Information processing device, information processing method, and information processing program

Abstract

To save packet data in the event that an anomaly occurs in the packet capture device that causes the packet data saving process to stop. [Solution] The information processing device 2 comprises a capture unit 31, an acquisition unit 32, an anomaly determination unit 34, and a storage processing unit 35. The capture unit 31 temporarily stores data of packets transmitted and received over the network, up to a preset data storage limit, in the memory 20. The acquisition unit 32 acquires information including the latest storage time of the packet data from a packet capture device that stores data of packets transmitted and received over the network. The anomaly determination unit 34 determines, based on the latest storage time, that a storage anomaly has occurred by the packet capture device. If the anomaly determination unit 34 determines that a storage anomaly has occurred, the storage processing unit 35 causes the packet data temporarily stored in the memory 20 to be saved to the storage 21.

Description

[Technical Field]

[0001] Embodiments of disclosure relate to information processing devices, information processing methods, and information processing programs. [Background technology]

[0002] Conventionally, packet capture devices are known that have a packet capture program that stores packet data, which is the data of packets transmitted and received over a network. However, in packet capture devices, the packet data storage process may stop or be delayed.

[0003] For example, in a packet capture device, the packet capture process may terminate abnormally or freeze, causing the packet data saving process to stop. Also, if a large volume of traffic occurs temporarily on the network (sometimes referred to as a burst), the amount of data that the packet capture device temporarily stores becomes excessive, requiring a lot of memory resources, which can delay the packet data saving process.

[0004] Patent Document 1 proposes a technique in which the number of times the cumulative number of packets or bytes in a flow rule exceeds a threshold at a predetermined period is accumulated in the flow rule as a burst detection count, and then the cumulative number of packets or bytes in the flow rule is deleted.

[0005] Furthermore, Patent Document 2 proposes a technique for storing packets received from a network in memory and determining a shutdown address so as to guarantee the retention of packets for the period before and after the detection point when it is detected that the cumulative number of packets per cycle exceeds an upper threshold.

[0006] Furthermore, Non-Patent Document 1 proposes a technique to improve capture performance by bundling multiple packets received from a network and compressing them in real time. [Prior art documents] [Patent Documents]

[0007] [Patent Document 1] Patent No. 7238993 [Patent Document 2] Patent No. 7160189 [Non-patent literature]

[0008] [Non-Patent Document 1] Sho Shimizu, Kazuhiro Kazama, Toshio Hirotsu, Shigeki Goto, "Accelerating Packet Capture by Real-Time Compression," Transactions on Computing Systems (ACS) 47 (SIG7(ACS14)), 183-193, 2006-05-15 [Overview of the Initiative] [Problems that the invention aims to solve]

[0009] However, if the aforementioned packet capture device terminates abnormally or freezes, a problem arises where the packet data saving process stops.

[0010] The present invention has been made in view of the above, and aims to provide an information processing device, an information processing method, and an information processing program that can save packet data when an abnormality occurs in a packet capture device that causes the packet data saving process to stop. [Means for solving the problem]

[0011] In order to solve the above-described problems and achieve the object, an information processing apparatus according to the present invention includes a capture unit, an acquisition unit, an abnormality determination unit, and a storage processing unit. The capture unit temporarily stores in a memory data of packets that are transmitted and received over a network and that are data of past packets up to a preset data storage upper limit amount. The acquisition unit acquires information including the latest storage time of the data of packets in a packet capture apparatus that stores the data of packets transmitted and received over the network. The abnormality determination unit determines whether a storage abnormality has occurred in the packet capture apparatus based on the latest storage time. When the storage processing unit determines that a storage abnormality has occurred according to the abnormality determination unit, the storage processing unit stores the data of packets temporarily stored in the memory in a storage.

Advantages of the Invention

[0012] According to the present invention, it is possible to store packet data when an abnormality occurs in which the storage process of packet data stops in a packet capture apparatus.

Brief Description of the Drawings

[0013] [Figure 1] FIG. 1 is a diagram for explaining an overview of an information processing system including an information processing apparatus according to an embodiment. [Figure 2] FIG. 2 is a diagram for explaining the operation of the information processing apparatus when a storage stop abnormality occurs in a packet capture apparatus according to an embodiment. [Figure 3] FIG. 3 is a diagram for explaining the operation of the information processing apparatus when a storage delay abnormality occurs in a packet capture apparatus according to an embodiment. [Figure 4] FIG. 4 is a diagram showing an example of the configuration of an information processing apparatus according to an embodiment. [Figure 5] FIG. 5 is a diagram for explaining an example of a determination process for occurrence of a storage stop abnormality by an abnormality determination unit according to an embodiment. [Figure 6] FIG. 6 is a diagram for explaining an example of a determination process for occurrence of a storage delay abnormality by an abnormality determination unit according to an embodiment. [Figure 7]FIG. 7 is a diagram for explaining an example of a determination process for resolving a storage delay abnormality by an abnormality determination unit according to an embodiment. [Figure 8] FIG. 8 is a flowchart showing an example of information processing by a processing unit of an information processing apparatus according to an embodiment. [Figure 9] FIG. 9 is a flowchart showing an example of an abnormality determination process by a processing unit of an information processing apparatus according to an embodiment. [Figure 10] FIG. 10 is a diagram showing an example of a computer that executes an information processing program. [Embodiment for Implementing the Invention]

[0014] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings. Note that the present invention is not limited by this embodiment. Also, in the description of the drawings, the same parts are denoted by the same reference numerals.

[0015] [Outline of Information Processing Apparatus] FIG. 1 is a diagram for explaining the outline of an information processing system including an information processing apparatus according to an embodiment. As shown in FIG. 1, the information processing system according to the embodiment includes a packet capture device 1, an information processing device 2, and a network communication device 3. The network communication device 3 is, for example, a switch having a mirror port, a router having a mirror port, etc., but is not limited to such examples. The switch is, for example, a layer 2 switch or a layer 3 switch.

[0016] The packet capture device 1 is a device that captures the data of packets transmitted and received in the network and stores the data of the captured packets. Hereinafter, the network in which the data of the packets captured by the packet capture device 1 is transmitted and received may be described as a capture target network, and the data of the packets may be described as packet data.

[0017] Packet capture by packet capture device 1 is performed by temporarily storing the packet data in its internal memory, and saving the packet data by packet capture device 1 is performed by writing the packet data to storage in a specific file format. The memory of packet capture device 1 is, for example, RAM (Random Access Memory), and the storage is, for example, flash memory or HDD (Hard Disk Drive). The specific file format is, for example, PCAP format.

[0018] The information processing device 2 captures packet data transmitted and received on the target network up to a set capacity, and saves the captured packet data according to the status of the packet capture device 1. In the information processing device 2, packet data capture is performed by temporarily storing it in its internal memory.

[0019] In the example shown in Figure 1, the information processing device 2 can capture the latest 1500MB of packet data as a configured capacity. The information processing device 2 discards older packet data that was captured before the latest 1500MB of packet data.

[0020] The information processing device 2 is a device that has a backup function to write captured packet data to storage in a specific file format when an error occurs in saving packet data in the packet capture device 1.

[0021] Packet data storage abnormalities in packet capture device 1 include, for example, packet data storage failure abnormalities and packet data storage delay abnormalities. Storage failure abnormalities occur, for example, when the packet capture process of packet capture device 1 terminates abnormally or freezes. Storage delay abnormalities occur, for example, when a burst occurs in the target network.

[0022] First, we will explain the operation of the information processing device 2 when a data storage failure occurs in the packet capture device 1. Figure 2 is a diagram illustrating the operation of the information processing device 2 when a data storage failure occurs in the packet capture device 1 according to this embodiment.

[0023] As shown in Figure 2, if a packet data saving failure occurs in packet capture device 1, the latest save time, which is the time when the captured data was last saved, will not be updated in packet capture device 1. A difference will occur between the latest save time and the current time.

[0024] The information processing device 2 compares the latest saved time of the packet capture device 1 with the current time, and if there is a difference between the latest saved time and the current time, it determines whether the latest saved time has not been updated. In the example shown in Figure 2, the latest saved time has not been updated from "17:00:00". If the information processing device 2 determines that the latest saved time has not been updated, it determines that a saving failure has occurred in the packet capture device 1.

[0025] If the information processing device 2 determines that a data saving failure has occurred in the packet capture device 1, it writes each captured packet data to storage as data in a specific file format. In this way, the information processing device 2 can save packet data if a data saving failure occurs in the packet capture device 1.

[0026] Next, we will explain the operation of the information processing device 2 when a storage delay abnormality occurs in the packet capture device 1. Figure 3 is a diagram illustrating the operation of the information processing device 2 when a storage delay abnormality occurs in the packet capture device 1 according to this embodiment.

[0027] As shown in Figure 3, if a large amount of data is sent and received to the target network in a short period of time, a burst occurs in the target network. In this case, a packet data saving delay anomaly occurs in the packet capture device 1, and a difference arises between the latest saving time, which is the time when the captured data was last saved in the packet capture device 1, and the current time.

[0028] The information processing device 2 calculates the packet amount, which is the total amount of data in packets sent and received per unit time to the target network for capture, and determines whether the packet amount is above a threshold. The information processing device 2 determines that a storage delay anomaly has occurred if the packet amount is above the threshold and there is a difference between the latest storage time and the current time, or if this condition continues.

[0029] If the information processing device 2 determines that a data saving delay has occurred, it writes each captured packet data to storage as data in a specific file format. In this way, the information processing device 2 can save packet data when a data saving delay error occurs in the packet capture device 1. The information processing device 2 will be described in more detail below.

[0030] [Configuration of Information Processing Device 2] Next, an example of the configuration of the information processing device 2 will be described. Figure 4 is a diagram showing an example of the configuration of the information processing device 2 according to the embodiment.

[0031] As shown in Figure 4, the information processing device 2 comprises a communication unit 10, a storage unit 11, and a processing unit 12. The communication unit 10 is connected to the network to be captured and can communicate with each of a plurality of devices, including, for example, a packet capture device 1 and a network communication device 3.

[0032] The memory unit 11 stores various types of information. The memory unit 11 includes a memory 20 and a storage 21. The memory 20 is, for example, RAM such as DRAM (Dynamic Random Access Memory) or SRAM (Static Random Access Memory).

[0033] The storage 21 is, for example, flash memory or an HDD. The storage 21 includes a packet data storage unit 22 and a configuration information storage unit 23. Packet data is written to and stored in the packet data storage unit 22 in a specific file format. The specific file format is, for example, PCAP format, PCAPNG format, but may also be CSV format or JSON format.

[0034] The configuration information storage unit 23 stores configuration information, which is information set by the administrator of the information processing device 2. The configuration information includes, for example, the data storage limit amount UM, period TA, first threshold TH1, second threshold TH2, and third threshold TH3, which will be described later.

[0035] The data storage limit UM is the upper limit of the area in memory 20 that can store packet data, and is an example of the setting capacity described above. The period TA is the period for checking for anomalies. The first threshold TH1 is the time for a preliminary determination of an anomaly. The second threshold TH2 is the number of preliminary determinations required to make a final determination of an anomaly. The third threshold TH3 is the amount of communication at which a burst is determined to have occurred.

[0036] The processing unit 12 includes a reception unit 30, a capture unit 31, an acquisition unit 32, a calculation unit 33, an anomaly determination unit 34, and a storage processing unit 35. The reception unit 30 accepts settings such as the data storage limit UM, the period TA, the first threshold TH1, the second threshold TH2, and the third threshold TH3.

[0037] The data storage limit UM, period TA, first threshold TH1, second threshold TH2, and third threshold TH3 are, for example, information included in the configuration information transmitted from the administrator's terminal device as described above. The receiving unit 30 receives the configuration information, thereby receiving settings such as the data storage limit UM, first threshold TH1, second threshold TH2, and third threshold TH3, and stores the received configuration information in the configuration information storage unit 23.

[0038] Furthermore, the configuration information transmitted from the administrator's terminal device may include information indicating the amount of data transmitted per unit time and the capture time instead of the data storage limit UM. In this case, the result of multiplying the amount of data transmitted per unit time by the capture time is stored in the configuration information storage unit 23 as the data storage limit UM. For example, if the amount of data transmitted per unit time is 100 MB and the capture time is 15 seconds, the data storage limit UM is 1500 MB.

[0039] The capture unit 31 temporarily stores in the memory 20 the data of packets transmitted and received on the target network, up to a preset data storage limit UM.

[0040] For example, the capture unit 31 acquires packets transmitted and received on the target network via the communication unit 10, and temporarily stores the data of the acquired packets in a memory area 20a of the memory 20 that has a pre-set data storage limit UM. The memory area 20a where the packet data is stored by the capture unit 31 is also called a ring buffer.

[0041] The capture unit 31 stores packet data in the storage area 20a up to the data storage limit UM, and then overwrites the oldest packet data with the latest UM packet data, thereby storing packet data in the storage area 20a up to the data storage limit UM.

[0042] If the abnormality detection unit 34 determines that a storage delay abnormality has occurred, the capture unit 31 will not overwrite the packet data in the storage area 20a until the abnormality detection unit 34 resolves the storage delay abnormality. As a result, the capture unit 31 can save the packet data that was temporarily stored in the storage area 20a before the abnormality detection unit 34 determined that a storage delay abnormality had occurred to the storage area 21 without any loss.

[0043] Furthermore, if the abnormality detection unit 34 determines that a data storage stop error has occurred, the capture unit 31 writes the packet data stored in the memory area 20a to the storage 21 via the storage processing unit 35, while continuing to save the packet data to the memory area 20a. This allows the capture unit 31 to capture packet data and the storage processing unit 35 to save the captured data to the storage 21 even after the abnormality detection unit 34 has determined that a data storage stop error has occurred.

[0044] The acquisition unit 32 acquires information including the latest save time of packet data in the packet capture device 1 via the communication unit 10. The acquisition unit 32 acquires information including the most recent creation time among the creation times of each packet data file stored in a specific storage as the latest save time.

[0045] The specific storage is the storage on which packet data is written and saved by the packet capture device 1, and is either the storage of the packet capture device 1 or the storage of a file server (not shown). The packet data file is a file of packet data written to the storage in a specific file format.

[0046] The calculation unit 33 calculates the packet volume MP per unit of time in the target network. The packet volume MP is the total number of packets transmitted and received per unit of time (packets / second) or the total amount of packet data per unit of time (megabytes / second) in the target network. The calculation unit 33 acquires the packet data transmitted and received in the target network via the communication unit 10 and calculates the packet volume MP based on the acquired packet data.

[0047] The anomaly determination unit 34 determines the occurrence of a storage anomaly by the packet capture device 1 based on the latest storage time for which information was acquired by the acquisition unit 32. For example, it determines the occurrence of a storage anomaly based on the time difference, which is the difference between the latest storage time and the current time. The current time is the time measured using the system clock of the information processing device 2, but it may also be the time obtained from current time information acquired from an external device. In the following, the latest storage time may be referred to as latest storage time TC, and the current time may be referred to as current time TR.

[0048] The abnormality determination unit 34 determines that a storage abnormality has occurred by the packet capture device 1, and that multiple types of abnormalities have occurred, including the storage stop abnormality and storage delay abnormality described above. The abnormality determination unit 34 also determines that the storage abnormality by the packet capture device 1 has been resolved.

[0049] As shown in Figure 4, the abnormality determination unit 34 includes a first determination processing unit 40 and a second determination processing unit 41. The first determination processing unit 40 repeatedly determines the time difference ΔT, which is the difference between the latest saved time TC and the current time TR, with a period TA. The period TA is an example of a specific period.

[0050] The first determination processing unit 40 tentatively determines that an abnormality has occurred if the time difference ΔT exceeds the first threshold TH1, and determines that no abnormality has occurred if the time difference ΔT is less than or equal to the first threshold TH1, and repeats this process periodically TA.

[0051] Furthermore, if the first determination processing unit 40 provisionally determines that an abnormality has occurred, it determines whether the previous latest save time TC and the current latest save time TC are the same. Also, if the first determination processing unit 40 provisionally determines that an abnormality has occurred, it determines whether the packet amount MP calculated by the calculation unit 33 exceeds the third threshold TH3.

[0052] The second determination processing unit 41 determines that a storage error has occurred if the time difference ΔT determined by the first determination processing unit 40 exceeds the first threshold TH1 for a period of two or more consecutive times, up to the second threshold TH2.

[0053] For example, the second determination processing unit 41 determines that a save stop error has occurred if the time difference ΔT determined by the first determination processing unit 40 exceeds the first threshold TH1 and the latest save time TC is the same for a period of two consecutive times or more, up to the second threshold TH2.

[0054] Furthermore, the second determination processing unit 41 determines that a storage delay anomaly has occurred if the time difference ΔT exceeds the first threshold TH1 and the packet amount MP exceeds the third threshold TH3 for a continuous period of two or more thresholds.

[0055] Furthermore, after the first determination processing unit 40 has determined that a storage delay anomaly has occurred, the second determination processing unit 41 determines whether or not the storage delay anomaly has been resolved based on the packet volume MP. For example, after the first determination processing unit 40 has determined that a storage delay anomaly has occurred, the second determination processing unit 41 determines that the storage delay anomaly has been resolved if the packet volume MP falls below the third threshold TH3, and determines that the storage delay anomaly has not been resolved otherwise.

[0056] Here, with reference to Figure 5, the determination of the occurrence of a save stop error by the error determination unit 34 will be explained. Figure 5 is a diagram illustrating an example of the save stop error determination process by the error determination unit 34 according to this embodiment. In Figure 5, "Current UNIX Time" indicates the current time TR expressed in UNIX® time, and "Extracted UNIX Timestamp" indicates the latest save time TC. Also in Figure 5, "Time Difference" indicates the time difference ΔT, and "Packets per second on interface en10" indicates the packet volume MP on the captured network. In the example shown in Figure 5, the period TA = 5 (seconds), TH1 = 5 (seconds), and TH3 = 100,000. These are the same in Figures 6 and 7 which will be described later.

[0057] If the current time TR is "1722241241", the time difference ΔT = 4 ≤ TH1 and the packet amount MP = 168 ≤ TH3, so the anomaly detection unit 34 does not determine that a save anomaly has occurred. If 5 seconds have passed since the current time TR was "1722241241" and the current time TR has become "1722241246", the time difference ΔT = 9 > TH1, and the latest save time TC is the same as 5 seconds ago, "1722241237". Therefore, the anomaly detection unit 34 tentatively determines that a save stop anomaly has occurred.

[0058] If the current time TR is "1722241246" and another 5 seconds have passed, resulting in the current time TR being "1722241251", then the time difference ΔT = 14 > TH1, and the latest save time TC is the same as 5 seconds ago, "1722241237". Therefore, the abnormality determination unit 34 tentatively determines that a save stop abnormality has occurred. The abnormality determination unit 34 determines that a save stop abnormality has occurred if the number of times it has made a tentative determination of a save stop abnormality is equal to or greater than the second threshold TH2. In the example shown in Figure 5, the second threshold TH2 = 2.

[0059] Next, with reference to Figure 6, the determination of the occurrence of a save delay abnormality by the abnormality determination unit 34 will be explained. Figure 6 is a diagram illustrating an example of the save delay abnormality determination process by the abnormality determination unit 34 according to the embodiment.

[0060] When the current time TR is "1722241241", the time difference ΔT = 2 ≤ TH1 and the packet size MP = 168 ≤ TH3, so the anomaly detection unit 34 does not determine that a storage anomaly has occurred. When 5 seconds have passed from the state where the current time TR is "1722241241" and the current time TR becomes "1722241246", the time difference ΔT = 6 > TH1 and the packet size MP = 658842 > TH3. Therefore, the anomaly detection unit 34 tentatively determines that there is a storage delay anomaly.

[0061] If the current time TR is "1722241246" and another 5 seconds pass until the current time TR becomes "1722241251", the time difference ΔT = 10 > TH1, and the packet volume MP = 658842 > TH3. Therefore, the anomaly detection unit 34 tentatively determines that there is a storage delay anomaly. The anomaly detection unit 34 determines that a storage delay anomaly has occurred if the number of times it has tentatively determined a storage delay anomaly is equal to or greater than the second threshold TH2. In the example shown in Figure 6, the second threshold TH2 = 2.

[0062] Next, with reference to Figure 7, the determination of whether to resolve a storage delay abnormality after its occurrence by the abnormality determination unit 34 will be explained. Figure 7 is a diagram illustrating an example of the storage delay abnormality resolution determination process by the abnormality determination unit 34 according to this embodiment.

[0063] If the current time TR is "1722241251", the time difference ΔT = 10 and the packet volume MP = 116738 > TH3. After 5 seconds, when the current time TR becomes "1722241256", the time difference ΔT = 10 > TH1, but the packet volume MP = 68 ≤ TH3. Therefore, the anomaly detection unit 34 determines that the storage delay anomaly has been resolved.

[0064] Returning to Figure 4, let's continue the explanation of the processing unit 12. If the abnormality determination unit 34 determines that a storage abnormality has occurred, the storage processing unit 35 causes the packet data temporarily stored in the storage area 20a of the memory 20 to be saved to the packet data storage unit 22 of the storage 21.

[0065] Furthermore, if the storage processing unit 35 determines that a storage stop error has occurred, it will continue to store the packet data stored in the storage area 20a after the abnormality determination unit 34 determined that a storage stop error had occurred, in the packet data storage unit 22 of the storage 21.

[0066] As a result, even if a storage failure occurs in the packet capture device 1, the storage processing unit 35 can continue to save the packet data captured by the capture unit 31 to the storage 21 even after the storage failure occurs in the packet capture device 1.

[0067] Furthermore, if the abnormality determination unit 34 determines that a storage delay abnormality has occurred, or if the abnormality determination unit 34 determines that the storage delay abnormality has been resolved after determining that an abnormality has occurred, the storage processing unit 35 causes the packet data temporarily stored in the storage area 20a of the memory 20 to be saved to the storage 21.

[0068] As a result, when a burst occurs in the network being captured, the storage processing unit 35 can save the packet data captured by the capture unit 31 to the storage 21 without discarding it.

[0069] Furthermore, the storage processing unit 35 can also store the packet data temporarily stored in the storage area 20a in a file server (not shown) instead of the packet data storage unit 22.

[0070] [Information Processing] Next, the procedure for information processing by the processing unit 12 of the information processing device 2 according to the embodiment will be described. Figure 8 is a flowchart showing an example of information processing by the processing unit 12 of the information processing device 2 according to the embodiment.

[0071] As shown in Figure 8, the processing unit 12 of the information processing device 2 determines whether or not it has received the setting information (step S10). If the processing unit 12 determines that it has received the setting information (step S10: Yes), it performs a setting process to store the received setting information in the storage unit 11 (step S11).

[0072] If the processing in step S11 is completed, or if it is determined that no setting information has been received (step S10: No), the processing unit 12 determines whether or not it is time for an abnormality determination (step S12). The abnormality determination timing is the timing that occurs in the periodic TA described above.

[0073] If the processing unit 12 determines that it is time for abnormality detection (step S12: Yes), it performs abnormality detection processing (step S13). The abnormality detection processing in step S13 is the processing shown in steps S20 to S29 in Figure 9, which will be described in detail later.

[0074] If the abnormality detection process in step S13 is completed, the processing unit 12 determines whether or not it has determined that there is a save abnormality in the abnormality detection process (step S14). If the processing unit 12 determines that there is a save abnormality in the abnormality detection process (step S14: Yes), it determines whether or not it is time to save (step S15). The save timing is immediately if the save stop abnormality is determined in the abnormality detection process, and if the save delay abnormality is determined in the abnormality detection process, it is the timing when the processing unit 12 determines that the save delay abnormality has been resolved.

[0075] If the processing unit 12 determines that it is not time to save (step S15: No), it repeats the process in step S15. If the processing unit 12 determines that it is time to save (step S15: Yes), it performs a save operation to write the packet data temporarily stored in the memory area 20a of the memory 20 to the storage 21 (step S16).

[0076] If the processing in step S16 is completed, the processing unit 12 determines whether it is time to terminate operation (step S17) if it has determined that it is not time to determine an abnormality (step S12: No) or if it has determined that there is no saving abnormality (step S14: No). The processing unit 12 determines that it is time to terminate operation, for example, when the power to the information processing device 2 is turned off.

[0077] If the processing unit 12 determines that it is not yet time to terminate the operation (step S17: No), it proceeds to step S10. If it determines that it is time to terminate the operation (step S17: Yes), it terminates the process shown in Figure 8.

[0078] Figure 9 is a flowchart showing an example of an abnormality detection process performed by the processing unit 12 of the information processing device 2 according to this embodiment. In Figure 9, the lowercase letter "t" indicates the current processing time, and the lowercase letter "t-1" indicates the previous processing time. The previous processing time is a time period TA earlier than the current processing time.

[0079] As shown in Figure 9, the processing unit 12 processes the time difference ΔT t Determine whether or not the first threshold TH1 is ≤ (step S20). Time difference ΔT t The current time TR t From the latest saved time TC t This is the value obtained by subtracting the time difference ΔT. Processing unit 12 t If it is determined that the first threshold TH1 is not ≤ (Step S20: No), the time difference ΔT t = Time difference ΔT t-1 Determine whether or not this is the case (step S21). Time difference ΔT t= Time difference ΔT t-1 The determination of whether it is or not is the determination of whether the time difference ΔT between the previous time and the current time is the same or not.

[0080] The processing unit 12 is the time difference ΔT t = Time difference ΔT t-1 When it is determined that it is (step S21: Yes), the count value CA1 is incremented to CA1 = CA1 + 1 (step S22). The processing unit 12 determines whether the count value CA1 ≥ the second threshold value TH2 (step S23). When the processing unit 12 determines that the count value CA1 ≥ the second threshold value TH2 (step S23: Yes), it determines the save stop abnormality of the packet capture device 1 (step S24).

[0081] When the processing in step S24 is completed, when it is determined that the count value CA1 is not ≥ the second threshold value TH2 (step S23: No), or when it is determined that the time difference ΔT t = Time difference ΔT t-1 is not (step S21: No), it determines whether the packet quantity MP t exceeds the third threshold value TH3 (step S25).

[0082] The processing unit 12 is the packet quantity MP t When it is determined that it exceeds the third threshold value TH3 (step S25: Yes), the count value CA2 is incremented to CA2 = CA2 + 1 (step S26). The processing unit 12 determines whether the count value CA2 ≥ the second threshold value TH2 (step S27). When the processing unit 12 determines that the count value CA2 ≥ the second threshold value TH2 (step S27: Yes), it determines the save delay abnormality of the packet capture device 1 (step S28).

[0083] The processing unit 12 is the packet quantity MP tIf it is determined that the third threshold TH3 is not exceeded (step S25: No), it is determined that an unexplained delay has occurred (step S29). The processing unit 12 performs the following actions when the processing in step S29 is completed, when the processing in step S28 is completed, when it is determined that the count value CA2 ≥ the second threshold TH2 (step S27: No), or when the time difference ΔT t If it is determined that the value is less than or equal to the first threshold TH1 (Step S20: Yes), the process shown in Figure 9 is terminated.

[0084] [Differentiation] In the example described above, the abnormality determination unit 34 determines a storage stop abnormality when the count value CA1 is equal to the second threshold TH2, and determines a storage delay abnormality when the count value CA2 is equal to the second threshold TH2, but is not limited to this example. For example, the second threshold TH2 may include a second threshold TH2-1 and a second threshold TH2-2. The second threshold TH2-1 and the second threshold TH2-2 can be different values ​​from each other. In this case, the abnormality determination unit 34 can determine a storage stop abnormality when the count value CA1 is equal to the second threshold TH2-1, and determine a storage delay abnormality when the count value CA2 is equal to the second threshold TH2-2.

[0085] Furthermore, the abnormality detection unit 34 can also determine a save stop abnormality without using the time difference Δ, which is the difference between the latest save time TC and the current time TR. For example, without determining the time difference ΔT, the abnormality detection unit 34 can determine that a save stop abnormality has occurred if the state in which the latest save time TC is the same time continues for two or more consecutive times, up to the second threshold TH2.

[0086] Furthermore, in the example described above, the abnormality determination unit 34 determines whether a storage delay abnormality has occurred without comparing the previous latest storage time TC with the current latest storage time TC, but the example is not limited to this. For example, the second determination processing unit 41 can also determine that a storage delay abnormality has occurred if the latest storage time TC is not the same time. For example, the second determination processing unit 41 can also determine that a storage delay abnormality has occurred if the time difference ΔT exceeds the first threshold TH1, but the latest storage time TC is not the same time, and the packet amount MP exceeds the third threshold TH3, and this condition persists for two or more consecutive times, up to the second threshold TH2.

[0087] Furthermore, if the abnormality detection unit 34 simultaneously determines that a save stop abnormality has occurred and a save delay abnormality has occurred, the capture unit 31 will not overwrite the packet data in the storage area 20a until the save delay abnormality is resolved by the abnormality detection unit 34. In this case, if the save processing unit 35 determines that the save delay abnormality has been resolved after the abnormality detection unit 34 has determined that a save delay abnormality has occurred, it will cause the storage processing unit 35 to save the packet data temporarily stored in the storage area 20a of the memory 20 to the storage 21.

[0088] Furthermore, the processing unit 12 can also function as an analysis unit that analyzes packet data stored in the packet capture device 1 and packet data stored in the storage unit 11.

[0089] [Effects of the Embodiment] As described above, the information processing device 2 according to this embodiment comprises a capture unit 31, an acquisition unit 32, an anomaly determination unit 34, and a storage processing unit 35. The capture unit 31 temporarily stores data of packets transmitted and received over the network, up to a preset data storage limit UM, in the memory 20. The acquisition unit 32 acquires information including the latest storage time TC of the packet data in the packet capture device 1, which stores the data of packets transmitted and received over the network. The anomaly determination unit 34 determines that a storage anomaly has occurred in the packet capture device 1 based on the latest storage time TC. If the anomaly determination unit 34 determines that a storage anomaly has occurred, the storage processing unit 35 causes the packet data temporarily stored in the memory 20 to be saved in the storage 21. As a result, the information processing device 2 can save packet data when a storage stop anomaly occurs in the packet capture device 1, which is an anomaly in which the packet data saving process stops.

[0090] Furthermore, the anomaly detection unit determines the occurrence of a storage anomaly based on the time difference ΔT, which is the difference between the latest storage time TC and the current time TR. This allows the information processing device 2 to more accurately determine any storage stop anomalies in the packet capture device 1.

[0091] Furthermore, the abnormality determination unit 34 includes a first determination processing unit 40 that periodically determines whether the time difference ΔT, which is the difference between the latest storage time TC and the current time TR, exceeds a first threshold TH1, and a second determination processing unit 41 that determines that a storage abnormality has occurred if the state in which the time difference ΔT exceeds the first threshold TH1 continues for a second threshold TH2 or more. As a result, the information processing device 2 can accurately determine storage stop abnormalities, which are abnormalities in which the packet data storage process is stopped in the packet capture device 1, and storage delay abnormalities, which are abnormalities in which the packet data storage process is delayed.

[0092] Furthermore, the second determination processing unit 41 determines that a storage error has occurred if the time difference ΔT exceeds the first threshold TH1 and the latest storage time TC is the same for a period of two consecutive times or more, exceeding the second threshold TH2. This allows the information processing device 2 to accurately determine storage stop errors in the packet capture device 1.

[0093] Furthermore, the information processing device 2 according to this embodiment includes a calculation unit 33 that calculates the packet volume MP per unit time in the network. The first determination processing unit 40 determines whether the packet volume MP is equal to or greater than the third threshold TH3 using a periodic TA. The second determination processing unit 41 determines that a storage error has occurred if the time difference ΔT exceeds the first threshold TH1 and the packet volume MP exceeds the third threshold for a period of two thresholds or more. As a result, the information processing device 2 can accurately determine storage delay errors in the packet capture device 1.

[0094] Furthermore, the information processing device 2 according to this embodiment includes a reception unit 30 that accepts settings for the data storage upper limit UM, period TA, first threshold TH1, second threshold TH2, and third threshold TH3. This allows the administrator of the information processing device 2 to make settings based on the communication status of the network to be captured, and to accurately determine any storage abnormalities in the packet capture device 1.

[0095] Furthermore, after determining the occurrence of a storage error, the anomaly detection unit 34 determines whether the storage error has been resolved based on the packet amount MP. If the storage error has been resolved after the anomaly detection unit 34 has determined that a storage error has occurred, the storage processing unit 35 causes the packet data temporarily stored in the memory 20 to be saved to the storage 21. As a result, the information processing device 2 can accurately save packet data from before the time the storage delay error was determined when a storage delay error occurred in the packet capture device 1.

[0096] [System configuration, etc.] Furthermore, the components of each part shown in the diagram are functional concepts and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown in the diagram, and all or part of them can be functionally or physically distributed and integrated in any unit according to various loads and usage conditions. Moreover, each processing function performed by each device can be implemented, in whole or in any part, by a CPU and the program executed on that CPU, or by hardware using wired logic.

[0097] Furthermore, among the processes described in the embodiments above, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0098] [program] It is also possible to create a program that describes the processing performed by the information processing device 2 according to the above embodiment in a language that can be executed by a computer. In one embodiment, the information processing device 2 can be implemented by installing the information processing program that performs the above information processing as packaged software or online software on a desired computer. For example, by having the information processing device execute the above information processing program, the information processing device can be made to function as the information processing device 2. The information processing device referred to here is a general-purpose computer, but is not limited to this example, and may be a general-purpose server (for example, an on-premise server or a cloud server), or any other computer.

[0099] Figure 10 shows an example of a computer that executes an information processing program. Computer 1000 includes, for example, memory 1010, a CPU 1020, a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0100] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1031. The disk drive interface 1040 is connected to the disk drive 1041. A removable storage medium, such as a magnetic disk or optical disk, is inserted into the disk drive 1041. A serial port interface 1050 is connected to, for example, a mouse 1051 and a keyboard 1052. A video adapter 1060 is connected to, for example, a display 1061.

[0101] Here, the hard disk drive 1031 stores, for example, the OS 1091, the application program 1092, the program module 1093, and the program data 1094. The information described in the above embodiment is stored, for example, in the hard disk drive 1031 or the memory 1010.

[0102] Furthermore, the information processing program is stored in the hard disk drive 1031 as a program module 1093 containing instructions to be executed by the computer 1000, for example. Specifically, the program module 1093 containing instructions for each process executed by the information processing device 2 described in the above embodiment is stored in the hard disk drive 1031.

[0103] Furthermore, the data used for information processing by the information processing program is stored as program data 1094, for example, in the hard disk drive 1031. The CPU 1020 then reads the program module 1093 and program data 1094 stored in the hard disk drive 1031 into the RAM 1012 as needed and executes the procedures described above.

[0104] Furthermore, the program module 1093 and program data 1094 related to the information processing program are not limited to being stored on the hard disk drive 1031; for example, they may be stored on a removable storage medium and read by the CPU 1020 via a disk drive 1041 or the like. Alternatively, the program module 1093 and program data 1094 related to the information processing program may be stored on another computer connected via a network such as a LAN or WAN and read by the CPU 1020 via a network interface 1070.

[0105] Although embodiments applying the invention made by the present inventors have been described above, the present invention is not limited by the descriptions and drawings that constitute part of the disclosure of the present invention in this embodiment. That is, all other embodiments, examples, and operational techniques made by those skilled in the art based on this embodiment are included in the scope of the present invention. [Explanation of Symbols]

[0106] 1. Packet capture device 2. Information Processing Device 3. Network communication device 10 Communications Department 11 Storage section 12 Processing Units 20 memory 20a storage area 21 Storage 22 Packet data storage unit 23. Configuration Information Storage Unit 30 Reception Department 31 Capture section 32 Acquisition Department 33 Calculation Section 34 Abnormality determination section 35 Storage Processing Unit 40 First Determination Processing Unit 41 Second Determination Processing Unit

Claims

1. A capture unit that temporarily stores data from past packets up to a predetermined data storage limit in memory, which are data from packets sent and received over the network. An acquisition unit that acquires information including the latest storage time of the packet data in a packet capture device that stores the data of packets transmitted and received on the network, An anomaly determination unit determines the occurrence of a storage anomaly by the packet capture device based on the latest storage time, The system includes a storage processing unit that, when the abnormality detection unit determines that the storage abnormality has occurred, causes the packet data temporarily stored in the memory to be saved to storage. An information processing device characterized by the following:

2. The abnormality determination unit, Based on the time difference, which is the difference between the most recent save time and the current time, the occurrence of the save error is determined. The information processing apparatus according to feature 1.

3. The abnormality determination unit, A first determination processing unit that determines at specific intervals whether the aforementioned time difference exceeds a first threshold, The system includes a second determination processing unit that determines that a storage abnormality has occurred when the state in which the time difference exceeds the first threshold continues for a second threshold or longer. The information processing apparatus according to feature 2.

4. The second determination processing unit is: If the aforementioned time difference exceeds the first threshold and the latest save time is the same for a period of two or more consecutive times, it is determined that a save error has occurred. The information processing apparatus according to feature 3.

5. The network includes a calculation unit that calculates the amount of packets per unit of time, The first determination processing unit, The amount of packets is determined at the specified period to be equal to or greater than the third threshold. The second determination processing unit is: If the time difference exceeds the first threshold and the packet quantity exceeds the third threshold for a period of two or more consecutive times, it is determined that a storage anomaly has occurred. The information processing apparatus according to claim 3.

6. The abnormality determination unit, After determining the occurrence of the storage anomaly, it is determined whether the storage anomaly has been resolved based on the packet volume. The aforementioned storage processing unit is If the storage error has been determined to have been resolved after the error detection unit has determined that the storage error has occurred, the data of the packets temporarily stored in the memory will be saved to the storage. The information processing apparatus according to any one of claims 1 to 5.

7. A method of information processing performed by a computer, A capture process that temporarily stores data from past packets up to a predetermined data storage limit in memory, which are data from packets sent and received over a network. A step of acquiring information including the latest storage time of the packet data in a packet capture device that stores the data of packets transmitted and received on the network, An anomaly determination step is performed to determine the occurrence of a storage anomaly by the packet capture device based on the latest storage time, If the abnormality determination step determines that the storage abnormality has occurred, the process includes a storage processing step that causes the packet data temporarily stored in the memory to be saved to storage. An information processing method characterized by the following:

8. A capture procedure for temporarily storing data from past packets transmitted and received over a network, up to a predetermined data storage limit, in memory, A procedure for obtaining information including the latest storage time of packet data in a packet capture device that stores data of packets transmitted and received on the aforementioned network, An anomaly determination procedure for determining the occurrence of a storage anomaly by the packet capture device based on the latest storage time, If the aforementioned abnormality detection procedure determines that the storage abnormality has occurred, the computer is instructed to execute a storage processing procedure that causes the packet data temporarily stored in the memory to be saved to storage. An information processing program characterized by the following features.

Images