Traffic monitoring device, traffic monitoring method, and program

Abstract

A traffic monitoring device (10) comprises a burst flow detection unit (15) that, on the basis of a plurality of packets received sequentially by a receiving unit (11), detects as a burst flow a flow in which the traffic flow rate or the amount of increase thereof has exceeded a first reference. The traffic monitoring device comprises a high-flow-rate flow detection unit (16B) that, on the basis of packets sampled by a packet sampling unit (16A), estimates the pre-sampling average traffic flow rate of flows to which the packets respectively belong, and detects as a high-flow-rate flow a flow in which the estimated average traffic flow rate is greater than a second reference. The traffic monitoring device (10) comprises a monitoring target control unit (17) that adds, as a monitoring target, a flow that has been detected as a burst flow, and adds, as a monitoring target, a flow that has been detected as a high-flow-rate flow. Thus, the flows of monitoring targets are selected appropriately.

Description

[Technical field]

[0001] The present invention relates to a traffic monitoring device, a traffic monitoring method, and a program. [Background technology]

[0002] In order to grasp the communication status of a communication network, particularly traffic abnormalities of flows that are collections of packets with a common destination and / or source flowing through the communication network, it is common to acquire all packets flowing through the communication network and monitor the traffic of all flows (for example, Non-Patent Document 1). Here, due to factors such as the virtualization of communication networks, which has led to multiple communication networks being configured on a single physical structure, a large number of flows exist on the communication network. [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] Michal Kekely, Jan Korenek, “Mapping of P4 Match Action Tables to FPGA,” 2017 27th International Conference on Field Programmable Logic and Applications (FPL) Summary of the Invention [Problem to be solved by the invention]

[0004] When a large number of flows exist on a communication network, it is not realistic to monitor all of the flows, and it is better to monitor only a portion of the flows.

[0005] An object of the present invention is to appropriately select flows to be monitored. [Means for solving the problem]

[0006] In order to solve the above problems, a traffic monitoring device according to the present invention is a traffic monitoring device that monitors traffic in a communication network for each flow, and includes a receiving unit that sequentially receives a plurality of packets flowing through the communication network, a packet identification unit that sequentially identifies whether or not each of the plurality of packets sequentially received by the receiving unit belongs to a flow to be monitored, a counting unit that counts packets identified by the packet identification unit as belonging to the flow to be monitored, an output unit that outputs a result of the counting by the counting unit, and a flow monitoring unit that monitors a flow for which a traffic flow rate or an increase therein is greater than a first criterion based on the plurality of packets sequentially received by the receiving unit. a packet sampling unit that samples a portion of the plurality of packets sequentially received by the receiving unit; a high-flow flow detection unit that estimates an average traffic flow rate before sampling of a flow to which each of the portion of packets belongs based on the portion of packets sampled by the packet sampling unit, and detects a flow for which the estimated average traffic flow rate is higher than a second criterion as a high-flow flow; and a monitoring target control unit that adds the flow detected as the burst flow to the monitoring target and adds the flow detected as the high-flow flow to the monitoring target.

[0007] Further, a traffic monitoring method according to the present invention is a traffic monitoring method for monitoring traffic of a communication network for each flow, and includes a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network, which are sequentially received by a receiving unit, belongs to a flow to be monitored; an aggregation step of tallying up packets identified as belonging to the flow to be monitored by the packet identification step; a burst flow detection step of detecting a flow whose traffic flow rate or its increase amount has become greater than a first criterion as a burst flow based on the plurality of packets sequentially received by the receiving unit; a packet sampling step of sampling a portion of the plurality of packets sequentially received by the receiving unit; a high-flow flow detection step of estimating an average traffic flow rate before sampling of a flow to which each of the portion of packets belongs based on the portion of packets sampled by the packet sampling step, and detecting a flow whose estimated average traffic flow rate is greater than a second criterion as a high-flow flow; and a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high-flow flow to the monitoring target.

[0008] Furthermore, a program according to the present invention causes a computer that monitors traffic in a communication network for each flow to execute a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network and received sequentially by a receiving unit belongs to a flow to be monitored; a counting step of counting packets identified as belonging to the flow to be monitored by the packet identification step; a burst flow detection step of detecting, as a burst flow, a flow whose traffic flow rate or an increase therein has become greater than a first criterion, based on the plurality of packets sequentially received by the receiving unit; a packet sampling step of sampling a portion of the plurality of packets sequentially received by the receiving unit; a high-flow flow detection step of estimating, based on the portion of packets sampled by the packet sampling step, an average traffic flow rate before sampling of a flow to which each of the portion of packets belongs, and detecting, as a high-flow flow, a flow whose estimated average traffic flow rate is greater than a second criterion; and a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high-flow flow to the monitoring target. Effect of the Invention

[0009] According to the present invention, the flows to be monitored are appropriately selected. [Brief description of the drawings]

[0010] [Figure 1] FIG. 1 is a configuration diagram of a traffic monitoring device according to an embodiment of the present invention. [Diagram 2] FIG. 2 is a diagram illustrating an example of a data structure of a packet. [Diagram 3] FIG. 3 is a diagram illustrating an example of the structure of the rule table. [Figure 4] FIG. 4 is a graph showing changes in traffic flow rate when a microburst occurs. [Diagram 5]FIG. 5 is a graph showing the change in traffic flow rate of a high-flow rate flow. [Figure 6] FIG. 6 is a flowchart of the first rule control process. [Figure 7] FIG. 7 is a flowchart of the second rule control process. [Figure 8] FIG. 8 is a diagram showing the configuration of the traffic monitoring device of FIG. 1 implemented by a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

[0012] 1, a traffic monitoring device 10 according to this embodiment includes a receiving unit 11, a packet classifying unit 12, a counting unit 13, and an output unit 14. The traffic monitoring device 10 further includes a burst flow detecting unit 15, a packet sampling unit 16A, a high-flow-rate flow detecting unit 16B, a monitoring target control unit 17, and a storage unit 19. The traffic monitoring device 10 thus configured is configured to monitor traffic in the communication network NW for each flow.

[0013] At least a part of each of the above units 11 to 17 is composed of a logic circuit written in, for example, an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). At least a part of each of the units 11 to 17 may be composed of a processor such as a CPU (Central Processing Unit) that executes a program. The storage unit 19 is composed of an appropriate non-volatile storage device such as a flash memory or an SSD (Solid State Drive). The storage unit 19 may be composed of at least a part of a memory such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). Each of the units 11 to 17 may be composed of a memory that temporarily holds data being processed.

[0014] The receiver 11 sequentially receives a plurality of packets (more specifically, mirroring packets) transmitted and received in the communication network NW one by one. As shown in FIG. 2, a packet is composed of data (also called payload) and a header placed before the data. Each piece of data constituting the header is assigned a meaning for each number of bits. This bit-separated data with a given meaning is called a header field value, and a group of packets with matching header field values ​​is called a flow. Therefore, the header field value is also information for identifying a flow. The header field value may include each IP (Internet Protocol) address indicating the source and destination of the L3 header. A flow may be, for example, a set of packets with a common header field value indicating at least one of the destination, source, and communication protocol.

[0015] Returning to FIG. 1, each packet received by the receiver 11 is input to each of the packet identification unit 12, burst flow detection unit 15, and packet sampling unit 16A, which are arranged in parallel with each other as viewed from the receiver 11.

[0016] The packet identification unit 12 identifies whether or not each of the multiple packets received in sequence by the receiving unit 11 belongs to a flow to be monitored. A flow to be monitored is a flow that has been detected as a burst flow or a high-volume flow, as described below, and has been added to the list of flows to be monitored.

[0017] For example, the packet identification unit 12 extracts a header field value from a packet to be processed. Furthermore, the packet identification unit 12 refers to a rule table 19A stored in the storage unit 19. Rules that specify packets that belong to a flow to be monitored are registered in the rule table 19A. As shown in FIG. 3, a rule is registered for each flow to be monitored, and one rule includes the header field value of that flow, a flow ID associated with the header field value, and a monitoring cause (burst flow or high-flow rate flow) for which the flow is to be monitored. The flow ID may be made up of a rule ID that identifies the rule.

[0018] The packet identification unit 12 searches the rule table 19A for the header field value extracted above. If the search is successful, the packet to be processed this time is identified as belonging to the flow to be monitored. In this case, the packet identification unit 12 acquires the flow ID and monitoring cause corresponding to the header field value used in the search from the rule table 19A. The packet identification unit 12 further measures the data amount of the packet to be processed this time. Here, the number of bytes is counted as the data amount. Thereafter, the packet identification unit 12 outputs the acquired flow ID and monitoring cause, and the measured data amount to the counting unit 13. If the search is not successful, the flow to which the packet to be processed this time belongs is not being monitored. In this case, the packet identification unit 12 does not output the flow ID, monitoring cause, and data amount to the counting unit 13.

[0019] In this manner, the packet identification unit 12 compares each of the multiple packets received sequentially by the receiving unit 11 with the rules that specify packets that belong to the flow to be monitored and are registered in the rule table 19 A. The packet identification unit 12 identifies, from among the multiple packets, packets that match the rules as packets that belong to the flow to be monitored.

[0020] The tallying unit 13 counts packets identified by the packet identification unit 12 as belonging to a flow to be monitored. Here, the tallying unit 13 counts the number of times a flow ID is received from the packet identification unit 12 for each flow ID, i.e., for each flow. The counted number of times of reception can also be said to be the number of packets received by the receiving unit 11, i.e., the number of packets. The tallying unit 13 accumulates the amount of data for each flow ID, i.e., for each flow. For each fixed period, the tallying unit 13 outputs to the output unit 14 the number of packets and the amount of data counted or accumulated during the fixed period, as well as the flow ID and the monitoring cause, as the tallying result. The tallying result may be either the number of packets or the number of bytes. The tallying result is also output to the monitoring target control unit 17.

[0021] The output unit 14 outputs the counting result from the counting unit 13. The output unit 14 may output at least the latter of the flow ID (or the name of the flow or rule identified from the flow ID) and the number of packets and the accumulated data amount for each flow as the counting result. The output unit 14 displays the counting result, for example, on a display device provided in the traffic monitoring device 10 or external to the traffic monitoring device 10. The output unit 14 may output the counting result to a processing unit provided inside or outside the traffic monitoring device 10, and the processing unit may determine the presence or absence of a traffic abnormality for each flow based on the counting result. The processing unit may execute a process of displaying a flow determined to have a traffic abnormality on the display device and / or a process of blocking communication in the flow.

[0022] The burst flow detection unit 15 detects, as a burst flow, a flow in which the traffic flow rate or the increase in the traffic flow rate becomes larger than a first reference, based on a plurality of packets sequentially received by the receiving unit 11. A burst flow detected by the burst flow detection unit 15 is shown in Fig. 4. A burst flow is a sudden increase in traffic volume. A burst flow has a sudden large effect on the behavior of the communication network NW.

[0023] Returning to FIG. 1, the burst flow detection unit 15 monitors, for example, the number of packets and the total data amount of packets for each fixed period P for each flow (for each header field value) as a traffic flow rate. The burst flow detection unit 15 determines whether the number of packets or the total data amount for the most recent period P exceeds a predetermined threshold. If the number of packets or the total data amount exceeds a predetermined threshold, the traffic flow rate in the flow begins to increase (such as period T in FIG. 4), and the flow is detected as a burst flow. The traffic flow rate to be monitored may be only one of the number of packets and the total data amount. The method for detecting a burst flow may be performed by the method for detecting the occurrence of burst traffic described in International Publication WO / 2021 / 014552. The detection of burst traffic in this publication corresponds to the detection of a burst flow. The burst flow detection unit 15 may monitor the time change of the traffic flow rate when the number of packets or the total data amount per unit time is taken as the traffic flow rate, and detect a flow in which the increase in the traffic flow rate exceeds a predetermined threshold as a burst flow. The burst flow detection unit 15 supplies the monitored object control unit 17 with the field values ​​of the packets to which the detected burst flow belongs.

[0024] The packet sampling unit 16A samples some of the packets received in sequence by the receiving unit 11. This allows some packets to be randomly extracted from all packets received in sequence by the receiving unit 11. The packet sampling unit 16A sequentially supplies only the some of the packets obtained by sampling to the downstream high-flow-rate flow detection unit 16B.

[0025] Based on a portion of packets sampled by packet sampling unit 16A, high-flow flow detection unit 16B estimates the average traffic flow rate before sampling of the flow to which each of the portion of packets belongs. High-flow flow detection unit 16B detects a flow whose estimated average traffic flow rate is greater than a second criterion as a high-flow flow. The second criterion may be different for each flow. High-flow flows detected by high-flow flow detection unit 16B are shown in FIG. 5. A high-flow flow is one in which the traffic flow rate is high for a long period of time. High-flow flows have a long-term impact on the behavior of the communication network NW.

[0026] The high-flow-rate flow detection unit 16B holds, for example, the packets sampled by the packet sampling unit 16A for each flow (for each header field value). When the high-flow-rate flow detection unit 16B holds a new packet, it estimates the average traffic flow rate of the flow of all the original packets before sampling, that is, when sampling is not performed, based on the new packet and the held packets of the same flow (header field value) as the new packet. This average traffic flow rate is, for example, the average value or representative value of the number of packets or the total data amount (traffic amount) per unit time in a predetermined period including the holding timing of the new packet. The estimation method is performed by any method using the sampling theorem or the like. The estimation method may be a method learned by machine learning or the like. The high-flow-rate flow detection unit 16B determines whether the estimated average traffic flow rate exceeds a predetermined threshold. When it is determined that the average traffic flow rate exceeds the predetermined threshold, the flow to which the new packet belongs is detected as a high-flow-rate flow with a large traffic flow rate. At this time, high-flow rate flow detection unit 16B supplies the header field value of the new packet to monitoring target control unit 17. By estimating the traffic flow rate of the original flow after sampling, the influence of a sudden decrease in traffic flow rate due to a microburst or the like is reduced, and high-flow rate flows are detected with high accuracy.

[0027] The monitoring target control unit 17 adds flows detected as burst flows by the burst flow detection unit 15 to the monitoring targets. Furthermore, the monitoring target control unit 17 adds flows detected as high flow rates by the high flow rate flow detection unit 16B to the monitoring targets. This addition is performed by additionally registering rules that specify packets belonging to each flow, that is, combinations of flow IDs and header field values, in the rule table 19A.

[0028] The monitoring target control unit 17 adds the above-mentioned flow to the monitoring targets by, for example, executing a first rule control process shown in Fig. 6. The monitoring target control unit 17 executes the first rule control process from the time when the traffic monitoring device 10 is started up.

[0029] In the rule control process, the monitoring target control unit 17 first determines whether a header field value has been supplied from the burst flow detection unit 15 (step S11). If the result of this determination is positive, the monitoring target control unit 17 determines whether the supplied header field value is registered in the rule table 19A (step S12). If the result is positive, the flow of that header field value has already been subject to monitoring. In this case, the monitoring target control unit 17 proceeds to the process of step S21.

[0030] If the determination result in step S12 is negative, the monitoring target control unit 17 acquires a flow ID corresponding to the currently supplied header field value (step S13). The monitoring target control unit 17 acquires a flow ID corresponding to the currently supplied header field value, for example, by referring to a table indicating the correspondence between flow IDs and header field values ​​stored in the storage unit 19 or the like. If the currently supplied header field value is not registered in the table, the monitoring target control unit 17 acquires the flow ID by issuing a new flow ID. In this case, the monitoring target control unit 17 also registers the flow ID and header field value in the table.

[0031] The monitoring target control unit 17 associates the currently supplied header field value with the flow ID acquired in step S13 as one rule, and registers them in the rule table 19A (step S14).

[0032] After step S14, if the determination result of step S11 is negative or if the determination result of step S12 is positive, the monitored object control unit 17 determines whether a header field value has been supplied from the high flow rate flow detection unit 16B (step S21). If the determination result is positive, the monitored object control unit 17 executes the processes of steps S22 to S24. Steps S22 to S24 are the same processes as steps S12 to S14, respectively, and therefore detailed explanations thereof will be omitted. After step S24, if the determination result of step S21 is negative or if the determination result of step S22 is positive, the monitored object control unit 17 executes step S11 again.

[0033] The monitoring target control unit 17 deletes the flows to be monitored by, for example, executing the second rule control process shown in Fig. 7. The monitoring target control unit 17 executes the second rule control process from the time when the traffic monitoring device 10 is started up.

[0034] In the second rule control process, the monitored object control unit 17 first judges whether the counting result has been supplied from the counting unit 13 (step S31). If the judgement result is positive, the monitored object control unit 17 judges whether the number of packets or the data amount, i.e., the traffic flow rate, included in the counting result for each of the flows to be monitored is lower than the third criterion (step S32). If the judgement result is positive, the monitored object control unit 17 determines that the flow to be judged has become normal, and deletes the rule including the flow ID included in the counting result of the processing object from the rule table 19A (step S33). As a result, the flow that has become normal is deleted from the monitored object. If the judgement result of step S31 or S32 is negative or after step S33, step S31 is executed again. The third criterion may be different for each flow and / or each monitoring cause.

[0035] As described above, the monitoring target control unit 17 excludes from the monitoring target any flow whose number of packets or data amount, ie, traffic flow rate, included in the counting result is lower than the third criterion as a flow that has become normal.

[0036] Through the above-mentioned series of processes, the burst flow and the high-flow rate flow are added to the monitoring target by the packet identification unit 12. As described above, the burst flow and the high-flow rate flow affect the behavior of the communication network NW in different ways. Here, the burst flow changes abruptly (see FIG. 4), and is difficult to detect by a detection method using sampling by the packet sampling unit 16A and the high-flow rate flow detection unit 16B. On the other hand, the high-flow rate flow changes little (see FIG. 5), and is difficult to detect by the burst flow detection unit 15. In this embodiment, the burst flow detection unit 15, the packet sampling unit 16A, and the high-flow rate flow detection unit 16B each detect the burst flow and the high-flow rate flow separately by a method suitable for detecting each flow. Then, the detected flow is added to the flow to be monitored by the packet identification unit 12 by the monitoring target control unit 17. Therefore, the two types of flows that give the behavior of the communication network NW can be appropriately added to the monitoring target, and thus the selection of the flow to be monitored can be appropriately performed. Furthermore, the rule table 19A is used to manage the flows to be monitored, which makes it easier to manage the flows to be monitored.

[0037] Furthermore, in this embodiment, flows whose number of packets or data volume, i.e., traffic flow rate, included in the aggregation result is lower than the third criterion are regarded as normal flows and excluded from monitoring targets, thereby preventing normal flows from remaining as monitoring targets and allowing appropriate selection of flows to be monitored.

[0038] 8 shows a hardware configuration diagram of the traffic monitoring device 10 configured by a computer. The traffic monitoring device 10 includes a processor 101 such as a CPU, a main memory 102 of the processor 101, and a non-volatile storage device 103 that stores programs and various data and configures the storage unit 19 of FIG. 1. The traffic monitoring device 10 further includes a network interface card (NIC) 104 that is connected to a communication network NW and relays packets. The processor 101 executes or uses the programs and data stored in the storage device 103 and read into the main memory 102 to operate as the above-mentioned units 11 to 17. The receiving unit 11 and the output unit 14 may be realized by a combination of the processor 101 that executes programs and the NIC 104.

[0039] [Scope of the present invention] The present invention is not limited to the above-mentioned embodiment and modification. For example, the present invention includes various modifications to the above-mentioned embodiment and modification that can be understood by a person skilled in the art within the scope of the technical idea of ​​the present invention. The configurations listed in the above-mentioned embodiment and modification can be appropriately combined within a range without contradiction. In addition, it is also possible to delete any of the above-mentioned configurations. The above-mentioned various programs may be stored in a non-transitory computer-readable storage medium, not limited to the non-volatile storage device 103. The "device" and "part" may be an entity in which the configuration for realizing the operation is housed in one housing, or an entity (system) in which the configuration for realizing the operation is distributed and housed in multiple housings. [Explanation of symbols]

[0040] 10...traffic monitoring device, 11...receiving unit, 12...packet identification unit, 13...counting unit, 14...output unit, 15...burst flow detection unit, 16A...packet sampling unit, 16B...high-flow-rate flow detection unit, 17...monitoring target control unit, 19...memory unit, 19A...rule table, 101...processor, 102...main memory, 103...storage device, NW...communication network.

Claims

1. A traffic monitoring device that monitors traffic in a communication network for each flow, comprising: a receiving unit that sequentially receives a plurality of packets transmitted through the communication network; a packet identification unit that sequentially identifies whether or not each of the plurality of packets sequentially received by the receiving unit belongs to a flow that is a monitoring target; a counting unit that counts packets identified by the packet identification unit as belonging to the flow to be monitored; an output unit that outputs a result of the counting by the counting unit; a burst flow detection unit that detects, based on the plurality of packets sequentially received by the receiving unit, a flow in which a traffic flow rate or an increase rate thereof becomes greater than a first reference as a burst flow; a packet sampling unit that samples some of the plurality of packets sequentially received by the receiving unit; a high-flow-rate flow detection unit that estimates an average traffic flow rate before sampling of a flow to which each of the partial packets belongs based on the partial packets sampled by the packet sampling unit, and detects a flow in which the estimated average traffic flow rate is higher than a second criterion as a high-flow-rate flow; a monitoring target control unit that adds the flow detected as the burst flow to the monitoring target and adds the flow detected as the high flow rate flow to the monitoring target; A traffic monitoring device comprising:

2. the packet identification unit compares each of the plurality of packets sequentially received by the receiving unit with a rule that is registered in a rule table and that specifies packets that belong to the flow to be monitored, and identifies a packet that matches the rule among the plurality of packets as a packet that belongs to the flow to be monitored; when adding the burst flow or the high-flow rate flow to the flows to be monitored, the monitoring target control unit adds a rule that specifies packets belonging to the burst flow or the high-flow rate flow to the rule table.

2. A traffic monitoring device according to claim 1.

3. the monitoring target control unit deletes, based on the counting result by the counting unit, flows whose traffic flow rate indicated by the counting result is lower than a third criterion from the monitoring targets; 3. A traffic monitoring device according to claim 1 or 2.

4. A traffic monitoring method for monitoring traffic in a communication network for each flow, comprising the steps of: a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network, which are sequentially received by a receiving unit, belongs to a flow to be monitored; a counting step of counting packets identified as belonging to the flow to be monitored by the packet identification step; a burst flow detection step of detecting, as a burst flow, a flow whose traffic flow rate or its increase rate has become greater than a first reference based on the plurality of packets sequentially received by the receiving unit; a packet sampling step of sampling some of the plurality of packets sequentially received by the receiving unit; a high-flow-rate flow detection step of estimating an average traffic flow rate before sampling of a flow to which each of the partial packets belongs based on the partial packets sampled by the packet sampling step, and detecting a flow in which the estimated average traffic flow rate is higher than a second criterion as a high-flow-rate flow; a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high flow rate flow to the monitoring target; A traffic monitoring method comprising:

5. A computer that monitors the traffic of a communication network for each flow. a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network, which are sequentially received by a receiving unit, belongs to a flow to be monitored; a counting step of counting packets identified as belonging to the flow to be monitored by the packet identification step; a burst flow detection step of detecting, as a burst flow, a flow whose traffic flow rate or its increase rate has become greater than a first reference based on the plurality of packets sequentially received by the receiving unit; a packet sampling step of sampling some of the plurality of packets sequentially received by the receiving unit; a high-flow-rate flow detection step of estimating an average traffic flow rate before sampling of a flow to which each of the partial packets belongs based on the partial packets sampled by the packet sampling step, and detecting a flow in which the estimated average traffic flow rate is higher than a second criterion as a high-flow-rate flow; a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high flow rate flow to the monitoring target; A program that executes the following.

Images