Analysis device, analysis method, and program

Abstract

The present invention provides a technology with which it is possible to easily grasp the occurrence of switching between communication paths. This analysis device specifies feature information relating to the respective arrival times of different communication paths in a communication network on the basis of a difference in the arrival time of a communication packet between a first communication device and a second communication device that are connected via the communication network.

Description

[Technical Field]

[0001] The present invention relates to an analysis device, an analysis method, program Regarding. [Background technology]

[0002] Communication devices installed at different locations and connected to each other via a communication network can communicate without being aware that the communication paths that make up the communication network are being switched over time. The switching of communication paths may be performed at the discretion of a telecommunications carrier that operates the communication network. For example, in order to perform maintenance on relay devices that make up the communication network, the telecommunications carrier may redirect communication between communication devices that had been communicating via one communication path to another communication path. This allows communication between the communication devices to be maintained even when the communication network is switched.

[0003] A related technology is disclosed in Patent Document 1. Patent Document 1 discloses technology relating to a device that includes an RTT calculation unit as a means for calculating the RTT of a signal transmitted and received between a client device and a server device by extracting a plurality of samples of the signal, a variation determination unit as a means for determining the variation in the RTT calculated by the RTT calculation unit, and a sample number adjustment unit as a means for adjusting the number of samples based on the determination result of the variation determination unit. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Application Laid-Open No. 2010-28684 Summary of the Invention [Problem to be solved by the invention]

[0005] Therefore, there is a need for technology that can easily detect when a communication path has been switched.

[0006] Therefore, the present invention provides an analysis device, an analysis method, and program The purpose is to provide. [Means for solving the problem]

[0007] According to a first aspect of the invention, the analysis device includes a feature information identification means for identifying feature information regarding the arrival time of each of different communication paths in a communication network based on the difference in arrival time of a communication packet between a first communication device and a second communication device connected via the communication network.

[0008] According to a second aspect of the invention, the analysis method identifies characteristic information regarding the arrival time of each of different communication paths in a communication network based on the difference in arrival time of communication packets between a first communication device and a second communication device connected via the communication network.

[0009] According to a third aspect of the invention, the program causes the computer of the analysis device to function as a feature information identification means that identifies feature information regarding the arrival time of each of different communication paths in a communication network based on the difference in arrival time of communication packets between a first communication device and a second communication device connected via the communication network. [Effects of the Invention]

[0010] According to the present invention, it is possible to easily grasp that a switch in the communication path has occurred based only on the communication data. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram showing a communication device equipped with an analysis device according to the present embodiment and a communication network to which the communication device is connected; [Figure 2] FIG. 10 is a first diagram illustrating response times as a function of time between communication devices according to the present embodiment. [Figure 3]FIG. 10 is a second diagram illustrating response time as a function of time between communication devices according to the present embodiment. [Figure 4] 10A and 10B are diagrams illustrating a delay in a response in a communication device of a communication destination according to the present embodiment. [Figure 5] FIG. 10 is a diagram showing an example of characteristic information of communication on a certain communication path according to the present embodiment. [Figure 6] FIG. 10 is a diagram showing an example of communication characteristic information for each of a plurality of communication paths according to the present embodiment. [Figure 7] FIG. 1 is a functional block diagram of an analysis device according to a first embodiment. [Figure 8] FIG. 3 is a diagram showing a processing flow of the analysis device according to the first embodiment. [Figure 9] 10A and 10B are diagrams illustrating measurement results and communication characteristic information according to the first embodiment. [Figure 10] FIG. 10 is a first diagram illustrating a process of identifying characteristic information for each communication path according to the first embodiment. [Figure 11] FIG. 10 is a second diagram illustrating the process of identifying characteristic information for each communication path according to the first embodiment. [Figure 12] FIG. 10 is a functional block diagram of an analysis device according to a second embodiment. [Figure 13] FIG. 10 is a functional block diagram of an analysis device according to a third embodiment. [Figure 14] FIG. 10 is a functional block diagram of an analysis device according to a fourth embodiment. [Figure 15] FIG. 10 is a diagram showing output information of an analysis device according to a fourth embodiment. [Figure 16] FIG. 10 is a diagram illustrating an analysis system according to a fifth embodiment. [Figure 17] FIG. 10 is a diagram illustrating an analysis system according to a sixth embodiment. [Figure 18] FIG. 1 is a diagram illustrating a minimum configuration of an analysis device. [Figure 19] FIG. 10 is a diagram showing a processing flow of an analysis device with a minimum configuration. [Figure 20] FIG. 1 is a block diagram illustrating an example of the hardware configuration of a calculation processing device that can realize an analysis device according to each embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0012] A communication network to which a communication device equipped with an analysis device according to an embodiment of the present invention is connected will be described below with reference to the drawings. FIG. 1 is a diagram illustrating a communication device equipped with an analysis device according to this embodiment and a communication network to which the communication device is connected. With this configuration, the communication device equipped with the analysis device and the communication device with which it communicates constitute an analysis system 100. In the analysis system 100 shown in FIG. 1, a communication device 1 equipped with an analysis device 10 is communicatively connected to other communication devices 21 and 22 via relay devices 31 and 32. The other communication devices 21 and 22 are collectively referred to as communication devices 2. The relay devices 31 and 32 are collectively referred to as relay devices 3. When communication device 1 communicates with communication device 21, the communication is via relay device 31 or relay device 32. When communication device 1 communicates with communication devices 21 and 22, whether the relay device that relays the communication is relay device 31 or relay device 32 depends on the settings of the telecommunications carrier that manages the communication network between communication device 1 and communication devices 21 and 22. For example, when the distance between communication device 1 and communication devices 21 and 22 is long, such as several hundred kilometers, different telecommunications carriers may manage the communication network, and the communication network will be configured with a large number of relay devices 3. In this case, different telecommunications carriers may manage the relay devices 3. For example, in the communication network connecting communication device 1 and communication device 22 shown in FIG. 1, there are two communication paths: a first communication path A in which relay device 32 relays communication between communication device 1 and communication device 22, and a second communication path B in which relay device 31 and relay device 32 relay communication between communication device 1 and communication device 22. Similarly, in the communication network connecting communication device 1 and communication device 21 shown in FIG. 1, there are two communication paths: a first communication path A in which relay device 31 relays communication between communication device 1 and communication device 21, and a second communication path B in which relay device 32 and relay device 31 relay communication between communication device 1 and communication device 21. The greater the number of relay devices 3, the greater the number of communication paths that can be used in the communication network between communication device 1 and communication devices 21 and 22. Typically, users of communication device 1 and communication devices 21 and 22 are not informed of, and are not even aware of, which communication paths are being used in the communication network connecting those communication devices 2.

[0013] Here, in such communications between communication devices, it may be desirable to be able to detect whether a communication path has been switched or not, from the viewpoint of security.

[0014] Figure 2 is a first diagram illustrating the difference in response time over time between communication devices communicating with each other. Assume that communication device 1 sends a Ping to communication device 21 and measures the response time (RTT) (Figure 2(C)) from the start of measurement to the end of measurement over a long period, such as six hours. Figure 2 shows a graph with the vertical axis representing each time point from the start of measurement to the end of measurement, and the horizontal axis representing the response time RTT. In this graph, dots represent the average response time for each Ping over a unit time period, such as two minutes, and the color of the dots represents the number of Ping responses received within that response time. In Figure 2(A), where the horizontal axis is narrowed, the RTT is almost linear, indicating that the RTT is consistent over the six hours. However, by increasing the resolution and widening the horizontal axis, differences in the RTT are apparent over the six hours. Differences in response time RTT correspond to differences in the RTT of communication packets arriving between two communication devices connected via a communication network. The occurrence of a difference in RTT indicates that the communication path length has changed along the way, that is, the communication path has changed, as can be seen from Fig. 2. The analysis device of this embodiment detects such differences in communication paths.

[0015] FIG. 3 is a second diagram showing the difference in response time over time between communication devices communicating with each other. The graph shown in FIG. 3 shows the relationship between each time (vertical axis) from the measurement start time to the measurement end time and the response time RTT (horizontal axis) in a case where a communication network includes many relay devices 3 and many communication path switches are made in the communication between the communication devices. As shown in FIG. 3, a difference occurs in the striped pattern at a certain time t. This indicates that communication between the communication devices is being made using multiple communication paths before time t, and that communication between the communication devices is being made using multiple communication paths after time t. Furthermore, FIG. 3 shows that the multiple communication paths used before time t are different from those used after time t. A user of a communication device 1 equipped with an analysis device 10 wants to understand the usage status of these communication paths and the switching of communication paths.

[0016] FIG. 4 is a diagram illustrating a delay in a response in a communication device at a communication destination. The communication device 2 (for example, communication devices 21 and 22) of the communication destination returns a response based on the communication data from the communication device 1. The timing of this response varies depending on time due to interrupt processing in the communication device 2, etc.

[0017] For example, as shown in FIG. 4, an interrupt process occurs in the communication device 2. As an example, the communication device 2 receives communication data A, B, C, D, E, and F from the communication device 1 in this order. Assume that the communication data A, B, C, D, E, and F are Pings. The communication device 2 performs processes related to the communication data collectively in predetermined time units. In this case, the communication device 2 waits for a process start time t1 to process the response to the communication data A and B, and performs the process during the time T1 from the process start time t1 to the next process start time t2. That is, the communication device 2 generates a jitter Tx1 until the process start time t1 of the response process for the communication data A, and a jitter Tx2 until the process start time t1 of the response process for the communication data B. At the time T1, the communication device 2 performs the responses (Ping responses) to the communication data A and the communication data B to the communication device 1 in the order in which they were received.

[0018] Furthermore, when the communication device 2 receives communication data C, D, and E during time T1, it waits to process the response to the communication data C, D, and E until the next processing start time t2. The communication device 2 waits to process the response to the communication data C, D, and E until the processing start time t2, and performs the response during time T2 from the current processing start time t2 to the next processing start time t3. That is, in the communication device 2, jitter Tx3 occurs until the processing start time t2 of the response processing for the communication data C, jitter Tx4 occurs until the processing start time t2 of the response processing for the communication data D, and jitter Tx5 occurs until the processing start time t2 of the response processing for the communication data E. At time T2, the communication device 2 performs responses (Ping responses) to the communication data C, D, and E to the communication device 1 in the order in which they were received.

[0019] Furthermore, when the communication device 2 receives communication data F after time T2, it waits to process the response to the communication data F until the next processing start time t4. The communication device 2 waits to process the response to the communication data F until the processing start time t4, and performs the response during time T3 from the processing start time t4 to the next processing start time. That is, in the communication device 2, jitter Tx6 occurs until the processing start time t4 of the response processing for the communication data F. The communication device 2 responds to the communication data F (Ping response) to the communication device 1 at time T3.

[0020] The jitters Tx1 to Tx6 are different from each other. Therefore, the longer the jitter time for the Ping sent from the communication device 1, the longer the response delay for the Ping sent from the communication device 1. This causes a difference in response time between the time when communication data such as a Ping is sent by the communication device 1 and the time when the response is received. Note that the response time can also be caused by factors other than the jitter time in the communication device 2. For example, the performance of the network interface card of the communication device 2, the performance of the kernel, and the operating state of the application software used can cause a delay in the transmission of the response signal from the communication device 2. The characteristic information related to the communication response time generated based on the difference in the response times indicates a characteristic unique to each communication device 2. Note that the response time RTT between communication devices is an example of the arrival time between the communication devices.

[0021] FIG. 5 is a diagram illustrating an example of characteristic information related to the response time of a certain communication path according to this embodiment. The characteristic information (signature) related to the response time of the communication path illustrated in FIG. 5 indicates the relationship between the response time of a Ping sent from communication device 1 to communication device 2 and the cumulative relative frequency when one Ping transmission is used as a transmission unit. That is, as illustrated in FIG. 5, the characteristic information related to the response time of the communication path according to this embodiment indicates the cumulative relative frequency distribution of the response time RTT (Round Trip Time) from when communication device 1 sends a Ping to when it receives a Ping response from communication device 2. In the example of FIG. 5, the response time RTT when communication device 1 sends a Ping to communication device 2 is characterized by being distributed between approximately 170 μsec and 600 μsec. The response time RTT also varies depending on the distance between communication device 1 and communication device 2. In this characteristic information related to the response time of the communication path, the increase per unit time of the cumulative relative frequency is small in the initial period and the final period of the response time RTT indicated by the characteristic information, and the increase per unit time of the cumulative relative frequency is large near the center.

[0022] FIG. 6 is a diagram illustrating an example of characteristic information regarding response times of multiple communication paths according to this embodiment. As described in FIG. 2, assume that communication device 1 sends a Ping to communication device 21, and the response time RTT (Round Trip Time) from the time communication device 1 receives a Ping response from communication device 21 is measured (FIG. 2(C)) for a long period of time, such as six hours. If the communication path is switched during this time due to the operation of relay device 3 constituting the communication network between communication device 1 and communication device 2, differences in response times such as those shown in FIGS. 2 and 3 can be observed. Then, using the measurement results showing these differences in response time, a graph of the cumulative relative frequency distribution of response time RTT (Round Trip Time) as described in FIG. 5 is generated, resulting in a graph like that shown in FIG. 6. Similar to FIG. 5, FIG. 6 also illustrates the cumulative relative frequency distribution of response time RTT (Round Trip Time).

[0023] When the communication path of a Ping communication packet changes, the communication characteristics shown in Figure 2 can be confirmed in multiple different RTT time intervals, as shown in Figure 5. Because the distance of the communication path changes as the communication path changes, the difference in response time shown in Figure 2 appears in different RTT time intervals. Feature information 1 related to response time appears in time interval 1 from time t1 to time t2, feature information 2 related to response time appears in time interval 2 from time t2 to time t3, feature information 3 related to response time appears in time interval 3 from time t3 to time t4, and feature information 4 related to response time appears in time interval 5 from time t4 to time t5, each indicating feature information related to the response time for a different communication path. In other words, the feature information shown in Figure 6 indicates feature information related to the response time (arrival time) for each communication path.

[0024] As described with reference to FIG. 5, in response time feature information, the growth in cumulative relative frequency is small between the initial period and the final period of the response time RTT indicated by the feature information. Therefore, when feature information on the response times of multiple communication paths is obtained, feature information on the response times of each communication path can be extracted from the feature information on the response times of the multiple communication paths using a response time RTT with a small growth in cumulative relative frequency or a response time RTT with a small occurrence frequency for calculating the cumulative relative frequency. Then, the analysis device 10 included in the communication device 1 transmits a Ping from the communication device 1 to the communication device 21, and extracts feature information on the response times of the communication paths based on the measurement results of the response time RTT (Round Trip Time) over a long period of time until the communication device 1 receives a Ping response from the communication device 21. If the analysis device 10 identifies a communication path switch or the like based on the feature information on the response times of the communication paths, it can notify the user of an abnormality.

[0025] First Embodiment FIG. 7 is a functional block diagram of the analysis device according to the first embodiment. The analysis device 10 performs the functions of a measurement unit 11, a response time calculation unit 12, an analysis unit 13, an RTT calculation unit 14, and an output unit 15. The analysis device 10 includes a measurement result storage unit 101.

[0026] The measurement unit 11 transmits a communication packet to the communication device 2 as a communication destination and measures the arrival time of the communication packet. A Ping packet is one form of a communication packet. The response time calculation unit 12 calculates the arrival time based on the arrival time of the communication packet and records it in the measurement result storage unit 101. The analysis unit 13 calculates characteristic information about the response time of each of the different communication paths in the communication network based on the difference in arrival time of the communication packets transmitted from the communication device 1 to the communication device 2. The characteristic information about the response time indicates the relationship between the arrival time of the communication packets transmitted from the communication device 1 to the communication device 2 and the cumulative relative frequency of the arrival time. The response time RTT is one aspect of the arrival time. The analysis unit 13 calculates the occurrence frequency for each time unit when the time span of the arrival times of multiple communication packets is divided into predetermined time units. The analysis unit 13 then identifies the characteristic information about the response time, which is categorized by the arrival time during which the occurrence frequency remains below a predetermined threshold, as the characteristic information about the response time of one communication path. The RTT calculation unit 14 calculates a representative arrival time (response time RTT) for each communication path. The output unit 15 outputs the calculation result.

[0027] FIG. 8 is a diagram showing the processing flow of the analysis device. Hereafter, the communication device 1 communicates with the communication device 22, and the analysis device 10 analyzes the communication network between the communication device 1 and the communication device 22. First, the measurement unit 11 transmits a Ping, which is one of the communication packets, to the IP address of the communication device 22, the communication destination (step S101). When the communication device 21 receives the Ping, it transmits a Ping response to the communication device 1. The measurement unit 11 of the communication device 1 acquires information about the received Ping response. The measurement unit 11 outputs the transmission time of the Ping and the reception time of the Ping response to the response time calculation unit 12. The measurement unit 11 continues to transmit a Ping, for example, once per second, for a predetermined time from the measurement start time to the measurement end time. The predetermined time from the measurement start time to the measurement end time may be a long time, for example, six hours. The measurement unit 11 sequentially outputs the transmission time of the Ping transmitted during the predetermined time and the reception time of the Ping response to the response time calculation unit 12. The response time calculation unit 12 calculates a response time RTT that indicates the interval between the time when the Ping was sent and the time when the Ping response was received (step S102). The response time calculation unit 12 associates the IP address of the communication device 2 of the communication destination, the time when the Ping was sent, the time when the Ping response was received, and the response time RTT, and records them as measurement results (step S103). As a result, measurement results for a predetermined period (6 hours) are recorded in the measurement result storage unit 101.

[0028] FIG. 9 is a diagram showing the measurement results and characteristic information related to the response time according to the first embodiment. As shown in FIG. 9A, for example, the response time RTTs of the measurement results are mostly distributed between approximately 10.2 milliseconds and approximately 12.6 milliseconds. The distribution of the response time RTTs of the measurement results may exceed the range shown in FIG. 9A. However, the analysis unit 13 may use response information within a range that includes a predetermined percentage, such as 90% of the response time RTTs of communication packets. The analysis unit 13 acquires such measurement results from the measurement result storage unit 101. The analysis unit 13 calculates first characteristic information related to the response time based on the measurement results (FIG. 9A) (step S104). The first characteristic information is shown in FIGS. 9B and 9C. The analysis unit 13 calculates the frequency of occurrence of the response time RTTs for each class corresponding to 0.1 millisecond intervals within the time range of the response time RTTs indicated by the first characteristic information (step S105). This process is one aspect of a process for calculating the frequency of occurrence for each time unit when the time span of the arrival times of multiple communication packets is divided into predetermined time units. The analysis unit 13 calculates the relative frequency and the cumulative relative frequency based on the appearance frequency of the response time RTT (step S104). The relationship between the response time RTT and its cumulative relative frequency can be expressed as shown in FIG.

[0029] The analysis unit 13 may change the tiers depending on the degree of variation in the response time RTT. If the intervals of seconds corresponding to each tier are too wide, the difference in response time as shown in FIG. 2(A) is unlikely to be apparent. Similarly, if the intervals of seconds corresponding to each tier are too narrow, the difference in response time as shown in FIG. 2(B) is unlikely to be apparent. Therefore, the analysis unit 13 may set the tiers so that the number of occurrences of 0 falls within a range greater than or equal to a predetermined value α and less than a predetermined value β. The analysis unit 13 may repeatedly calculate the occurrence frequency while changing the intervals of the tiers corresponding to the width of the response time RTT, and set the tiers so that the number of occurrences of 0 falls within a range greater than or equal to a predetermined value α and less than a predetermined value β. Alternatively, the tiers may be set by other processing. Alternatively, the analysis unit 13 may set a preset tier for the measured response time RTT.

[0030] FIG. 10 is a first diagram showing the process of identifying characteristic information related to the response time for each communication path according to the first embodiment. After calculating the response time characteristic information as shown in FIG. 9B, the analysis unit 13 identifies a range of response times RTTs in which the occurrence frequency in the characteristic information remains below a threshold. In this embodiment, the analysis unit 13 identifies a range of response times RTTs in which the occurrence frequency is 0 or less, i.e., the occurrence frequency is 0 (step S106). The threshold value of the occurrence frequency may be a value other than 0 (e.g., 1 or 2) as long as the purpose is to identify a range in which the growth of the cumulative relative frequency is small, as shown in FIG. 6. In the example of FIG. 10, the analysis unit 13 identifies a range of response times RTTs corresponding to 10.6 to 11.4 milliseconds and a range of response times RTTs corresponding to 12.1 to 12.4 milliseconds (FIG. 10A). These ranges indicate the ranges in the graph of FIG. 9C corresponding to the response times RTTs in which the growth of the relative cumulative frequency per unit time is small and almost flat. This range corresponds to a time range including the time points that separate the response time characteristic information of different communication paths.

[0031] 10(B), the analysis unit 13 identifies, as delimiting times for separating characteristics of a communication interval, the start class of a first time range of response time RTTs having an occurrence frequency of 0, which is 10.6 milliseconds, the earliest time range, and the end class of the first time range, which is 11.0 milliseconds, the median time range of the first time range, which is 11.4 milliseconds. Similarly, the analysis unit 13 identifies, as delimiting times for separating characteristics of a communication interval, the start class of a second time range of response time RTTs having an occurrence frequency of 0, which is 12.1 milliseconds, the earliest time range, and the median time range of the second time range, which is 12.25 milliseconds, the median time range of the second time range, which is 12.4 milliseconds. The analysis unit 13 also identifies, as delimiting times for separating characteristics of a communication interval, the response time RTT (10.0 milliseconds) corresponding to the smallest time range and the response time RTT (13.0 milliseconds) corresponding to the largest time range (step S107).

[0032] The analysis unit 13 uses the identified division times (10.0 milliseconds, 11.0 milliseconds, 12.25 milliseconds, 13.0 milliseconds) to identify the time interval of the response time RTT between these division times as the time interval for identifying characteristic information regarding the response time of each communication path (step S108). That is, the analysis unit 13 identifies the time interval from 10.0 milliseconds to 11.0 milliseconds as the time interval indicating characteristic information regarding the response time of the first communication path in the communication network connecting the communication device 1 and the communication device 2 (item 1 in FIG. 10(D)). The analysis unit 13 also identifies the time interval from 11.1 milliseconds to 12.25 milliseconds as the time interval indicating characteristic information regarding the response time of the second communication path in the communication network connecting the communication device 1 and the communication device 2 (item 2 in FIG. 10(D)). Furthermore, the analysis unit 13 identifies the period from 12.26 milliseconds to 13.0 milliseconds as the time interval indicating characteristic information related to the response time of the third communication path in the communication network connecting the communication device 1 and the communication device 2 (item number 3 in FIG. 10(D)).

[0033] FIG. 11 is a second diagram showing the process of identifying characteristic information related to the response time for each communication path according to the first embodiment. The analysis unit 13 calculates second characteristic information (FIG. 11A) indicating the relationship between the response time RTT of each communication path and its cumulative relative frequency based on the characteristic information regarding the response time of each communication path (step S109). In this second characteristic information, the cumulative relative frequency for each class of response time RTT indicates 0 to 1 for each time range of the response time RTT of each communication path (FIG. 11A).

[0034] The analysis unit 13 calculates a representative response time RTT for each of one or more communication paths indicated by the second characteristic information (step S110). That is, the analysis unit 13 calculates the average value (10.2 ms) or median value (10.1 ms) of the response time RTT of each communication packet included in the time range of the response time RTT between the boundary times (10.0 ms, 11.0 ms) of the response time RTT time interval, which is characteristic information regarding the response time of the first communication path, as the representative response time RTT of the first communication path (FIG. 11(B)). Similarly, the analysis unit 13 calculates the average value (11.7 ms) or median value (11.6 ms) of the response time RTT of each communication packet included in the time range of the response time RTT between the boundary times (11.0 ms, 12.25 ms) of the response time RTT time interval, which is characteristic information regarding the response time of the second communication path, as the representative response time RTT of the second communication path (FIG. 11(B)). Similarly, the analysis unit 13 calculates the average value (12.7 milliseconds) and median value (12.6 milliseconds) of the response time RTT of each communication packet included in the time range of the response time RTT between the dividing times (12.25 milliseconds, 13.0 milliseconds) of the response time RTT time interval, which is characteristic information regarding the response time of the third communication path, as the representative response time RTT of the third communication path (Figure 11(B)).

[0035] The analysis unit 13 also outputs the calculated characteristic information relating to the response times of the first to third communication paths to the output unit 15. Based on the calculated characteristic information relating to the response times of the first to third communication paths, the output unit 15 displays on the display a table (FIG. 11(B)) showing the average and median values ​​of the response times RTT, which are characteristic information of each communication path, and a graph (FIG. 11(C)) showing the relationship between the response times RTT, which are characteristic information of each communication path, and the cumulative relative frequency (step S111). The output unit 15 displays on the display the characteristic information (FIG. 9(B)) shown in FIG. 9 and a graph (FIG. 9(C)) showing the relationship between the response times RTT and the cumulative relative frequency, which is generated based on the characteristic information. The output unit 15 may transmit the displayed information to another device.

[0036] Through the above processing, the analysis device 10 calculates and outputs characteristic information regarding the response time of each of the different communication paths in the communication network based on the difference in response time of the communication packets transmitted from communication device 1 to communication device 2 connected via the communication network. At this time, the analysis device 10 outputs, as the characteristic information, information regarding the representative value (average value or median value) of the response time RTT of each communication path and a graph indicating that the communication path of the communication packets in the communication network has been switched. This allows the user to easily understand the switch in the communication path of the communication packets transmitted from communication device 1 to communication device 2.

[0037] Second Embodiment FIG. 12 is a functional block diagram of an analysis device according to the second embodiment. 7, the analysis device 10 may also function as a distance measurement unit 16. The distance measurement unit 16 calculates the distance of the communication path to the communication device of the communication destination.

[0038] The distance measurement unit 16 acquires the medium speed Vm of the communication data of the transmission medium between the communication device 1 and the communication device 2 of the communication destination from a storage unit or the like. The transmission medium of the communication network connecting the communication device 1 and the communication device 2 is known. The medium speed Vm of the transmission medium is also known in advance. The distance measurement unit 16 calculates the distance of the communication path between the communication device 1 and the communication device 2 by multiplying the medium speed Vm by (the response time RTT / 2). The distance measurement unit 16 may calculate the distance multiple times based on the response time RTT between the time when one Ping is sent and the time when the Ping response is received, and determine the average of the calculated distances as the distance between the communication devices 1 and 2. Alternatively, the distance measurement unit 16 may calculate the distance between the communication device 1 and the communication device 2 by multiplying the medium speed Vm by (the response time RTT / 2), using the average or median of the response times RTT of each communication path calculated by the RTT calculation unit 14 as the response time RTT. The distance measurement unit 16 outputs the distance for each communication path to the output unit 15. The output unit 15 may display the distance for each communication path in the table shown in Fig. 11(B) in association with the average value or median value of the response time RTT, which is characteristic information regarding the response time of each communication path.

[0039] According to the processing of the second embodiment described above, the analysis device 10 can calculate the distance between the communication devices along each communication path analyzed by the analysis unit 13.

[0040] <Third embodiment> FIG. 13 is a functional block diagram of an analysis device according to the third embodiment. 7 and 12, the analysis device 10 may further perform the function of an anomaly detection unit 17. In this case, the analysis device 10 includes a policy storage unit 18. The abnormality detection unit 17 determines an abnormality in a communication path based on characteristic information related to the response time of the communication path. The abnormality detection unit 17 may determine an abnormality in the communication path based on a difference in characteristic information related to the response time of the communication path. The abnormality detection unit 17 may determine an abnormality in the communication path based on a representative value (average value or median value) of the arrival time of the communication path.

[0041] More specifically, anomaly detection rules are recorded in the policy storage unit 18. For example, a first rule is recorded that determines an anomaly when the number of communication paths is three or more, a second rule is recorded that determines an anomaly when the response time RTT of one communication path exceeds 50 milliseconds, and a third rule is recorded that determines an anomaly when the transmission distance exceeds 1000 km.

[0042] The anomaly detection unit 17 acquires characteristic information regarding the response time of each communication path from the analysis unit 13. The anomaly detection unit 17 calculates the number of communication paths at the measured time from the number of representative response times (RTTs) included in the characteristic information. The anomaly detection unit 17 compares this number with the number of communication paths indicated by the first rule, and if the number of communication paths at the measured time is equal to or greater than the number of communication paths indicated by the first rule, the anomaly detection unit 17 outputs an anomaly determination and an ID indicating the first rule to the output unit 15. The output unit 15 displays the information indicating the anomaly and an ID indicating the rule used to determine the anomaly.

[0043] The anomaly detection unit 17 acquires a representative response time RTT of each communication path from the RTT calculation unit 14. The anomaly detection unit 17 compares the representative response time RTT with the response time RTT indicated by the second rule, and if the response time RTT acquired from the RTT calculation unit 14 is equal to or longer than the response time RTT indicated by the second rule, the anomaly detection unit 17 outputs an abnormality determination and an ID indicating the second rule to the output unit 15. The output unit 15 displays information indicating the abnormality and an ID indicating the rule used to determine the abnormality.

[0044] The abnormality detection unit 17 acquires the distance of each communication path from the distance measurement unit 16. The abnormality detection unit 17 compares the acquired distance with the distance indicated by the third rule, and if the distance acquired from the distance measurement unit 16 is equal to or greater than the distance indicated by the third rule, the abnormality detection unit 17 outputs an abnormality determination and an ID indicating the third rule to the output unit 15. The output unit 15 displays information indicating the abnormality and an ID indicating the rule used to determine the abnormality.

[0045] According to the processing of the third embodiment, the analysis device 10 can notify the user of an abnormality or the like based on the status of a change in the communication path, thereby enabling the user to grasp an abnormality caused by a change in the communication path that constitutes the communication network between communication devices.

[0046] <Fourth embodiment> FIG. 14 is a functional block diagram of an analysis device according to the fourth embodiment. FIG. 15 is a diagram showing output information of the analysis device according to the fourth embodiment. 7, 12, and 13, the analysis device 10 may further perform the functions of the image creation unit 19. The image creation unit 19 generates and outputs an image (FIG. 15) showing response times corresponding to the times between the communication devices shown in FIGS. 2 and 3. The image creation unit 19 may superimpose on this image the numerical values ​​of the response times (RTT) of each communication path, or the average Ping response time in this graph as a vertical line, and a color scale showing the magnitude of the number of Ping responses received within that response time.

[0047] Fifth Embodiment FIG. 16 is a diagram showing an analysis system according to the fifth embodiment. In each of the above-described embodiments, the analysis device 10 included in the communication device 1 performs the above-described processes. However, the analysis server 200 that is connected to and communicates with the communication device 1 may have the functions of the analysis device 10. The analysis server 200 may then acquire information on the measurement results of the measurement unit 11 of the communication device 1 and perform the processes of the functional units of the other embodiments described above.

[0048] Sixth Embodiment FIG. 17 is a diagram showing an analysis system according to the sixth embodiment. In the first to fifth embodiments described above, characteristic information regarding the response times of a plurality of communication paths is calculated based on the response time RTT. However, the analysis device 10 and the analysis server 200 may perform the same analysis processing as in the above-described embodiments using the arrival time T of a Ping packet from communication device 1 to communication device 2 instead of the response time RTT. The arrival time T of a Ping packet from communication device 1 to communication device 2 also varies depending on the load state of relay device 3 along the way. The analysis device 10 and the analysis server 200 may acquire information about the arrival time T from the communication destination communication device 2 (21, 22) and perform processing of each functional unit in the other embodiments described above.

[0049] FIG. 18 is a diagram showing the minimum configuration of the analysis device. FIG. 19 is a diagram showing the processing flow of an analysis device with a minimum configuration. The analysis device 10 includes at least an analysis means 181 . The analysis means 181 calculates characteristic information regarding the arrival time of each of different communication paths in the communication network based on the difference in arrival time of communication packets between a first communication device and a second communication device connected via the communication network (step S201).

[0050] (Hardware configuration) FIG. 20 is a block diagram schematically illustrating an example of the hardware configuration of a calculation processing device that can realize the analysis device according to each embodiment of the present invention. An example of the configuration of hardware resources for implementing the analysis device 10 using one calculation processing device (information processing device, computer) will be described. However, the analysis device 10 may be physically or functionally implemented using at least two calculation processing devices. Furthermore, the analysis device 10 may be implemented as a dedicated device.

[0051] The calculation processing device 80 has a central processing unit (hereinafter referred to as "CPU") 81, a volatile storage device 82, a disk 83, a non-volatile recording medium 84, and a communication interface (hereinafter referred to as "communication IF") 87. The calculation processing device 80 may be connectable to an input device 85 and an output device 86. The calculation processing device 80 can send and receive information to and from other calculation processing devices and other communication devices via the communication IF 87.

[0052] The nonvolatile recording medium 84 is a computer-readable medium, such as a compact disc or a digital versatile disc. The nonvolatile recording medium 84 may also be a universal serial bus memory (USB memory), a solid state drive, or the like. The nonvolatile recording medium 84 retains the program and enables portability without requiring power supply. The nonvolatile recording medium 84 is not limited to the above-mentioned media. Instead of the nonvolatile recording medium 84, the program may be transported via the communication IF 87 and a communication network. The volatile storage device 82 is computer-readable and can temporarily store data. The volatile storage device 82 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0053] That is, when executing a software program (computer program: hereinafter simply referred to as "program") stored on disk 83, CPU 81 copies the program to volatile storage device 82 and executes the arithmetic processing. CPU 81 reads data necessary for program execution from volatile storage device 82. When display is required, CPU 81 displays the output result on output device 86. When inputting a program from the outside, CPU 81 reads the program from input device 85. CPU 81 interprets and executes an analysis program (FIG. 4 or 5) stored in volatile storage device 82 that corresponds to the functions (processing) represented by each unit shown in FIG. 2 (or FIG. 3). CPU 81 executes the processing described in each embodiment of the present invention above. That is, in such cases, each embodiment of the present invention can be understood to be realized by such an analysis program. Furthermore, each embodiment of the present invention can be understood to be realized by a computer-readable non-volatile recording medium on which such an analysis program is recorded.

[0054] The present invention has been described above using the above-described embodiment as an exemplary example. However, the present invention is not limited to the above-described embodiment. In other words, the present invention can be applied in various aspects that can be understood by a person skilled in the art within the scope of the present invention.

[0055] Note that part or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0056] (Appendix 1) an analysis means for calculating characteristic information relating to arrival times of communication packets from a first communication device to a second communication device connected via a communication network, based on a difference in arrival times of the communication packets between the first communication device and the second communication device; An analysis device comprising:

[0057] (Appendix 2) The analysis means calculates a representative value of the arrival time of each of the different communication paths based on the arrival time of each of the different communication paths. 2. The analysis device of claim 1, comprising:

[0058] (Appendix 3) The analysis means calculating an occurrence frequency for each time unit when dividing a time span of the arrival time due to multiple transmissions of the communication packet into predetermined time units; Information about the arrival time of each of the communication packets classified by the arrival time, whose occurrence frequency continues to be less than a predetermined threshold, is calculated as characteristic information about the arrival time of one of the communication paths. 10. The analysis device of claim 1 or 2.

[0059] (Appendix 4) an abnormality determination means for determining an abnormality in the communication path based on characteristic information relating to the arrival time of the communication path; 4. The analysis device according to claim 1, further comprising:

[0060] (Appendix 5) an abnormality determination means for determining an abnormality in the communication path based on a difference between characteristic information relating to the arrival time of the communication path, which indicates a relationship between the arrival time for each time unit when a time span of the arrival time due to multiple transmissions of a communication packet is divided into predetermined time units and the cumulative relative frequency for each time unit; 4. The analysis device according to claim 1, further comprising:

[0061] (Appendix 6) an abnormality determination means for determining an abnormality in the communication path based on a representative value of the arrival time of the communication path; 4. The analysis device according to claim 1, comprising:

[0062] (Appendix 7) The arrival time is calculated as the difference between the transmission time at the first communication device of a communication packet transmitted from a first communication device to a second communication device and the reception time at the first communication device of a communication packet transmitted by the second communication device to the first communication device in response to the first communication device. 7. The analysis device according to any one of claims 1 to 6.

[0063] (Appendix 8) The arrival time is calculated as the difference between the transmission time at the first communication device of a communication packet transmitted from a first communication device to a second communication device and the reception time at the second communication device of the communication packet. 7. The analysis device according to any one of claims 1 to 6.

[0064] (Appendix 9) Calculating characteristic information relating to the arrival time of each of different communication paths in a communication network based on a difference in arrival time of a communication packet between a first communication device and a second communication device connected via the communication network Analysis method.

[0065] (Appendix 10) The computer of the analysis device, an analysis means for calculating characteristic information relating to arrival times of communication packets from a first communication device to a second communication device connected via a communication network, based on a difference in arrival times of the communication packets between the first communication device and the second communication device; A storage medium that stores a program that functions as a [Explanation of symbols]

[0066] 1, 2, 21, 22...Communication equipment 3, 31, 32...Relay device 10...Analysis equipment 11...Measurement part 12 Response time calculation section 13...Analysis department 14...RTT calculation section 15. Output section 16... Distance measurement section 17. Abnormality detection unit 18. Policy storage unit 19. Image Creation Section 100...Analysis System 200...Analysis server

Claims

1. an analysis means for calculating an occurrence frequency for each time unit when a time width of each arrival time of a communication packet due to a plurality of transmissions between a first communication device and a second communication device connected via a communication network is divided into predetermined time units, and calculating, as characteristic information regarding the arrival time of each of different communication paths in the communication network, a representative value of the arrival time of each communication packet classified by the arrival time for which the occurrence frequency continues to be below a predetermined threshold; An analysis device comprising:

2. an abnormality determination means for determining an abnormality in the communication path based on characteristic information relating to the arrival time of the communication path; The analysis device according to claim 1 , comprising:

3. an abnormality determination means for determining an abnormality in the communication path based on a difference between characteristic information relating to the arrival time of the communication path, which indicates a relationship between the arrival time for each time unit when a time span of the arrival time due to multiple transmissions of a communication packet is divided into predetermined time units and the cumulative relative frequency for each time unit; The analysis device according to claim 1 , comprising:

4. an abnormality determination means for determining an abnormality in the communication path based on a representative value of the arrival time of the communication path; The analysis device according to claim 1 , comprising:

5. The arrival time is calculated as the difference between the transmission time at the first communication device of a communication packet transmitted from a first communication device to a second communication device and the reception time at the first communication device of a communication packet transmitted by the second communication device to the first communication device in response to the first communication device. The analysis device according to any one of claims 1 to 4.

6. The arrival time is calculated as the difference between the transmission time at the first communication device of a communication packet transmitted from a first communication device to a second communication device and the reception time at the second communication device of the communication packet. The analysis device according to any one of claims 1 to 4.

7. An analysis device comprising: A time width of each arrival time of a communication packet transmitted multiple times between a first communication device and a second communication device connected via a communication network is divided into predetermined time units, and an occurrence frequency for each of the time units is calculated, and a representative value of the arrival time of each communication packet classified by the arrival time for which the occurrence frequency remains below a predetermined threshold is calculated as characteristic information relating to the arrival time of each of different communication paths in the communication network. Analysis method.

8. The computer of the analysis device, an analysis means for calculating an occurrence frequency for each time unit when a time width of each arrival time of a communication packet due to a plurality of transmissions between a first communication device and a second communication device connected via a communication network is divided into predetermined time units, and calculating, as characteristic information regarding the arrival time of each of different communication paths in the communication network, a representative value of the arrival time of each communication packet classified by the arrival time for which the occurrence frequency continues to be below a predetermined threshold; A program that functions as a

Images