Traffic data collection system, traffic data collection method, and traffic data collection program

Abstract

This network monitoring system comprises a reception unit, an extraction unit and a reconstruction unit. The reception unit receives the time sequence data of band values of a monitored network. The extraction unit extracts the feature values of the time sequence data from the time sequence data of band values by applying a seasonal adjustment method to the time sequence data. Then, the extraction unit transmits the feature values of the time sequence data via a network used for collecting the traffic data of the monitored network. The reconstruction unit receives the feature values of the time sequence data via the network used for collecting the traffic data of the monitored network. The reconstruction unit then reconstructs the time sequence data of band values from the feature values of the time sequence data.

Description

[Technical field]

[0001] The present disclosure relates to a traffic data collection system, a traffic data collection method, and a traffic data collection program. [Background technology]

[0002] After the network is constructed, it is maintained and operated so that the network continues to operate normally. For the purpose of maintenance and operation, a network monitoring system generally collects information on traffic flowing through the network.

[0003] Traffic is data that flows through a network. Such data is also called network traffic. Depending on the context, the term "traffic" can mean the amount of data that flows through a network (traffic volume). Traffic is processed in data units called packets. A series of packets is called a flow.

[0004] There are various techniques for collecting traffic information. For example, one technique is to send traffic statistics for each flow. Another technique is to send traffic time series data for each period when packets arrive over the network. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] JP 2012-105043 A [Non-patent literature]

[0006] [Non-Patent Document 1] “RFC 7011―Specification of the IP Flow Information Export (IPFIX) Protocol for the Exchange of Flow Information” [online], [Retrieved February 22, 2022], Internet<https: / / datatracker.ietf.org / doc / html / rfc7011> Summary of the Invention [Problem to be solved by the invention]

[0007] However, in the above-mentioned prior art, it may be difficult to reduce the burden on the network bandwidth for collecting information on traffic.

[0008] Therefore, the present disclosure proposes a traffic data collection system, a traffic data collection method, and a traffic data collection program that can reduce the load on the network bandwidth for collecting information regarding traffic. [Means for solving the problem]

[0009] In one aspect of the present disclosure, a traffic data collection system includes a first receiving unit that receives time series data of bandwidth values ​​of a network under monitoring, an extraction unit that extracts features of the time series data from the time series data of bandwidth values ​​by applying a seasonal adjustment method to the time series data, a transmitting unit that transmits the features of the time series data via a network for collecting traffic data of the network under monitoring, a second receiving unit that receives the features of the time series data via the network for collecting traffic data of the network under monitoring, and a restoration unit that restores the time series data of bandwidth values ​​from the features of the time series data. Effect of the Invention

[0010] A traffic data collection system according to one or more embodiments of the present disclosure can reduce the burden on network bandwidth for collecting information regarding traffic. [Brief description of the drawings]

[0011] [Figure 1] FIG. 1 is a block diagram of an example environment for network monitoring. [Diagram 2] FIG. 2 shows an overview of the network monitoring process according to the present disclosure. [Diagram 3] FIG. 3 is a block diagram of an example of a configuration of a network monitoring system according to the present disclosure. [Figure 4] FIG. 4 illustrates an example of a functional architecture of a network monitoring system according to the present disclosure. [Diagram 5] FIG. 5 illustrates an example of a functional architecture of an encoder according to the present disclosure. [Figure 6A] FIG. 6A illustrates an example of feature extraction according to the present disclosure. [Figure 6B] FIG. 6B illustrates an example of feature extraction according to the present disclosure. [Figure 7] FIG. 7 illustrates an example of a functional architecture of a decoder according to the present disclosure. [Figure 8A] FIG. 8A illustrates an example of time series data reconstruction according to the present disclosure. [Figure 8B] FIG. 8B illustrates an example of time series data reconstruction according to the present disclosure. [Figure 9A] FIG. 9A illustrates an example of adjusting feature extraction parameters according to the present disclosure. [Figure 9B] FIG. 9B illustrates an example of adjusting feature extraction parameters according to the present disclosure. [Figure 10A] FIG. 10A illustrates an example of optimizing parameter set A according to the present disclosure. [Figure 10B] FIG. 10B illustrates an example of optimizing parameter set A according to the present disclosure. [Figure 11A] FIG. 11A illustrates an example of optimizing parameter set B according to the present disclosure. [Figure 11B]FIG. 11B illustrates an example of optimizing parameter set B according to the present disclosure. [Figure 11C] FIG. 11C illustrates an example of optimizing parameter set B according to the present disclosure. [Figure 11D] FIG. 11D illustrates an example of optimizing parameter set B according to the present disclosure. [Figure 12] FIG. 12 is a sequence diagram showing an example of a process for collecting time-series data of bandwidth values. [Figure 13] FIG. 13 shows an example of the hardware configuration of a computer. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] A number of embodiments will be described in detail below with reference to the drawings. However, the present invention is not limited to these embodiments. The features of the various embodiments can be combined in various ways, provided that the features are not mutually inconsistent. The same elements are indicated by the same reference numerals, and duplicated descriptions are omitted.

[0013] The following explanation is composed of 10 sections: 1. Introduction, 2. Environment for network monitoring, 3. Overview of network monitoring process, 4. Configuration of network monitoring system, 5. Details of network monitoring process, 6. Sequence diagram of network monitoring process, 7. Effects, 8. Other, 9. Hardware configuration, and 10. Summary of embodiment.

[0014] 1. Introduction Traffic data of a monitored network is collected by a network monitoring system. Time series data of the traffic is sent from a flow exporter to a flow collector or a traffic data collector. As the monitored network becomes larger and the traffic volume increases, the amount of collected traffic also increases. This leads to congestion of the collection path. The collection path is a network for collecting traffic data of the monitored network.

[0015] One method to solve this problem is sampling. Sampling can limit the amount of information sent. However, if traffic time series data is collected at a low sampling rate, the accuracy of the obtained time series data is degraded.

[0016] As mentioned above, there is a method to send traffic statistics information for each flow. However, this method using traffic statistics also sends traffic data other than the bandwidth value. Therefore, this method increases the bandwidth usage rate of the network on the collection route.

[0017] As mentioned above, there is also a method of transmitting traffic time series data for each packet arrival period via the network. However, in the method using the packet arrival period, the time series data itself is transmitted. Therefore, this method increases the load on the collection route.

[0018] In order to solve the above problems, a network monitoring system according to one or more embodiments of the present disclosure performs one or more network monitoring processes described below.

[0019] [2. Network monitoring environment] First, with reference to FIG. 1, an environment for network monitoring according to the present disclosure will be described.

[0020] 1 is a block diagram of an example of an environment for network monitoring, an environment 10. As shown in FIG. 1, the environment 10 includes a network monitoring system 11, a monitored line 12, and a network 13.

[0021] The network monitoring system 11 is a system that performs one or more network monitoring processes. The one or more network monitoring processes include a process of collecting traffic data. An overview of the network monitoring process according to the present disclosure will be described in the next section.

[0022] The network monitoring system 11 includes one or more data processing devices, such as one or more servers, one or more personal computers (PCs), one or more network devices, etc. An example of the configuration of the network monitoring system 11 is described in Section 4.

[0023] The monitoring line 12 is, for example, a WAN (Wide Area Network) line, an Internet line, etc. The monitoring line 12 connects the network monitoring system 11 and the network 13.

[0024] The network 13 is a network under monitoring. The network 13 is, for example, a network such as a WAN.

[0025] [3. Overview of network monitoring process] Next, an overview of a network monitoring process according to the present disclosure will be described with reference to Fig. 2. Note that this overview is not intended to limit the present invention or the embodiments described in the following sections.

[0026] FIG. 2 illustrates an overview 20 of a network monitoring process according to the present disclosure.

[0027] 2, the network monitoring system 11 includes a collection controller 21, a flow exporter 22, an encoder 23, and a decoder 24. The collection controller 21 is implemented, for example, by a server. The flow exporter 22 is implemented, for example, by a router. The encoder 23 and the decoder 24 are implemented, for example, by a router or a switch.

[0028] In step S1, the encoder 23 receives time-series data of bandwidth values ​​from the flow exporter 22 using IPFIX (Internet Protocol (IP) Flow Information Export). The encoder 23 holds the bandwidth values ​​and 5-tuple information for the data retention period. The encoder 23 creates time-series data of bandwidth values ​​based on the data retention period. The encoder 23 then holds the created time-series data.

[0029] The data retention period is set by the collection controller 21. In the example of FIG. 2, the data retention period is "duration: T". The collection controller 21 sets this data retention period in the encoder 23 and the decoder 24. Furthermore, the collection controller 21 sets an event time in the encoder 23. In the example of FIG. 2, the event time is "event time: xx-xx".

[0030] In step S2, the collection controller 21 adjusts parameters of STL (Seasonal and Trend decomposition using Loess (Locally estimated scatterplot smoothing)) decomposition. As described later, the STL decomposition is used to extract features from time-series data of band values.

[0031] The collection controller 21 determines the adjustment method and adjustment order of the STL decomposition parameters based on the characteristics of the parameters. A specific adjustment method will be described later with reference to Figures 9A and 9B.

[0032] In step S3, the encoder 23 decomposes the time series data of the band values ​​into a trend term, a seasonal term, and a residual term using STL decomposition. The STL decomposition is performed based on the adjusted parameters. Then, the encoder 23 extracts features from the trend term, the seasonal term, and the residual term.

[0033] The trend features are the slope and intercept. The seasonal feature is the spectrum. The residual features are the standard deviation and mean.

[0034] Furthermore, the encoder 23 extracts an event term from the time series data of the band value. The feature quantities of an event are time and quantity.

[0035] The encoder 23 sends the feature quantities of the trend term, seasonal term and residual term, as well as the event term, to the decoder 24. The path between the encoder 23 and the decoder 24 is the traffic data collection path. Thus, the encoder 23 transmits the extracted feature quantities instead of the bandwidth value.

[0036] In step S4, the decoder 24 receives the feature quantities of the trend term, the seasonal term, and the residual term, as well as the event term. The decoder 24 then restores the time series data of the band values ​​from the received feature quantities and the event term. For example, the decoder 24 uses the received feature quantities to create the trend term, the seasonal term, and the residual term. The decoder 24 then restores the time series data of the band values ​​by adding up the trend term, the seasonal term, the residual term, and the event term.

[0037] As described above, the encoder 23 of the network monitoring system 11 utilizes STL decomposition to send time-series data of bandwidth values. Therefore, the network monitoring system 11 can reduce the amount of data of bandwidth values ​​in the traffic data. As a result, the network monitoring system 11 can reduce the load on the collection path in the network monitoring system 11.

[0038] [4. Network monitoring system configuration] Next, an example of the configuration of the network monitoring system 11 will be described with reference to FIG.

[0039] Fig. 3 is a block diagram of a network monitoring system 11 which is an example of the configuration of the network monitoring system according to the present disclosure. As shown in Fig. 3, the network monitoring system 11 includes a communication unit 31, a control unit 32, and a storage unit 33. The network monitoring system 11 may include an input unit (e.g., a keyboard, a mouse) that receives input from an administrator of the network monitoring system 11. The network monitoring system 11 may also include an output unit (e.g., a liquid crystal display, an organic EL (Electro Luminescence) display) that displays information to the administrator of the network monitoring system 11.

[0040] [4-1. Communications Department 31] The communication unit 31 is implemented by network devices such as a NIC (Network Interface Card), an optical fiber cable, an L2 (Layer 2) switch, an L3 (Layer 3) switch, a router, etc. The communication unit 31 is connected to the monitoring line 12. The communication unit 31 can transmit and receive information to and from the network 13 via the monitoring line 12.

[0041] [4-2. Control unit 32] The control unit 32 is a controller. The control unit 32 uses a random access memory (RAM) as a working area and is implemented by one or more processors (e.g., a central processing unit (CPU), a micro processing unit (MPU)) that execute various programs stored in a storage device of the network monitoring system 11. The control unit 32 may also be implemented by an integrated circuit such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or a general purpose graphic processing unit (GPGPU).

[0042] 3, the control unit 32 includes an adjustment unit 34, a receiving unit 35, an extracting unit 36, and a restoration unit 37. One or more processors of the network monitoring system 11 can implement each control unit by executing instructions stored in one or more memories of the network monitoring system 11. The data processing performed by each control unit is an example, and each control unit (e.g., the extracting unit 36) may perform the data processing described in relation to other control units (e.g., the receiving unit 35).

[0043] [4-2-1. Adjustment section 34] The adjustment unit 34 adjusts parameters of the STL decomposition. The adjustment unit 34 can be implemented by the collection controller 21 of Fig. 2. The collection controller 21 is implemented by a server in the network monitoring system 11, for example.

[0044] [4-2-2. Receiving unit 35] The receiver 35 receives time-series data of bandwidth values ​​of a network under monitoring. The receiver 35 is an example of a first receiver. The network under monitoring is, for example, the network 13 in Fig. 1. The receiver 35 can be implemented by the flow exporter 22 in Fig. 2. The flow exporter 22 is implemented by, for example, a router in the network monitoring system 11.

[0045] [4-2-3. Extraction part 36] The extraction unit 36 ​​extracts feature amounts of time series data from the time series data of the bandwidth values. The extraction unit 36 ​​is also an example of a transmission unit. The extraction unit 36 ​​transmits the feature amounts of the time series data. The extraction unit 36 ​​can be implemented by the encoder 23 in Fig. 2. The encoder 23 is implemented by, for example, a router or a switch in the network monitoring system 11.

[0046] The extraction unit 36 ​​can apply a seasonal adjustment method to the time series data. For example, the extraction unit 36 ​​can use STL decomposition. To extract features of the time series data, the extraction unit 36 ​​can also use various seasonal adjustment methods other than STL decomposition. For example, the extraction unit 36 ​​can use other seasonal adjustment methods such as X-11, X-12-ARIMA, etc.

[0047] [4-2-4. Restoration section 37] The restoration unit 37 restores the time series data of the band values ​​from the feature amount of the time series data. The restoration unit 37 is also an example of a second receiving unit. The restoration unit 37 receives the feature amount of the time series data. The restoration unit 37 can be implemented by the decoder 24 in Fig. 2. The decoder 24 is implemented by, for example, a router or a switch in the network monitoring system 11.

[0048] [4-3. Storage section 33] The storage unit 33 is implemented by, for example, a semiconductor memory element such as a RAM or a flash memory, or a storage device such as a hard disk or an optical disk. The storage unit 33 stores various data used in the network monitoring process, such as parameters of STL decomposition.

[0049] [5. Details of network monitoring process] Above, an overview of the network monitoring process according to the present disclosure has been described with reference to Fig. 2. In this section, an example of the network monitoring process according to the present disclosure will be described in more detail.

[0050] 4 shows an example of a functional architecture of the network monitoring system 11 according to the present disclosure. As shown in FIG. 4, the network monitoring system 11 has three functions.

[0051] The first function is to extract features from the time series data of band values ​​using STL decomposition. The second function is to reconstruct the time series data using the features. The third function is to set the parameters of STL decomposition.

[0052] The first function is described in more detail below with reference to Figures 5, 6A and 6B. The second function is described in more detail below with reference to Figures 7, 8A and 8B. The third function is described in more detail below with reference to Figures 9A, 9B, 10A, 10B, 11A, 11B, 11C and 11D.

[0053] [5-1. Encoder Functional Architecture] Fig. 5 illustrates a functional architecture 50 that is an example of the functional architecture of an encoder according to the present disclosure. As illustrated in Fig. 5, the encoder 23 receives flow statistics from the flow exporter 22. The encoder 23 generates feature data of a bandwidth value from the flow statistics. The encoder 23 is configured by the collection controller 21.

[0054] The encoder 23 creates time-series data of bandwidth values ​​for a specified period (data retention period). This period is set by the collection controller 21. The encoder 23 also retains 5-tuple information for this period only.

[0055] The encoder 23 extracts features from the time series data using event time (time of occurrence of an event). The event time is set by the collection controller 21. The encoder 23 performs STL decomposition of the time series data based on the STL decomposition parameters. Band value feature data is extracted from the decomposed time series data. For scalability, the encoder 23 can perform multi-threaded processing.

[0056] [5-2. Feature Extraction] 6A and 6B collectively illustrate an example of feature extraction 60 according to the present disclosure. As shown in FIG. 6A, an STL decomposition is applied to the time series data of band values. The time series data is decomposed into trend, seasonality, residuals, and events. The feature data extracted from the time series data includes (1) trend slope and intercept, (2) seasonal Fourier transformed spectrum (low pass filtered), (3) mean and standard deviation of the residuals, and (4) event time and volume of events.

[0057] As shown in Fig. 6B, the collection controller 21 sets parameters such as the number of trend change points, periodicity strength characteristics, and event occurrence times. The encoder 23 generates data such as trend data, trend change points, seasonal data, and residual data by applying STL decomposition to the time series data of band values. This data is generated based on the parameters set by the collection controller 21. Furthermore, the encoder 23 generates event-related fluctuation data from the time series data of band values.

[0058] The encoder 23 extracts the slope from the trend data. The encoder 23 generates the spectrum data by applying a Fourier transform to the seasonal data. To generate the spectrum data, the encoder 23 may use a low-pass filter cutoff frequency set by the collection controller 21. The encoder 23 calculates the mean and standard deviation of the residuals by applying a residual calculation to the residual data. The encoder 23 transmits (1) the slope / intercept data and trend change points, (2) the spectrum data, (3) the mean and standard deviation of the residuals, and (4) the event-induced variation data as "STL decomposition feature data."

[0059] [5-3. Decoder Functional Architecture] Fig. 7 shows a functional architecture 70 which is an example of the functional architecture of a decoder according to the present disclosure. As shown in Fig. 7, the decoder 24 restores time-series data of band values ​​from feature amount data of STL decomposition. Then, the decoder 24 transmits the time-series data of band values ​​to a visualization server.

[0060] The decoder 24 restores the time series data of the band values ​​based on the data retention period set by the collection controller 21 and the feature data of the STL decomposition. The time series data from which the band values ​​have been restored is generated from the feature data of the STL decomposition. Then, a time is added to the time series data from which the band values ​​have been restored. The time is added based on the data retention period.

[0061] In order to support various analysis techniques, the decoder 24 may transmit not only the time-series data in which the band values ​​are restored, but also the feature data itself to the visualization server. For scale-out purposes, the decoder 24 can perform multi-thread processing, similar to the encoder 23.

[0062] [5-4. Time series data restoration] 8A and 8B collectively illustrate a time series data reconstruction 80, which is an example of a time series data reconstruction according to the present disclosure. As shown in FIG. 8A, the time series data of band values ​​is reconstructed from the feature data of the STL decomposition. As described above with reference to FIG. 6A, the feature data of the STL decomposition includes (1) the trend slope and intercept, (2) the spectrum after the seasonal Fourier transform (low pass filtered), (3) the mean and standard deviation of the residuals, and (4) the event time and amount of the events.

[0063] As shown in Figure 8B, the decoder 24 generates reconstructed trend data from the slope / intercept data and trend change points. The decoder 24 generates reconstructed seasonal data by applying an inverse Fourier transform to the spectral data. The decoder 24 generates reconstructed residual data by applying random number generation to the mean and standard deviation of the residuals. The decoder 24 generates time series data with reconstructed band values ​​by combining the reconstructed trend data, reconstructed seasonal data, reconstructed residual data, and event variation data.

[0064] [5-5. Adjusting feature extraction parameters] 9A and 9B collectively illustrate an example of tuning 90 of feature extraction parameters according to this disclosure.

[0065] A network operator (e.g., an operator of the network monitoring system 11 in FIG. 1) collects information about traffic in a network under monitoring (e.g., network 13 in FIG. 1). The network under monitoring is a target for traffic measurement. When the traffic information is collected, the operator may need to consider the available network bandwidth of the collection path. That is, it may be necessary to obtain more information more accurately under the limitations of the data size of the collected information.

[0066] Similarly, operators are required to improve the restoration accuracy as much as possible for time-series data restoration using STL decomposition, subject to data size restrictions. Therefore, the network monitoring system 11 improves the restoration accuracy, subject to data size restrictions, by optimizing parameters of the STL decomposition.

[0067] As shown in Fig. 9A, the encoder 23 optimizes the parameters of the STL decomposition. Specifically, the encoder 23 optimizes the strength of seasonality, the number of trend change points, and the size of the low-pass filter. The encoder 23 can optimize the parameters for each transmission of band value data (data transmission period T).

[0068] As shown in FIG. 9B, the encoder 23 classifies parameters by the characteristics of when the parameter value is changed.

[0069] The encoder 23 can determine whether the change in data size exceeds a threshold. If the change in data size does not exceed the threshold, the encoder 23 can adjust the strength of the seasonality. If the change in data size exceeds the threshold, the encoder 23 can adjust the number of trend change points or the size of the low pass filter.

[0070] The encoder 23 classifies parameters whose data size does not change into parameter group A. The encoder 23 classifies parameters whose data size changes into parameter group B. For example, the strength of seasonality is classified into parameter group A. The number of trend change points and the size of the low-pass filter are classified into parameter group B.

[0071] The parameters "seasonality strength, number of trend change points, and size of low-pass filter" affect the data size and reconstruction accuracy. The parameter values ​​are determined by considering the characteristics of this effect.

[0072] The encoder 23 finds an optimal solution for each of the parameter groups A and B. Note that the parameter groups A and B are independent of each other. Therefore, the optimal solutions found for each of the parameter groups A and B are the final overall optimal solutions.

[0073] [5-5-1. Optimization of parameter group A] 10A and 10B collectively illustrate an example optimization 100 of parameter set A according to the present disclosure. As shown in FIG. 10A, the encoder 23 derives a relationship between parameter variables and reconstruction accuracy. The encoder 23 then finds optimal parameter values ​​by applying an algorithm, such as simulated annealing, to this relationship.

[0074] Here, the characteristics of "seasonal strength" will be described. As shown in FIG. 10B, parameter group A includes seasonal strength. In STL decomposition, time series data is fitted to a model in which each term is combined. The original data is the sum of a trend term, a seasonal term, and a residual. When the parameter value that determines the magnitude of the seasonal term is large, the time series data is fitted to a model with a large periodicity.

[0075] [5-5-2. Optimization of parameter group B] 11A, 11B, 11C, and 11D collectively show an example of optimization 110 of parameter set B according to the present disclosure. As shown in FIG. 11A, the encoder 23 creates a parameter set constraint condition by focusing on the upper limit of the data size. As shown in FIG. 11B, the encoder 23 derives a parameter set that maximizes the reconstruction accuracy under the constraint condition. Numerical analysis is used to derive the parameter set.

[0076] 11A, a program for deriving a parameter set is started (111). First, the encoder 23 derives the relationship between the parameter set and the size of the transmission data (plane A) (112). The encoder 23 derives an intersection line x between the data size upper limit and plane A (113).

[0077] 11B, the encoder 23 derives the relationship between the parameter group and the restoration accuracy (plane B) (114). The encoder 23 derives the parameters that maximize the value of the restoration accuracy (plane B) at the intersection line x (115). The program then ends.

[0078] Here, the characteristics of the "number of trend change points" and the "size of the low-pass filter" will be described. As described above with reference to FIG. 10B, in STL decomposition, the time series data is fitted to a model in which each term is combined. As described above, the original data is the sum of the trend term, the seasonal term, and the residual. As shown in FIG. 11C, the more the number of trend change points, the more accurately the trend can be fitted to the time series data that is the subject of the decomposition. Regarding the size of the low-pass filter, the low-pass filter is used to transmit only the data of the low frequency band of the seasonal data after the Fourier transform. As shown in FIG. 11D, the size of the low-pass filter is the frequency bandwidth taken out from the function after the Fourier transform.

[0079] [6. Network monitoring process sequence diagram] Next, a sequence diagram of an example of a network monitoring process according to the present disclosure will be described with reference to Fig. 12. The example of the network monitoring process includes a process for collecting time series data of bandwidth values. The process for collecting time series data of bandwidth values ​​is performed, for example, by the network monitoring system 11 of Fig. 1.

[0080] FIG. 12 is a sequence diagram showing a process 200 which is an example of a process for collecting time-series data of bandwidth values.

[0081] In step S121, the adjustment unit 34 of the network monitoring system 11 transmits the parameters of the STL decomposition to the extraction unit 36 ​​of the network monitoring system 11.

[0082] In step S122, the receiving unit 35 of the network monitoring system 11 transmits to the extracting unit 36 ​​the time-series data on the bandwidth value of the network under monitoring.

[0083] In step S123, the extraction unit 36 ​​extracts feature amounts of the time-series data from the time-series data based on the parameters of the STL decomposition.

[0084] In step S 124 , the extraction unit 36 ​​transmits the feature amount of the time-series data to the restoration unit 37 of the network monitoring system 11 .

[0085] In step S125, the restoration unit 37 restores the time series data of the band values ​​from the feature amounts of the time series data.

[0086] [7. Effects] As described above, the network monitoring system 11 utilizes STL decomposition for transmitting time series data of bandwidth. The time series data of bandwidth is important from the viewpoint of network maintenance and operation. The extraction unit 36 ​​of the network monitoring system 11 extracts feature amounts of the time series data by applying STL decomposition to the time series data. Then, the extraction unit 36 ​​transmits the feature amounts of the time series data to the restoration unit 37 of the network monitoring system 11. As a result, the network monitoring system 11 can reduce the bandwidth of the collection path.

[0087] [8. Other] A portion of a process described as being performed automatically may be performed manually. Alternatively, all or a portion of a process described as being performed manually may be performed automatically in a known manner. Furthermore, information including the procedure, specific names, various data, and parameters of the processes shown in this specification and drawings may be changed arbitrarily unless otherwise specified. For example, various information shown in each drawing is not limited to the illustrated information.

[0088] The components of the illustrated systems and devices conceptually illustrate the functions of the systems and devices. The components are not necessarily physically configured as shown in the drawings. In other words, the specific form of the distributed or integrated systems and devices is not limited to the form of the systems and devices shown in the drawings. All or part of the systems and devices may be functionally or physically distributed or integrated depending on various loads and usage conditions.

[0089] [9. Hardware Configuration] 13 is a diagram showing an example of a hardware configuration of a computer 1000. The systems and methods described in this specification are implemented by, for example, the computer 1000 shown in FIG.

[0090] 13 shows an example of a computer in which a program is executed to implement the network monitoring system 11. The computer 1000 has, for example, a memory 1010 and a CPU 1020. The computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0091] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or an optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0092] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, a program that defines each process of the network monitoring system 11 is implemented as a program module 1093 in which code executable by the computer 1000 is written. The program module 1093 is stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing the same process as the functional configuration in the network monitoring system 11 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0093] The hard disk drive 1090 can store a traffic data collection program for network monitoring processing. The traffic data collection program can also be created as a program product that, when executed, performs one or more of the methods described above.

[0094] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in memory 1010 or hard disk drive 1090. Then, CPU 1020 reads out program module 1093 or program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as necessary, and executes the program.

[0095] Note that the program module 1093 and the program data 1094 are not limited to being stored in the hard disk drive 1090, but may be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and the program data 1094 may be stored in another computer connected via a network (LAN, WAN, etc.). Then, the program module 1093 and the program data 1094 may be read by the CPU 1020 from the other computer via the network interface 1070.

[0096] 10. Summary of the embodiment As described above, the network monitoring system 11 according to the present disclosure includes a receiving unit 35, an extracting unit 36, and a restoring unit 37. In at least one embodiment, the receiving unit 35 receives time series data of bandwidth values ​​of a network under monitoring. In at least one embodiment, the extracting unit 36 ​​extracts feature quantities of the time series data from the time series data of the bandwidth values ​​by applying a seasonal adjustment method to the time series data. Then, the extracting unit 36 ​​transmits the feature quantities of the time series data via a network for collecting traffic data of the network under monitoring. In at least one embodiment, the restoring unit 37 receives the feature quantities of the time series data via a network for collecting traffic data of the network under monitoring. Then, the restoring unit 37 restores the time series data of the bandwidth values ​​from the feature quantities of the time series data.

[0097] In some embodiments, the extraction unit 36 ​​decomposes the time series data of the band values ​​into a trend term, a seasonal term, and a residual term by applying STL decomposition to the time series data, and extracts feature quantities of the time series data from the trend term, the seasonal term, and the residual term.

[0098] As described above, the network monitoring system 11 according to the present disclosure includes an adjustment unit 34. In at least one embodiment, parameters of the STL decomposition are adjusted based on the change in size of the time series data when the parameters are changed. In some embodiments, the extraction unit 36 ​​decomposes the time series data of the band values ​​into trend terms, seasonal terms, and residual terms by applying the STL decomposition based on the parameters adjusted by the adjustment unit 34 to the time series data.

[0099] In some embodiments, the adjustment unit 34 determines whether the change in size of the time series data exceeds a threshold, and adjusts a parameter that is the strength of seasonality if the change in size of the time series data does not exceed the threshold, and adjusts a parameter that is the number of trend change points or the size of the low-pass filter if the change in size of the time series data exceeds the threshold.

[0100] In some embodiments, the extraction unit 36 ​​extracts an event term indicating a fluctuation due to an event from the time-series data of the band value, and transmits the event term as a feature amount of the time-series data.

[0101] In some embodiments, the extraction unit 36 ​​extracts feature quantities of the time series data from the time series data of the band values ​​for the predetermined period. In some embodiments, the restoration unit 37 restores the time series data of the band values ​​for the predetermined period based on the feature quantities of the time series data and the predetermined period.

[0102] Although various embodiments have been described in detail herein with reference to the drawings, these embodiments are merely examples and are not intended to limit the present invention to these embodiments. The features described herein can be realized in various ways, including various modifications and improvements based on the knowledge of those skilled in the art.

[0103] Furthermore, the above-mentioned "module (-er suffix, -or suffix)" can be read as a unit, a means, a circuit, etc. For example, a communication module, a control module, and a storage module can be read as a communication unit, a control unit, and a storage unit, respectively. [Explanation of symbols]

[0104] 10 Environment 11 Network Monitoring System 12 Monitoring Line 13 Network 31 Communications Department 32 Control section 33 Storage section 34 Adjustment part 35 Receiving section 36 Extraction part 37 Restoration Department

Claims

1. A first receiving unit that receives time series data of bandwidth values ​​of a network under monitoring; an extraction unit that extracts a feature amount of the time series data from the time series data of the band values ​​by applying a seasonal adjustment method to the time series data; a transmission unit that transmits the feature amount of the time series data via a network for collecting traffic data of the network under monitoring; a second receiving unit that receives the feature amount of the time series data via a network for collecting traffic data of the network under monitoring; A restoration unit that restores the time series data of the band values ​​from the feature amount of the time series data. A traffic data collection system comprising:

2. The extraction unit decomposes the time series data of the band values ​​into a trend term, a seasonal term, and a residual term by applying STL (Seasonal and Trend decomposition using Loess (Locally estimated scatterplot smoothing)) decomposition to the time series data, and extracts feature amounts of the time series data from the trend term, the seasonal term, and the residual term.

2. The traffic data collection system according to claim 1.

3. An adjustment unit that adjusts a parameter of the STL decomposition based on a change in the size of the time-series data when the parameter is changed, The extraction unit decomposes the time series data of the band values ​​into a trend term, a seasonal term, and a residual term by applying STL decomposition to the time series data based on the parameters adjusted by the adjustment unit.

3. A traffic data collection system according to claim 2.

4. The adjustment unit determines whether a change in size of the time series data exceeds a threshold, adjusts the parameter representing the strength of seasonality when the change in size of the time series data does not exceed the threshold, and adjusts the parameter representing the number of trend change points or the size of a low-pass filter when the change in size of the time series data exceeds the threshold.

4. A traffic data collection system according to claim 3.

5. The extraction unit extracts an event term indicating a fluctuation due to an event from the time series data of the band value, The transmission unit transmits the event term as a feature of the time series data. A traffic data collection system according to any one of claims 1 to 4.

6. The extraction unit extracts a feature amount of the time series data from the time series data of the band value for a predetermined period of time; The restoration unit restores the time series data of the band value for the predetermined period based on a feature amount of the time series data and the predetermined period. A traffic data collection system according to any one of claims 1 to 5.

7. 1. A computer implemented method for collecting traffic data, comprising: A first receiving unit that receives time series data of bandwidth values ​​of a network under monitoring; an extraction unit that extracts a feature amount of the time series data from the time series data of the band values ​​by applying a seasonal adjustment method to the time series data; a transmitting unit that transmits the feature amount of the time series data via a network for collecting traffic data of the network under monitoring; a second receiving unit that receives the feature amount of the time series data via a network for collecting traffic data of the network under monitoring; A restoration unit that restores the time series data of the band values ​​from the feature amount of the time series data. A traffic data collection method comprising:

8. A traffic data collection program for causing a computer to function as the traffic data collection system according to any one of claims 1 to 6.

Images