Traffic analysis device, traffic analysis method, and traffic analysis program

Abstract

This traffic analysis device (1) comprises: a traffic emulator (13) for mirroring each element of traffic in a real network system (2) at the present time of day into a virtual space and executing protocol control of each element of the traffic in the virtual space to thereby calculate the status of the traffic in the real network system (2) at the next time of day; and an analysis exclusion unit (14) for excluding, from the calculation object of the traffic emulator (13) with respect to each element of mirrored traffic, any traffic for which the calculation result of the traffic emulator (13) is predicted not to be obtainable by the next time of day.

Description

[Technical field]

[0001] The present invention relates to a traffic analysis device, a traffic analysis method, and a traffic analysis program. [Background technology]

[0002] A technology for predicting future traffic volume has been proposed. For example, Patent Document 1 describes a communication bandwidth calculation device that predicts future user traffic volume and calculates the bandwidth facility amount required for communication services. This improves the economic efficiency of communication service providers by calculating the facility amount of communication resources that is neither excessive nor insufficient. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] JP 2020-150524 A Summary of the Invention [Problem to be solved by the invention]

[0004] We consider the application of technology for predicting future traffic volume to the detection of unauthorized communications. For the detection of unauthorized communications, traffic emulation, which predicts individual traffic flows in detail, is more effective than the rough prediction of traffic volume as in Patent Document 1. The traffic emulator mimics (mirrors) in a virtual space the various traffic flows in a real network at the current time (t) and predicts (ideal) traffic conditions that conform to the protocol regulations in the virtual space at the next time (t+1) using the various traffic flows at the current time (t) as a starting point.

[0005] The current time (t) is the target time at which the real network is observed, and the next time (t+1) is the target time at which the real network is observed the next time after the current time. The traffic emulator can detect user traffic that violates the protocol rules by comparing the ideal traffic state at the next time with the user traffic state in the real world at the next time.

[0006] However, the amount of traffic flowing through a large-capacity backbone network is huge, at 10 Gbps or 100 Gbps per wavelength, and the number of traffic flows that the traffic emulator must calculate is also huge. Therefore, the shorter the calculation interval from the current time (t) to the next time (t+1) is (for example, every 10 seconds), the more the traffic emulator is required to have extremely high (real-time) calculation capabilities.

[0007] Therefore, no matter how accurately the traffic emulator can calculate a huge amount of traffic, if the calculation is not completed in time for the next time (t+1), the calculation result cannot be applied to detect unauthorized communications. Incidentally, in conventional traffic volume prediction technologies such as that described in Patent Document 1, there were no such strict constraints on calculation time, and therefore no consideration had been given to reducing the calculation costs for traffic for which calculation results could not be obtained by the next time.

[0008] Therefore, a main object of the present invention is to appropriately reduce the calculation cost when predicting the traffic state at the next time (t+1) from the traffic state at the current time (t). [Means for solving the problem]

[0009] In order to solve the above problems, a traffic analysis device of the present invention has the following features. The present invention relates to a traffic emulator that calculates the state of traffic on a real network system at a next time by mirroring each traffic on the real network system at a current time in a virtual space and executing protocol control of each traffic in the virtual space; and a calculation exclusion unit that excludes, for each mirrored traffic, traffic for which it is predicted that the calculation result of the traffic emulator will not be obtained by the next time from the calculation target of the traffic emulator. Effect of the Invention

[0010] According to the present invention, it is possible to appropriately reduce the calculation cost when predicting the traffic state at the next time (t+1) from the traffic state at the current time (t). [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a configuration diagram of a traffic analysis device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a hardware configuration diagram of the traffic analysis device according to the present embodiment. [Diagram 3] FIG. 2 is an explanatory diagram showing an overview of the processing of the traffic analysis device according to the present embodiment. [Figure 4] FIG. 4 is a sequence diagram showing the processing of the traffic analysis device according to the present embodiment. [Diagram 5] 1 is a comparison table for asserting the effect of the traffic analysis device according to the present embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described in detail with reference to the drawings.

[0013] FIG. 1 is a diagram showing the configuration of a traffic analysis device 1. The traffic analysis device 1 includes a calculation time determination unit 11 , a traffic model management unit 12 , a traffic emulator 13 , an analysis exclusion unit 14 , and a traffic comparison unit 15 . The real network system 2 is an actual network system to be analyzed by the traffic analysis device 1 .

[0014] The traffic emulator 13 mirrors each traffic on the real network system 2 at the current time (t) in a virtual space and executes protocol control of each traffic in the virtual space, thereby calculating the traffic state on the real network system 2 at the next time (t+1).

[0015] The calculation time determination unit 11 (calculation exclusion unit) determines whether or not the calculation result can be obtained by the next time based on the calculation time of the traffic emulator 13 from when the mirrored traffic at the current time is input to the traffic emulator 13 to when the traffic state at the next time is output. The calculation time determination unit 11 outputs the determination result to the analysis and exclusion unit 14. The analysis exclusion unit 14 (calculation exclusion unit) excludes from the calculation target of the traffic emulator 13, for each traffic mirrored from the real network system 2, traffic for which the calculation result of the traffic emulator 13 is not predicted to be obtained by the next time.

[0016] The analysis exclusion unit 14 determines the traffic to be excluded from the calculation target by, for example, any one of the following methods. (Method 1: Advance Estimation) The amount of processing required to execute protocol control for each traffic in virtual space and the processing capacity of the computer on which the traffic emulator 13 runs are referenced to estimate the expected time required for the calculations of the traffic emulator 13, and traffic whose future time exceeds the next time by the estimated time from the current time is excluded from the calculations of the traffic emulator 13. (Method 2: Checking the progress during calculation) Based on the progress of the traffic state calculated by the traffic emulator 13 up to now and the remaining time from the present to the next time, traffic for which the calculation results of the traffic emulator 13 are not predicted to be obtained by the next time is excluded from the calculation targets of the traffic emulator 13.

[0017] The traffic model management unit 12 manages, as a traffic model, control information defined in the protocol for the traffic emulator 13 to execute protocol control of each traffic in a virtual space. The traffic emulator 13 reads out a traffic model for each traffic protocol from the traffic model management unit 12 and uses it to calculate the traffic state. If the state of traffic on the real network system 2 at the next time does not satisfy the operation prescribed by the protocol of that traffic, the traffic comparison unit 15 notifies the real network system 2 of the non-satisfied traffic as abnormal traffic.

[0018] FIG. 2 is a diagram showing the hardware configuration of the traffic analysis device 1. As shown in FIG. The traffic analysis device 1 is configured as a computer 900 having a CPU 901 , a RAM 902 , a ROM 903 , a HDD 904 , a communication I / F 905 , an input / output I / F 906 , and a media I / F 907 . The communication I / F 905 is connected to an external communication device 915. The input / output I / F 906 is connected to an input / output device 916. The media I / F 907 reads and writes data from a recording medium 917. Furthermore, the CPU 901 controls each processing unit by executing a program (also called an application or its abbreviation, an app) loaded into the RAM 902. This program can be distributed via a communication line, or can be recorded on a recording medium 917 such as a CD-ROM and distributed.

[0019] FIG. 3 is an explanatory diagram showing an overview of the process of the traffic analysis device 1. As shown in FIG. A state 101 is a bar graph showing the expected time required for the calculation of each of the four traffic streams VA, VB, VC, and VD mirrored by the traffic emulator 13 at the current time (t). It is predicted at the current time (t) that the traffic VA and VB will be able to be calculated in time for the next time (t+1), but the traffic VC and VD will not be able to be calculated in time for the next time (t+1).

[0020] A state 102 shows the calculation time of the traffic VA, VB, and VC in the form of a bar graph. Here, the calculation time determination unit 11 has determined that the traffic VCs and VDs that cannot be calculated in time in the state 101 are candidates to be excluded from future calculation targets. The analysis exclusion unit 14 has excluded the traffic VDs with low priority from the calculation targets while leaving the traffic VCs with high priority as calculation targets. Therefore, in state 102, the calculation of the traffic VD is suspended and the available spare calculation capacity is allocated to the traffic VC, so that the calculation of the traffic VC is completed earlier than expected (at the time of the wavy vertical line). In this way, the traffic analysis device 1 can increase the amount of traffic that can be calculated in time for the next time (t+1) by early excluding a part of the mirrored traffic from the calculation target.

[0021] FIG. 4 is a sequence diagram showing the process of the traffic analysis device 1. As shown in FIG. In S101, the traffic emulator 13 receives real traffic (or information indicating the state thereof) at the current time from the real network system 2, and notifies the analysis and exclusion unit 14 of the real traffic as a candidate for the exclusion process in S106.

[0022] In S102a, the traffic emulator 13 acquires the protocol operation contents of the actual traffic at the next time from the traffic model management unit 12 using the protocol information of the actual traffic at the current time received in S101 as a search key. In S102b, the traffic comparison unit 15 acquires information for defining the protocol operation content acquired in S102a (protocol defining information) from the traffic model management unit 12 for the abnormality determination process in S112.

[0023] The traffic emulator 13 calculates the traffic state at the next time from the traffic state at the current time by simulating in a virtual space the protocol operation for each traffic flow on the real network system 2. This calculation process transitions in the order of calculation start in S103a → calculation in progress in S103b → calculation completion in S103c. At the start of the calculation in S103a, the traffic emulator 13 mirrors the actual traffic at the current time notified in S101 onto the virtual space. After that, the traffic emulator 13 starts a calculation to transition each traffic in the virtual space to the traffic state at the next time when the network conditions in the virtual space are changed, by reflecting the protocol operation contents acquired in S102a.

[0024] At the start of calculation in S103a, the traffic emulator 13 estimates the expected time for calculating the traffic state of each traffic at the next time. This estimation process is, for example, (expected time)=(amount of calculation required to reflect the protocol operation contents from the current time to the next time)÷(computational capacity of the computer on which the traffic emulator 13 operates), and the computational capacity of the computer is obtained from the number of CPU cores, clock speed, etc. The end point of the predicted time is the time when the calculation in S103c is completed. The start point of the predicted time may be the time when the actual traffic at the current time is received in S101, or may be the calculation start time in S103a.

[0025] In S104, the traffic emulator 13 notifies the calculation time determination unit 11 of the estimated expected time for each traffic. In S105a, the calculation time determination unit 11 determines whether the time in the future from the current time (t) by the predicted time of S104 has exceeded the next time (t+1) using the determination formula "current time (t) + predicted time < next time (t+1)". In other words, for traffic determined in S105a to have exceeded the next time (t+1), it is predicted in advance that the traffic emulator 13 will not be able to complete the calculation by the next time (t+1).

[0026] In S105b, the calculation time determination unit 11 notifies the analysis exclusion unit 14 of the traffic for which the calculation cannot be completed in time (Yes in S105a) as a candidate for exclusion from the calculation target of the traffic emulator 13, that is, exclusion candidate traffic.

[0027] In S106, the analysis exclusion unit 14 decides to exclude some or all of the exclusion candidate traffic notified in S105b from the calculation target of the traffic emulator 13. Here, the analysis exclusion unit 14 may use the following method for determining whether or not to actually exclude traffic from the calculation target and in what order to interrupt the calculation of the excluded traffic. (Exclusion method 1) The priority at the next time point is determined in advance for each terminal that sends or receives traffic, and the traffic of a terminal with a lower priority is more likely to be excluded from calculation, or the calculation of traffic is interrupted in order of decreasing priority.

[0028] (Exclusion method 2) The traffic state calculated up to now is compared with the protocol specification information of S102b, and if traffic that does not match the protocol specification information (that is, traffic that does not operate in accordance with the protocol specification or that operates in a manner that does not operate in accordance with the protocol specification) is found, it is made more likely to be excluded from the calculation, or traffic calculation is interrupted in early order.

[0029] (Exclusion method 3) The less progress the traffic state has made up to now, the more likely it is to be excluded from the calculation, or the calculation of traffic is interrupted in the order of progress. For example, if the state that can be calculated up to the next time is 100%, traffic A that has been calculated 20% is excluded first, and traffic A that has been calculated 60% is excluded last.

[0030] In S107, the analysis exclusion unit 14 notifies the traffic emulator 13 of an instruction to exclude the traffic determined in S106 from the calculation target. The traffic emulator 13 interrupts (or forcibly terminates) the calculation of the traffic that has been excluded in S107 from the traffic being calculated in S103b. This allows the excess computing power of the computer on which the traffic emulator 13 is running to be utilized for calculating other traffic that has not been excluded, thereby increasing the number of traffic flows whose calculations are completed by the next time (S103c).

[0031] In S105a, the calculation time determination unit 11 determines whether the time until the next time has elapsed based on the expected time estimated before the traffic calculation. On the other hand, instead of S105a, the calculation time determination unit 11 may determine whether the time until the next time has elapsed by comparing the progress degree of the traffic state calculated up to now with the remaining time until the next time.

[0032] For example, assume that the current time (t) = 10:00, the next time (t+1) = 10:10, and the current time during calculation = 10:05 (50% progress). The calculation of traffic A is at a progress rate of 75%. The calculation is being carried out at a faster pace than the current time (50% progress), and it is expected that the calculation will be completed by the next time of 10:10 if it continues at this rate. Therefore, the calculation time determination unit 11 determines not to exclude the calculation of traffic A (No in S105a). The calculation of traffic B is at a progress rate of 25%. The calculation is lagging behind at a slower pace than the current time (50% progress). Therefore, even if the calculation is continued as is, it is predicted that it will not be completed by the next time of 10:10, and the calculation time determination unit 11 determines to exclude the calculation of traffic B (Yes in S105a).

[0033] In S108, the traffic emulator 13 notifies the traffic comparison unit 15 of the virtual traffic in the virtual space at the next time when the calculation is completed (Yes in S103c). As described above, each of the processes from S101 to S108 is executed during the period from the current time (t) to the next time (t+1). Below, S111 and onwards are processes that are executed from the next time (t+1) onwards.

[0034] In S111, when the traffic comparison unit 15 receives the actual traffic at the next time (t+1) from the real network system 2, the traffic comparison unit 15 compares the actual traffic with the virtual traffic at the next time received in S108. If the comparison results in a mismatch, the traffic comparison unit 15 considers the actual traffic at the next time (t+1) to be abnormal traffic.

[0035] In S112, the traffic comparison unit 15 determines whether or not the following abnormality exists as a result of comparing both traffics in S111. The following is an example of protocol specification information for TCP (Transmission Control Protocol). TCP specifies an operation in which, after a data signal including a predetermined sequence number is transmitted from node A to node B, an acknowledgement response signal (Ack) including the same sequence number is returned from node B to node A.

[0036] (Anomaly 1) Virtual traffic exists, but corresponding real traffic does not exist. For example, the virtual traffic includes a combination of a data signal and an Ack, but the real traffic includes only a data signal and does not include an Ack. In this case, Node B detects an anomaly indicating a violation of the protocol (failure to return an Ack).

[0037] (Anomaly 2) There is real traffic, but no corresponding virtual traffic. For example, an ACK is received that contains an ACK number (acknowledgement number) that is completely unrelated to the sequence number written in the data packet. In order to inform the sender that a data packet was lost along the way, the correct ACK number is calculated as "the first sequence number + the number of consecutive bytes that were successfully received." Therefore, an ACK with an ACK number that has nothing to do with the sequence number is an anomaly that indicates invalid traffic.

[0038] (Abnormality 3) The real traffic and the virtual traffic correspond to each other in terms of flow, but the state of the real traffic and the state of the virtual traffic do not match, and the state of the real traffic does not match the protocol specification information (sequence number matching rules) of S102b. For example, if the virtual traffic contains a combination of a data signal with sequence number = 101 and an Ack with sequence number = 109, but the real traffic contains a data signal with sequence number = 101 and an Ack with sequence number = 109, an anomaly is detected indicating that the operation of the real traffic violates the protocol (mismatch in sequence numbers).

[0039] In S113, the traffic comparison unit 15 assigns an anomaly flag indicating an anomaly (whether an anomaly exists, what the cause of the anomaly is, etc.) to the comparison result in S111 or to the actual traffic detected in (Anomaly 1) to (Anomaly 3) in S112. In S114, the traffic comparison unit 15 returns the actual traffic at the next time to which the abnormality flag has been added to the real network system 2. This allows each device in the real network system 2 to execute measures against the abnormality, such as discarding the actual traffic to which the abnormality flag has been added or displaying the contents of the abnormality flag on the screen of the administrator.

[0040] FIG. 5 is a comparison table for asserting the effects of the traffic analysis device 1. The first column (Time) of the comparison table indicates the time of each state during the calculation. The second column (real network) of the comparison table is a list of real traffic existing on the real network system 2. The first character of the real traffic identifier (e.g., “RTa(t)”) is R (Real) for real traffic or V (Virtual) for virtual traffic, and the second character is T (Traffic) for traffic. In addition, the third character of the real traffic identifier indicates the flow identifier (a, b, c, d), followed by the time information in the first column, such as (t), in parentheses.

[0041] The third column (Virtual 1) in the comparison table shows the virtual traffic when the traffic analysis device 1 is in a computer environment (such as a supercomputer) that provides sufficient computing power, and the calculation of all traffic is completed by the next time. The fourth and fifth columns (Virtual 2, 3) of the comparison table show the virtual traffic when the calculation of some traffic is not completed by the next time due to a computer environment (such as a general personal computer) with limited calculation capacity of the traffic analysis device 1. The difference between the fourth column (Virtual 2) and the fifth column (Virtual 3) is that the process of excluding some traffic from the calculation target shown in Fig. 3 is not applied (Virtual 2) and is applied (Virtual 3).

[0042] The first row of the comparison table indicates that the real traffic existing on the real network system 2 at the current time (t) is mirrored to each of the virtual networks (1, 2, 3). In other words, four sets of mirroring are performed: RTa(t) → VTa(t), RTb(t) → VTb(t), RTc(t) → VTc(t), and RTd(t) → VTd(t).

[0043] The second row of the comparison table shows the traffic state at the next time (t+1). From the actual network system 2, normal traffic RTa(t+1), RTb(t+1), and RTc(t+1) remain, but RTd(t+1) has disappeared as abnormal traffic and RTe(t+1) has been added. With sufficient calculation capacity, (Virtual 1) at the next time (t+1) can calculate four sets of traffic states, VTa(t) → VTa(t+1), VTb(t) → VTb(t+1), VTc(t) → VTc(t+1), and VTd(t) → VTd(t+1), by the next time. Therefore, by comparing the second and third columns at the next time (t+1), abnormal traffic can be detected as follows: ·RTa(t+1)=VTa(t+1) →Normal traffic ·RTb(t+1)=VTb(t+1) →Normal traffic ·RTc(t+1)=VTc(t+1) →Normal traffic ·VTd(t+1) mismatch → Abnormal traffic ·RTe(t+1) mismatch → Abnormal traffic

[0044] Due to insufficient calculation capacity for (Virtual 2) at the next time (t+1), only two sets of traffic states, VTa(t) → VTa(t+1) and VTb(t) → VTb(t+1), are calculated by the next time. Therefore, by comparing the second and fourth columns at the next time (t+1), abnormal traffic can be detected as follows: ·RTa(t+1)=VTa(t+1) →Normal traffic ·RTb(t+1)=VTb(t+1) →Normal traffic ·RTc(t+1) mismatch → False positive detection of abnormal traffic (VTd(t+1) mismatch cannot be detected) ·RTe(t+1) mismatch → Abnormal traffic

[0045] Although (Virtual 3) at the next time (t+1) has insufficient calculation capacity, by applying a process that excludes traffic from the calculation, it is possible to calculate three sets of traffic states, VTa(t) → VTa(t+1), VTb(t) → VTb(t+1), and VTc(t) → VTc(t+1), by the next time. Therefore, by comparing the second and fifth columns at the next time (t+1), abnormal traffic can be detected as follows: ·RTa(t+1)=VTa(t+1) →Normal traffic ·RTb(t+1)=VTb(t+1) →Normal traffic ·RTc(t+1)=VTc(t+1) →Normal traffic (VTd(t+1) mismatch cannot be detected) ·RTe(t+1) mismatch → Abnormal traffic In other words, the false positive in (Virtual 2) is prevented in (Virtual 3).

[0046] [effect] The traffic analysis device 1 of the present invention includes a traffic emulator 13 that calculates the state of traffic on the real network system 2 at the next time by mirroring each traffic on the real network system 2 at the current time in a virtual space and executing protocol control of each traffic in the virtual space; The system is characterized by having an analysis and exclusion unit 14 that excludes, for each mirrored traffic, traffic for which it is predicted that the calculation results of the traffic emulator 13 will not be obtained by the next time from the calculation targets of the traffic emulator 13.

[0047] As a result, when predicting the traffic state at the next time (t+1) from the traffic state at the current time (t), unnecessary traffic for which calculation results are predicted not to be obtained by the next time is excluded from the calculation. Therefore, since the calculation cost for the unnecessary traffic can be appropriately reduced, it becomes possible to efficiently allocate the calculation resources that were wasted to other traffic that can be calculated by the next time. Therefore, it is possible to increase the traffic that can be calculated by the next time.

[0048] The present invention is characterized in that the analysis and exclusion unit 14 estimates the expected time required for the calculations of the traffic emulator 13 by referring to the processing amount for executing protocol control of each traffic in a virtual space and the processing capacity of the computer on which the traffic emulator 13 operates, and excludes from the calculations of the traffic emulator 13 any traffic whose future time exceeds the next time by the expected time from the current time.

[0049] This allows for early exclusion of unnecessary traffic by estimating in advance the traffic to be excluded from the calculation.

[0050] The present invention is characterized in that the analysis and exclusion unit 14 excludes from the calculation target of the traffic emulator 13, traffic for which it is predicted that the calculation result of the traffic emulator 13 will not be obtained by the next time, based on the progress of the traffic state calculated by the traffic emulator 13 up to now and the remaining time from the present to the next time.

[0051] This makes it possible to detect traffic to be excluded from the calculation during the calculation, thereby making it possible to exclude unnecessary traffic from the calculation with high accuracy.

[0052] In the present invention, the traffic analysis device 1 further includes a traffic comparison unit 15. The traffic comparison unit 15 compares the traffic state at the next time calculated by the traffic emulator 13 with the traffic state on the real network system 2 at the next time, and notifies the real network system 2 of any inconsistent traffic as abnormal traffic.

[0053] This makes it possible to detect unauthorized communications from the traffic on the real network system 2 at the next time.

[0054] The present invention is characterized in that, when the state of traffic on the real network system 2 at the next time does not satisfy the operation specified in the protocol of that traffic, the traffic comparison unit 15 notifies the real network system 2 of the traffic that does not satisfy the operation as abnormal traffic.

[0055] This makes it possible to properly detect unauthorized communications even when there is room for interpretation of the behavior defined in the protocol, such as the omission of the transmission of certain control messages. [Explanation of symbols]

[0056] 1 Traffic analysis device 2. Actual network system 11 Calculation time judgment section (calculation exclusion section) 12 Traffic Model Management Department 13 Traffic Emulator 14 Analysis exclusion part (calculation exclusion part) 15 Traffic Comparison Section

Claims

1. a traffic emulator that calculates a state of traffic on the real network system at a next time by mirroring each traffic on the real network system at a current time in a virtual space and executing a protocol control of each traffic on the virtual space; and a calculation exclusion unit that excludes, for each mirrored traffic, traffic for which a calculation result of the traffic emulator is not expected to be obtained by the next time from a calculation target of the traffic emulator. Traffic analysis equipment.

2. The calculation exclusion unit estimates a predicted time required for the calculation of the traffic emulator by referring to a processing amount for executing protocol control of each traffic in a virtual space and a processing capacity of a computer on which the traffic emulator operates, and excludes traffic whose future time from the current time exceeds the next time by the predicted time from the calculation target of the traffic emulator. The traffic analysis device according to claim 1 .

3. The calculation exclusion unit excludes traffic for which a calculation result of the traffic emulator is not expected to be obtained by the next time based on a progress degree of the traffic state calculated by the traffic emulator up to now and a remaining time from the present time to the next time from a target of the calculation of the traffic emulator. The traffic analysis device according to claim 1 .

4. The traffic analysis device further includes a traffic comparison unit, The traffic comparison unit compares the traffic state at the next time calculated by the traffic emulator with the traffic state on the real network system at the next time, and notifies the real network system of any inconsistent traffic as abnormal traffic.

4. A traffic analysis device according to claim 1, wherein the traffic analysis device is a communication device.

5. The traffic comparison unit is characterized in that, when the state of traffic on the real network system at the next time does not satisfy the operation defined by the protocol of the traffic, the traffic comparison unit notifies the real network system of the non-satisfied traffic as abnormal traffic. The traffic analysis device according to claim 4.

6. The traffic analysis device includes a traffic emulator and a calculation exclusion unit, the traffic emulator mirrors each traffic on the real network system at the current time in a virtual space and executes protocol control of each traffic in the virtual space to calculate a state of traffic on the real network system at a next time; The calculation exclusion unit excludes, for each of the mirrored traffic streams, traffic streams for which a calculation result of the traffic emulator is not expected to be obtained by the next time from a target of the calculation of the traffic emulator. Traffic analysis methods.

7. A traffic analysis program for causing a computer to function as the traffic analysis device according to any one of claims 1 to 5.

Images