Network monitoring device, network monitoring method and computer program

Abstract

To make it possible to appropriately determine a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from a communication network.SOLUTION: A network monitoring device includes: a collection setting unit that performs a data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from a network to be monitored; a data collection unit that collects the monitoring data from the network to be monitored; a load information acquisition unit that acquires load information indicating a load on the network to be monitored when the monitoring data is collected; an analysis unit that acquires an analysis result of a communication network state from the monitoring data using a communication network state analysis model and acquires importance of each data item in the analysis of the communication network state; and an aggregation unit that generates aggregated data that associates the load information, with the importance corresponding to the monitoring data when the load information is acquired.SELECTED DRAWING: Figure 1

Description

[Technical field]

[0001] The present invention relates to a network monitoring device, a network monitoring method, and a computer program. [Background technology]

[0002] In recent years, with the advancement of AI (Artificial Intelligence) technology, techniques for analyzing the state of communication networks using machine learning such as deep learning have been attracting attention, but in machine learning, it is important to ensure a sufficient amount and diversity of data to be used for learning. Regarding the data items to be collected from communication networks, various data items are specified for each device, for example, in the MIB (Management Information Base) of SNMP (Simple Network Management Protocol). In addition, in CNF (Cloud-native Network Function), which is expected to become widespread in the future due to the advancement of virtualization technology, various data can be collected via agents for each application by utilizing monitoring software such as "Prometheus", which has been developed mainly in the cloud industry, so the number of collectable data items increases. On the other hand, by periodically collecting data from communication networks to monitor the communication network, a monitoring load is placed on the communication bandwidth and resources of the communication network side. For this reason, it is important to collect data from communication networks by limiting it to the data items necessary for analyzing the state of the communication network.

[0003] Conventionally, for example, Patent Documents 1, 2, and 3 are known as techniques for analyzing the state of a communication network that considers the monitoring load. The technique described in Patent Document 1 periodically collects equipment information such as a fault history and communication data volume from managed network devices, and changes the collection interval, for example, shortening the collection interval only for equipment information from network devices with many faults, based on the obtained equipment information. The technique described in Patent Document 2 predicts future traffic from traffic information collected at multiple measurement periods, and determines an appropriate measurement period for traffic information from the bandwidth load required for collecting traffic information and the cost information required for facility expansion based on the traffic prediction. The technique described in Patent Document 3 reduces the load required for data collection by calculating and sorting the traffic volume for each user terminal, and extracting log data only from user terminals with a predetermined traffic volume or more. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2005-18120 A [Patent Document 2] JP 2015-207795 A [Patent Document 3] JP 2020-102776 A Summary of the Invention [Problem to be solved by the invention]

[0005] However, the technology described in Patent Document 1 does not take into consideration the usefulness of the collected data items in the analysis. Also, the technologies described in Patent Documents 2 and 3 do not consider data items other than those related to traffic. For this reason, it is difficult to appropriately determine the data items to be collected from a communication network in order to analyze the communication network state using these technologies.

[0006] The present invention has been made in consideration of these circumstances, and its purpose is to appropriately determine a monitoring setting pattern indicating multiple data items to be included in monitoring data collected from a communication network to analyze the communication network status. [Means for solving the problem]

[0007] (1) One aspect of the present invention is a network monitoring device comprising: a collection setting unit that sets, in the communication network to be monitored, a data collection setting pattern that indicates a plurality of data items to be included in monitoring data collected from the communication network to be monitored in order to analyze a communication network state; a data collection unit that collects the monitoring data from the communication network to be monitored; a load information acquisition unit that acquires load information that indicates a load placed on the communication network to be monitored when collecting the monitoring data; an analysis unit that acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquires the importance of each of the data items in the analysis of the communication network state; and an aggregation unit that generates aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information was acquired. (2) One aspect of the present invention is the network monitoring device of (1) above, which generates the aggregated data for each of a plurality of types of the monitoring setting patterns.

[0008] (3) One aspect of the present invention is a network monitoring method including: a collection setting step in which a network monitoring device performs data collection settings on a monitored communication network corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from the monitored communication network in order to analyze a communication network state; a data collection step in which the network monitoring device collects the monitoring data from the monitored communication network; a load information acquisition step in which the network monitoring device acquires load information indicating a load placed on the monitored communication network when collecting the monitoring data; an analysis step in which the network monitoring device acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm and acquires the importance of each of the data items in the analysis of the communication network state; and an aggregation step in which the network monitoring device generates aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information was acquired.

[0009] (4) One aspect of the present invention is a computer program for causing a computer to execute the following steps: a collection setting step of setting, on a monitored communication network, a data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from the monitored communication network in order to analyze a communication network state; a data collection step of collecting the monitoring data from the monitored communication network; a load information acquisition step of acquiring load information indicating the load placed on the monitored communication network when collecting the monitoring data; an analysis step of acquiring an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquiring the importance of each of the data items in the analysis of the communication network state; and an aggregation step of generating aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information is acquired. Effect of the Invention

[0010] According to the present invention, it is possible to obtain an effect of appropriately determining a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from a communication network in order to analyze the state of the communication network. [Brief description of the drawings]

[0011] [Figure 1] 1 is a block diagram showing an example of the configuration of a network monitoring device according to an embodiment; [Diagram 2] 1 is a block diagram showing an example of the configuration of a collection design unit according to an embodiment. FIG. [Diagram 3] 1 is a flowchart illustrating an example of a procedure of a network monitoring method according to an embodiment. [Figure 4] 13 is a diagram illustrating an example of a configuration of a data item list according to an embodiment. [Diagram 5] 4 is a diagram illustrating an example of the configuration of load information according to an embodiment. [Figure 6] 13 is a diagram illustrating an example of a configuration of importance according to an embodiment. [Figure 7] 1 is a diagram illustrating an example of a configuration of aggregated data according to an embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. Fig. 1 is a block diagram showing an example of the configuration of a network monitoring device according to an embodiment. In Fig. 1, the network monitoring device 1 collects monitoring data of multiple data items from a communication network (monitored network) NW to be monitored, analyzes the state of the monitored network NW (communication network state) based on the collected monitoring data, and outputs the analysis result of the communication network state.

[0013] As an example of this embodiment, the monitored network NW uses CNF (Cloud Native Network Function) and includes a plurality of CNF nodes 110 and a CNF management system 120. Note that the monitored network NW is not limited to one that uses CNF, and may be any communication network capable of collecting monitoring data.

[0014] The network monitoring device 1 includes a collection setting unit 11, a data collection unit 12, an analysis unit 20, and a collection design unit 30.

[0015] Each function of the network monitoring device 1 is realized by the network monitoring device 1 including computer hardware such as a CPU (Central Processing Unit) and a memory, and the CPU executing a computer program stored in the memory. The network monitoring device 1 may be configured using a general-purpose computer device, or may be configured as a dedicated hardware device. For example, the network monitoring device 1 may be configured using a server computer connected to a communication network such as the Internet. Each function of the network monitoring device 1 may be realized by cloud computing. The network monitoring device 1 may be realized by a single computer, or may be realized by distributing the functions of the network monitoring device 1 among multiple computers. The network monitoring device 1 may be configured to open a website using, for example, a WWW system.

[0016] The collection setting unit 11 performs data collection setting corresponding to a monitoring setting pattern on the monitored network NW. The monitoring setting pattern indicates a plurality of data items to be included in monitoring data collected from the monitored network NW to analyze the communication network state.

[0017] The data collection unit 12 collects monitoring data from the monitored network NW.

[0018] The analysis unit 20 includes a database 21 and a communication network state analysis model 22. The database 21 accumulates data for analyzing the state of the communication network. The communication network state analysis model 22 is a model for analyzing the state of the communication network, constructed by a predetermined machine learning algorithm.

[0019] The analysis unit 20 analyzes the communication network state of the monitored network NW using the monitoring data collected by the data collection unit 12. The analysis unit 20 obtains an analysis result of the communication network state from the monitoring data using the communication network state analysis model 22, and obtains the importance of each data item in the analysis of the communication network state. The importance can be easily obtained by using a machine learning algorithm that uses a decision tree, such as "RandomForest" or "XGBoost".

[0020] The analysis unit 20 outputs the analysis result of the communication network state of the monitored network NW. The analysis unit 20 also outputs the importance of each data item in the analysis of the communication network state to the collection design unit 30.

[0021] 2 is a block diagram showing an example of the configuration of a collection design unit according to this embodiment. In FIG. 2, the collection design unit 30 includes a pattern selection unit 31, a load information acquisition unit 32, and an aggregation unit 33.

[0022] The pattern selection unit 31 accepts input of a monitoring setting pattern A from the user terminal 3 used by the user. The monitoring setting pattern A indicates multiple data items and monitoring-related setting items to be included in the monitoring data collected from the monitored network NW to analyze the communication network state. Examples of the data items include information on traffic, resources, routing, etc. Also, examples of the setting items include data collection intervals and communication protocols. The pattern selection unit 31 makes a data collection setting request B to the collection setting unit 11 to collect monitoring data according to the monitoring setting pattern A.

[0023] In response to request B from the pattern selection unit 31, the collection setting unit 11 performs data collection setting for each CNF node 110 and the CNF management system 120 of the monitored network NW to collect monitoring data according to monitoring setting pattern A. In the example of the monitored network NW in Fig. 1, the collection setting unit 11 performs data collection setting for each CNF node 110 and the CNF management system 120. As a result, each CNF node 110 and the CNF management system 120 of the monitored network NW outputs monitoring data according to monitoring setting pattern A.

[0024] The data collection unit 12 collects monitoring data from each CNF node 110 in the monitored network NW and the CNF management system 120. This collected monitoring data corresponds to the data collection setting of the monitoring setting pattern A set in the monitored network NW by the collection setting unit 11. The data collection unit 12 outputs the monitoring data C collected from the monitored network NW to the analysis unit 20 and the collection design unit 30.

[0025] The load information acquisition unit 32 acquires load information E indicating the load on the monitored network NW when collecting the monitoring data C based on the monitoring data C acquired from the data collection unit 12. Examples of the load information E include information on traffic, CPU, memory, etc. The method of acquiring the load information E is set in advance.

[0026] In addition, the load information acquisition unit 32 acquires a list (data item list) F of data items included in the monitoring data C. The data item list F may be acquired from the monitoring data C, or may be acquired from the monitoring setting pattern A.

[0027] The load information acquisition unit 32 outputs the load information E and the data item list F to the aggregation unit 33. The aggregation unit 33 records the load information E and the data item list F acquired from the load information acquisition unit 32.

[0028] When a plurality of types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, . . .) are input from the user terminal 3, the load information acquisition unit 32 makes a request D for data collection setting of the next monitoring setting pattern A to the collection setting unit 11. As a result, the collection setting unit 11 performs data collection setting of the next monitoring setting pattern A for each CNF node 110 and the CNF management system 120 of the monitored network NW, then the data collection unit 12 collects monitoring data corresponding to the data collection setting of the next monitoring setting pattern A, then the load information acquisition unit 32 acquires load information E and a data item list F related to the next monitoring setting pattern A and outputs them to the aggregation unit 33.

[0029] The analysis unit 20 accumulates the monitoring data C acquired from the data collection unit 12 in a database 21. In a model learning stage, the analysis unit 20 uses the monitoring data C accumulated in the database 21 as learning data to learn a communication network state analysis model 22 by a predetermined machine learning algorithm. The learned communication network state analysis model 22 is used to analyze the communication network state of the monitored network NW.

[0030] In the communication network state analysis stage, the analysis unit 20 uses the communication network state analysis model 22 to acquire an analysis result of the communication network state from the monitoring data C acquired from the data collection unit 12, and acquires the importance G of each data item in the analysis of the communication network state. The analysis unit 20 outputs the importance G of each data item to the aggregation unit 33. The aggregation unit 33 records the importance G of each data item acquired from the load information acquisition unit 32.

[0031] The aggregation unit 33 generates aggregated data H that associates the load information E with the importance G corresponding to the monitoring data C at the time when the load information E was acquired. The aggregation unit 33 transmits the aggregated data H to the user terminal 3.

[0032] Next, a network monitoring method according to this embodiment will be described with reference to Fig. 3. Fig. 3 is a flowchart showing an example of the procedure of the network monitoring method according to this embodiment.

[0033] (Step S1) The collection setting unit 11 performs data collection setting for collecting monitoring data according to a monitoring setting pattern A for each CNF node 110 and the CNF management system 120 of the monitored network NW.

[0034] (Step S2) The data collection unit 12 collects monitoring data C from each CNF node 110 in the monitored network NW and the CNF management system 120. This collected monitoring data C is monitoring data corresponding to the data collection setting of the monitoring setting pattern A set in the monitored network NW in step S1.

[0035] (Step S3) The load information acquisition unit 32 acquires load information E indicating the load on the monitored network NW when collecting the monitoring data C, based on the monitoring data C collected in step S2. In addition, the load information acquisition unit 32 acquires a data item list F of the data items included in the monitoring data C.

[0036] (Step S4) The analysis unit 20 uses the communication network state analysis model 22 to obtain an analysis result of the communication network state from the monitoring data C collected in step S2, and obtains the importance G of each data item in the analysis of the communication network state.

[0037] (Step S5) The aggregator 33 generates aggregated data H that associates the load information E and the data item list F acquired in step S3 with the importance G acquired in step S4. The aggregator 33 transmits the aggregated data H to the user terminal 3.

[0038] When the network monitoring device 1 receives a plurality of types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...) from the user terminal 3, it executes the above-mentioned process of Fig. 3 for each monitoring setting pattern A. Note that in the learning stage of the communication network state analysis model 22, the communication network state analysis model 22 may be learned by using the monitoring data C of the plurality of types of monitoring setting patterns A as learning data.

[0039] Fig. 4 is a configuration example of a data item list according to this embodiment. In the example of Fig. 4, a plurality of data items constituting monitoring data for each of a plurality of monitoring setting patterns A (pattern A1, pattern A2, ...) are shown in a data item list F. Note that the data items for each monitoring setting pattern A shown in Fig. 4 are for convenience of explanation.

[0040] Fig. 5 is a configuration example of load information according to this embodiment. In the example of Fig. 5, the value of each load item is included in the load information E for each of a plurality of types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...). Also, in the example of Fig. 5, in one monitoring setting pattern A, for each load item, a total value obtained by totalizing the values ​​of the load items of all the CNF nodes 110 and the CNF management system 120 in the monitoring setting pattern A is included in the load information E. Examples of the total value include an average value and a median value. Note that the values ​​of each load item shown in Fig. 5 are for convenience of explanation.

[0041] Fig. 6 is an example of the configuration of importance according to this embodiment. In the example of Fig. 6, the importance G of each data item is shown in descending order of importance. Also, in the example of Fig. 6, the feature amount and the data item in the communication network state analysis model 22 are in one-to-one correspondence. Note that the importance values ​​shown in Fig. 6 are for convenience of explanation.

[0042] Fig. 7 is a configuration example of aggregated data according to this embodiment. In the example of Fig. 7, in aggregated data H, load information E and importance G are associated with each of a plurality of types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...). Also, in the example of Fig. 7, in one monitoring setting pattern A, a total value resulting from the totalization of the importance G of all data items in the monitoring setting pattern A is included in the aggregated data H. Examples of the total value include an average value and a sum. Note that the values ​​of each load item and each importance shown in Fig. 7 are for convenience of explanation.

[0043] Aggregated data H exemplified in Fig. 7 is transmitted from the network monitoring device 1 to the user terminal 3. The user can recognize the relationship between load information and importance for each of a plurality of types of monitoring setting patterns A (pattern A1, pattern A2, pattern A3, ...) using aggregated data H exemplified in Fig. 7, and determine an appropriate monitoring setting pattern A. For example, it is possible to determine the monitoring setting pattern A that maximizes the overall importance value under load conditions that satisfy the CPU utilization rate of x% or less and the memory (MEM) utilization rate of y megabytes (MB) or less. For example, it is possible to determine the monitoring setting pattern A that maximizes the overall importance value from among the monitoring setting patterns A in which the CPU utilization rate, memory utilization amount, and communication delay are all below their respective threshold values.

[0044] The user notifies the network monitoring device 1 of the monitoring setting pattern A (target monitoring setting pattern A) that is determined to be appropriate by the user terminal 3. The network monitoring device 1 monitors the monitoring target network NW (analyzes the communication network state) using the target monitoring setting pattern A notified by the user. Specifically, the collection setting unit 11 performs data collection setting for each CNF node 110 of the monitoring target network NW and the CNF management system 120 to collect monitoring data by the target monitoring setting pattern A. Next, the data collection unit 12 collects monitoring data C (target monitoring data C) from each CNF node 110 of the monitoring target network NW and the CNF management system 120. This target monitoring data C is monitoring data corresponding to the data collection setting of the target monitoring setting pattern A. Next, the analysis unit 20 acquires an analysis result of the communication network state from the target monitoring data C using the communication network state analysis model 22. This analysis result of the communication network state is output from the network monitoring device 1.

[0045] According to this embodiment, the user can obtain the effect of being able to appropriately determine, based on the aggregated data H, a monitoring setting pattern indicating multiple data items to be included in the monitoring data collected from the monitored network NW to analyze the communication network status.

[0046] This will make it possible to improve the overall service quality in, for example, telecommunications network monitoring systems, thereby contributing to Goal 9 of the United Nations-led Sustainable Development Goals (SDGs), which is to "build resilient infrastructure, promote sustainable industrialization and foster innovation."

[0047] Although an embodiment of the present invention has been described in detail above with reference to the drawings, the specific configuration is not limited to this embodiment, and design changes and the like that do not deviate from the gist of the present invention are also included.

[0048] Also, a computer program for implementing the functions of each of the above-mentioned devices may be recorded on a computer-readable recording medium, and the program recorded on the recording medium may be read into a computer system and executed. Note that the "computer system" referred to here may include hardware such as an OS and peripheral devices. Furthermore, in the case of using a WWW system, the "computer system" also includes the homepage providing environment (or display environment). In addition, the term "computer-readable recording medium" refers to writable non-volatile memory such as a flexible disk, an optical magnetic disk, a ROM, or a flash memory, a portable medium such as a DVD (Digital Versatile Disc), or a storage device such as a hard disk built into a computer system.

[0049] Furthermore, the term "computer-readable recording medium" includes devices that retain a program for a certain period of time, such as volatile memory (e.g., DRAM (Dynamic Random Access Memory)) within a computer system that serves as a server or client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. The program may be transmitted from a computer system in which the program is stored in a storage device or the like to another computer system via a transmission medium, or by a transmission wave in the transmission medium. Here, the "transmission medium" that transmits the program refers to a medium that has a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for implementing some of the functions described above, or may be a so-called differential file (differential program) that can implement the functions described above in combination with a program already recorded in the computer system. [Explanation of symbols]

[0050] 1...network monitoring device, 11...collection setting unit, 12...data collection unit, 20...analysis unit, 30...collection design unit, 21...database, 22...communication network state analysis model, 31...pattern selection unit, 32...load information acquisition unit, 33...aggregation unit, NW...monitored network

Claims

1. a collection setting unit that performs data collection setting on a communication network to be monitored, the data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data to be collected from the communication network to be monitored in order to analyze a state of the communication network; a data collection unit that collects the monitoring data from the communication network to be monitored; a load information acquisition unit that acquires load information indicating a load placed on the communication network to be monitored when collecting the monitoring data; an analysis unit that acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquires the importance of each of the data items in the analysis of the communication network state; an aggregator that generates aggregated data that associates the load information with the importance corresponding to the monitoring data at the time the load information is acquired; A network monitoring device comprising:

2. generating the aggregated data for each of the plurality of types of monitoring setting patterns; The network monitoring device according to claim 1 .

3. a collection setting step in which a network monitoring device performs data collection setting on a communication network to be monitored, the data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data to be collected from the communication network to be monitored in order to analyze a communication network state; a data collection step in which the network monitoring device collects the monitoring data from the communication network to be monitored; a load information acquisition step of the network monitoring device acquiring load information indicating a load applied to the communication network to be monitored when collecting the monitoring data; an analysis step in which the network monitoring device acquires an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquires the importance of each of the data items in the analysis of the communication network state; an aggregation step of generating aggregated data in which the load information is associated with the importance corresponding to the monitoring data at the time when the load information is acquired by the network monitoring device; A network monitoring method comprising:

4. On the computer, a collection setting step of performing a data collection setting corresponding to a monitoring setting pattern indicating a plurality of data items to be included in monitoring data collected from a communication network to be monitored in order to analyze a communication network state, on the communication network to be monitored; a data collection step of collecting the monitoring data from the communication network to be monitored; a load information acquisition step of acquiring load information indicating a load applied to the communication network to be monitored when the monitoring data is collected; an analysis step of acquiring an analysis result of the communication network state from the monitoring data using a communication network state analysis model constructed by a predetermined machine learning algorithm, and acquiring the importance of each of the data items in the analysis of the communication network state; an aggregating step of generating aggregated data in which the load information is associated with the importance corresponding to the monitoring data at the time when the load information is acquired; A computer program for executing the above.

Images