Information processing device, generation method, and generation program

Abstract

To visualize the flow of communication data sent and received between network devices.SOLUTION: An information processing device 100 acquires, from a plurality of network devices included in a network, statistical information in which time-series data of the number of packets transmitted / received by each network device to / from other network devices is associated with each port. The information processing device 100 executes, for each of the plurality of network devices, processing of selecting a candidate port group including one or more ports from among a plurality of ports included in the same network device, and an aggregation port indicating a port other than the candidate port group from among the plurality of ports on the basis of the statistical information, and determining whether data is transferred from the aggregation port to the candidate port group on the basis of the similarity between first time-series data that integrates time-series data contained in the candidate port group and second time-series data of the aggregation port. The information processing device 100 generates screen information that visualizes data movement via the plurality of network devices included in the network on the basis of the determination result.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to an information processing device and the like. [Background technology]

[0002] Information systems have evolved from the centralized architecture of the mainframe era to a distributed architecture through open systems, with various devices and services connected via networks. However, as information systems have evolved to a distributed architecture, communication data (packets) sent and received between devices must travel complex routes to reach the destination device, which can result in unpredictable communication failures.

[0003] In the case of unpredictable communication failures, network devices (routers, L2 switches, L3 switches, etc.) often cannot automatically detect and notify of errors.

[0004] For this reason, when a problem such as a communications failure occurs, maintenance workers check the set of physically connected network devices, and perform tasks such as unplugging and plugging in the network cables connected to the connection ports of the network devices, as well as restarting or replacing network devices suspected of being the source of the communications failure. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2004-356915 A Summary of the Invention [Problem to be solved by the invention]

[0006] However, with the conventional technology described above, when a problem such as a communication failure occurs, it is often the case that a device other than the one the maintenance worker recognized as the cause of the communication failure is actually involved, and it takes a lot of time to determine the cause.

[0007] For example, in the case of a problem as described above where it is difficult to pinpoint the location of the fault, if it is possible to visualize all of the communication data flowing through the network from a bird's-eye view, maintenance workers can use this visualized information to efficiently pinpoint the cause of the problem.

[0008] In one aspect, the present invention has an object to provide an information processing device, a generation method, and a generation program capable of visualizing the flow of communication data transmitted and received between each network device. [Means for solving the problem]

[0009] In the first proposal, the information processing device includes an acquisition unit, a determination unit, and a generation unit. The acquisition unit acquires statistical information from a plurality of network devices included in the network, in which time series data of the number of packets transmitted and received by each network device between other network devices is associated with each port. The determination unit selects a candidate port group including one or more ports among a plurality of ports included in the same network device and an aggregated port indicating a port other than the candidate port group among the plurality of ports based on the statistical information, and executes a process for determining whether data is moving from the aggregated port to the candidate port group based on a similarity between first time series data obtained by integrating the time series data included in the candidate port group and second time series data of the aggregated port, for each of the plurality of network devices. The generation unit generates screen information that visualizes the movement of data passing through a plurality of network devices included in the network based on the determination result of the determination unit. Effect of the Invention

[0010] It is possible to visualize the flow of communication data sent and received between each network device. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a diagram illustrating an example of a system according to the present embodiment. [Diagram 2]FIG. 2 is a diagram (1) for explaining the processing of the information processing device according to the present embodiment. [Diagram 3] FIG. 3 is a diagram (2) for explaining the process of the information processing device according to the present embodiment. [Figure 4] FIG. 4 is a diagram (3) for explaining the process of the information processing device according to the present embodiment. [Diagram 5] FIG. 5 is a diagram (4) for explaining the process of the information processing device according to the present embodiment. [Figure 6] FIG. 6 is a diagram (5) for explaining the process of the information processing device according to the present embodiment. [Figure 7] FIG. 7 is a functional block diagram illustrating a configuration of an information processing device according to the present embodiment. [Figure 8] FIG. 8 is a diagram illustrating an example of a data structure of the statistical information table. [Figure 9] FIG. 9 illustrates an example of the data structure of the physical connection list. [Figure 10] FIG. 10 is a diagram illustrating an example of the data structure of the routing list. [Figure 11] FIG. 11 is a diagram (1) showing an example of screen information generated by the generating unit. [Figure 12] FIG. 12 is a diagram showing an example of screen information generated by the generating unit. [Figure 13] FIG. 13 is a diagram showing an example of screen information generated by the generation unit (3). [Figure 14] FIG. 14 is a flowchart showing the processing procedure of the information processing device. [Figure 15] FIG. 15 is a diagram illustrating an example of a hardware configuration of a computer that realizes the same functions as the information processing apparatus of the embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an information processing device, a generating method, and a generating program disclosed in the present application will be described in detail with reference to the accompanying drawings. Note that the present invention is not limited to the embodiments. EXAMPLES

[0013] Fig. 1 is a diagram showing an example of a system according to the present embodiment. As shown in Fig. 1, the system 1 includes an information processing device 100 and network devices 10a, 10b, 10c, 10d, 10e, 10f, 10g, and 10h. Here, a case will be described in which the system 1 includes the network devices 10a to 10h, but the system 1 may also include other network devices. In the following description, the network devices 10a to 10h will be collectively referred to as network device 10.

[0014] The network device 10 is a communication device that relays packets transmitted and received over two or more different networks. The network device 10 corresponds to a router, an L2 switch, an L3 switch, a repeater hub, etc. The network device 10 has a plurality of connection ports, and is physically connected to other network devices 10 by a network cable or the like. Although not shown in the figure, each network includes a plurality of computers, and the network device 10 relays packets transmitted from these computers.

[0015] Furthermore, the network device 10 is connected to the information processing device 100. When the network device 10 receives a request for statistical information from the information processing device 100 by SNMP (Simple Network Management Protocol), which is a standard network protocol, the network device 10 transmits the statistical information to the information processing device 100.

[0016] The statistical information is time-series data indicating the relationship between time and the number of packets transmitted (or received) by the network device 10. More specifically, the statistical information includes the IP (Internet Protocol) of the network device 10, information identifying each connection port, and information distinguishing whether the connection port is a transmitting-side connection port or a receiving-side connection port, and time-series data is set for each connection port.

[0017] The information processing device 100 acquires statistical information from the network device 10 by SNMP or the like. The information processing device 100 executes, for each network device 10, a process for determining the data flow between each connection port in the same network device 10 based on the statistical information, thereby identifying the flow of data (packets) on the system 1 and performing a process for visualizing the data flow.

[0018] 2 to 6 are diagrams (1) for explaining the processing of an information processing device according to this embodiment. FIG. 2 will be explained. In FIG. 2, the explanation will be given using a network device 10a as an example. The network device 10a has connection ports s1-1, s1-2, s1-3, and s1-4 on the transmitting side, and connection ports r1-1, r1-2, r1-3, and r1-4 on the receiving side.

[0019] The information processing device 100 identifies the time series data of each of the connection ports s1-1 to s1-4 and r1-1 to r1-4 based on the statistical information received from the network device 10a. The number of each connection port indicates the number of packets received (sent) by the connection port in a certain time period (for example, 10 minutes).

[0020] The information processing device 100 selects a candidate port group including one or more connection ports from among the transmission side connection ports s1-1 to s1-4, and one connection port (aggregation port) from among the reception side connection ports r1-1 to r1-4. The information processing device 100 calculates a correlation coefficient between first time series data obtained by integrating the time series data of the candidate port group and second time series data of the aggregation port.

[0021] The information processing device 100 repeatedly executes the above process while changing the combination of connection ports included in the candidate port group and the connection port to be set as the aggregated port, and identifies the combination of the candidate port group and the aggregated port that maximizes the correlation coefficient.

[0022] For example, when the correlation coefficient between the candidate ports consisting of connection ports s1-1, s1-2, and s1-3 and the aggregated port (connection port r1-4) is maximum, the information processing device 100 determines that the packet received at connection port r1-4 has been output to connection ports s1-1, s1-2, and s1-3, respectively.

[0023] On the other hand, the information processing device 100 selects a candidate port group including one or more connection ports from among the receiving side connection ports r1-1 to r1-4, and one connection port (aggregation port) from among the transmitting side connection ports s1-1 to s1-4. The information processing device 100 calculates a correlation coefficient between first time series data obtained by integrating the time series data of the candidate port group and second time series data of the aggregation port.

[0024] The information processing device 100 repeatedly executes the above process by changing the combination of connection ports included in the candidate port group and the connection port to be set as the aggregated port, and identifies the combination of the candidate port group and the aggregated port that maximizes the correlation coefficient.

[0025] For example, when the correlation coefficient between the candidate ports consisting of connection ports r1-1, r1-2, and r1-3 and the aggregated port (connection port s1-4) is maximum, the information processing device 100 determines that packets received at connection ports r1-1, r1-2, and r1-3 have been output to connection port s1-4.

[0026] The information processing device 100 executes the process described with reference to FIG. 1 for each of the network devices 10 other than the network device 10a, thereby identifying the data flow.

[0027] We now move on to the description of Fig. 3. In the example shown in Fig. 3, the description will be given using network devices 10a, 10b, and 10c. Similar to Fig. 2, the network device 10a has transmitting side connection ports s1-1, s1-2, s1-3, and s1-4, and receiving side connection ports r1-1, r1-2, r1-3, and r1-4.

[0028] The network device 10b has transmitting side connection ports s2-1, s2-2, s2-3, and s2-4, and receiving side connection ports r2-1, r2-2, r2-3, and r2-4. The network device 10c has transmitting side connection ports s3-1, s3-2, and s3-3, and receiving side connection ports r3-1, r3-2, r3-3, and r3-4.

[0029] Here, the information processing device 100 holds a physical connection list showing the connection relationship of each connection port, and is capable of identifying the connection relationship of each physical connection. For example, it is assumed that the connection port s1-4 of the network device 10a and the connection port r2-2 of the network device 10b are connected to each other by a physical connection. It is assumed that the connection port r1-4 of the network device 10a and the connection port s2-2 of the network device 10b are connected to each other by a physical connection.

[0030] It is assumed that the connection port s2-4 of the network device 10b and the connection port r3-4 of the network device 10c are connected to each other by a physical wire. It is assumed that the connection port r2-4 of the network device 10b and the connection port s3-3 of the network device 10c are connected to each other by a physical wire.

[0031] Furthermore, packets arriving at connection ports s1-1, s1-2, and s1-3 of the network device 10a are output to each terminal device. For example, connection port s1-2 is connected to terminal device x1. Furthermore, connection ports r1-1, r1-2, and r1-3 of the network device 10a accept packets from each terminal device. For example, connection port r1-2 is connected to terminal device x2. Connection port r3-2 of the network device 10c serves as a connection port for an external network.

[0032] The flow of data from an external network to a terminal device is called downstream. When identifying the downstream data flow, the information processing device 100 performs processing to identify a pair of a candidate port group with the maximum correlation coefficient and an aggregated port, in order from the network device 10 on the terminal device side (in the opposite direction to the data flow).

[0033] On the other hand, the flow of data from the terminal device to the external network is called the upstream. When identifying the upstream data flow, the information processing device 100 performs a process of identifying a pair of a candidate port group with the maximum correlation coefficient and an aggregated port, in order from the network device 10 on the terminal device side (in the same direction as the data flow).

[0034] We now move on to the description of Fig. 4. In Fig. 4, a case will be described in which the information processing device 100 specifies the downstream data flow. The information processing device 100 selects the network device 10a that is closest to the terminal device x1. It is assumed that the connection port s1-2 is connected to the terminal device x1. The information processing device 100 selects a candidate port group including one or more connection ports from among the transmission side connection ports s1-1 to s1-4, and one connection port (aggregated port) from among the reception side connection ports r1-1 to r1-4.

[0035] When the correlation coefficient between the first time series data of the candidate ports consisting of connection ports s1-1, s1-2, and s1-3 (time series data obtained by integrating each time series data of the group of candidate ports) and the second time series data of the aggregated port (connection port r1-4) is maximum, the information processing device 100 determines that the packet received at connection port r1-4 was output to connection ports s1-1, s1-2, and s1-3, respectively. As a result, the information processing device 100 identifies the data flow "connection port r1-4 → connection port s1-2 → terminal device x1."

[0036] The information processing device 100 selects the network device 10b that is next closest to the terminal device x1 after the network device 10a. The information processing device 100 selects a candidate port group including one or more connection ports from among the transmission side connection ports s2-1 to s2-4, and one connection port (aggregated port) from among the reception side connection ports r2-1 to r2-4. The aggregated port is in the physical connection list, and the opposing network device and port are uniquely determined.

[0037] When the correlation coefficient between the first time series data of the candidate ports consisting of connection ports s2-1, s2-2, and s2-3 and the second time series data of the aggregated port (connection port r2-4) is maximum, the information processing device 100 determines that the packet received at connection port r2-4 has been output to connection ports s2-1, s2-2, and s2-3, respectively. In addition, since connection port r1-4 and connection port s2-2 are connected by a physical wire, the information processing device 100 specifies the data flow as "connection port r2-4 → connection port s2-2 → connection port r1-4 → connection port s1-2 → terminal device x1."

[0038] The information processing device 100 selects the network device 10c, which is next closest to the terminal device x1 after the network device 10b. The information processing device 100 selects a candidate port group including one or more connection ports from among the transmission side connection ports s3-1 to s3-4, and one connection port (aggregated port) from among the reception side connection ports r3-1 to r3-4.

[0039] When the correlation coefficient between the first time series data of the candidate port consisting of the connection port s3-3 and the second time series data of the aggregated port (connection port r3-2) is maximum, the information processing device 100 determines that the packet received at the connection port r3-2 has been output to the connection port s3-3. In addition, since the connection port r2-4 and the connection port s3-3 are connected by a physical line, the information processing device 100 specifies the data flow "connection port r3-2 → connection port s3-3 → connection port r2-4 → connection port s2-2 → connection port r1-4 → connection port s1-2 → terminal device x1". Since the connection port s3-3 is the connection port connected to the external network, the information processing device 100 ends the process of specifying the downstream data flow.

[0040] We now move on to the description of Fig. 5. In Fig. 5, a case will be described in which the information processing device 100 specifies the flow of upstream data. The information processing device 100 selects the network device 10a that is closest to the terminal device x2. It is assumed that the connection port r1-2 is connected to the terminal device x2. The information processing device 100 selects a candidate port group including one or more connection ports from among the receiving side connection ports r1-1 to r1-4, and one connection port (aggregated port) from among the transmitting side connection ports s1-1 to s1-4.

[0041] When the correlation coefficient between the first time series data (time series data obtained by integrating the time series data of the candidate port group) of the connection ports r1-1, r1-2, and r1-3 and the second time series data of the aggregated port (connection port s1-4) is maximum, the information processing device 100 determines that the packets received at the connection ports r1-1, r1-2, and r1-3 have been output to the connection port s1-4, respectively. As a result, the information processing device 100 identifies the data flow "terminal device x2 → connection port r1-2 → connection port s1-4."

[0042] The information processing device 100 selects the network device 10b that is next closest to the terminal device x2 after the network device 10a. The information processing device 100 selects a candidate port group including one or more connection ports from among the receiving side connection ports r2-1 to r2-4, and one connection port (aggregated port) from among the transmitting side connection ports s2-1 to s2-4.

[0043] When the correlation coefficient between the first time series data of the candidate ports consisting of the connection ports r2-1, r2-2, and r2-3 and the second time series data of the aggregated port (connection port s2-4) is maximum, the information processing device 100 determines that the packets received at the connection ports r2-1, r2-2, and r2-3 have been output to the connection port s2-4, respectively. In addition, since the connection port s1-4 and the connection port r2-2 are connected by a physical wire, the information processing device 100 specifies the data flow as "terminal device x2 → connection port r1-2 → connection port s1-4 → connection port r2-2 → connection port s2-4."

[0044] The information processing device 100 selects the network device 10c, which is next closest to the terminal device x2 after the network device 10b. The information processing device 100 selects a candidate port group including one or more connection ports from among the receiving side connection ports r3-1 to r3-4, and one connection port (aggregated port) from among the transmitting side connection ports s3-1 to s3-3.

[0045] When the correlation coefficient between the first time series data of the candidate port consisting of the connection port r3-4 and the second time series data of the aggregated port (connection port r3-2) is maximum, the information processing device 100 determines that the packet received at the connection port r3-4 has been output to the connection port s3-2. In addition, since the connection port s2-4 and the connection port r3-4 are connected by a physical wire, the information processing device 100 specifies the data flow as "terminal device x2 → connection port r1-2 → connection port s1-4 → connection port r2-2 → connection port s2-4 → connection port r3-4 → connection port s3-2".

[0046] Incidentally, when a line is made redundant, the information processing device 100 treats multiple redundant connection ports as a single connection port, identifies a pair of a candidate port group with the maximum correlation coefficient and an aggregated port, and then identifies a pair of a candidate port with the maximum correlation coefficient and an aggregated port for each redundant connection port.

[0047] The following is an explanation of Fig. 6. In the example shown in Fig. 6, the connection port of the network device 10b r2-1 and connection port s3-1 of network 10c are connected by a physical wire, and connection port r2-4 of network 10b and connection port s3-3 of network 10c are connected by a physical wire, thereby providing redundancy. Since network device 10a and network device 10b are not provided with redundancy, a description of the process of identifying pairs of candidate port groups and aggregated ports in network device 10a will be omitted.

[0048] To explain using the network device 10b, the information processing device 100 sets the redundant connection ports r2-1 and r2-4 out of the connection ports r2-1, r2-2, r2-3, and r2-4 as one connection port R2. The information processing device 100 selects one connection port (aggregated port) out of a candidate port group including one or more connection ports out of the transmission side connection ports s2-1 to s2-4 and the reception side connection ports R2, r2-2, and r2-3. The time series data of the connection port R2 is time series data obtained by integrating the time series data of the connection ports r2-1 and r2-4.

[0049] When the correlation coefficient between the first time series data of the candidate ports consisting of connection ports s2-1, s2-2, and s2-3 and the second time series data of the aggregated port (connection port R2) is maximum, the information processing device 100 determines that the packet received at connection port R2 has been output to connection ports s2-1, s2-2, and s2-3, respectively.

[0050] Next, the information processing device 100 selects one connection port (aggregated port) from a candidate port group including one or more connection ports from the narrowed-down connection ports s2-1 to s2-3 and from connection ports r2-1 and r2-4 constituting the connection port R2.

[0051] Regarding the correlation coefficient between the second time series data of connection port r2-1 and each of the first time series data of connection ports s2-1 to s2-3, if the correlation coefficient between the first time series data of connection port s2-1 and the second time series data of connection port r2-1 is maximum, the information processing device 100 determines that the packet received at connection port r2-1 has been output to connection port s2-1.

[0052] Regarding the correlation coefficient between the second time series data of connection port r2-4 and each of the first time series data of connection ports s2-1 to s2-3, if the correlation coefficient between the first time series data of connection port s2-2 and the second time series data of connection port r2-4 is maximum, the information processing device 100 determines that the packet received at connection port r2-4 has been output to connection port s2-2.

[0053] To explain using the network device 10c, the information processing device 100 sets the redundant connection ports s3-1 and s3-3 out of the connection ports s2-1, s3-2, and s3-3 as one connection port S3. The information processing device 100 selects one connection port (aggregated port) out of a candidate port group including one or more connection ports out of the transmission side connection ports S3 and s3-2, and the reception side connection ports r3-1, r3-2, r3-3, and r3-4. The time series data of the connection port S3 is time series data obtained by integrating the time series data of the connection ports s3-1 and s3-3.

[0054] If the correlation coefficient between the first time series data of the candidate ports consisting of connection ports S3 and s2 and the second time series data of the aggregated port (connection port r3-2) is maximum, the information processing device 100 determines that the packet received at connection port r3-2 has been output to connection port S2.

[0055] Furthermore, since the connection port S3 includes the connection ports s3-1 and s3-3, the information processing device 100 determines that the packet received at the connection port r3-2 has been output to each of the connection ports s3-1 and s3-3.

[0056] By executing the process shown in Figure 6, the information processing device 100 identifies the data flow "connection port r3-2 → connection port s3-3 → connection port r2-4 → connection port s2-2 → connection port r1-4 → connection port s1-2 → terminal device x1" and "connection port r3-2 → connection port s3-1 → connection port r2-1 → connection port s2-1."

[0057] As described in Figures 2 to 6, the information processing device 100 of this embodiment can identify the data flow on the system 1 and visualize the data flow by executing, for each network device 10, a process of determining the data flow between each connection port within the same network device 10 based on statistical information.

[0058] Next, an example of the configuration of the information processing device 100 according to this embodiment will be described. Fig. 7 is a functional block diagram showing the configuration of the information processing device according to this embodiment. As shown in Fig. 7, this information processing device 100 has a communication unit 110, an input unit 120, a display unit 130, a storage unit 140, and a control unit 150.

[0059] The communication unit 110 is connected to the network device 10 by wire or wirelessly, and transmits and receives information to and from the network device 10. For example, the communication unit 110 is realized by a NIC (Network Interface Card) or the like.

[0060] The input unit 120 is an input device for inputting various types of information, and corresponds to a keyboard, a mouse, a touch panel, or the like.

[0061] The display unit 130 is a display device that displays information output from the control unit 150. The display unit 130 corresponds to a liquid crystal display, an organic EL (Electro Luminescence) display, a touch panel, or the like.

[0062] The storage unit 140 includes a statistical information table 141, a physical connection list 142, and a routing list 143. The storage unit 140 is realized by, for example, a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0063] The statistical information table 141 is a table that holds statistical information acquired from the network device 10. Fig. 8 is a diagram showing an example of the data structure of the statistical information table. In Fig. 8, a time period during which the number of packets is counted is set in an area 141a of the statistical information table 141. For example, the number of packets is counted every 10 minutes.

[0064] In the area 141b, the IP address of the network device 10, information for identifying the connection port, and information for specifying whether the connection port is a sending connection port or a receiving connection port are set. If the connection port is a sending port, "send" is set, and if the connection port is a receiving port, "recpt" is set.

[0065] As an example, the statistical information set in the areas 141b-1 and 141b-2 will be described, and a description of the statistical information other than the areas 141b-1 and 141b-2 will be omitted.

[0066] The statistical information in the area 141b-1 indicates the relationship between the number of packets received by the connection port (receiving side) "GigabitEthernet1-0-24" of the network device 10 having the IP address "192.111.10.252" and time. For example, it indicates that the number of packets received by the connection port (receiving side) "GigabitEthernet1-0-24" during the 10 minutes from 0:00 to 0:10 on August 21, 2019 is "1623." Explanations of the number of packets in other time periods related to the statistical information in the area 141b-1 are omitted.

[0067] The statistical information in the area 141b-2 indicates the relationship between the number of packets transmitted from the connection port (transmission side) "GigabitEthernet1-0-22" of the network device 10 having the IP address "192.111.10.252" and time. For example, it indicates that the number of packets transmitted from the connection port (transmission side) "GigabitEthernet1-0-22" during the 10 minutes from 0:00 to 0:10 on August 21, 2019 is "66." Explanations of the number of packets in other time periods related to the statistical information in the area 141b-2 are omitted.

[0068] The physical connection list 142 is a list showing the relationship between the connection ports of the network devices 10 connected by physical connections. Fig. 9 is a diagram showing an example of the data structure of the physical connection list. As shown in Fig. 9, the physical connection list 142 has an item number, a sending side IP, a sending side connection port, a receiving side IP, and a receiving side connection port.

[0069] The item number is a number that distinguishes each record in the physical connection list 142. A number is assigned to each record registered in the physical connection list 142 in ascending order.

[0070] The sending side connection port indicates a connection port from which the network device 10 sends packets. The sending side IP indicates the IP address of the network device 10 having the sending side connection port. The same network device 10 may have multiple sending side connection ports.

[0071] The receiver connection port indicates a connection port through which the network device 10 receives packets. The receiver IP indicates the IP address of the network device 10 having the receiver connection port. The same network device 10 may have multiple receiver connection ports.

[0072] For example, item number "0" indicates that the sending side connection port "GigabitEthernet1-0-24" of the network device 10 with IP address "192.111.10.252" is connected to the receiving side connection port "GigabitEthernet1-0-24" of the network device 10 with IP address "192.111.10.252" by a physical wire. Explanations of the other item numbers will be omitted.

[0073] The routing list 143 is a list that holds information about the flow of data. Fig. 10 is a diagram showing an example of the data structure of the routing list. As shown in Fig. 10, the routing list 143 has an item number, a data flow, and a type.

[0074] The item number is a number that distinguishes each record in the routing list 143. A number is assigned to each record registered in the routing list 143 in ascending order. The data flow indicates the data flow explained in Figs. 4 to 6 etc. The type indicates whether the data flow is downstream or upstream. The data flow from an external network to a terminal device is downstream (down). On the other hand, the data flow from a terminal device to an external network is upstream (up).

[0075] For example, for item number "0" downstream, the data flow is "192.111.10.5_EthernetPort(ether13)_recpt → 192.111.10.5_EthernetPort(ether17)_send → 192.111.10.253_GigabitEthernet1-1-1_recpt → 192.111.10.253_GigabitEthernet2-1-1_send → 192.111.12.5_EthernetPort(ether21)_recpt → 192.111.12.5_EthernetPort(ether24)_send → 192.111.12.6_EthernetPort(ether9)_recpt → 192.111.12.6_EthernetPort(ether8)_send → x1."

[0076] To explain a portion of the above data flow, "192.111.10.5_EthernetPort(ether13)_recpt->192.111.10.5_EthernetPort(ether17)_send" indicates that data is flowing from the receiving side (recpt) connection port "EthernetPort(ether13)" of the network device 10 with IP address "192.111.10.5" to the sending side (send) connection port "EthernetPort(ether17)" of the network device 10 with IP address "192.111.10.5".

[0077] Returning to the description of Fig. 7, the control unit 150 includes an acquisition unit 151, a determination unit 152, and a generation unit 153. The control unit 150 is realized by, for example, a central processing unit (CPU) or a micro processing unit (MPU). The control unit 150 may also be executed by, for example, an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA).

[0078] The acquiring unit 151 uses SNMP to acquire statistical information from the network device 10. The acquiring unit 151 registers the acquired statistical information in the statistical information table 141.

[0079] The determination unit 152 identifies the data flow by executing, for each network device 10, a process for determining the data flow between each connection port in the same network device 10 based on the statistical information in the statistical information table 141. The determination unit 152 corresponds to the process described with reference to Figs. 2 to 6.

[0080] The determination unit 152 selects one network device 10, and selects a candidate port group including one or more connection ports among the multiple connection ports included in the selected network device 10, and one connection port other than the candidate port group among the multiple connection ports as an aggregated port. In addition, if the candidate port group is a connection port on the transmitting side, the aggregated port becomes a connection port on the receiving side. In case the candidate port group is a connection port on the receiving side, the aggregated port becomes a connection port on the transmitting side.

[0081] The determination unit 152 generates first time series data by integrating the time series data of each connection port included in the candidate port group. The determination unit 152 calculates the correlation coefficient between the first time series data of the candidate port group and the second time series data of the aggregated port. For example, the determination unit 152 calculates the correlation coefficient ρ based on equation (1). In equation (1), cov(X,Y) indicates covariance, and the number of packets (time series data) in each time period to be compared is input to the variables "X" and "Y". σ X ,σ Y indicates standard deviation.

[0082]

number

[0083] The determination unit 152 calculates a correlation coefficient between the first time series data and the second time series data while changing the combination of connection ports included in the candidate port group and the connection port to be set as the aggregated port in the selected network device 10, and determines the combination of connection ports included in the candidate port group that maximizes the correlation coefficient and the connection port to be set as the aggregated port.

[0084] The determination unit 152 updates the data flow based on the determination result and the physical connection list 142. For example, a description will be given using the network device 10a in FIG. 4. It is assumed that the correlation coefficient between the first time series data of the candidate port group (connection ports s1-1, s1-2, s1-3) and the second time series data of the aggregated port (connection port r1-4) is maximized, the terminal device x1 is connected to the connection port s1-2, and a physical connection is connected to the aggregated port (connection port r1-4). In this case, the determination unit 152 generates a data flow "connection port r1-4 → connection port s1-2 → terminal device x1".

[0085] When generating a data flow for downstream, the determination unit 152 selects the network devices 10 in order (opposite the data flow) from the network device 10 closest to the terminal device x1, and repeats the above process to determine the data flow and update the entire data flow. When the aggregated port becomes a connection port connected to an external network, the determination unit 152 ends the process and registers the data flow information in the routing list 143. The process of generating a data flow for downstream by the determination unit 152 corresponds to the contents described in FIG. 4.

[0086] When generating a data flow for upstream, the determination unit 152 selects the network devices 10 in order (in the same direction as the data flow) starting from the network device 10 closest to the terminal device x2, and repeats the above process to determine the data flow and update the entire data flow. When the aggregated port becomes a connection port connected to an external network, the determination unit 152 ends the process and registers the data flow information in the routing list 143. The process of generating a data flow for upstream by the determination unit 152 corresponds to the contents described in FIG. 5.

[0087] For the redundant network devices 10, the determination unit 152 executes the process described in FIG. 6 based on the physical connection list 142 to identify a pair of the candidate port group with the maximum correlation coefficient and the aggregated port, and determines the data flow.

[0088] For example, the determination unit 152 treats multiple redundant connection ports as one connection port (hereinafter, an integrated port) and calculates the correlation coefficient between the first time series data of the candidate port group and the second time series data of the aggregated port. If the integrated port is included in the candidate port group with the largest correlation coefficient, the integrated port is restored to the original individual connection ports, and the data flow is determined based on the correlation coefficient between the first time series data of each connection port included in the candidate port group and the second time series data of the aggregated port.

[0089] 6, the redundant connection ports r2-1 and r2-4 are regarded as one connection port (integrated port) R2 among the connection ports r2-1, r2-2, r2-3, and r2-4. The determination unit 152 selects one connection port (aggregated port) from a candidate port group including one or more connection ports among the transmission side connection ports s2-1 to s2-4 and the reception side connection ports R2, r2-2, and r2-3. The time series data of the connection port R2 is time series data obtained by integrating the time series data of the connection ports r2-1 and r2-4.

[0090] If the correlation coefficient between the first time series data of the candidate ports consisting of connection ports s2-1, s2-2, and s2-3 and the second time series data of the aggregated port (connection port R2) is maximum, the judgment unit 152 judges that the packet received at connection port R2 has been output to each of the connection ports s2-1, s2-2, and s2-3.

[0091] Next, the determining unit 152 selects a candidate port group including one or more connection ports from the narrowed-down connection ports s2-1 to s2-3, and one connection port (aggregated port) from the connection ports r2-1 and r2-4 constituting the connection port R2.

[0092] Regarding the correlation coefficient between the second time series data of connection port r2-1 and each of the first time series data of connection ports s2-1 to s2-3, if the correlation coefficient between the first time series data of connection port s2-1 and the second time series data of connection port r2-1 is maximum, the judgment unit 152 judges that the packet received at connection port r2-1 has been output to connection port s2-1.

[0093] Regarding the correlation coefficient between the second time series data of connection port r2-4 and each of the first time series data of connection ports s2-1 to s2-3, if the correlation coefficient between the first time series data of connection port s2-2 and the second time series data of connection port r2-4 is maximum, the judgment unit 152 judges that the packet received at connection port r2-4 has been output to connection port s2-2.

[0094] By executing the above process, the determination unit 152 determines each data flow and registers information on each data flow in the routing list 143. The determination unit 152 may also generate data flows for each time period using statistical information for different time periods. For example, the determination unit 152 may generate a data flow based on statistical information for late night (0:00 to 9:00), a data flow based on statistical information for business hours (9:00 to 18:00), and a data flow based on statistical information for the evening (18:00 to 24:00), and register them in the routing list 143.

[0095] Furthermore, the determining unit 152 may perform the above process in order of the network devices 10 with the fewest ports connected to the physical connections, based on the physical connection list 142.

[0096] The generation unit 153 generates screen information that visualizes the flow of data passing through each network device included in the system 1, based on the data flow registered in the routing list 143. The generation unit 153 may output the generated screen information to the display unit 130 for display, or may transmit the screen information to an external device.

[0097] 11 to 13 are diagrams showing an example of screen information generated by the generation unit. FIG. 11 shows screen information of a data flow based on statistical information for late night (0:00 to 9:00). In screen information 30, data flows 31, 32, 33, 34, and 35 are shown. In the explanation of FIGS. 11 to 13, for the sake of convenience, a network device 10 with an IP address "****" is represented as a network device "****". It is also assumed that information on departments connected to each network device 10, information on terminal devices, external networks, and connection relationships with backup servers are defined in advance.

[0098] A data flow 31 passes through the network device "192.111.10.5", the network device "192.111.10.253", the network device "192.111.10.252", and the network device "192.111.11.5" in this order.

[0099] A data flow 32 passes through the network device "192.111.10.5", the network device "192.111.10.253", and the network device "192.111.11.5" in this order.

[0100] A data flow 33 passes through the network device "192.111.10.5", the network device "192.111.10.253", the network device "192.111.12.5", and the network device "192.111.12.6" in that order.

[0101] A data flow 34 passes through the network device "192.111.11.5", the network device "192.111.10.252", the network device "192.111.10.253", and the network device "192.111.13.5" in this order.

[0102] A data flow 35 passes through the network device "192.111.10.7", the network device "192.111.10.5", the network device "192.111.10.253", the network device "192.111.12.5", and the network device "192.111.16.5" in this order.

[0103] For example, by referring to screen information 30, a maintenance worker can determine that network device "192.111.11.5" in the sales and accounting network communicates with network device "192.111.10.5" that processes sales information from external branches in batches, and further that this sales information is shared with network switch "192.111.13.5" in the technical department.

[0104] Furthermore, by referring to screen information 30, the maintenance worker can confirm that data is being transferred from the information systems department's network device "192.111.10.7" to a group of subordinate backup servers.

[0105] 12 shows screen information of a data flow based on statistical information during a business period (9:00 to 18:00). In screen information 40, data flows 41, 42, 43, 44, and 45 are displayed.

[0106] A data flow 41 passes through the network device "192.111.10.5", the network device "192.111.10.253", and the network device "192.111.11.5" in this order.

[0107] A data flow 42 passes through the network device "192.111.10.5", the network device "192.111.10.253", and the network device "192.111.12.5" in this order.

[0108] A data flow 43 passes through the network device "192.111.10.5", the network device "192.111.10.253", the network device "192.111.12.5", and the network device "192.111.12.6" in this order.

[0109] A data flow 44 passes through the network device "192.111.10.5", the network device "192.111.10.253", the network device "192.111.12.5", and the network device "192.111.16.5" in this order.

[0110] A data flow 45 passes through the network device "192.111.13.5", the network device "192.111.10.253", the network device "192.111.10.252", and the network device "192.111.11.5" in this order.

[0111] A data flow 46 passes through the network device "192.111.10.5" and then the network device "192.111.10.7."

[0112] For example, by referring to the screen information 40, a maintenance worker can identify that during the business period "9:00 to 18:00", communications are occurring mainly from network devices corresponding to technology, manufacturing, and warehouses from external networks connected to the Internet, each branch office, and the cloud. In addition, the worker can confirm that there is a lot of communications due to human movement, such as a lot of communications from executives' terminal devices to the information systems department.

[0113] 13 shows screen information of a data flow based on statistical information in the evening (18:00 to 24:00). In screen information 50, data flows 51 and 52 are shown.

[0114] A data flow 51 passes through the network device "192.111.10.5" and then the network device "192.111.10.7".

[0115] A data flow 52 passes through the network device "192.111.12.6" and then the network device "192.111.16.5."

[0116] For example, by referring to screen information 50, a maintenance worker can confirm that during the overtime hours of 18:00 to 24:00, there is communication from the external network to the information systems department's business server, and communication of inventory information from the manufacturing department's machine group to the warehouse.

[0117] 11 to 13, the case where the screen information of the data flow based on the statistical information for each predetermined period is generated is described, but the present invention is not limited to this. For example, the information processing device 100 can generate the screen information of the real-time data flow by shortening the collection period of the statistical information.

[0118] Next, an example of a processing procedure of the information processing device 100 according to the present embodiment will be described. Fig. 14 is a flowchart showing the processing procedure of the information processing device. As shown in Fig. 14, the determination unit 152 of the information processing device 100 specifies the tracking direction depending on whether it is from downstream or upstream (step S101).

[0119] The determination unit 152 sorts the network devices 10 in ascending order of the number of connection ports connected to the physical connections based on the physical connection list 142 (step S102). Of the unselected network devices, the determination unit 152 preferentially selects a network device with a smaller number of connection ports connected to the physical connections (step S103).

[0120] The determination unit 152 selects the aggregated port and a group of candidate ports (step S104). If the aggregated port does not exist in the physical connection list 142 (step S105, No), the determination unit 152 adds the aggregated port as an egress port to the routing list 143 (step S106), and proceeds to step S111.

[0121] On the other hand, if the aggregated port exists in the physical connection list 142 (Yes at step S105), the determination unit 152 proceeds to step S107. If the aggregated port has a redundant configuration, the determination unit 152 integrates the time series data of each aggregated port (step S107).

[0122] The determining unit 152 determines a combination of the aggregated port and the candidate port group that maximizes the correlation coefficient based on the correlation coefficient between the time series data of the aggregated port and the time series data of the candidate port group (step S108).

[0123] The determination unit 152 updates the routing list 143 based on the determined combination of the aggregated port and the candidate port group (step S109). When the aggregated port has a redundant configuration, the determination unit 152 identifies an optimal combination of the aggregated port and the candidate port group for each aggregated port, and updates the routing list 143 (step S110).

[0124] If there is an unselected network device 10 (Yes at step S111), the determination unit 152 proceeds to step S103. On the other hand, if there is no unselected network device (No at step S111), the determination unit 152 proceeds to step S112.

[0125] The generating unit 153 of the information processing device 100 generates screen information based on the routing list 143 (step S112). The generating unit 153 causes the generated screen information to be displayed on the display unit 130 (step S113).

[0126] Next, the effect of the information processing device 100 according to the present embodiment will be described. The information processing device 100 acquires statistical information from the network device 10 by SNMP or the like. Based on the statistical information, the information processing device 100 specifies a combination of the candidate port group and the aggregated port that maximizes the correlation coefficient while changing the combination of connection ports included in the candidate port group in the same network device 10 and the connection port to be set as the aggregated port, and executes a process for determining the data flow between each connection port for each network device 10, thereby specifying the flow of data (packets) on the system 1, and generating and displaying screen information showing the data flow. This makes it possible to visualize the flow of communication data transmitted and received between each network device.

[0127] When multiple ports are made redundant, the information processing device 100 treats the multiple redundant connection ports as one connection port (hereinafter, "integrated port") and calculates the correlation coefficient between the first time series data of the candidate port group and the second time series data of the aggregated port. When the integrated port is included in the candidate port group with the largest correlation coefficient, the information processing device 100 returns the integrated port to the original individual connection ports and determines the data flow based on the correlation coefficient of each time series data. This makes it possible to identify the data flow even when multiple ports are made redundant.

[0128] Although the information processing device 100 according to this embodiment uses an existing physical connection list 142, the physical connection list 142 may be generated based on the statistical information table 141. For example, the information processing device 100 calculates a correlation coefficient (correlation coefficient between network devices 10) based on the number of packets transmitted and received by each network device 10 in each time period, and determines that a pair of network devices 10 with a correlation coefficient equal to or greater than a threshold value are connected to each other by a physical connection.

[0129] Next, an example of a hardware configuration of a computer that realizes the same functions as the information processing device 100 described in the above embodiment will be described. Fig. 15 is a diagram showing an example of a hardware configuration of a computer that realizes the same functions as the information processing device of the embodiment.

[0130] 15, the computer 200 includes a CPU 201 that executes various arithmetic processes, an input device 202 that accepts data input from a user, and a display 203. The computer 200 also includes a communication device 204 that transmits and receives data to and from external devices, etc., via a wired or wireless network, and an interface device 205. The computer 200 also includes a RAM 206 that temporarily stores various information, and a hard disk device 207. The devices 201 to 207 are connected to a bus 208.

[0131] The hard disk device 207 includes an acquisition program 207a, a determination program 207b, and a generation program 207c. The CPU 201 reads out each of the programs 207a to 207c and develops them in the RAM 206.

[0132] The acquisition program 207a functions as an acquisition process 206a. The determination program 207b functions as a determination process 206b. The generation program 207c functions as a generation process 206c.

[0133] The processing of the acquisition process 206a corresponds to the processing of the acquisition unit 151. The processing of the determination process 206b corresponds to the processing of the determination unit 152. The processing of the generation process 206c corresponds to the processing of the generation unit 153.

[0134] It is not necessary that each of the programs 207a to 207c is stored in the hard disk device 207 from the beginning. For example, each of the programs may be stored in a "portable physical medium" such as a flexible disk (FD), CD-ROM, DVD, magneto-optical disk, or IC card that is inserted into the computer 200. Then, the computer 200 may read and execute each of the programs 207a to 207c. [Explanation of symbols]

[0135] 100 Information processing device 110 Communications Department 120 Input section 130 Display section 140 Storage section 141 Statistics Table 142 Physical wiring list 143 Routing List 150 Control section 151 Acquisition Department 152 Judgment section 153 Generation part

Claims

1. an acquisition unit that acquires statistical information from a plurality of network devices included in the network, the statistical information being associated with each port with time series data of the number of packets transmitted / received by each network device between the other network devices; a determination unit that, based on the statistical information for different time periods, selects a candidate port group including one or more ports out of a plurality of ports included in the same network device, and an aggregated port indicating a port other than the candidate port group out of the plurality of ports, and executes, for each of the plurality of network devices, a process of determining whether or not data is moving from the aggregated port to the candidate port group based on a similarity between first time series data obtained by integrating time series data included in the candidate port group and second time series data of the aggregated port, and when the aggregated port of the second time series data having the greatest similarity to the first time series data is a plurality of redundant ports, further calculates a similarity between the time series data of the ports included in the candidate port group and the time series data of the plurality of redundant ports, thereby determining a data flow from the plurality of redundant ports to the ports included in the candidate port group; a generation unit that generates screen information that visualizes data movement through a plurality of network devices included in the network for each different time period based on the judgment results for each different time period by the judgment unit; 13. An information processing device comprising:

2. 2. The information processing device according to claim 1, wherein the determination unit calculates a similarity between first time series data and second time series data of the aggregated port while changing a combination of ports included in the candidate port group and a port to be set as the aggregated port, and identifies a combination of ports included in the candidate port group that has the greatest similarity and a port to be set as the aggregated port.

3. 2. The information processing device according to claim 1, wherein, when a plurality of ports are made redundant, the determination unit calculates the similarity between the first time series data and the second time series data by treating the redundant ports as one port.

4. 1. A computer-implemented generation method comprising: Acquire statistical information from multiple network devices included in the network, in which time series data on the number of packets transmitted and received by each network device between other network devices is associated with each port; a process of selecting a candidate port group including one or more ports among a plurality of ports included in a single network device and an aggregated port indicating a port among the plurality of ports other than the candidate port group based on the statistical information for different time periods, and determining whether data is moving from the aggregated port to the candidate port group based on a similarity between first time series data obtained by integrating time series data included in the candidate port group and second time series data of the aggregated port, for each of the plurality of network devices; when the aggregate port of the second time series data having the greatest similarity to the first time series data is a plurality of redundant ports, a similarity between the time series data of the port included in the group of candidate ports and the time series data of the plurality of redundant ports is further calculated to determine a data flow from the plurality of redundant ports to the port included in the group of candidate ports; Based on the determination results for each different time period, screen information is generated that visualizes the movement of data passing through a plurality of network devices included in the network for each different time period. A generating method comprising:

5. On the computer, Acquire statistical information from multiple network devices included in the network, in which time series data on the number of packets transmitted and received by each network device between other network devices is associated with each port; a process of selecting a candidate port group including one or more ports among a plurality of ports included in a single network device and an aggregated port indicating a port among the plurality of ports other than the candidate port group based on the statistical information for different time periods, and determining whether data is moving from the aggregated port to the candidate port group based on a similarity between first time series data obtained by integrating time series data included in the candidate port group and second time series data of the aggregated port, for each of the plurality of network devices; when the aggregate port of the second time series data having the greatest similarity to the first time series data is a plurality of redundant ports, a similarity between the time series data of the port included in the group of candidate ports and the time series data of the plurality of redundant ports is further calculated to determine a data flow from the plurality of redundant ports to the port included in the group of candidate ports; Based on the determination results for each different time period, screen information is generated that visualizes the movement of data passing through a plurality of network devices included in the network for each different time period. A generating program for executing a process.

Images