Traffic monitoring device, traffic monitoring method, and traffic monitoring program

Abstract

A traffic monitoring device (20): acquires IF statistical data and flow statistical data from an external storage device that accumulates the IF statistical data and the flow statistical data, said IF statistical data being statistical information by IF acquired from network devices and said flow statistical data being statistical information calculated from sampled packets; and calculates a total traffic amount for each individual flow on the basis of the total traffic amount for each IF calculated from the IF statistical data and the sum of the traffic amounts for each flow calculated from the flow statistical data.

Description

[Technical Field]

[0001] The present invention relates to a traffic monitoring device, a traffic monitoring method, and a traffic monitoring program. [Background technology]

[0002] In recent years, the importance of collecting and analyzing traffic has increased for the purpose of detecting failures and anomalies in applications, services, etc. One known technology for this purpose is xFlow, which aggregates and analyzes traffic by transferring flow statistics calculated from packet header information or the header portion itself (header sample). Among these xFlow technologies, IPFIX w / IE315 (Non-Patent Document 1) and sFlow (Non-Patent Document 2), which extract and transfer header samples, are known. In addition, tFlow (Non-Patent Document 3) and IPFIX (Non-Patent Documents 4 to 9), which are network (hereinafter referred to as "NW") equipment that transfer flow statistics calculated from packet header information, are known.

[0003] On the other hand, as a method for analyzing encapsulated packets, a format conversion device is known that analyzes the header samples of sampled encapsulated packets and transmits flow information such as outer / inner header information and flow statistical information such as traffic volume and number of packets calculated per flow (see Patent Document 1 and Non-Patent Document 10).

[0004] Furthermore, network devices on the network can also transmit IF statistical information such as the total traffic volume and the total number of packets for each interface (hereinafter referred to as "IF") of the network device at regular time intervals by telemetry. [Prior art documents] [Patent documents]

[0005] [Patent Document 1] Patent Publication No. 2021-090161 [Non-patent literature]

[0006]

Non-patent document 1

Non-patent document 2

Non-patent document 3

Non-patent document 4

Non-patented document 5

[0007] However, with conventional techniques, it was not possible to estimate the total traffic volume for each flow based on the flow statistical information of the sampled header samples and the statistical information for each IF collected by telemetry, without collecting header samples of all packets.

[0008] For example, when detecting traffic anomalies caused by applications or services, it is necessary to monitor the total traffic volume for each flow of the application or service. However, using xFlow technology to sample packets and obtain header samples does not allow for the calculation of the total traffic volume for each flow of all packets that have not been sampled. On the other hand, collecting header samples of all packets instead of sampling allows for the calculation of the total traffic volume for each flow, but this increases the number of header samples transferred, which raises concerns about a significant increase in network load.

[0009] In addition, in the method of collecting statistical information per IF from network devices using telemetry, it is possible to collect the total traffic volume per IF from the network devices, but it is not possible to calculate the total traffic volume per flow from the total traffic volume per IF. [Means for solving the problem]

[0010] In order to solve the above problems and achieve the object, the traffic monitoring device of the present invention is characterized by comprising: an acquisition unit that acquires IF statistical data, which is statistical information on an IF basis acquired from a network device, and flow statistical data, which is statistical information calculated from sampled packets, from an external storage device that accumulates the IF statistical data and the flow statistical data; and a first calculation unit that calculates the total traffic volume for each individual flow based on the total traffic volume for each IF calculated from the IF statistical data and the total traffic volume for each flow calculated from the flow statistical data. [Effects of the Invention]

[0011] The present invention has the advantage of making it possible to estimate the total traffic volume for each flow based on IF-based statistical information collected by telemetry and flow statistical information of sampled header samples, without collecting header samples of all packets. [Brief explanation of the drawings]

[0012] [Figure 1] FIG. 1 is a diagram illustrating an example of an overview of traffic monitoring according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating an example of the device configuration of the data lake and the traffic monitoring device according to the embodiment. [Figure 3] FIG. 3 is a data table diagram illustrating an example of IF statistical data collected by the data lake according to the embodiment. [Figure 4] FIG. 4 is a data table diagram illustrating an example of flow statistical data acquired from the data lake by the traffic monitoring device according to the embodiment. [Figure 5] FIG. 5 is a diagram illustrating an example of calculation of the total traffic volume for each flow according to the embodiment. [Figure 6] FIG. 6 is a diagram illustrating an example of calculation of the total traffic volume for each flow in a network device in an area other than the representative area according to the embodiment. [Figure 7] FIG. 7 is a flowchart of data collection and centralized management using a data lake according to the embodiment. [Figure 8] FIG. 8 is a flowchart of calculation of the total traffic volume for each flow in the network device in the representative area by the traffic monitoring device according to the embodiment. [Figure 9] FIG. 9 is a flowchart of calculation of the total traffic volume for each flow in a network device in another area by the traffic monitoring device according to the embodiment. [Figure 10] FIG. 10 is a diagram illustrating an example of a computer in which the data lake and the traffic monitoring device according to the embodiment are implemented. DETAILED DESCRIPTION OF THE INVENTION

[0013] Hereinafter, with reference to the drawings, a description will be given of an embodiment (hereinafter, "embodiment") for carrying out the present invention. Note that the present invention is not limited to this embodiment. Furthermore, in the embodiment of the present invention, "the total value of the traffic volume of all packets that meet a predetermined condition" is defined as "total traffic volume," "the total value of all the traffic volumes per flow of sampling packets that meet a predetermined condition" is defined as "total traffic volume of all flows," and "the total value of the traffic volumes per flow of sampling packets that meet a predetermined condition, only for flows to be monitored" is defined as "total traffic volume per flow," and these terms will be consistently described below.

[0014] [1. Overview] In the present invention, a data lake 10 (hereinafter simply referred to as "data lake 10"), which is an external storage device, collects and centrally manages telemetry data 50 from a network device 40 and flow statistics xFlow packets 52 of encapsulated packets from a format conversion device 30 in a network in which multiple service networks are superimposed. Furthermore, a traffic monitoring device 20 acquires IF statistics data 55 including information such as the total traffic volume per IF and flow statistics data 56 including information such as the traffic volume per flow of sampled encapsulated packets from the data lake 10 based on predetermined conditions, calculates the total traffic volume for each flow of the application, service, etc. to be monitored, and performs traffic monitoring.

[0015] 2. Example of Traffic Monitoring According to the Embodiment First, an example of processing performed by the data lake 10 and the traffic monitoring device 20 will be described with reference to FIG. 1. FIG. 1 is a diagram illustrating an example of an overview of traffic monitoring according to an embodiment. In FIG. 1, a network device 40, which is a communication device on a network, first transmits telemetry data 50 to the data lake 10. The telemetry data 50 includes "network device identification information," "network device IF identification information," "time information," "received traffic volume," "transmitted traffic volume," "number of received packets," and "number of transmitted packets" acquired by telemetry. The number of network devices 40 in the network is not limited, and multiple devices may be included as needed for the network configuration. The telemetry data 50 may also include information other than the information described above.

[0016] Next, the network device 40 transmits the sampled encapsulated packet as an xFlow packet 51 to the format conversion device 30. The xFlow packet 51 includes a "header sample of the encapsulated packet," a "sampling rate," "time information," "network device identification information," "network device IF identification information," "communication direction," and "packet size before sampling." The xFlow packet 51 may include information other than the above-mentioned information.

[0017] Next, the format conversion device 30 that has received the xFlow packet 51 calculates statistical information for each flow from the xFlow packet 51 and transmits a flow statistics xFlow packet 52 to the data lake 10. The flow statistics xFlow packet 52 includes "flow information including outer header information, inner header information, etc.," "flow statistical information including the traffic volume of inner packets, the traffic volume of packets including outer headers, the number of packets, etc., calculated for each flow," "time information," "sampling rate," "network device identification information," "interface identification information of the network device," and "communication direction." Note that the flow statistics xFlow packet 52 may include information other than the information described above.

[0018] The data lake 10 centrally manages network topology information 53, network device information 54 such as IFs and IP addresses of the network devices that make up the network, information contained in the telemetry data 50 (hereinafter referred to as IF statistical data 55), and information contained in the flow statistical xFlow packet 52 (hereinafter referred to as flow statistical data 56).

[0019] Next, the traffic monitoring device 20 acquires IF statistical data 55 and flow statistical data 56 based on predetermined conditions from the data lake 10. Next, based on the acquired IF statistical data 55 and flow statistical data 56, the traffic monitoring device 20 calculates an estimate of the total traffic volume for each flow of the application, service, etc. to be monitored.

[0020] [3. Example of data lake and traffic monitoring device configuration] The configuration of the data lake 10 and the traffic monitoring device 20 according to the embodiment will be described with reference to Fig. 2. As shown in Fig. 2, the present invention is realized by a device configuration including the data lake 10 and the traffic monitoring device 20. The detailed functions of each unit will be described below.

[0021] (Data Lake 10) The data lake 10 includes a communication unit 11, a storage unit 12, and a control unit 13. Although not shown, the data lake 10 may also include an input unit (e.g., a keyboard, a mouse, etc.) that accepts various operations and a display unit (e.g., a display, etc.) that displays various information.

[0022] The data lake 10 is a device capable of centrally storing structured data and unstructured data. For example, it can store structured data with regularity, such as XML files and CSV files, as well as unstructured data, such as image files, document files, video files, and emails, in their original formats. The data lake 10 may also have the function of storing only structured data.

[0023] (Communications Department 11) The communication unit 11 of the data lake 10 is realized by a network interface card (NIC) or the like, and controls communication via a telecommunication line such as a local area network (LAN) or the Internet. The traffic monitoring device 20, which will be described later, acquires data via the communication unit 11 of the data lake 10 and a communication unit 21 of the traffic monitoring device 20.

[0024] (Storage unit 12) The storage unit 12 of the data lake 10 stores data and programs necessary for various processes performed by the control unit 13. The storage unit 12 also includes an IF statistical data storage unit 121 and a flow statistical data storage unit 122. The storage unit 12 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0025] (IF statistical data storage unit 121) The IF statistical data storage unit 121 stores the IF statistical data 55 based on information contained in the telemetry data 50 transmitted from the NW device 40.

[0026] (Flow statistical data storage unit 122) The flow statistics data storage unit 122 stores flow statistics data 56 based on information contained in the flow statistics xFlow packet 52 transmitted from the format conversion device 30 .

[0027] (Control unit 13) The control unit 13 of the data lake 10 has a collection unit 131. The control unit 13 has an internal memory for temporarily storing programs that define various processing procedures and the like and processing data, and is realized by electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit), or integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array).

[0028] (Collection Department 131) The collector 131 collects IF statistical data 55 based on information contained in telemetry data 50 transmitted from the network device 40, and collects flow statistical data 56 based on information contained in flow statistical xFlow packets 52 transmitted from the format conversion device 30. Note that the data collected by the collector 131 is not limited to the above-mentioned information, and other information may be collected.

[0029] (Traffic monitoring device 20) Next, a description will be given of the traffic monitoring device 20. The traffic monitoring device 20 has a communication unit 21, a storage unit 22, and a control unit 23. Although not shown, the traffic monitoring device 20 may also have an input unit (e.g., a keyboard, a mouse, etc.) that accepts various operations, and a display unit (e.g., a display, etc.) that displays various information.

[0030] (Communications Department 21) The communication unit 21 of the traffic monitoring device 20 is realized by a NIC or the like, and controls communication via a telecommunication line such as a LAN or the Internet. The traffic monitoring device 20 acquires data via the communication unit 11 of the data lake 10 and the communication unit 21 of the traffic monitoring device 20.

[0031] (Storage unit 22) The memory unit 22 of the traffic monitoring device 20 stores data and programs necessary for various processes performed by the control unit 23. The memory unit 22 is realized by a semiconductor memory element such as a RAM (Random Access Memory) or a flash memory, or a storage device such as a hard disk or an optical disk.

[0032] (Control unit 23) The control unit 23 of the traffic monitoring device 20 includes an acquisition unit 231, a first calculation unit 232, and a second calculation unit 233. The control unit 23 has an internal memory for temporarily storing programs that define various processing procedures and processing data, and is realized by electronic circuits such as a CPU or MPU, or integrated circuits such as an ASIC or FPGA.

[0033] (Acquisition part 231) The acquiring unit 231 acquires the IF statistical data 55 and the flow statistical data 56 based on predetermined acquisition conditions from a data lake 10, which is an external storage device that accumulates the IF statistical data 55, which is statistical information for each IF acquired from a network device, and the flow statistical data 56, which is statistical information calculated from sampled packets. Then, the acquiring unit 231 acquires the IF statistical data 55 and the flow statistical data 56, which have the same NW device identification information, IF identification information, and communication direction, and whose measurement time is within a predetermined period, from the data lake 10. Note that the data acquisition conditions may include conditions other than those described above. Furthermore, the traffic volume acquired from the flow statistical data 56 may be the "traffic volume of inner packets" or the "traffic volume of packets including an outer header."

[0034] Here, when the data lake 10 holds information with different expressions for the same attribute in the IF statistical data 55 and the flow statistical data 56, for example, when the same network device is expressed with different identification information, the acquisition unit 231 can acquire the above data from the data lake 10 by previously storing in the management device the identification information for the same attribute in the IF statistical data 55 and the flow statistical data 56 in correspondence with each other.

[0035] (First calculation unit 232) The first calculation unit 232 calculates the total traffic volume of the IF for a predetermined measurement period by adding up the NW device identification information, the IF identification information, and the total traffic volume per IF that has the same communication direction and is measured at a predetermined time period, which are information included in the IF statistical data 55 acquired by the acquisition unit 231 in paragraph 0033. Note that, when the "traffic volume of inner packets" is acquired in the flow statistical data 56 in paragraph 0033, the first calculation unit 232 calculates the total traffic volume of the IF for the predetermined measurement period by adding up the total traffic volume per IF in the IF statistical data 55 and the total number of packets per IF for the predetermined measurement period.

[0036] The first calculation unit 232 also calculates an estimate of the total traffic volume for each individual flow of the application, service, etc. to be monitored, based on the total traffic volume for a predetermined measurement period of the per-flow traffic volume of sampling packets, which is information included in the flow statistical data 56 acquired by the acquisition unit 231 in paragraph 0033, and the total traffic volume of the IF. The traffic monitoring device 20 identifies the flow of the application or service to be monitored by using, alone or in combination, outer header information and inner header information, which are information included in the flow statistical data 56.

[0037] 3 to 5, an example will be described in which the acquisition unit 231 acquires the IF statistical data 55 and the flow statistical data 56, and the first calculation unit 232 calculates an estimate of the total traffic volume of the application k to be monitored in the network device of the representative area. In this example, the acquisition conditions for the IF statistical data 55 and the flow statistical data 56 are set as follows: measurement period "from T1 to T2", network device identification information "NE1", IF identification information "IF1", and communication direction "downstream".

[0038] First, the acquiring unit 231 acquires IF statistical data 55 that matches the above-mentioned data acquisition conditions from the data lake 10. Fig. 3 shows an example of the IF statistical data 55 acquired by the acquiring unit 231. For example, the acquiring unit 231 acquires IF statistical data 55 in which the data in the first row of the table is start time "T1", end time "T1_3", NW device identification information "NE1", IF identification information "IF1", total downstream IF-unit traffic volume (byte) "X1", and total downstream IF-unit packet count "N1". Note that when the communication direction is set to "upstream" in the acquisition conditions, the acquiring unit 231 acquires IF statistical data 55 for the upstream direction.

[0039] Next, the acquiring unit 231 acquires flow statistical data 56 that matches the aforementioned data acquisition conditions from the data lake 10. Fig. 4 shows an example of the flow statistical data 56 acquired by the acquiring unit 231. For example, the acquiring unit 231 acquires flow statistical data 56 in which the data in the first row of the table has a start time of "T1", an end time of "T1_1", NW device identification information of "NE1", IF identification information of "IF1", a communication direction of "downstream", a sampling rate of "10,000", outer header information of "f1_out", inner header information of "f1_in", a per-flow traffic volume (byte) of "100", and a per-flow packet count of "10".

[0040] In FIG. 4, the Outer header information in this example is shown as "f1_out" and the Inner header information is shown as "f1_in", but the actual Outer header information includes a 5-tuple including a source IP address, a source port number, a destination IP address, a destination port number, and a protocol number, an MPLS (Multi-Protocol Label Switching) label, etc., and the actual Inner header information includes the above-mentioned 5-tuple, etc.

[0041] The traffic monitoring device 20 identifies the flow of the application or service to be monitored by using, alone or in combination, the port number and source IP address contained in the 5-tuple of the Outer header information and Inner header information described above. Note that the combination of information such as the 5-tuple used to identify a flow is not limited to the information and combinations described above, and other information and combinations can also be used to identify a flow.

[0042] Next, an example of calculating the total traffic volume α of application k in a network device in a representative area will be described with reference to Fig. 5. First, the first calculation unit 232 adds up all the network device identification information, IF identification information, and per-flow traffic volume (bytes) for which the communication direction is the same and the measurement time is within a predetermined period in the flow statistical data 56 of the sampling packets acquired by the acquisition unit 231 in paragraph 0039 for the network devices in the representative area, to calculate the total traffic volume Sa of all flows. Next, the first calculation unit 232 extracts data of the application k to be monitored based on the inner header information such as the port number and server-side IP address of the inner header included in the flow statistical data 56, and calculates the total traffic volume Sk for each flow of application k.

[0043] Next, the first calculation unit 232 calculates the total traffic volume α of application k in the network device in the representative area by using the total traffic volume Sa of all flows, the total traffic volume Sk of application k, and the total traffic volume (bytes) XA of the IF calculated in paragraph 0035. For example, the calculation is performed using the following formula (1).

[0044]

number

[0045] The total traffic volume for each flow of other applications may be substituted for Sk in the above-mentioned formula (1). For example, the first calculation unit 232 can calculate the total traffic volume β of application m in the network device in the representative area by using the total traffic volume Sm of application m.

[0046] (Second calculation unit 233) The second calculation unit 233 calculates an estimate of the total traffic volume per flow in the network device in an arbitrary area based on the total traffic volume per IF and the total traffic volume per flow in the network device in the representative area calculated by the first calculation unit 232, and the total traffic volume per IF in the network device in an arbitrary area other than the representative area.

[0047] An example will be described below in which the total traffic volume for each flow of each application in network devices in other areas is calculated using the total traffic volume for each flow of each application calculated based on IF statistical data 55 and flow statistical data 56 in network devices in a representative area in Fig. 6. Note that because the topology of a carrier network is designed so that network facilities are used evenly based on user distribution, the geographical difference in traffic observed by core routers is small, and the flow distribution of an application is almost the same between the representative area from which flow statistical data 56 was acquired and other areas.

[0048] First, the acquiring unit 231 acquires IF statistical data 55 of network devices in other areas other than the representative area. The acquiring unit 231 acquires IF statistical data 55 that matches the network device identification information and IF identification information of the network device in the other area and whose communication direction and measurement period match the data acquisition conditions of the IF statistical data 55 acquired when calculating the total traffic amount α of application k in the network device in the representative area. Next, the first calculating unit 232 derives the total traffic amount (bytes) YB of the IF in question during a predetermined measurement period for the acquired IF statistical data 55 of the network device in the other area. Subsequently, the second calculating unit 233 calculates the total traffic amount α' of application k in the network device in the other area using the total traffic amount α of application k in the network device in the representative area calculated by the first calculating unit 232, the total traffic amount XA for each IF in the network device in the representative area, and the total traffic amount YB for each IF in the network device in the other area. For example, the calculation is performed using the following formula (2).

[0049]

number

[0050] The total traffic volume for each flow of another application may be substituted for α in the above-mentioned formula (2). For example, the second calculation unit 233 can calculate the total traffic volume β' of application m in the network devices in the other areas by using the total traffic volume β of application m in the network device in the representative area.

[0051] [4. Traffic monitoring method procedure] 7 to 9, the procedure of the traffic monitoring method using the data lake 10 and the traffic monitoring device 20 will be described. First, the procedure by which the data lake 10 collects and centrally manages data will be described using FIG.

[0052] 7, the format conversion device 30 collects header samples from xFlow packets 51 (step S11). Next, the data lake 10 collects telemetry data 50 from the network device 40 and flow statistic xFlow packets 52 from the format conversion device 30 (step S12). Then, the data lake 10 centrally manages the network topology information 53, the network device information 54, the IF statistic data 55, and the flow statistic data 56 (step S13).

[0053] Next, the procedure for calculating the total traffic volume for each flow in the network device of the representative area by the traffic monitoring device 20 will be described with reference to Fig. 8. First, the acquisition unit 231 acquires the IF statistical data 55 and the flow statistical data 56 in the network device of the representative area from the data lake 10 based on predetermined conditions (step S21). Next, the first calculation unit 232 calculates the total traffic volume XA for each IF in the network device of the representative area based on the IF statistical data 55 (step S22). The first calculation unit 232 calculates the total traffic volume Sa of all flows and the total traffic volume Sk of the application k to be monitored based on the flow statistical data 56 (step S23). Furthermore, the first calculation unit 232 calculates and stores the total traffic volume α of application k in the network device of the representative area using the total traffic volume XA for each IF in the network device of the representative area, the total traffic volume Sa of all flows, and the total traffic volume Sk of application k to be monitored (step S24).

[0054] Next, the procedure for calculating the total traffic volume in the network devices in other areas by the traffic monitoring device 20 will be described with reference to Fig. 9. First, the acquisition unit 231 acquires IF statistical data 55 in the network devices in other areas from the data lake 10 based on predetermined conditions (step S31). Next, the first calculation unit 232 calculates the total traffic volume YB for each IF in the network devices in other areas (step S32). Next, the second calculation unit 233 acquires the total traffic volume α of application k in the network devices in the representative area, which was calculated in advance by the first calculation unit 232 (S24 in Fig. 8) (step S33). Next, the second calculation unit 233 calculates the total traffic volume α' of application k in the network device in the other area using the total traffic volume YB for each IF in the network device in the other area, the total traffic volume α of application k in the network device in the representative area, and the total traffic volume XA for each IF in the network device in the representative area (step S34).

[0055] [5. Effects] As described above, in the present invention, the data lake 10 collects and centrally manages the telemetry data 50 transmitted by the network device 40 and the flow statistics xFlow packets 52 transmitted by the format conversion device 30. In addition, the traffic monitoring device 20 acquires the IF statistics data 55 and flow statistics data 56 accumulated in the data lake 10 based on predetermined conditions, and calculates the total traffic volume for each flow of the application or service to be monitored. Therefore, the present invention has the following effects.

[0056] [5-1. Traffic monitoring for each flow] The traffic monitoring device 20 can calculate the total traffic volume for each flow of a monitored application, service, or the like, and therefore can monitor traffic for each flow of a monitored application, service, or the like in order to detect abnormalities in the application, service, or the like.

[0057] [5-2. Calculating the total traffic volume per flow using a low-load method] The traffic monitoring device 20 calculates the total traffic volume for each flow of the application or service to be monitored, without collecting header samples of all packets, using flow statistical data 56 of the sampled header samples and IF statistical data 55, which is telemetry data with a small amount of data. Therefore, the traffic monitoring device 20 can calculate the target total traffic volume using a method that places a low load on the network.

[0058] [5-3. Reducing traffic volume across the network] The traffic monitoring device 20 collects header samples only from network devices in the representative area, and for network devices in areas other than the representative area, it can calculate the total traffic volume for each flow of the monitored application, service, etc. by simply obtaining IF statistical data 55, thereby reducing the load on the network and the network devices.

[0059] [6. Hardware Configuration] The components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of each device can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0060] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can also be performed manually using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters shown in the drawings can be changed as desired unless otherwise specified.

[0061] [program] In one embodiment, the data lake 10 and the traffic monitoring device 20 can be implemented by installing a traffic monitoring program, which collects the data and monitors traffic, as package software or online software on a desired computer. For example, by executing the traffic monitoring program on an information processing device, the information processing device can function as the data lake 10 and the traffic monitoring device 20. The information processing device referred to here includes desktop and notebook personal computers. Other information processing devices also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

[0062] 10 is a diagram showing an example of a computer in which the data lake 10 and the traffic monitoring device 20 are implemented. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0063] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0064] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define the processes of the data lake 10 and the traffic monitoring device 20 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, a program module 1093 for executing processes similar to those of the functional configurations in the data lake 10 and the traffic monitoring device 20 is stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0065] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0066] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN or a WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0067] [7. Other] Although the present invention has been described above as an embodiment, the present invention is not limited to the description and drawings that form part of the disclosure of the present invention. In other words, other embodiments, examples, and operational techniques that can be made by those skilled in the art based on the present invention are all included in the scope of the present invention. [Explanation of symbols]

[0068] 10. Data Lake 11 Communications Department 12 Storage section 121 IF statistical data storage unit 122 Flow Statistics Data Storage Unit 13 Control Unit 131 Collection Department 20 Traffic monitoring device 21 Communications Department 22 Memory section 23 Control Unit 231 Acquisition Department 232 First Calculation Unit 233 Second Calculation Unit 30 Format conversion device 40 NW equipment 50 Telemetry Data 51 xFlow packets 52 Flow Statistics xFlow Packets 53 Network topology information 54 NW device information 55 IF Statistical Data 56 Flow Statistics XA Total traffic volume per IF in the network equipment of the representative area YB Total traffic volume per IF in network equipment in other areas α Total traffic volume of application k in the network equipment in the representative area α' Total traffic volume of application k in network devices in other areas β Total traffic volume of application m in the network equipment in the representative area β' Total traffic volume of application m in network devices in other areas Sk: total traffic volume of application k Sm Total traffic volume of application m Sa: Total traffic volume of all flows 1000 computers 1010 memory 1011 ROM 1012 RAM 1020 CPU 1030 hard disk drive interface 1040 disk drive interface 1050 serial port interface 1060 video adapter 1070 Network Interface 1080 Bus 1090 hard disk drive 1091 OS 1092 Application Program 1093 Program Module 1094 Program Data 1100 disk drive 1110 Mouse 1120 keyboard

Claims

1. an acquisition unit that acquires IF statistical data, which is statistical information for each IF acquired from a network device, and flow statistical data, which is statistical information calculated from sampled packets, from an external storage device that accumulates the IF statistical data and the flow statistical data; a first calculation unit that calculates a total traffic volume for each individual flow based on the total traffic volume for each IF calculated from the IF statistical data and the total traffic volume for each flow calculated from the flow statistical data; A traffic monitoring device comprising:

2. The network device further includes a second calculation unit that calculates the total traffic amount for each flow in a network device in an arbitrary area based on the total traffic amount for each IF and the total traffic amount for each flow in a network device in a representative area and the total traffic amount for each IF in a network device in the arbitrary area other than the representative area.

2. The traffic monitoring device according to claim 1.

3. A traffic monitoring method executed by a traffic monitoring device, comprising: acquiring IF statistical data, which is statistical information for each IF acquired from a network device, and flow statistical data, which is statistical information calculated from sampled packets, from an external storage device that accumulates the IF statistical data and the flow statistical data; calculating a total traffic volume for each individual flow based on the total traffic volume for each IF calculated from the IF statistical data and the total traffic volume for each flow calculated from the flow statistical data; A traffic monitoring method comprising:

4. A traffic monitoring program for causing a computer to execute a method, comprising: acquiring IF statistical data, which is statistical information for each IF acquired from a network device, and flow statistical data, which is statistical information calculated from sampled packets, from an external storage device that accumulates the IF statistical data and the flow statistical data; calculating a total traffic volume for each individual flow based on the total traffic volume for each IF calculated from the IF statistical data and the total traffic volume for each flow calculated from the flow statistical data; A traffic monitoring program characterized by executing the above.

Images