data in the first embodiment. [Figure 11] This figure shows an example of generated data D41 for traffic data in the first embodiment. [Figure 12] This figure shows an example of generated data D42 for the CPU in the first embodiment. [Figure 13] This figure shows an example of generated data D42 for the CPU in the first embodiment. [Figure 14] This figure shows an example of generated data D42 for memory in the first embodiment. [Figure 15] This figure shows an example of generated data D42 for memory in the first embodiment. [Figure 16]FIG. showing an example of the generated data D43 for error data in the first embodiment. [Figure 17] FIG. showing an example of the generated data D43 for the IF error in the first embodiment. [Figure 18] FIG. showing an example of the generated data D43 for discards in the first embodiment. [Figure 19] FIG. showing an example of the summary document in the first embodiment. [Figure 20] FIG. showing an example of the configuration diagram of the network device 110 in the first embodiment. [Figure 21] A flowchart showing an example of the processing procedure of the network analysis system 120 in the first embodiment. [Figure 22] A block diagram showing an example of the network analysis system 120 of the second embodiment. [Figure 23] A block diagram showing an example of the learning system 400 of the second embodiment. [Figure 24] FIG. showing an example of the network configuration data D61 in the second embodiment. [Figure 25] FIG. showing an example of the customer project trend / needs data D62 in the second embodiment. [Figure 26] FIG. showing an example of the response pattern and threshold data D71 in the second embodiment. [Figure 27] FIG. showing an example of the learning set D81 in the second embodiment. [Figure 28] FIG. showing an example of the learning set D82 in the second embodiment. [Figure 29] FIG. showing an example of the learning set D83 in the second embodiment. [Figure 30] A flowchart showing an example of the processing procedure of the network performance data learning device 410 in the second embodiment.

BEST MODE FOR CARRYING OUT THE INVENTION

[0011] Hereinafter, embodiments of the network analysis system, network analysis method, and network analysis program of the present invention will be described with reference to the drawings.

[0012] Figure 1 shows an example of the configuration of a corporate network system 1 in the first embodiment. Network system 1 includes, for example, a corporate LAN data center 100 and multiple corporate LAN systems 200A, 200B, ... In the following description, when referring to corporate LAN systems collectively, they will simply be described as "corporate LAN system 200". The corporate LAN data center 100 and corporate LAN systems 200 are connected via a communication network NW, such as a public network that implements a WAN.

[0013] The enterprise LAN data center 100 includes, for example, network equipment 110 and a network analysis system 120. The network equipment 110 includes, for example, an RT (Router) 110a, an LB (Load Balancer) 110b, a FW (Firewall) 110c, an IDS (Intrusion Detection System) / IPS (Intrusion Prevention System) 110d, an L2SW (Layer 2 Switch) 110e, and an L3SW (Layer 3 Switch) 110f. The network analysis system 120 is connected to the network equipment 110 and performs network analysis processing on the network equipment 110.

[0014] The enterprise LAN system 200 includes network equipment 210, such as RT210a and L2SW210b. Each of the enterprise LAN systems 200 is located, for example, at a different location.

[0015] Figure 2 is a block diagram showing an example of the functional configuration of the network analysis system 120 in the first embodiment. The network analysis system 120 includes, for example, a network performance data analysis device 120A, a data storage unit 140, and a trained model storage unit 150. The network performance data analysis device 120A includes, for example, an input unit 122, a processing unit 124, a traffic data trend analysis unit 126, a traffic data transition analysis unit 128, a CPU memory data trend analysis unit 130, a CPU memory data transition analysis unit 132, an error data trend analysis unit 134, an error data transition analysis unit 136, and a report generation unit 138. The input unit 122, processing unit 124, traffic data trend analysis unit 126, traffic data transition analysis unit 128, CPU memory data trend analysis unit 130, a CPU memory data transition analysis unit 132, an error data trend analysis unit 134, an error data transition analysis unit 136, and a report generation unit 138 are functional units realized by a processor (computer) such as a CPU executing a network analysis program.

[0016] The input unit 122 receives performance data D11 for a predetermined period of the target network device. The input unit 122 may also receive part specification data D12 that specifies the target network device from among multiple network devices. Figure 3 shows an example of performance data D11 in the first embodiment. Performance data D11 is data that associates hostname, interface, data acquisition date and time, IN traffic volume, OUT traffic volume, number of errors, number of discards, CPU usage, and memory usage. discards indicates that packets were discarded by network equipment, for example, because the buffer capacity was exceeded. Figure 4 shows an example of part-specific data D12 in the first embodiment. Part-specific data D12 is data indicating a part specified by the customer, and is, for example, data that associates hostname, interface, and period.

[0017] The processing unit 124 generates processing data D31, D32, and D33 by processing the performance data D11 based on the performance data D11 and the threshold D21. The processing unit 124 may also generate processing data by processing the performance data D11 of the part specified by the part specification data D12 based on the performance data D11, the part specification data D12, and the threshold D21.

[0018] Figure 5 shows an example of threshold D21 in the first embodiment. Threshold D21 is data that indicates the threshold to be compared with performance data D11, and is, for example, data that associates data type, configuration pattern, and threshold. The threshold is a value used to determine whether or not action is required for network devices 110 and 210, and is set for each configuration pattern of network devices 110 and 210 where the traffic volume, CPU usage, memory usage, number of errors, and number of discards are high and it is determined that action is required. The threshold may be set to a predetermined value, or it may be set to a dynamically calculated value. Figure 6 shows an example of processed data D31 for traffic data in the first embodiment. Processed data D31 is data that associates, for example, hostname, interface, data IN or OUT for the host, number of threshold exceedances, average traffic volume, maximum traffic volume, and maximum traffic measurement date and time. In the description in Figure 6, for example, "a or b Mbps" indicates that when the data in Figure 3 is processed, the largest value between "a Mbps" and "b Mbps" will be set, and "aabb Mbps" indicates that when the data in Figure 3 is processed, the average value of "aa Mbps" and "bb Mbps" will be set. In other words, Figure 6 is a schematic table that explains the content of the set values, and the same applies to subsequent tables. Furthermore, the processed data D31 for traffic data in the first embodiment may be aggregated data not shown. For example, it may be aggregated data of performance data D11 for a predetermined period stored in the data storage unit 140, or it may be aggregated data of past performance data D11 (including the predetermined period) stored in the data storage unit 140. Further aggregated data necessary for displaying an example of generated data D41 for IN traffic data in the first embodiment described later, as shown in Figure 9, may be added, as may further aggregated data necessary for displaying an example of generated data D41 for OUT traffic data in the first embodiment described later, as shown in Figure 10. Furthermore, further aggregated data necessary for displaying an example of generated data D41 for traffic data in the first embodiment described later, as shown in Figure 11, may be added. For example, further aggregated data relating to some of the information in Figure 11 (e.g., including increase / decrease amount, number of threshold exceedances, average value bandwidth, peak value bandwidth, and peak value utilization rate, but not trends) may be added. Figure 7 shows an example of processed data D32 for CPU memory data in the first embodiment. Processed data D32 is data to which, for example, host name, number of times the CPU threshold was exceeded, average CPU usage rate, maximum CPU usage rate, date and time of measurement of maximum CPU usage rate, number of times the memory threshold was exceeded, average memory usage rate, maximum memory usage rate, and date and time of measurement of maximum memory usage rate are associated. Furthermore, the processed data D32 for CPU memory data in the first embodiment may be aggregated data not shown. For example, it may be aggregated data of performance data D11 for a predetermined period stored in the data storage unit 140, or it may be aggregated data of past performance data D11 (including the predetermined period) stored in the data storage unit 140. Further aggregated data necessary for displaying an example of generated data D42 for the CPU in the first embodiment described later in Figure 12 may be added, and further aggregated data necessary for displaying an example of generated data D42 for memory in the first embodiment described later in Figure 14 may be added. Furthermore, further aggregated data necessary for displaying an example of generated data D41 for the CPU in the first embodiment described later in Figure 13 may be added, and further aggregated data necessary for displaying an example of generated data D41 for memory in the first embodiment described later in Figure 15 may be added. For example, further aggregated data relating to some of the information in Figures 13 and 15 (for example, including increase / decrease amount, number of threshold exceedances, average usage rate, peak value usage rate, and peak value date and time, but not trends) may be added. Figure 8 shows an example of processed data D33 for error data in the first embodiment. Processed data D32 is data to which, for example, hostname, interface, number of times the error threshold was exceeded, total number of errors per month, maximum number of errors, date on which the maximum number of errors was measured, number of times the discard threshold was exceeded, total number of discards per month, maximum number of discards, and date on which the maximum number of discards was measured are associated. Furthermore, the processed data D33 for error data in the first embodiment may be aggregated data not shown. For example, it may be aggregated data of performance data D11 for a predetermined period stored in the data storage unit 140, or it may be aggregated data of past performance data D11 (including the predetermined period) stored in the data storage unit 140. Further aggregated data necessary for displaying Figure 16, which is an example of generated data D43 for error data in the first embodiment described later, may be added. Furthermore, further aggregated data necessary for displaying Figure 17, which is an example of generated data D43 for IF errors in the first embodiment described later, may be added, as may further aggregated data necessary for displaying Figure 18, which is an example of generated data D43 for discards in the first embodiment described later. For example, further aggregated data relating to information other than trends in Figures 17 and 18 (e.g., including increase / decrease amount, number of threshold exceedances, cumulative number of occurrences per month, number of peak value occurrences, and peak value date and time, but not trends) may be added.

[0019] The traffic data trend analysis unit 126, the traffic data transition analysis unit 128, the CPU memory data trend analysis unit 130, the CPU memory data transition analysis unit 132, the error data trend analysis unit 134, and the error data transition analysis unit 136 function as analysis units that acquire analysis results. The analysis units input the processed data into a first machine learning model trained on a training dataset that includes analysis results showing the past trends and future trends of the network configuration, processed data, and network performance of the network device 110, and acquire the analysis results output from the first machine learning model.

[0020] The first machine learning model may include the third and fourth machine learning models. The third machine learning model is trained to output trend information showing past trends when processed data is input. The fourth machine learning model is trained to output trend information showing future trends when processed data is input. Specifically, in the analysis unit of the first embodiment, the first machine learning model includes a trained model for trend analysis to analyze trends and a trained model for trend analysis to analyze trends, the trained model for trend analysis corresponds to the third machine learning model, and the trained model for trend analysis corresponds to the fourth machine learning model. Specifically, the analysis unit is configured as follows.

[0021] The traffic data trend analysis unit 126 inputs the processed data D31 into a trained model M10 (first machine learning model) for traffic data trend analysis, which was trained using a training dataset that includes analysis results showing past trends in network configuration, processed data, and network performance, and obtains the analysis results output from the trained model M10 for traffic data trend analysis. The traffic data transition analysis unit 128 inputs the processed data D31 into a trained model M12 (first machine learning model) for traffic data transition analysis, which was trained using a training dataset that includes analysis results showing future trends in network configuration, processed data, and future trends, and obtains the analysis results output from the trained model M12 for traffic data transition analysis. The analysis results obtained by the traffic data trend analysis unit 126 and the analysis results obtained by the traffic data transition analysis unit 128 are output to the report generation unit 138 as generated data D41.

[0022] Figure 9 shows an example of generated data D41 for IN traffic data in the first embodiment. The generated data D41 for IN traffic data includes charts and graphs showing the time-series changes of traffic trends, bandwidth limits, and average traffic. These time-series changes include at least future time-series changes and may also include past time-series changes (including a predetermined period). Figure 10 shows an example of generated data D41 for OUT traffic data in the first embodiment. The generated data D41 for OUT traffic data includes charts and graphs showing the time series changes of traffic trends, thresholds, and average traffic. These time series changes include at least future time series changes and may also include past time series changes (including a predetermined period). Figure 11 shows an example of generated data D41 for traffic data in the first embodiment. The generated data D41 for traffic data includes charts and graphs showing monthly and three-month trends. The trends include at least future trends and may also include past trends (including a predetermined period). The generated data D41, which is the analysis result output from the traffic data trend analysis unit 126, is the analysis result of trend information obtained by inputting processed data D31, which is data obtained by processing performance data D11 for a predetermined period input from the input unit 122, into a trained model M10 for traffic data trend analysis that has been trained using a training dataset that includes analysis results showing past trends of network configuration, processed data, and network performance. This may be a chart or graph showing trends (e.g., trends, threshold exceedance status, peak values, etc.) related to traffic data for a period including the predetermined period (for example, if the predetermined period is the current month, then 3 months including the current month). For example, the trend in Figure 11 is not simply a choice between increase, decrease, or no change, but rather the result of analyzing trend information obtained by inputting threshold exceedance and peak value into the trained model M10 for traffic data trend analysis. The threshold exceedance and peak value can be judged from past learning to determine if an increasing trend of a certain level or higher is observed, and if a decreasing trend of a certain level or higher is observed, it can be determined as decrease, and in all other cases, it can be determined as no change. Values ​​other than the trend in Figure 11 may also be included in the processed data D31. The generated data D41, which is the analysis result output from the traffic data trend analysis unit 128, is the analysis result of trend information obtained by inputting processed data D31, which is data processed from performance data D11 for a predetermined period input from the input unit 122, into a trained model M12 for traffic data trend analysis, which is trained using a training dataset that includes analysis results showing future trends of network configuration, processed data, and network performance. This may be a chart or graph showing time-series changes that represent future trends related to traffic data, or it may be a chart or graph showing time-series changes that represent future and past trends.

[0023] The CPU memory data trend analysis unit 130 inputs the processed data D32 into a trained model M16 (first machine learning model) for CPU memory data trend analysis, which was trained using a training dataset that includes analysis results showing past trends in network configuration, processed data, and performance, and obtains the analysis results output from the trained model M16 for CPU memory data trend analysis. The CPU memory data transition analysis unit 132 inputs the processed data D32 into a trained model M18 (first machine learning model) for CPU memory data transition analysis, which was trained using a training dataset that includes analysis results showing future trends in network configuration, processed data, and future trends, and obtains the analysis results output from the trained model M18 for CPU memory data transition analysis. The analysis results obtained by the CPU memory data trend analysis unit 130 and the analysis results obtained by the CPU memory data transition analysis unit 132 are output to the report generation unit 138 as generated data D42.

[0024] Figure 12 shows an example of generated data D42 for the CPU in the first embodiment. The generated data D42 for the CPU includes charts and graphs showing the time-series changes in CPU usage, thresholds, and average CPU usage. Figure 13 shows an example of generated data D42 for the CPU in the first embodiment. The generated data D42 for the CPU includes charts and graphs showing the trends over one month and three months. Figure 14 shows an example of generated data D42 for memory in the first embodiment. The generated data D42 for memory includes charts and graphs showing the time series changes of memory usage, thresholds, and average memory usage. Figure 15 shows an example of generated data D42 for memory in the first embodiment. The generated data D42 for memory includes charts and graphs showing the trends over one month and three months. The generated data D42, which is the analysis result output from the CPU memory data trend analysis unit 130, is the analysis result of trend information obtained by inputting processed data D32, which is data processed from performance data D11 for a predetermined period input from the input unit 122, into a trained model M16 for CPU memory data trend analysis, which is trained using a training dataset that includes analysis results showing past trends in network configuration, processed data, and performance. This may be a chart or graph showing trends related to CPU and memory data (e.g., trends of increase or decrease, threshold exceedance status, peak values, etc.) for a period including the predetermined period (for example, if the predetermined period is the current month, then 3 months including the current month). For example, the trends in Figures 13 and 15 are not simply a selection from increase, decrease, or no change, but rather the result of analyzing trend information obtained by inputting threshold exceedance and peak value into the trained model M16 for CPU memory data trend analysis. The threshold exceedance and peak value can be judged from past learning to determine if an increasing trend of a certain level or higher is observed, and if a decreasing trend of a certain level or higher is observed, it can be determined as decrease, and in all other cases, it can be determined as no change. Values ​​other than the trends in Figures 13 and 15 may also be included in the processed data D31. The generated data D42, which is the analysis result output from the CPU memory data transition analysis unit 132, is the analysis result of transition information obtained by inputting processed data D32, which is data obtained by processing performance data D11 for a predetermined period input from the input unit 122, into a trained model M18 for CPU memory data transition analysis, which is trained using a training dataset that includes network configuration, processed data, and analysis results showing future transitions. This may be a chart or graph showing time-series changes that represent future transitions related to CPU and memory data, or it may be a chart or graph showing time-series changes that represent future and past transitions.

[0025] The error data trend analysis unit 134 inputs the processed data D33 into the trained model M20 (first machine learning model) for error data trend analysis, which was trained using a training dataset that includes analysis results showing past trends in network configuration, processed data, and performance, and obtains the analysis results output from the trained model M20 for error data trend analysis. The error data transition analysis unit 136 inputs the processed data D33 into the trained model M22 (first machine learning model) for error data transition analysis, which was trained using a training dataset that includes analysis results showing future trends in network configuration, processed data, and future trends, and obtains the analysis results output from the trained model M22 for error data transition analysis. The analysis results obtained by the error data trend analysis unit 134 and the analysis results obtained by the error data transition analysis unit 136 are output to the report generation unit 138 as generated data D43.

[0026] Figure 16 shows an example of generated data D43 for error data in the first embodiment. Generated data D43 for error data includes a chart graph showing the time-series changes of IF (interface) errors, discards, and thresholds. Figure 17 shows an example of generated data D43 for IF errors in the first embodiment. The generated data D43 for IF errors includes charts and graphs showing the trends over one month and three months. Figure 18 shows an example of generated data D43 for discards in the first embodiment. The generated data D43 for discards includes charts and graphs showing the trends over one month and three months. The generated data D43, which is the analysis result output from the error data trend analysis unit 134, is the analysis result of trend information obtained by inputting processed data D33, which is data obtained by processing performance data D11 for a predetermined period input from the input unit 122, into a trained model M20 for error data trend analysis that has been trained using a training dataset that includes analysis results showing past trends in network configuration, processed data, and performance. This may be a chart or graph showing trends related to error data (e.g., trends of increase or decrease, threshold exceedance status, peak value, etc.) for a period including the predetermined period (for example, if the predetermined period is the current month, then 3 months including the current month). For example, the trends in Figures 17 and 18 are not simply a selection from increase, decrease, or no change, but rather the result of analyzing trend information obtained by inputting threshold exceedance and peak value into the trained model M20 for error data trend analysis. The threshold exceedance and peak value can be judged from past learning to determine if an increasing trend of a certain level or higher is observed, and if a decreasing trend of a certain level or higher is observed, it can be determined as decrease, and in all other cases, it can be determined as no change. Values ​​other than the trends in Figures 17 and 18 may also be included in the processed data D31. The generated data D43, which is the analysis result output from the error data transition analysis unit 136, is the analysis result of transition information obtained by inputting processed data D32, which is data processed from performance data D11 for a predetermined period input from the input unit 122, into the trained model M22 for error data transition analysis, which is trained using a training dataset that includes network configuration, processed data, and analysis results showing future transitions. This may be a chart or graph showing time-series changes that represent future transitions related to error data, or it may be a chart or graph showing time-series changes that represent future and past transitions.

[0027] The report generation unit 138 functions as a generation unit that inputs the analysis results obtained by the analysis unit into a second machine learning model trained with training data containing information indicating the analysis results and countermeasures, and generates advice information based on the countermeasures information output from the second machine learning model. The second machine learning model is the report generation trained model M14 (second machine learning model). The report generation trained model M14 is trained to output countermeasures information when it receives trend information output from the trend analysis trained model (third machine learning model) and trend information output from the transition analysis trained model (fourth machine learning model). The countermeasures information is information indicating countermeasures for the network device 110. The report generation unit 138 outputs an analysis results report D51 that includes advice information. The analysis results report D51 includes a summary document, charts, and graphs that include countermeasures.

[0028] The data storage unit 140 stores performance data D11, processing data D31, D32, D33, generated data D41, D42, D43, and analysis result report D51. The trained model storage unit 150 records parameter data for constructing the trained model described above. The trained model storage unit 150 updates the trained model as the trained model has been trained.

[0029] Figure 19 shows an example of a summary document in the first embodiment. Summary documents are generated, for example, by training the report generation trained model M14 with previously created summary documents. The report generation trained model M14 outputs the summary documents as text data, which are then included in the analysis result report D51. The analysis result report D51 may also include various generated data as shown in Figures 9 to 18, and may include a configuration diagram showing the equipment in the target network device 110, as shown in Figure 20. Figure 20 shows an example of a configuration diagram of the network device 110 in the embodiment. The part specification data D12 input from the input unit 122 is data that specifies a part of the configuration diagram of the network device 110 shown in Figure 20.

[0030] Figure 21 is a flowchart showing an example of the processing procedure of the network analysis system 120 in the first embodiment. This processing procedure may be performed at predetermined intervals (for example, the current month). First, the input unit 122 inputs performance data D11 and part specification data D12 (step S100), and stores the input performance data D11 and part specification data D12 in the data storage unit 140 (step S102). The processing unit 124 extracts the maximum and average values ​​of the performance data D11 by aggregating the input performance data D11 (step S104). The processing data D31, D32, and D33 may include the values ​​aggregated in step S104.

[0031] The processing unit 124 refers to the performance data D11 and the part specification data D12 to determine whether or not there are any new network devices 110 (step S106). If there are new network devices 110 (step S106: NO), a base for the new network device 110 is created (step S108). The base for the new network device 110 is information that will be compared in subsequent processing, and is information created based on the performance data D11 and the part specification data D12. It may also include the addition of necessary tables or other information linked to the new network device 110 (for example, information showing the relationship with the configuration diagram of the network device 110 shown in Figure 20).

[0032] If there are no new network devices 110 (step S106: YES), the processing unit 124 refers to past performance data D11 and part-specific data D12 stored in the data storage unit 140 and compares the performance data D11 and part-specific data D12 entered this time with the performance data D11 and part-specific data D12 from one month ago (step S110). The processing unit 124 calculates the difference (increase / decrease value) between this month's performance data D11 and part-specific data D12 and last month's performance data D11 and part-specific data D12. The processed data D31, D32, and D33 may include the values ​​aggregated in steps S110 and S112.

[0033] Next, the processing unit 124 determines whether the calculated difference exceeds the threshold D21 (step S114). If the calculated difference does not exceed the threshold D21 (step S114: NO), it determines whether a part is specified by the part specification data D12 (step S116). If no data is specified by the part specification data D12 (step S116: NO), the number of threshold exceedances is saved as 0 (step S118), and the aggregated data is saved in the data storage unit 140 (step S120).

[0034] If the calculated difference exceeds the threshold D21 (step S114: YES), the number of times the threshold has been exceeded is tallied (step S122), the tallied data is stored in the data storage unit 140 (step S126), and the configuration information of each part is read (step S124). The configuration information indicates one of the network configurations that represents the relationship between a specific part and other parts, such as a single configuration, a redundant configuration, or an eclectic configuration. Next, the processing unit 124 extracts equipment related to a specific network device 110, such as redundant equipment and connected equipment (step S130). Redundant equipment is, for example, equipment that is in a redundant configuration with a specific network device 110. The processed data D31, D32, and D33 may include the values ​​tallied in steps S114 to S122 and the information collected in steps S124 and S130.

[0035] Next, the traffic data trend analysis unit 126, the traffic data transition analysis unit 128, the CPU memory data trend analysis unit 130, the CPU memory data transition analysis unit 132, the error data trend analysis unit 134, and the error data transition analysis unit 136 use the processed data D31, D32, and D33 to create generated data D41, D42, and D43, which include graph data and tabular data (step S132). The created generated data D41, D42, and D43 are stored in the data storage unit 140 (step S134).

[0036] Next, the report generation unit 138 creates a response plan using the generated data D41, D42, and D43, and determines the priority of the multiple response plans (step S136). At this time, the report generation unit 138 determines the number of times the threshold has been exceeded for each response plan, and assigns a higher priority to the response plan the more times the threshold has been exceeded.

[0037] Next, the report generation unit 138 determines the priority of the countermeasures based on customer needs (step S138). For example, the report generation unit 138 may give a higher priority to countermeasures for specific body parts specified by body part specification data D12. For example, the report generation unit 138 may give a lower priority to countermeasures for body parts that are scheduled to be discontinued.

[0038] Next, the report generation unit 138 determines a course of action based on the judgment results in steps S136 and S138 (step S140).

[0039] Next, the report generation unit 138 inputs the generated data D41, D42, D43 and the decided countermeasures into the trained model M14 for report generation, and outputs text data from the trained model M14 for report generation to create a summary document of the countermeasures (step S142). The report generation unit 138 creates a report including the summary document, the data and charts contained in the generated data D41, D42, D43, and outputs it to, for example, the administrator's terminal device of the network device 110 (step S144).

[0040] As described above, according to the network analysis system 120 of the first embodiment, processed data D31, D32, and D33 are generated by processing the performance data D11 based on the performance data D11 and threshold D21 of the target network device 110. The processed data is input into a first machine learning model trained on a training dataset that includes analysis results showing past trends and future trends of network configuration, processed data, and performance. The analysis results output from the first machine learning model are obtained, and the analysis results are input into a second machine learning model trained on training data that includes analysis results and information indicating countermeasures. Advice information is generated based on the countermeasures information output from the second machine learning model. As a result, according to the network analysis system 120, detailed advice can be created by performing an analysis on a specific communication network. Furthermore, according to the network analysis system 120 of the first embodiment, by analyzing the aggregated performance data D11 based on the network trends of network devices 110 and 210, it is possible to grasp trends and predict changes, generate countermeasures from trends, changes, and customer needs, and automatically output advice information. Furthermore, according to the network analysis system 120 of the first embodiment, based on network trends including LANs and WANs, it can capture network changes by analyzing the trends and transitions of aggregated performance data D11, identify the reasons and causes of changes from trend, transition, and needs predictions, and then automatically output suggestions for countermeasures. In addition, according to the network analysis system 120, it can perform detailed analysis by combining multiple AI models and output advice information.

[0041] The second embodiment will be described below. In the description of the second embodiment, the same reference numerals will be used for parts that are the same as those in the first embodiment. Figure 22 is a block diagram showing an example of a network analysis system 120 according to a second embodiment. The network analysis system 120 of the second embodiment differs from the first embodiment in that it includes a learning system 400 in the enterprise LAN data center 100. The differences will be explained below in detail.

[0042] Figure 23 is a block diagram showing an example of the learning system 400 according to the second embodiment. The learning system 400 includes, for example, a network performance data learning device 410, a data storage unit 430, and a trained model storage unit 440. The data storage unit 430 and the trained model storage unit 440 may also be used in conjunction with the data storage unit 140 and the trained model storage unit 150 described above. The data storage unit 430 stores performance data D11, processed data D31, D32, D33, generated data D41, D42, D43, and analysis result report D51. The trained model storage unit 440 stores the trained model M30 for report generation (second machine learning model) (generating AI), the trained model M32 for traffic data trend analysis, the trained model M34 for traffic data transition analysis, the trained model M36 for CPU memory data trend analysis, the trained model M38 for CPU memory data transition analysis, the trained model M40 for error data trend analysis, and the trained model M42 for error data transition analysis.

[0043] The network performance data learning device 410 includes, for example, an input unit 412, a processing unit 414, a traffic data trend analysis model generation unit 416, a traffic data transition analysis model generation unit 418, a CPU memory data trend analysis model generation unit 420, a CPU memory data transition analysis model generation unit 422, an error data trend analysis model generation unit 424, and an error data transition analysis model generation unit 426. The input unit 412, processing unit 414, traffic data trend analysis model generation unit 416, traffic data transition analysis model generation unit 418, CPU memory data trend analysis model generation unit 420, CPU memory data transition analysis model generation unit 422, an error data trend analysis model generation unit 424, an error data transition analysis model generation unit 426, and a report generation model generation unit (not shown) are functional units realized by a processor such as a CPU executing a network analysis program.

[0044] The input unit 412 receives performance data D11, processed data D31, D32, D33, and generated data D41, D42, D43 from the data storage unit 430. The processing unit 414 processes the performance data D11, processed data D31, D32, D33, and generated data D41, D42, D43 to create training sets D81, D82, and D83. Training set D81 is output to the traffic data trend analysis model generation unit 416 and the traffic data transition analysis model generation unit 418. Training set D82 is output to the CPU memory data trend analysis model generation unit 420 and the CPU memory data transition analysis model generation unit 422. Training set D83 is output to the error data trend analysis model generation unit 424 and the error data transition analysis model generation unit 426.

[0045] The traffic data trend analysis model generation unit 416, the traffic data transition analysis model generation unit 418, the CPU memory data trend analysis model generation unit 420, the CPU memory data transition analysis model generation unit 422, the error data trend analysis model generation unit 424, and the error data transition analysis model generation unit 426 may be input with network configuration data D61, customer case trend / needs data D62, and corresponding pattern data and threshold data D71. The data and learning set input to each generation unit are learning data. Furthermore, the network performance data learning device 410 may include a report generation model generation unit (not shown). The report generation model generation unit may be a generating AI. The report generation model generation unit receives network configuration data D61, customer project trend / needs data D62, and corresponding pattern data and threshold data D71 as input.

[0046] Figure 24 shows an example of network configuration data D61 in the second embodiment. Network configuration data D61 is, for example, data that associates a host name, a category indicating the host's affiliation, a configuration pattern, a system and status, and a configuration diagram number. Figure 25 shows an example of customer case trend / needs data D62 in the second embodiment. Customer case trend / needs data D62 is data that associates, for example, the scope of the project with the needs for determining the priority of the response policy and the trends. Figure 26 shows an example of the response pattern and threshold data D71 in the second embodiment. The response pattern and threshold data D71 is data that associates, for example, the response pattern number, data type, whether or not the threshold is exceeded, the medium- to long-term trend, the configuration pattern, and the countermeasure. The countermeasure is information that represents the countermeasure considering the trend, configuration, and priority, and as explained in more detail with reference to Figure 26, it is data for learning the countermeasure according to the data type, threshold exceedance, medium- to long-term trend, and configuration pattern.

[0047] Figure 27 shows an example of a training set D81 in the second embodiment. Training set D81 is historical traffic data, including, for example, hostname, interface, data IN or OUT for the host, trends for the month before last, number of threshold exceedances for the month before last, peak traffic for the month before last, trends for last month, number of threshold exceedances for last month, and peak traffic for last month. Figure 27 shows data for learning trends in response to threshold exceedances and peak values. More specifically, it shows data for learning trends for the month before last in response to the number of threshold exceedances and peak traffic for the month before last, and trends for last month in response to the number of threshold exceedances and peak traffic for last month. Trends may be input separately, may be the result of past analysis, or may be modified results of past analysis.

[0048] The traffic data trend analysis model generation unit 416 acquires the learning set D81, network configuration data D61, customer case trend / needs data D62, and corresponding pattern and threshold data D71 as learning data. The traffic data trend analysis model generation unit 416 trains the trained model M32 for traffic data trend analysis so that it outputs traffic data trend information when it receives data processed from performance data D10, location specification data D12, and threshold D21 as input. Training the trained model M32 for traffic data trend analysis includes changing the parameters that define the processing of the trained model M32 for traffic data trend analysis.

[0049] The traffic data trend analysis model generation unit 418 acquires the learning set D81, network configuration data D61, customer project trend / needs data D62, and corresponding pattern and threshold data D71 as learning data. The traffic data trend analysis model generation unit 418 trains the trained model M34 for traffic data trend analysis to output traffic data trend information when it receives data processed from performance data D10, location specification data D12, and threshold D21 as input. Training the trained model M34 for traffic data trend analysis includes changing the parameters that define the processing of the trained model M34 for traffic data trend analysis.

[0050] Figure 28 shows an example of training set D82 in the second embodiment. Training set D82 is historical data of CPU usage and memory usage, and includes, for example, hostname, trend for the month before last, number of threshold exceedances for the month before last, peak usage for the month before last, trend for last month, number of threshold exceedances for last month, and peak usage for last month. Figure 28 is data for training trends according to threshold exceedances and peak values. More specifically, it is data for training CPU usage trends for the month before last based on the number of threshold exceedances and peak CPU usage for the month before last for CPU usage, CPU usage trends for last month based on the number of threshold exceedances and peak CPU usage for last month for CPU usage, memory usage trends for the month before last based on the number of threshold exceedances and peak memory usage for the month before last for memory usage, and memory usage trends for last month based on the number of threshold exceedances and peak memory usage for last month for memory usage. Trends may be input separately, may be past analysis results, or may be modified past analysis results.

[0051] The CPU memory data trend analysis model generation unit 420 acquires the learning set D82, network configuration data D61, customer project trend / needs data D62, and corresponding pattern and threshold data D71 as learning data. The CPU memory data trend analysis model generation unit 420 trains the CPU memory data trend analysis model M36 to output trend information of CPU memory data when it receives data processed from performance data D10, part specification data D12, and threshold D21 as input. Training the CPU memory data trend analysis model M36 includes changing the parameters that define the processing of the CPU memory data trend analysis model M36.

[0052] The CPU memory data transition analysis model generation unit 422 acquires the learning set D82, network configuration data D61, customer project trend / needs data D62, and corresponding pattern and threshold data D71 as learning data. The CPU memory data transition analysis model generation unit 422 trains the CPU memory data transition analysis model M38 to output CPU memory data transition information when it receives data processed from performance data D10, part specification data D12, and threshold D21 as input. Training the CPU memory data transition analysis model M38 includes changing the parameters that define the processing of the CPU memory data transition analysis model M38.

[0053] Figure 29 shows an example of training set D83 in the second embodiment. Training set D83 is historical data of the number of errors and the number of discards, and includes, for example, hostname, interface, trend from two months ago, number of threshold exceedances two months ago, peak number of occurrences two months ago, trend from last month, number of threshold exceedances last month, and number of occurrences last month. Figure 29 is data for training on trends according to threshold exceedances and peak values. To explain in more detail with reference to Figure 29, it is data for training on the trend of the number of errors two months ago according to the number of threshold exceedances two months ago and the peak number of errors two months ago, the trend of the number of errors last month according to the number of threshold exceedances last month and the peak number of errors last month, the trend of the number of discards two months ago according to the number of threshold exceedances two months ago and the peak number of discards two months ago, and the trend of the number of discards last month according to the number of threshold exceedances last month and the peak number of discards last month. Trends may be input separately, may be the result of past analysis, or may be modified versions of past analysis results.

[0054] The error data trend analysis model generation unit 424 acquires the learning set D83, network configuration data D61, customer case trend / needs data D62, and response pattern and threshold data D71 as learning data. The error data trend analysis model generation unit 424 trains the pre-trained model M40 for error data trend analysis so that it outputs trend information for error data when it receives data processed from performance data D10, part specification data D12, and threshold D21 as input. Training the pre-trained model M40 for error data trend analysis includes changing the parameters that define the processing of the pre-trained model M40 for error data trend analysis.

[0055] The error data transition analysis model generation unit 426 acquires the learning set D83, network configuration data D61, customer case trend / needs data D62, and response pattern and threshold data D71 as learning data. The error data transition analysis model generation unit 426 trains the pre-trained model M42 for error data transition analysis to output error data transition information when it receives data processed from performance data D10, part specification data D12, and threshold D21 as input. Training the pre-trained model M42 for error data transition analysis includes changing the parameters that define the processing of the pre-trained model M42 for error data transition analysis. The report generation model generation unit may be a generation AI, and acquires network configuration data D61, customer case trend / needs data D62, and corresponding pattern data and threshold data D71 as training data. The report generation model generation unit trains a trained report generation model M30 to output an analysis result report when the generation data D41, D42, and D43 are input. Training the trained report generation model M30 includes changing the parameters that define the processing of the trained report generation model M30.

[0056] Figure 30 is a flowchart showing an example of the processing procedure of the network performance data learning device 410 in the second embodiment. In this processing procedure, for example, in Embodiment 1, the network analysis system 120 (network performance data analysis device 120A) may, after performing the processing shown in Figure 21 at predetermined intervals (for example, the current month), copy the data generated therein and stored in the data storage unit 140 to the data storage unit 430 in Figure 23, or share it, and utilize it. The trained model in the trained model storage unit 440 created by this processing procedure may be copied to the trained model storage unit 150 in Embodiment 1, or shared, and used in the processing shown in Figure 21 of Embodiment 1. First, the input unit 412 receives performance data D11, processing data D31, D32, D33, and generated data D41, D42, D43 from the data storage unit 430 (step S200). The processing unit 414 then processes the performance data D11, processing data D31, D32, D33, and generated data D41, D42, D43 to create learning sets D81, D82, D83 (step S202). The processing may include, for example, calculating trends in the data from the month before last and last month, the number of threshold exceedances, and peak values. The data may also be modified from the input unit 412.

[0057] The processing unit 414 refers to the performance data D11 and determines whether or not there is a new network device 110 (step S204). If there is a new network device 110 (step S204: YES), a base for the new network device 110 is created (step S206). The base for the new network device 110 is information that will be compared in subsequent processing, and is information created based on the performance data D11. It may include the addition of necessary tables or other information linked to the new network device 110 (for example, information showing the relationship with the configuration diagram of the network device 110 shown in Figure 20).

[0058] The processing unit 414 determines whether or not there is update information in the network configuration data D61, customer project trend / needs data D62, and corresponding pattern and threshold data D71 (step S208). If there is update information (step S208: YES), the processing unit 414 extracts the updated portion of the data (step S210), performs processing using the updated portion of the data, and updates the trained model using the processed training set and the training set processed in step S202 (step S212). If there is no update information (step S208: NO), the processing unit 414 updates the trained model using the training set processed in step S202 (step S214).

[0059] Next, the network performance data learning device 410 reflects the updated trained model in the trained model storage unit 440 (step S216). As a result, the network analysis system 120 can perform processing using the updated trained model.

[0060] As described above, according to the second embodiment, learning data including past processing data, network configuration data, and thresholds generated by the processing unit 414 is reflected in the first machine learning model (M32, M34, M36, M38, M32, M40, M42), and the parameters of the first machine learning model can be learned so that the analysis results of the processing data (progress information and transition information) are output from the first machine learning model. Network configuration data D61, customer case trend / needs data D62, and corresponding pattern data and threshold data D71 are reflected in the second machine learning model (M30), and the parameters of the second machine learning model can be learned so that the countermeasure policy information is output from the second machine learning model.

[0061] Although embodiments for carrying out the present invention have been described above using examples, the present invention is not limited in any way to these embodiments, and various modifications and substitutions can be made without departing from the spirit of the present invention. [Explanation of Symbols]

[0062] 1 Network system, 100 Enterprise LAN data center, 110, 210 Network equipment, 110 Network equipment, 120 Network analysis system, 120A Network performance data analysis device, 122 Input unit, 124 Processing unit, 126 Traffic data trend analysis unit, 128 Traffic data transition analysis unit, 130 CPU memory data trend analysis unit, 132 CPU memory data transition analysis unit, 134 Error data trend analysis unit, 136 Error data transition analysis unit, 138 Report generation unit, 140 Data storage unit, 150 Trained model storage unit, 200 Enterprise LAN system, 210 Network equipment, 302 Input unit, 304 Processing unit, 306 Traffic data trend analysis model generation unit, 308 Traffic data transition analysis model generation unit, 310 CPU memory data trend analysis model generation unit, 312 CPU memory data transition analysis model generation unit, 314 Error data trend analysis model generation unit, 316 Error data transition analysis model generation unit, 330 Data storage unit, 400 Learning system, 410 Network performance data learning device, 412 Input unit, 414 Processing unit, 416 Traffic data trend analysis model generation unit, 418 Traffic data transition analysis model generation unit, 420 CPU memory data trend analysis model generation unit, 422 CPU memory data transition analysis model generation unit, 424 Error data trend analysis model generation unit, 426 Error data transition analysis model generation unit, 430 Data storage unit, 440 Trained model storage unit, D11 Performance data, D12 Location-specified data, D21 Threshold, D31, D32, D33 Processing data, D41, D42, D43 Generated data, D51 Analysis result report, D61 Network configuration data, D62 Customer project trend / needs data, D71 Threshold data, D81, D82, D83 Learning set, M10 Trained model for traffic data trend analysis, M12 Trained models for traffic data trend analysis, M14; Trained models for report generation, M16; Trained models for CPU memory data trend analysis, M18; Trained models for CPU memory data trend analysis, M20; Trained models for error data trend analysis, M22; Trained models for error data trend analysis, M30; Trained models for report generation, M32Trained models for traffic data trend analysis (M34), traffic data transition analysis (M36), CPU memory data trend analysis (M38), CPU memory data transition analysis (M40), error data trend analysis (M42), and error data transition analysis (M42) are available.

Claims

1. An input section for inputting performance data of the target network equipment, A processing unit that generates processing data by processing the performance data based on the performance data and thresholds, An analysis unit inputs the processed data into a first machine learning model trained on a training dataset including network configuration data of the network equipment, processed data, and analysis results showing past trends and future trends, and acquires the analysis results output from the first machine learning model. A generation unit inputs the analysis results obtained by the analysis unit into a second machine learning model trained with training data containing analysis results and information indicating countermeasures, and generates advice information based on the countermeasure information output from the second machine learning model. A network analysis system equipped with the following features.

2. The input unit receives part specification data that specifies the target network device from among multiple network devices. The processing unit generates processing data by processing the performance data based on the performance data, the part specification data, and the threshold. The network analysis system according to claim 1.

3. The first machine learning model includes a third machine learning model and a fourth machine learning model. The third machine learning model is trained to output trend information showing past trends when the processed data is input. The fourth machine learning model is trained to output trend information showing future trends when the processed data is input. The network analysis system according to claim 1, wherein the second machine learning model is trained to output the countermeasure information when it receives the trend information output from the third machine learning model and the transition information output from the fourth machine learning model as input.

4. The second machine learning model is trained to output response strategy information that includes multiple response strategies. The network analysis system according to claim 3, wherein the generation unit determines the priority of the plurality of countermeasures based on the difference between the countermeasure information output from the second machine learning model, the performance data, and the threshold, and generates the advice information including the countermeasure with the highest priority.

5. The system includes a learning device that inputs learning data, including past processing data generated by the processing unit, network configuration data, thresholds, and countermeasures, into a first machine learning model, and learns the parameters of the first machine learning model so that it outputs analysis results of the processing data from the first machine learning model. The network analysis system according to claim 1.

6. Computers The steps include: inputting performance data for the target network equipment, A step of generating processed data by processing the performance data based on the performance data and a threshold, The process involves inputting the processed data into a first machine learning model trained on a training dataset that includes network configuration data of the network equipment, processed data, and analysis results showing past trends and future trends, and obtaining the analysis results output from the first machine learning model. The steps include: inputting the acquired analysis results into a second machine learning model trained with training data containing information indicating analysis results and countermeasures, and generating advice information based on the countermeasure information output from the second machine learning model; Network analysis methods, including those mentioned above.

7. On the computer, The steps include: inputting performance data for the target network equipment, A step of generating processed data by processing the performance data based on the performance data and a threshold, The process involves inputting the processed data into a first machine learning model trained on a training dataset that includes network configuration data of the network equipment, processed data, and analysis results showing past trends and future trends, and obtaining the analysis results output from the first machine learning model. The steps include: inputting the acquired analysis results into a second machine learning model trained with training data containing information indicating analysis results and countermeasures, and generating advice information based on the countermeasure information output from the second machine learning model; A network analysis program that performs the following actions.

Images