Analysis device, analysis method, and program

Abstract

Provided is an analysis device that is capable of easily detecting, by using only communication data, a change in another communicatively connected communication device and the configuration of a communication network connected to the other communication device. According to the present invention, first communication feature information generated on the basis of data regarding communication over a prescribed time period with another communication device connected to a communication network is compared with second communication feature information generated on the basis of new data regarding communication over a prescribed time period with the other communication device connected to the communication network, and it is determined whether or not there is a similarity between the items of communication feature information. A determination result indicating whether or not there is a change related to the communication network is output on the basis of whether or not there is a similarity.

Description

[Technical Field]

[0001] The present invention relates to an analysis device, an analysis method, program Regarding. [Background technology]

[0002] Changes in the configuration of other communication devices connected for communication or the communication network connected to other communication devices can be detected by changes in the MAC addresses or IP addresses of the other communication devices connected for communication or the other communication devices that make up the communication network. However, MAC addresses and IP addresses may be rewritten by relay devices. If the MAC addresses or IP addresses are rewritten, it is not easy to detect changes in the configuration of other communication devices connected for communication or the communication network connected to other communication devices.

[0003] In response to the problem of increasing processing load in identifying IoT (Internet of Things) devices, Patent Document 1 discloses a technology that periodically extracts features of unknown devices and compares the change patterns of the device features with the change patterns of known devices to identify unknown devices from known devices. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Patent No. 6930663 Summary of the Invention [Problem to be solved by the invention]

[0005] There is a demand for technology that can detect changes in other communication devices connected for communication or in the configuration of the communication network connected to other communication devices, using only communication data.

[0006] Therefore, the present invention provides an analysis device, an analysis method, and programThe purpose is to provide. [Means for solving the problem]

[0007] According to a first aspect of the invention, the analysis device comprises a determination means for comparing first communication characteristic information generated based on communication data over a predetermined period of time with other communication devices connected to a communication network with second communication characteristic information generated based on new communication data over a predetermined period of time with other communication devices connected to the communication network to determine whether the communication characteristic information is similar, and an output means for outputting a determination result indicating whether there has been a change regarding the communication network based on the presence or absence of the similarity.

[0008] According to a second aspect of the invention, the analysis method compares first communication characteristic information generated based on communication data over a predetermined period of time with other communication devices connected to a communication network with second communication characteristic information generated based on new communication data over a predetermined period of time with other communication devices connected to the communication network, determines whether the communication characteristic information is similar, and outputs a determination result indicating whether there has been a change regarding the communication network based on the presence or absence of the similarity.

[0009] According to a third aspect of the invention, the program causes the computer of the analysis device to function as a determination means that compares first communication characteristic information generated based on communication data over a predetermined time period with other communication devices connected to the communication network with second communication characteristic information generated based on new communication data over a predetermined time period with other communication devices connected to the communication network to determine whether the communication characteristic information is similar, and an output means that outputs a determination result indicating whether there has been a change regarding the communication network based on the presence or absence of the similarity. [Effects of the Invention]

[0010] According to the present invention, it is possible to easily detect, using only communication data, changes in other communication devices connected for communication and in the configuration of a communication network connected to other communication devices. [Brief explanation of the drawings]

[0011] [Figure 1] 1 is a diagram showing a communication device equipped with an analysis device according to the present embodiment and a communication network to which the communication device is connected; [Figure 2] 10A and 10B are diagrams illustrating delays in responses in a communication device that is an analysis target according to the present embodiment. [Figure 3] FIG. 10 is a diagram showing an example of communication feature information according to the present embodiment. [Figure 4] FIG. 1 is a functional block diagram of an analysis device according to an embodiment of the present invention. [Figure 5] FIG. 3 is a first diagram showing a processing flow of the analysis device according to the first embodiment. [Figure 6] FIG. 2 is a diagram showing a data outline of a signature according to the first embodiment. [Figure 7] FIG. 10 is a second diagram showing the processing flow of the analysis device according to the first embodiment. [Figure 8] FIG. 10 is a first diagram showing an overview of a process for comparing a first signature with a second signature; [Figure 9] FIG. 10 is a second diagram showing an outline of the process of comparing the first signature with the second signature. [Figure 10] FIG. 4 is a diagram illustrating an example of output information according to the first embodiment. [Figure 11] FIG. 10 is a diagram illustrating an outline of processing by a determination unit according to the second embodiment. [Figure 12] FIG. 13 is a diagram illustrating an outline of a process for specifying information corresponding to a response time according to the third embodiment. [Figure 13] FIG. 10 illustrates a communication network according to a fourth embodiment. [Figure 14] FIG. 13 is a diagram illustrating an outline of a signature comparison process according to the fourth embodiment. [Figure 15] FIG. 13 is a diagram illustrating an example of visual information included in output information according to the fourth embodiment. [Figure 16] FIG. 13 is a diagram illustrating an example of output information according to the fourth embodiment. [Figure 17] FIG. 1 is a diagram showing a minimum configuration of an analysis device according to the present embodiment. [Figure 18] FIG. 10 is a diagram showing a processing flow of an analysis device with a minimum configuration according to this embodiment. [Figure 19] FIG. 1 is a block diagram illustrating an example of the hardware configuration of a calculation processing device that can realize an analysis device according to an embodiment of the present invention. DETAILED DESCRIPTION OF THE INVENTION

[0012] A communication network to which a communication device equipped with an analysis device according to an embodiment of the present invention is connected will be described below with reference to the drawings. 1 is a diagram showing a communication device equipped with an analysis device according to this embodiment and a communication network 100 to which the communication device is connected. In the communication network 100 shown in Fig. 1, a communication device 1 equipped with an analysis device 10 is communicatively connected to other communication devices 21 and 22 to be analyzed via a relay device 3. The other communication devices 21 and 22 will be collectively referred to as communication devices 2.

[0013] The communication device 1 includes an analysis device 10. The analysis device 10 stores first communication characteristic information generated based on communication data with a communication device 21 to be analyzed over a predetermined time period. The analysis device 10 stores second communication characteristic information generated based on new communication data with the communication device 21 over a predetermined time period. The analysis device 10 compares the first communication characteristic information with the second communication characteristic information to determine whether the communication characteristic information is similar, and indicates whether there is a change in the communication network 100 based on whether the communication characteristic information is similar. In this case, the change in the communication network 100 indicates whether the communication device 21 is different from the device previously connected to the communication network 100. The analysis device 10 also stores first communication characteristic information generated based on communication data with a communication device 22 to be analyzed over a predetermined time period. The analysis device 10 stores second communication characteristic information generated based on new communication data with the communication device 22 over a predetermined time period. The analysis device 10 compares the first communication characteristic information and the second communication characteristic information between the communication device 22, determines whether the communication characteristic information is similar, and indicates whether there is a change in the communication network 100 based on whether there is a similarity. In this case, the change in the communication network 100 indicates whether there is a change in whether the communication device 22 is different from the device that was previously connected to the communication network 100.

[0014] FIG. 2 is a diagram illustrating a delay in a response in a communication device to be analyzed. The communication device 2 to be analyzed returns a response based on the communication data from the communication device 1. The timing of this response varies depending on time due to interrupt processing, etc., in the communication device 2. For example, as shown in FIG. 2, an interrupt process occurs in the communication device 2. As an example, the communication device 2 receives communication data A, B, C, D, E, and F from the communication device 1 in this order. Assume that the communication data A, B, C, D, E, and F are Pings. The communication device 2 performs processing related to the communication data collectively in predetermined time units. In this case, the communication device 2 waits until the processing start time t1 to process the response to the communication data A and B, and performs the response during the time T1 from the processing start time t1 to the next processing start time t2. In other words, the communication device 2 generates a jitter Tx1 until the processing start time t1 of the response processing for the communication data A and a jitter Tx2 until the processing start time t1 of the response processing for the communication data B. At the time T1, the communication device 2 performs responses (Ping responses) to the communication data A and communication data B to the communication device 1 in the order in which they were received. Furthermore, when the communication device 2 receives communication data C, D, and E during time T1, it waits to process the response to the communication data C, D, and E until the next process start time t2. The communication device 2 waits to process the response to the communication data C, D, and E until the process start time t2, and performs the response during time T2 from the current process start time t2 to the next process start time t3. That is, in the communication device 2, jitter Tx3 occurs until the process start time t2 of the response process for the communication data C, jitter Tx4 until the process start time t2 of the response process for the communication data D, and jitter Tx5 until the process start time t2 of the response process for the communication data E. At time T2, the communication device 2 performs responses (Ping responses) to the communication device 1 for the communication data C, D, and E in the order in which they were received. Furthermore, when the communication device 2 receives communication data F after time T2, it waits to process the response to the communication data F until the next process start time t4. The communication device 2 waits until the processing start time t4 to process the response to the communication data F, and performs the response during the time T3 from the processing start time t4 to the next processing start time. That is, in the communication device 2, jitter Tx6 occurs until the processing start time t4 of the response process for the communication data F.The communication device 2 responds to the communication data F (Ping response) to the communication device 1 at time T3. The jitters Tx1 to Tx6 described above are different from each other. Therefore, the response to the Ping sent by the communication device 1 to the communication device 2 being analyzed is delayed as the jitter time for the Ping sent from the communication device 1 becomes longer. This causes a difference in response time from the time of sending communication data such as a Ping sent by the communication device 1 to the time of receiving the response. Note that the response time can also be caused by factors other than the jitter time described above for the communication device 2 being analyzed. For example, the performance of the network interface card of the communication device 2 being analyzed, the performance of the kernel, the operating state of the application software used, and other factors can cause a delay in the transmission of the response signal from the communication device 2. The communication characteristic information generated based on the difference in response time described above indicates a characteristic unique to each communication device 2.

[0015] FIG. 3 is a diagram showing an example of communication feature information according to this embodiment. The communication characteristic information (signature) generated in this embodiment indicates the relationship between the response time of a Ping sent from communication device 1 to communication device 2 and the cumulative relative frequency when one Ping transmission is used as a transmission unit. That is, as shown in FIG. 3, the communication characteristic information according to this embodiment indicates the cumulative relative frequency distribution of the response time RTT (Round Trip Time) from when communication device 1 sends a Ping to when it receives a Ping response from communication device 2. In the example of FIG. 3, the response time RTT when communication device 1 sends a Ping to communication device 2 is characterized by being distributed between approximately 170 μsec and 600 μsec. The response time RTT also varies depending on the distance between communication device 1 and communication device 2.

[0016] FIG. 4 is a functional block diagram of the analysis device according to the first embodiment. The analysis device 10 performs the functions of a measurement unit 11, a response time calculation unit 12, a signature generation unit 13, a judgment unit 14, and an output unit 15. The analysis device 10 includes the following storage units: a target list storage unit 101, a measurement policy storage unit 102, a measurement result storage unit 103, an identification policy storage unit 104, and a signature storage unit 105.

[0017] The measurement unit 11 measures communication data between the communication device 2 that is the analysis target and that is recorded in the target list storage unit 101, based on the measurement policy recorded in the measurement policy storage unit . The response time calculation unit 12 calculates the response time based on the communication data and records it in the measurement result storage unit 103 . The signature generation unit 13 generates a signature, which is communication characteristic information regarding the communication device 2 , using the measurement results recorded in the measurement result storage unit 103 , and records the signature in the signature storage unit 105 . The judgment unit 14 compares a signature generated based on communication data with the communication device 2 over a predetermined period of time with a signature generated based on new communication data with the communication device 2 over a predetermined period of time, and uses the result of comparing the signature with the identification policy recorded in the identification policy memory unit 104 to determine whether the signatures are similar. The output unit 15 outputs a determination result indicating whether or not there is a change in the communication network 100 based on whether or not there is a similarity in the signatures of the communication devices 2. In this embodiment, the output unit 15 outputs a determination result indicating whether or not there is a change in the communication devices 2 to be analyzed that constitute the communication network 100.

[0018] The target list storage unit 101 stores a list of the IP addresses of the communication devices 2 to be analyzed. As an example, the target list storage unit 101 stores the IP address (xxxx) of the communication device 21 and the IP address (yyyy) of the communication device 22. The measurement policy storage unit 102 stores a measurement policy, which records information such as an identifier for specifying a method for measuring a response time. The measurement result storage unit 103 records the measurement result in which the response time based on communication data over a predetermined period of time is linked to identification information such as the IP address of the communication device 2. The identification policy storage unit 104 stores information such as an identifier for identifying a method for determining whether communication characteristics are similar based on a comparison between a signature previously generated for the communication device 2 and a signature newly generated for that communication device 2. The signature storage unit 105 stores the signature generated by the signature generation unit 13 for each communication device 2 in association with the identifier of the communication device 2.

[0019] FIG. 5 is a first diagram showing the processing flow of the analysis device according to the first embodiment. First, the analysis device 10 generates a signature of each communication device 2 to be recorded in the target list storage unit 101. Specifically, the measurement unit 11 acquires the IP address of the communication device 2 to be analyzed from the target list storage unit 101 (step S101). For example, the measurement unit 11 acquires the IP address of the communication device 21.<x.x.x.x> Assume that the communication device 21 has acquired the Ping data. The measurement unit 11 sends a Ping, which is one of the communication data, to the IP address of the communication device 21 (step S102). When the communication device 21 receives the Ping, it sends a Ping response to the communication device 1 equipped with the analysis device 10. The measurement unit 11 acquires the Ping response. The measurement unit 11 outputs the time when the Ping was sent and the time when the Ping response was received to the response time calculation unit 12. The measurement unit 11 continues to send a Ping, for example, once per second, for a predetermined time from the measurement start time to the measurement end time. The predetermined time from the measurement start time to the measurement end time may be three hours, for example. The measurement unit 11 outputs the time when the Ping was sent and the time when the Ping response was received to the response time calculation unit 12 in that order. The response time calculation unit 12 calculates a response time indicating the interval between the time when the Ping was sent and the time when the Ping response was received, and records the measurement results by linking the IP address of the communication device 2, the time when the Ping was sent, the time when the Ping response was received, and the response time (step S103). As a result, measurement results for a predetermined period of time (3 hours) are recorded in the measurement result storage unit 103. The measurement unit 11 measures the time when the Ping was sent and the time when the Ping response was received in the same way using the IP addresses of all communication devices 2 recorded in the target list storage unit 101, and the response time calculation unit 12 records the measurement results for all of these communication devices 2 in the measurement result storage unit 103 in the same way.

[0020] FIG. 6 is a diagram showing an outline of signature data according to the first embodiment. The signature generation unit 13 generates a first signature for each communication device 2 to be analyzed based on the identification policy acquired from the identification policy storage unit 104 (step S104). Specifically, the signature generation unit 13 generates data (FIG. 6) indicating the cumulative relative frequency of Ping responses for each Ping response time (e.g., 10 μsec) specified at a predetermined interval, based on measurement results of Ping communications over a predetermined period of time, such as three hours. The signature generation unit 13 associates an identifier, such as the IP address of the communication device 2, with the signature and records them in the signature storage unit 105. The identification policy defines, for example, a method for generating a cumulative relative frequency distribution.

[0021] FIG. 7 is a second diagram showing the processing flow of the analysis device according to the first embodiment. FIG. 8 is a first diagram showing an outline of the process of comparing the first signature with the second signature according to the first embodiment. After the signature of each communication device 2 is generated, the analysis device 10 starts the analysis process (step S201). In the analysis process, the measurement unit 11 measures the time of sending a Ping from each communication device 2 and the time of receiving the Ping response for that Ping over a predetermined period of time, as described above. The response time calculation unit 12 similarly calculates the response time for the Ping transmission over a predetermined period of time and records similar measurement results in the measurement result storage unit 103 (step S202). The signature generation unit 13 similarly generates a second signature for each communication device 21 during analysis (step S203). The signature generation unit 13 associates the newly generated second signature in the analysis process with an identifier such as the IP address of the communication device 2 and records it in the signature storage unit 105 (step S204).

[0022] Thereafter, the determination unit 14 acquires from the signature storage unit 105 a first signature previously generated for the communication device 2 and a second signature newly generated during analysis (step S205). The determination unit 14 calculates, for each specified response time, the difference between the cumulative relative frequency for each response time (e.g., 10 μsec) identified in the first signature and the cumulative relative frequency for each response time identified in the second signature at the same specified interval, and calculates the sum of the absolute values ​​of the differences (step S206). The determination unit 14 acquires a threshold value for determining whether the signatures recorded in the identification policy storage unit 104 are similar. The determination unit 14 determines whether the sum of the absolute values ​​of the differences in the cumulative relative frequencies for each specified response time is equal to or greater than the threshold (step S207). The determination unit 14 outputs a determination result indicating whether the sum of the absolute values ​​of the differences in the cumulative relative frequencies for each specified response time is equal to or greater than the threshold to the output unit 15. The determination unit 14 similarly generates a determination result for each communication device 2 recorded in the target list storage unit 101 and outputs it to the output unit 15. In the graph of Fig. 8, a solid line 81 indicates the relationship between the response time based on the first signature and the cumulative relative frequency, and a dotted line 82 indicates the relationship between the response time based on the second signature and the cumulative relative frequency.

[0023] FIG. 9 is a second diagram showing an outline of the process of comparing the first signature with the second signature according to the first embodiment. 9, compared to the example shown in FIG. 8, the sum of the absolute values ​​of the differences between the cumulative relative frequency for each response time (e.g., 10 μsec) identified at a predetermined interval in the first signature (solid line 91 in the graph in FIG. 9) and the cumulative relative frequency for each response time identified at the same predetermined interval in the second signature (dotted line 92 in the graph in FIG. 9) is larger. In this case, the sum is equal to or greater than the threshold. If the sum of the absolute values ​​of the differences between the cumulative relative frequencies for each response time (e.g., 10 μsec) identified at a predetermined interval is equal to or greater than the threshold, the determination unit 14 determines that a change has occurred in the communication device 2.

[0024] FIG. 10 is a diagram showing an example of output information according to the first embodiment. If the determination result indicates a threshold or higher, the output unit 15 outputs output information including at least information indicating that there has been a change in the communication device 2 to a predetermined device (step S208). If the determination result indicates a value less than the threshold, the output unit 15 outputs output information including at least information indicating that there has been no change in the communication device 2 to a predetermined device (step S209). The output unit 15 may generate output information including information indicating that there has been a change or no change for each communication device 2 recorded in the target list storage unit 101, and output the output information to a predetermined device as an output destination. The output unit 15 may generate output information including visual information using the measurement results used to generate a new signature. The visual information is, for example, information in which the response time of each Ping in a unit time, such as 2 minutes, is plotted as a dot in a graph with the vertical axis representing each time from the measurement start time to the measurement end time and the horizontal axis representing response time, and the color of the dot represents the number of Ping responses received within that response time.

[0025] According to the above-described process, analysis device 10 analyzes changes in the characteristics of one or more communication devices 2 based on communication characteristic information called a signature generated based on communication data over a predetermined period of time. If the communication characteristic information of a communication device 2 connected via communication network 100 during a certain period of time changes over time, it may be that the communication device 2 has been replaced by another, different communication device 2. Analysis device 10 can analyze such changes based on the communication data.

[0026] Second Embodiment FIG. 11 is a diagram showing an outline of processing by the determination unit according to the second embodiment. In the above process, if the distances between communication devices 2 connected via communication network 100 are different, analysis device 10 will determine that the signatures are different even if the communication device 2 being analyzed when the first signature (solid line 111 in FIG. 11) was created is the same as the communication device 2 being analyzed when the second signature (dotted line 112 in FIG. 11) was created. Therefore, analysis device 10 may shift and correct the response time of the first signature in accordance with changes in the distance between communication devices 2 to align the position of the response time at the rising edge of the cumulative relative frequency, and compare it with the second signature. Alternatively, analysis device 10 may shift and correct the response time of the second signature in accordance with changes in the distance between communication devices 2 to align the position of the response time at the rising edge of the cumulative relative frequency, and compare it with the first signature.

[0027] As an example, when shifting and correcting the response time of the first signature, the measurement unit 11 acquires the medium speed Vm of the communication data of the transmission medium between the communication device 1 and the communication device 2 to be analyzed from a storage unit or the like. Note that the transmission medium of the communication network 100 connecting the communication device 1 and the communication device 2 is known. The medium speed Vm of the transmission medium is also known in advance. The measurement unit 11 calculates the distance between the communication device 1 and the communication device 2 by multiplying the medium speed Vm by (response time R ÷ 2). The measurement unit 11 may calculate the distance multiple times based on the response time R between the time when one Ping is sent and the time when the Ping response is received, and determine the average of the distances as the distance between the communication device 1 and the communication device 2. The measurement unit 11 uses the distance A calculated when the first signature was calculated and the distance B calculated when the second signature was calculated to calculate a correction time according to the variation in distance by (distance A - distance B) ÷ medium speed Vm. The signature generation unit 13 then corrects the response time at the time of generating the first signature by adding or subtracting the correction time to the response time at the time of calculating the first signature, using the first signature and the second signature calculated in the same manner as in the first embodiment, so as to align the response time positions of the rising edges of the cumulative relative frequencies of those signatures.

[0028] Then, using the first signature and the corrected second signature, the judgment unit 14 outputs to the output unit 15 a judgment result indicating whether the sum of the absolute values ​​of the differences in cumulative relative frequency for each identified response time is greater than or equal to a threshold value.

[0029] As a result, even if the distance between communication device 1 and communication device 2 to be analyzed changes, analysis device 10 provided in communication device 1 can analyze the change in communication device 2 connected via communication network 100.

[0030] <Third embodiment> The analysis device 10 may be a device that analyzes changes in the communication device 2 in the same manner as described above, based on log data of communication data with the communication device 2 that is the analysis target. For example, by storing data on past Pings and Ping responses, it is possible to analyze changes in the communication device 2 in the same manner as described above. However, there is a possibility that responses from the communication device 2 that is the analysis target, such as Ping responses, cannot be obtained from the log data. In this case, the analysis device 10 may estimate information corresponding to the response time using only the communication data that it has sent to the communication device 2 that is the analysis target, and may use the estimated response time to analyze changes in the communication device 2 that is connected for communication, using the processing of the first embodiment or the second embodiment described above.

[0031] 12 is a diagram showing an outline of a process for identifying information corresponding to a response time according to the third embodiment. The response time from the communication device 2 is communication data that indicates the characteristics of the communication device 2. However, the analysis device 10 may generate a signature that indicates the communication characteristics of the communication device 2 using communication data other than the response time (RTT). For example, the analysis device 10 may generate a signature using communication data that is timeout-transmitted when a timeout occurs in communication data with the communication device 1.

[0032] Specifically, when communication device 1 transmits communication data and packet loss occurs in the communication data, causing a timeout, the interval between the initial transmission time of the communication data and the retransmission time when the communication data is retransmitted can be characteristic information of communication device 2 to be analyzed. As shown in Figure 12, in the first pattern (pattern 1), communication device α transmits communication data d1 to communication device β at time t1, and communication device β receives it at time t2, but then communication device α detects at time t3 that it is unable to receive a response signal r1 to communication data d1, waits until time t4, and then transmits communication data d2 to communication device β at time t4 due to a timeout, and communication device β receives the timeout-transmitted communication data at time t5. This shows a pattern of communication data. In this case, the analysis device 10 uses the time obtained by subtracting the waiting time (t4-t2) until the timeout transmission in communication device α from the time (t5) when communication data d2 is received, which is recorded as the log of communication device β, to the time (t2) when communication data d1 is received, in place of the above-mentioned response time RTT, as communication characteristic information of the communication data in communication device β and communication device α to generate the signature.

[0033] Alternatively, as shown in the second pattern (pattern 2), it is assumed that communication device α transmits communication data (communication data (a), (b), (c), and (d)) including consecutive packets in sequence at time t11, time t12, time t13, and time t14. In a situation where communication device β is expected to receive communication data (a), (b), (c), and (d) in sequence, if communication device β receives communication data (c) at time t15 before receiving communication data (b), communication device β makes a retransmission request for communication data (b) three times. The transmission time of the last of the three retransmission requests in communication β is assumed to be time t16. As a result, communication device α retransmits communication data (b). It is assumed that communication device β receives communication data (b) at time t17. In this case, the analysis device 10 uses the time obtained by subtracting the time from the reception time t15 of the communication data (c) to the final time t16 of the retransmission request from the time from the reception time t15 of the communication data (c) at communication device β to the reception time t17 of the retransmitted communication data (b) as communication characteristic information of the communication data at communication device β and communication device α in generating the signature instead of the above-mentioned response time RTT.

[0034] Alternatively, as shown in a third pattern (pattern 3), assume that communication device α transmits communication data (communication data (a), (b), (c), and (d)) including consecutive packets in sequence at time t11, time t12, time t13, and time t14. In a situation where communication device β is expected to receive communication data (a), (b), (c), and (d) in sequence, if communication device β receives communication data (c) at time t15 before receiving communication data (b), communication device β transmits a retransmission request for communication data (b) by including it in the transmission of a SYN ACK. Based on the retransmission request for communication data (b), communication device α retransmits communication data (b) at time t16, and communication device β receives communication data (b) at time t17. In this case, the analysis device 10 uses the time from the reception time t15 of the communication data (c) at communication device β to the reception time t17 of the retransmitted communication data (b) as communication characteristic information of the communication data at communication device β and communication device α to generate the signature instead of the above-mentioned response time RTT.

[0035] In the communication data formats of the above-mentioned patterns 1 to 3, the time used for the reception time in the retransmission communication due to a timeout indicates characteristics of the communication between two communication devices, similar to the response time RTT, and therefore can be used to generate a signature instead of the response time RTT.

[0036] <Fourth embodiment> FIG. 13 is a diagram illustrating a communication device including an analysis device according to a fourth embodiment and a communication network 100 to which the communication device is connected. In the communication network 100 illustrated in FIG. 13, a communication device 1 including an analysis device 10 is communicatively connected to another communication device 2 to be analyzed via two relay devices 31 and 32. As illustrated in FIG. 13, when the communication device 1 including the analysis device 10 is communicatively connected to the relay device 31 and is communicatively connected to the communication device 2 via the relay devices 31 and 32, the analysis device 10 generates a first signature. Furthermore, when the communication device 1 including the analysis device 10 changes its connection position on the communication network 100 illustrated in FIG. 13 and connects to the communication network 100 that directly connects the communication device 2 and the relay device 32, the communication device 1 generates a second signature and outputs a determination result indicating whether or not there has been a change in the communication network 100.

[0037] FIG. 14 is a diagram showing an outline of the signature comparison process in the fourth embodiment. As shown in FIG. 13 , the determination unit 14 of the analysis device 10 compares a first signature generated before a connection change to the communication network 100 with a second signature generated after the connection change. That is, the determination unit 14 acquires, from the signature storage unit 105, a first signature generated in advance for the communication device 2 and a second signature newly generated during analysis. The determination unit 14 calculates, for each response time specified in the first signature at a predetermined interval (e.g., 10 μsec) (solid line 141 in the graph of FIG. 14 ), the difference between the cumulative relative frequency for each response time specified in the second signature at the same predetermined interval (dotted line 142 in the graph of FIG. 14 ), and calculates the sum of the absolute values ​​of the differences ( FIG. 14 ). The determination unit 14 acquires a threshold value for determining whether the signatures stored in the identification policy storage unit 104 are similar to each other. The determination unit 14 determines whether the sum of the absolute values ​​of the differences in the cumulative relative frequencies for each identified response time is equal to or greater than a threshold. The determination unit 14 outputs a determination result indicating whether the sum of the absolute values ​​of the differences in the cumulative relative frequencies for each identified response time is equal to or greater than a threshold to the output unit 15. The determination unit 14 similarly generates a determination result for each communication device 2 recorded in the target list storage unit 101 among the devices constituting the communication network 100, and outputs the result to the output unit 15.

[0038] By performing such processing, the analysis device 10 can determine whether or not there has been a change in the connection position of the communication device 1 to the communication network 100, or if there has been a change in another communication device 2 constituting the communication network 100. Note that the determination unit 14 of the analysis device 10 may determine whether or not the first signature and the second signature are similar based on shape recognition of graphs of each of the first signature and the second signature, which indicate the relationship between the time related to communication data transmitted multiple times to another communication device and its cumulative relative frequency.

[0039] FIG. 15 is a diagram showing an example of visual information included in output information according to the fourth embodiment. When multiple relay devices 3 exist in the communication network 100 to which the communication device 1 is connected, the relay device 3 that relays packets on a packet-by-packet basis in communication with the communication device 2 on the other end may differ. This may be because the load balancer function of each relay device 3 causes packets to be assigned to different relay devices 3 in the communication network 100. In this case, the visual information shown in FIG. 10 forms a striped pattern as shown in FIG. 15. If the communication path when a Ping is sent from the communication device 1 to the communication device 2 differs, the response time also changes. Therefore, it is presumed that the visual information output by the analysis device 10 of the communication device 1 forms a striped pattern as shown in FIG. 15. This striped pattern changes at a certain timing. This is presumably because the relay device 3 has changed the route change algorithm using the load balancer function or the like. The analysis device 10 may detect such a change in the visual information and determine whether or not there has been a change in the communication network 100.

[0040] FIG. 16 is a diagram showing an example of output information according to the fourth embodiment. Similar to the output information shown in FIG. 10 , in the fourth embodiment, when the sum of the absolute values ​​of the differences in cumulative relative frequencies for each response time, which is the judgment result for a communication device 2 constituting the communication network 100, is equal to or greater than a threshold, the output unit 15 outputs output information including at least information indicating that the communication device 2 has changed to a predetermined device. When the judgment result is less than the threshold, the output unit 15 outputs output information including at least information indicating that the communication device 2 has not changed to a predetermined device. The output unit 15 may generate output information including information indicating that there has been a change or no change for each communication device 2 recorded in the target list storage unit 101 and output the output information to a predetermined output destination device. The output unit 15 may generate output information ( FIG. 16 ) including visual information using the measurement results used to generate a new signature. Furthermore, in the fourth embodiment, the output unit 15 of the analysis device 10 may generate output information including information indicating whether there has been a change in the communication network 100 as a whole based on the change in the visual information ( FIG. 16 ).

[0041] According to the above-described process, the analysis device 10 can analyze changes in the characteristics (network configuration) of the communication network 100 based on communication characteristic information called a signature generated based on communication data over a predetermined period of time. If the communication characteristic information of any of the communication devices 2 constituting the communication network 100 connected via the communication network 100 during a certain time period changes over time, there is a possibility that the communication device 2 constituting the communication network 100 exhibiting the change has been replaced with another device. The analysis device 10 can analyze such changes based on the communication data.

[0042] FIG. 17 is a diagram showing the minimum configuration of the analysis device. FIG. 18 is a diagram showing the processing flow of an analysis device with a minimum configuration. The analysis device 10 includes at least a determination means 171 and an output means 172 . The determination means 171 compares first communication characteristic information generated based on communication data over a predetermined period of time with other communication devices connected to the communication network 100 with second communication characteristic information generated based on new communication data over a predetermined period of time with other communication devices connected to the communication network 100 to determine whether the communication characteristic information is similar (step S701). The output means 172 outputs a determination result indicating whether or not there is a change in the communication network 100 based on the presence or absence of similarity (step S702).

[0043] (Hardware configuration) FIG. 19 is a block diagram showing an example of the hardware configuration of a calculation processing device 80 that can realize the analysis device 10 according to each embodiment of the present invention. An example of the configuration of hardware resources for implementing the analysis device 10 using one calculation processing device (information processing device, computer) will be described. However, the analysis device 10 may be physically or functionally implemented using at least two calculation processing devices. Furthermore, the analysis device 10 may be implemented as a dedicated device.

[0044] The calculation processing device 80 has a central processing unit (hereinafter referred to as "CPU") 81, a volatile storage device 82, a disk 83, a non-volatile recording medium 84, and a communication interface (hereinafter referred to as "communication IF") 87. The calculation processing device 80 may be connectable to an input device 85 and an output device 86. The calculation processing device 80 can send and receive information to and from other calculation processing devices and other communication devices via the communication IF 87.

[0045] The nonvolatile recording medium 84 is a computer-readable medium, such as a compact disc or a digital versatile disc. The nonvolatile recording medium 84 may also be a universal serial bus memory (USB memory), a solid state drive, or the like. The nonvolatile recording medium 84 retains the program and enables portability without requiring power supply. The nonvolatile recording medium 84 is not limited to the above-mentioned media. Instead of the nonvolatile recording medium 84, the program may be transported via the communication IF 87 and the communication network 100. The volatile storage device 82 is computer-readable and can temporarily store data. The volatile storage device 82 is a memory such as a dynamic random access memory (DRAM) or a static random access memory (SRAM).

[0046] That is, when executing a software program (computer program: hereinafter simply referred to as "program") stored on disk 83, CPU 81 copies the program to volatile storage device 82 and executes the arithmetic processing. CPU 81 reads data necessary for program execution from volatile storage device 82. When display is required, CPU 81 displays the output result on output device 86. When inputting a program from the outside, CPU 81 reads the program from input device 85. CPU 81 interprets and executes an analysis program (FIG. 4 or 5) stored in volatile storage device 82 that corresponds to the functions (processing) represented by each unit shown in FIG. 2 (or FIG. 3). CPU 81 executes the processing described in each embodiment of the present invention above. That is, in such cases, each embodiment of the present invention can be understood to be realized by such an analysis program. Furthermore, each embodiment of the present invention can be understood to be realized by a computer-readable non-volatile recording medium on which such an analysis program is recorded.

[0047] The present invention has been described above using the above-described embodiment as an exemplary example. However, the present invention is not limited to the above-described embodiment. In other words, the present invention can be applied in various aspects that can be understood by a person skilled in the art within the scope of the present invention. [Explanation of symbols]

[0048] 100···Communication Network 1, 2, 21, 22...Communication equipment 3, 31, 32...Relay device 4. Switch 11...Measurement section 12 Response time calculation section 13 Signature generation unit 14...determination section (determination means 171) 15. Output section (output means 172) 101···Target list storage unit 102 Measurement policy storage unit 103...Measurement result storage section 104: Identification policy storage unit 105 Signature storage unit

Claims

1. a determination means for comparing first communication characteristic information, which is generated based on communication data transmitted a plurality of times over a predetermined time period to another communication device connected to the communication network, and which indicates a characteristic of the relationship between the time from when the communication data is transmitted to the other communication device until a response to the communication data is received, and a cumulative relative frequency of the time, with second communication characteristic information, which is generated based on new communication data transmitted a plurality of times over a predetermined time period to another communication device connected to the communication network, and which indicates a characteristic of the relationship between the time from when the communication data is transmitted to the other communication device until a response to the communication data is received, and a cumulative relative frequency of the time, to determine whether the communication characteristic information is similar; an output means for outputting a determination result indicating whether or not there is a change in the communication network based on the presence or absence of the similarity; An analysis device comprising:

2. The determination means compares the communication characteristic information indicating characteristics related to the time from when the communication data is transmitted to the other communication device until when retransmission of communication data related to that information is transmitted, and determines whether or not the similarity exists. The analysis device according to claim 1 .

3. The determination means determines whether the communication feature information is similar based on whether a sum of the time differences according to the cumulative relative frequencies indicated by the first communication feature information and the second communication feature information is equal to or greater than a threshold. The analysis device according to claim 1 or 2.

4. The determination means determines whether or not the similarity exists based on shape recognition of graphs of the first communication characteristic information and the second communication characteristic information, each of which indicates a relationship between the time and the cumulative relative frequency of the communication data transmitted multiple times to the other communication device. The analysis device according to any one of claims 1 to 3.

5. The output means outputs a determination result indicating whether or not there is a change in the other communication device connected via the communication network based on the presence or absence of the similarity. The analysis device according to any one of claims 1 to 4.

6. The output means outputs a determination result indicating whether or not there is a change in the network configuration of the communication network based on the presence or absence of the similarity. The analysis device according to any one of claims 1 to 5.

7. comparing first communication feature information, which is generated based on communication data transmitted a plurality of times over a predetermined time period to another communication device connected to the communication network, and which indicates a characteristic of the relationship between the time from transmitting the communication data to the other communication device until a response to the communication data is received, and its cumulative relative frequency, with second communication feature information, which is generated based on new communication data transmitted a plurality of times over a predetermined time period to another communication device connected to the communication network, and which indicates a characteristic of the relationship between the time from transmitting the communication data to the other communication device until a response to the communication data is received, and its cumulative relative frequency, to determine whether the communication feature information are similar; and outputting a determination result indicating whether or not there is a change in the communication network based on the presence or absence of the similarity. Analysis method.

8. The communication characteristic information indicating characteristics related to the time from when the communication data is transmitted to the other communication device until when retransmission of communication data related to that information is transmitted is compared to determine whether or not the similarity exists. The analysis method according to claim 7.

9. The presence or absence of similarity of the communication feature information is determined based on whether or not the sum of the time differences according to the cumulative relative frequencies indicated by the first communication feature information and the second communication feature information is equal to or greater than a threshold value. The analysis method according to claim 7 or 8.

10. The presence or absence of the similarity is determined based on shape recognition of graphs of the first communication characteristic information and the second communication characteristic information, each of which indicates a relationship between the time and the cumulative relative frequency of the communication data transmitted multiple times to the other communication device. The analysis method according to any one of claims 7 to 9.

11. Based on the presence or absence of the similarity, a determination result indicating the presence or absence of a change in the other communication device connected via the communication network is output. The analysis method according to any one of claims 7 to 10.

12. Based on the presence or absence of the similarity, a determination result indicating the presence or absence of a change in the network configuration of the communication network is output. The analysis method according to any one of claims 7 to 11.

13. The computer of the analysis device, a determination means for determining whether or not the communication feature information is similar by comparing first communication feature information, which is generated based on communication data transmitted a plurality of times over a predetermined time period to another communication device connected to the communication network and indicates a characteristic of the relationship between the time from transmitting the communication data to the other communication device until a response to the communication data is received, and its cumulative relative frequency, with second communication feature information, which is generated based on new communication data transmitted a plurality of times over a predetermined time period to another communication device connected to the communication network and indicates a characteristic of the relationship between the time from transmitting the communication data to the other communication device until a response to the communication data is received, and its cumulative relative frequency; an output means for outputting a determination result indicating whether or not there is a change in the communication network based on the presence or absence of the similarity; A program that functions as a

Images