Traffic reapplication determination device, traffic reapplication determination method, and traffic reapplication determination program

Abstract

A traffic re-application determination device 1 comprises: a traffic totaling unit 21 that calculates at least two sums of traffics among the sum of application traffics applied to respective interfaces of a prescribed standby NW device 5 among a plurality of the standby NW devices 5, the sum of transmission traffics transmitted from the interfaces of the prescribed standby NW device 5, and the sum of reception traffics received through respective interfaces of a standby NW device 5 other than the prescribed standby NW device 5; and a re-application determination unit 23 that determines the necessity of re-application of the application traffics on the basis of the similarity level between said two sums of the traffics.

Description

[Technical Field]

[0001] The present invention relates to a traffic re-application determination device, a traffic re-application determination method, and a traffic re-application determination program. [Background technology]

[0002] When a failure occurs, telecommunications carriers' network (network) operations require them to quickly identify the location of the failure and grasp the extent of the impact. These tasks are performed based on network configuration information (e.g., the device name, IP address, communication port number, and connection relationship between ports on network devices).

[0003] On the other hand, the current state of the network configuration changes dynamically due to the addition, removal, and switching of network devices, communication ports, network connections, etc. Therefore, in order to maintain and operate these, it is important to manage correct network configuration information.

[0004] In this regard, there is a topology estimation technology that compares time-series data of the amount of traffic transmitted and received from each IF (interface) of a network device and estimates that the IFs with the highest similarity in the amount of traffic transmitted and received are connected (see Patent Document 1).

[0005] Specifically, the received traffic volume IF(t).in and the transmitted traffic volume IF(t).out of each IF at time t are obtained, and the "IF i (t).in-IF j (t).out" and "IF j (t).in-IF i The IFs with the smallest difference between the two are estimated to be in a connection relationship.

[0006] However, the topology estimation technique of Patent Document 1 compares the difference in traffic volume between each IF, so it is difficult to accurately estimate the connection relationship between IFs where the amount of traffic flowing is small and constant, such as in backup network devices.

[0007] Therefore, there is a method for improving the estimation accuracy of the topology estimation technique of Patent Document 1 by applying test traffic and giving each IF a unique feature due to a temporary increase in traffic volume (see Patent Document 2). Specifically, test traffic is applied to each IF of each protection network device at different timings to give each feature. [Prior art documents] [Patent documents]

[0008] [Patent Document 1] Patent No. 5695767 [Patent Document 2] Japanese Patent Application Publication No. 2020-127160 Summary of the Invention [Problem to be solved by the invention]

[0009] However, when the test traffic is applied at short intervals, the features of the test traffic may occur simultaneously in multiple IFs, which makes it impossible to accurately estimate the connection relationships.

[0010] For example, even if test traffic is applied to each IF of the backup network device A with different timing, due to the time lag until the packets of each test traffic reach the receiving side, some or all of the applied time characteristics will appear at each IF of the backup network device B, making it difficult to determine at which IF the timing of the characteristics overlaps and what the cause is.

[0011] While it would be ideal if there was a sufficient interval between application times, it is difficult to achieve a sufficient interval between application times while satisfying the specifications and operational constraints of network equipment. Furthermore, simultaneous occurrence or time lag of feature quantities is difficult to detect without detailed observation of time-series data.

[0012] The present invention has been made in view of the above circumstances, and an object of the present invention is to provide a technique that can automatically determine whether or not it is necessary to reapply traffic. [Means for solving the problem]

[0013] A traffic re-application determination device according to one embodiment of the present invention includes an adder that calculates the sum of at least two of the following traffics: the sum of applied traffic applied to each IF of a specified backup network device among a plurality of backup network devices; the sum of transmitted traffic transmitted from each IF of the specified backup network device; and the sum of received traffic received at each IF of a backup network device other than the specified backup network device; and a determination unit that determines whether or not the applied traffic needs to be re-applied based on the similarity between the two traffic sums.

[0014] A traffic re-application determination method according to one embodiment of the present invention is a traffic re-application determination method performed by a traffic re-application determination device, which includes the steps of calculating the sum of at least two of the following traffics: the sum of applied traffic applied to each IF of a predetermined backup network device among a plurality of backup network devices; the sum of transmitted traffic transmitted from each IF of the predetermined backup network device; and the sum of received traffic received at each IF of backup network devices other than the predetermined backup network device; and determining whether or not the applied traffic needs to be re-application based on the similarity between the two traffic sums.

[0015] A traffic re-application determination program according to one aspect of the present invention causes a computer to function as the traffic re-application determination device. [Effects of the Invention]

[0016] According to the present invention, it is possible to provide a technique that can automatically determine whether or not traffic re-application is necessary. [Brief explanation of the drawings]

[0017] [Figure 1] FIG. 1 is a diagram showing an outline of the invention. [Figure 2] FIG. 2 is a diagram showing the system configuration according to this embodiment. [Figure 3] FIG. 3 is a diagram showing a processing flow of the traffic re-application determination device. [Figure 4] FIG. 4 is a reference diagram for explaining the processing flow. [Figure 5] FIG. 5 is a reference diagram for explaining the processing flow. [Figure 6] FIG. 6 is a diagram illustrating a hardware configuration of the traffic re-application determination device. DETAILED DESCRIPTION OF THE INVENTION

[0018] Hereinafter, an embodiment of the present invention will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

[0019] [Summary of the Invention] 1 is a diagram showing an outline of the invention. Two standby network devices 5A and 5B are connected to each other via their respective IFs so that they can communicate with each other or in one direction.

[0020] At this time, the total amount of test traffic flow applied to the backup network device 5A by the traffic application device 2 should match the total amount of traffic flow for that feature amount received by the backup network device 5B. If they do not match, it is determined that the test traffic application process was not successful, and the test traffic must be applied again.

[0021] Therefore, the present invention proposes a method for recommending whether or not to reapply the test traffic based on the deterioration of the degree of agreement or similarity between the applied total flow rate TR1 of the test traffic applied to each backup network device 5 by the traffic application device 2 and the total transmission flow rate TR2 of the characteristic amount transmitted from each backup network device 5 or the total reception flow rate TR3 of the characteristic amount received by each backup network device 5. Note that it is also possible to compare only the total transmission flow rate TR2 and the total reception flow rate TR3.

[0022] [System configuration and device configuration] 2 is a diagram showing the system configuration according to this embodiment. The system according to this embodiment includes a traffic re-application determination device 1, a traffic application device 2, a traffic collection device 3, an HMI terminal 4, and multiple standby network devices 5. The traffic application device 2 and the traffic collection device 3 may be implemented as the same device.

[0023] The traffic application device 2 is a device that applies test traffic to each IF of one or more of the plurality of protection network devices 5. The method of applying the test traffic is arbitrary.

[0024] The traffic collecting device 3 is a device that collects time-series traffic data transmitted from each IF of a plurality of standby network devices 5 that can communicate with each other or one-way, and collects time-series traffic data received at each IF of the standby network devices 5. The traffic collecting device 3 is, for example, an operation system (OpS) of a communication carrier.

[0025] The HMI (Human Machine Interface) terminal 4 is a user terminal for inputting data used in the traffic re-application determination process.

[0026] The multiple backup network devices 5 are redundant devices that perform processing when a failure occurs in the working network device. The backup network devices 5 are, for example, routers, switches, or transmission devices. The multiple backup network devices 5 are connected to each other or to one of the interfaces so that they can communicate with each other or one way. However, since no traffic of actual services flows, the amount of traffic flowing between the backup network devices 5 is extremely small and generally constant.

[0027] The traffic re-application determination device 1 is a device that recommends the need for traffic re-application by comparing the sum of the test traffic flow rates applied to the backup network device 5 with the sum of the traffic flow rates of the characteristic quantities transmitted or received by the backup network device 5.

[0028] Specifically, the traffic re-application decision device 1 uses the total applied traffic created from the traffic application log data of the traffic application device 2 as a standard, compares it with the sum of the traffic flow rates on the sending or receiving sides of the backup network device 5, and has the function of recommending re-application of traffic as necessary based on the degree of agreement or similarity between the flow rates.

[0029] For example, the traffic re-application determination device 1 includes a data storage unit 10, a calculation unit 20, and an input / output unit 30, as shown in FIG.

[0030] The data storage unit 10 includes a traffic data storage unit 11 and a recommendation result storage unit 12 .

[0031] The traffic data storage unit 11 has a function of acquiring from the traffic application device 2 traffic application log data of the test traffic applied to each IF of the protection network device 5 by the traffic application device 2 and storing the traffic application log data.

[0032] In addition, the traffic data storage unit 11 has the function of acquiring and storing time-series traffic data transmitted from each IF of the backup network device 5 in response to the application of the above-mentioned test traffic from the traffic collection device 3, and acquiring and storing time-series traffic data received at each IF of the backup network device 5.

[0033] The recommendation result storage unit 12 has a function of storing recommendation information indicating whether or not the test traffic needs to be reapplied, as determined by the calculation unit 20 .

[0034] The calculation unit 20 includes a traffic summing unit 21, a traffic comparing unit 22, a reapplication determining unit 23, and a recommended information determining unit 24.

[0035] The traffic summing unit 21 has a function of reading out the traffic application log data from the traffic data storage unit 11 and summing up the traffic application log data applied to each IF of the protection network device 5 .

[0036] The traffic summing unit 21 also has a function of reading out time-series traffic data from the traffic data storage unit 11 and summing up the time-series traffic data for the feature amounts (= test traffic amounts) transmitted from each IF of the protection network device 5.

[0037] The traffic summing unit 21 also has a function of reading out time-series traffic data from the traffic data storage unit 11 and summing up the time-series traffic data of the feature amounts (= test traffic amounts) received at each IF of the protection network device 5.

[0038] The traffic comparison unit 22 has a function of comparing at least two sums of a first sum of traffic application log data applied to the backup network device 5, a second sum of time-series traffic data of feature amounts transmitted from the backup network device 5, and a third sum of time-series traffic data of feature amounts received by the backup network device 5.

[0039] For example, the traffic comparing unit 22 may compare the first sum with the second sum, or may compare the first sum with the third sum, or may compare the second sum with the third sum, or may compare the first sum to the third sum with each other. The traffic summing unit 21 may calculate only at least two sums to be compared by the traffic comparing unit 22.

[0040] The traffic comparison unit 22 may compare data for all time periods including traffic data not based on test traffic, or may extract and compare only feature portions from traffic application log data or time-series traffic data.

[0041] The method for comparing the sum values ​​is arbitrary. For example, the traffic comparator 22 may compare waveforms using DTW (Dynamic Time Warping) or a data analysis library.

[0042] The reapplication determination unit 23 has a function of determining whether or not it is necessary to reapply the test traffic based on the comparison result of the two sum values ​​performed by the traffic comparison unit 22. The method of determining whether or not it is necessary to reapply the test traffic is arbitrary. For example, the reapplication determination unit 23 determines that it is not necessary to reapply the test traffic if the degree of agreement or similarity of the two sum values ​​compared is equal to or greater than a threshold, and determines that it is necessary to reapply the test traffic if the degree of agreement or similarity is not equal to or greater than the threshold. Alternatively, the reapplication determination unit 23 may make a determination based on the difference between the two sum values ​​compared.

[0043] The recommendation information determination unit 24 has a function of determining the result of the determination by the re-application determination unit 23 as to whether or not test traffic re-application is necessary as recommendation information, and storing the recommendation information indicating whether or not test traffic re-application is necessary in the recommendation result storage unit 12.

[0044] The input / output unit 30 includes a setting information input unit 31 and a recommended information output unit 32 .

[0045] The setting information input unit 31 has a function of receiving setting information necessary for performing the traffic re-application determination process from the HMI terminal 4. For example, the setting information input unit 31 receives a threshold value used in the traffic re-application determination process and display content to be included in the recommendation information.

[0046] The recommended information output unit 32 has a function of outputting the recommended information determined by the recommended information determination unit 24 .

[0047] So far, we have explained the functions of the traffic re-application determination device 1. With the above functions, we can provide a technology that can automatically determine whether traffic re-application is necessary. In addition, we can automatically determine the accuracy of the feature assignment by the applied test traffic, which is expected to prevent a decrease in the accuracy of data analysis and reduce the data observation work.

[0048] [Operation of the traffic re-application decision device] Fig. 3 is a diagram showing the processing flow of the traffic re-application determination device 1. Fig. 4 and Fig. 5 are reference diagrams for explaining the processing flow. Here, two backup network devices 5A and 5B are analyzed.

[0049] Step S1; The traffic data storage unit 11 acquires from the traffic application device 2 traffic application log data of the test traffic applied by the traffic application device 2 to each IF of the protection network device 5A and stores the traffic application log data.

[0050] Step S2; The traffic data storage unit 11 acquires and stores time-series traffic data transmitted from each IF of the backup network device 5A in response to the application of the test traffic from the traffic collection device 3, and acquires and stores time-series traffic data received at each IF of the backup network device 5B.

[0051] Time-series traffic data can be obtained by executing commands such as "$ show pm-interface" and "$ snmpwalk -v 2c -c public" or by performing packet capture. Step S2 may be performed before step S1 or simultaneously with step S1.

[0052] Step S3; The traffic summing unit 21 sums up the traffic application log data of the test traffic applied to each IF of the backup network device 5A to obtain a summed total applied flow rate TR1. The traffic summing unit 21 sums up the time-series traffic data of the feature amounts (= test traffic amounts) transmitted from each IF of the backup network device 5A to obtain a summed total transmitted flow rate TR2. The traffic summing unit 21 sums up the time-series traffic data of the feature amounts (= test traffic amounts) received at each IF of the backup network device 5B to obtain a summed total received flow rate TR3.

[0053] In addition, when the test traffic application method involves remotely logging in to a backup network device and applying test traffic to the other backup network device, the sending and receiving sides are identified from the remote login history. In other methods, the IF data is divided into two equal parts into the first column (sending side) and the second column (receiving side) of the IF list output by the topology estimation device 6 (see Patent Document 1), and the sending and receiving sides are identified from the IF data after the division.

[0054] Step S4; The traffic comparator 22 compares the applied total flow rate TR1, which is an ideal value, with the received total flow rate TR3 actually received by the backup network device 5B. At this time, data from all time periods including traffic data not due to test traffic may be compared, or only feature portions may be extracted and compared from traffic application log data or time-series traffic data. The reason why data from all time periods including traffic data not due to test traffic may be compared is because the amount of traffic flowing between the backup network devices 5 is extremely small.

[0055] Step S5; If the applied total flow rate TR1 and the received total flow rate TR3 are not similar, for example, if the degree of similarity between them is not greater than a threshold, the reapplication judgment unit 23 determines that the timing of adding features using test traffic is not appropriate, and recommends reapplication of test traffic as a judgment result.

[0056] On the other hand, if the applied total flow rate TR1 and the received total flow rate TR3 are similar, for example, if the degree of similarity between them is equal to or greater than a threshold, the reapplication judgment unit 23 judges that the timing of adding features using test traffic is appropriate, and determines as a judgment result that reapplication of test traffic is not necessary.

[0057] Step S6; If the applied total flow rate TR1 and the received total flow rate TR3 are not similar, the recommended information determination unit 24 determines the determination result recommending re-application of the test traffic as recommended information. Thereafter, the recommended information output unit 32 outputs the recommended information to the traffic application device 2, the traffic collection device 3, and the HMI terminal 4.

[0058] Step S7; If the applied total flow rate TR1 and the received total flow rate TR3 are similar, the recommended information determination unit 24 determines the result of the determination that re-application of test traffic is unnecessary as recommended information. Thereafter, the recommended information output unit 32 outputs the recommended information to the traffic application device 2, the traffic collection device 3, and the HMI terminal 4.

[0059] In step S4, the traffic comparison unit 22 may compare, for example, the total transmission flow rate TR2 actually transmitted by the standby network device 5A with the total reception flow rate TR3 actually received by the standby network device 5B. In this case, the "total application flow rate TR1" in steps S5 to S7 is replaced with the "total transmission flow rate TR2."

[0060] In steps S4 to S7, only time portions with low traffic similarity may be extracted and compared with the traffic application log, and only IFs that are considered to have deteriorated accuracy may be targeted for re-application and output as the determination results.

[0061] [effect] As described above, the traffic re-application determination device 1 according to the present invention includes a traffic summation unit 21 that calculates the sum of at least two of the following traffics: the sum of applied traffic applied to each IF of a predetermined backup NW device 5 among a plurality of backup NW devices 5; the sum of transmitted traffic transmitted from each IF of the predetermined backup NW device 5; and the sum of received traffic received at each IF of backup NW devices 5 other than the predetermined backup NW device 5; and a re-application determination unit 23 that determines whether or not the applied traffic needs to be re-applied based on the similarity between the two traffic sums.

[0062] By providing these functional units, the present invention can provide a technology that can automatically determine whether or not to re-apply traffic. It can also automatically determine the accuracy of the feature assignment by the applied test traffic, which can prevent a decrease in the accuracy of data analysis and reduce the amount of data observation work.

[0063] [others] The present invention is not limited to the above-described embodiment, and various modifications are possible within the scope of the present invention.

[0064] The traffic re-application determination apparatus 1 of the present embodiment described above can be realized, for example, by using a general-purpose computer system including a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 6. The memory 902 and the storage 903 are storage devices. In the computer system, the CPU 901 executes a predetermined program loaded on the memory 902, thereby realizing each function of the traffic re-application determination apparatus 1.

[0065] The traffic re-application determination device 1 may be implemented by one computer. The traffic re-application determination device 1 may be implemented by multiple computers. The traffic re-application determination device 1 may be a virtual machine implemented on a computer. The program for the traffic re-application determination device 1 may be stored in a computer-readable recording medium such as an HDD, SSD, USB memory, CD, or DVD. The program for the traffic re-application determination device 1 may also be distributed via a communication network. [Explanation of symbols]

[0066] 1: Traffic reapplication determination device 10: Data storage section 11: Traffic data storage unit 12: Recommended result storage section 20: Arithmetic section 21: Traffic summing unit 22: Traffic comparison section 23: Re-application judgment section 24: Recommendation information determination unit 30: Input / output section 31: Setting information input section 32: Recommended information output section 2: Traffic injection device 3: Traffic collection device 4: HMI terminal 5: Standby network device 6: Topology estimation device 901:CPU 902: Memory 903:Storage 904:Communication equipment 905: Input device 906: Output device

Claims

1. an adder that calculates the sum of at least two of the following traffics: a sum of applied traffics applied to each IF of a predetermined backup network device among a plurality of backup network devices; a sum of transmitted traffics transmitted from each IF of the predetermined backup network device; and a sum of received traffics received by each IF of backup network devices other than the predetermined backup network device; a determination unit that determines whether or not it is necessary to re-apply the applied traffic based on the similarity between the sums of the two traffics; A traffic re-application determination device comprising:

2. The summing unit 2. The traffic re-application decision device according to claim 1, wherein the device decides whether or not the applied traffic needs to be re-applied based on the similarity between the total applied traffic and the total received traffic.

3. The summing unit 2. The traffic re-application decision device according to claim 1, wherein the device decides whether or not the applied traffic needs to be re-applied based on the similarity between the total of the transmitted traffic and the total of the received traffic.

4. A traffic re-application determination method performed by a traffic re-application determination device, calculating a sum of at least two of traffics among a sum of applied traffics applied to each IF of a predetermined backup network device among a plurality of backup network devices, a sum of transmitted traffics transmitted from each IF of the predetermined backup network device, and a sum of received traffics received by each IF of backup network devices other than the predetermined backup network device; determining whether or not the applied traffic needs to be reapplied based on the similarity between the two traffic sums; A traffic re-application determination method for performing the above.

5. 4. A traffic re-application determination program that causes a computer to function as the traffic re-application determination device according to claim 1.

Images