Generation apparatus, generation method, generation program, and analysis system

Abstract

Analyzing the communication behavior of each user. [Solution] NPB22 assigns VLANID:α to communication data based on VLANID:u, which identifies communication data in carrier network N1, and information that identifies the device (TAP) that extracted communication data from carrier network N1. NPB22 forwards packets with VLANID:α to a function that analyzes the flow of carrier network N1 (for example, FE32 and analysis device 50).

Description

Technical Field

[0001] The present invention relates to a generation device, a generation method, a generation program, and an analysis system.

Background Art

[0002] Conventionally, a technique for analyzing communication behavior based on the flow of packets sampled from a network is known (for example, see Patent Document 1).

Prior Art Documents

Patent Documents

[0003]

Patent Document 1

Summary of the Invention

Problems to be Solved by the Invention

[0004] However, the conventional technology has a problem that it may not be possible to analyze the communication behavior for each user.

[0005] A physical network for a communication line provider to provide communication services is called a carrier network. On the carrier network, a number of logical lines are set according to contracts or service specifications. A user can perform data communication using one or more logical lines.

[0006] For example, Patent Document 1 describes that traffic measurement using a flow can be performed. A flow is information on traffic flowing through network devices, aggregated in units such as source and destination IP addresses, port numbers, and protocols. For example, according to a flow, traffic analysis by IP address unit or protocol unit becomes possible.

[0007] On the other hand, the conventional technology does not support traffic analysis in terms of user units or logical line units.

[0008] To solve the above-mentioned problems and achieve the objective, the generation device according to the present invention includes an assignment unit that assigns a second line identifier to the communication data based on a first line identifier that identifies communication data in a carrier network and information that identifies a device that has extracted the communication data from the carrier network, and a transfer unit that transfers the communication data. [Effects of the Invention]

[0009] According to the present invention, it is possible to analyze the communication behavior of each user. [Brief explanation of the drawing]

[0010] [Figure 1] Figure 1 shows an example of the configuration of the analysis system. [Figure 2] Figure 2 is a diagram illustrating the operation of TAP. [Figure 3] Figure 3 shows an example of an NPB configuration without assigning a VLAN ID for line identification. [Figure 4] Figure 4 shows an example of forwarding destination information when a VLAN ID for line identification is not assigned. [Figure 5] Figure 5 shows an example of an NPB configuration that assigns a VLAN ID for line identification. [Figure 6] Figure 6 shows an example of forwarding destination information when a VLAN ID is assigned for line identification. [Figure 7] Figure 7 shows an example of VLAN ID information for line identification. [Figure 8] Figure 8 is a diagram illustrating the operation of the analytical instrument. [Figure 9] Figure 9 is a flowchart showing the processing flow of the analysis system. [Figure 10] Figure 10 shows an example of a computer that runs the generation program. [Modes for carrying out the invention]

[0011] Hereinafter, embodiments of the generation device, generation method, generation program, and analysis system disclosed in the present application will be described in detail based on the drawings. Note that the present invention is not limited by this embodiment.

[0012] FIG. 1 is a diagram showing an example of an analysis system according to the first embodiment. As shown in FIG. 1, the analysis system 1 includes TAP11, TAP12, NPB21, NPB22, FE31, FE32, and an analysis device 50. NPB21 and NPB22 are Network Packet Brokers, and based on signals and the like received from the previous-stage functions, transfer data necessary for analysis to the subsequent-stage functions. NPB21, NPB22, FE31, and FE32 are an example of a generation device.

[0013] The carrier network N1 is a physical network configured by cables and the like that connect communication devices and between communication devices. A plurality of virtual networks are constructed on the carrier network N1.

[0014] Here, in the carrier network N1, it is assumed that communication devices are connected by optical fibers and optical signals flow as traffic. Also, a virtual network is called a line. Also, the line identifier of the virtual network is a VLAN.

[0015] Users of communication services are associated with one or more VLANs. A user indicates the entity that uses the communication service, and may be an individual or an organization such as a company. That is, a user can perform data communication using one or more lines based on a contract with a communication carrier.

[0016] The analysis system 1 analyzes the behavior of communication in the carrier network N1. The analysis system 1 collects the flow of packets, which are communication data flowing on the carrier network N1, and performs analysis regarding the behavior of communication based on the collected flow.

[0017] At that time, the analysis system 1 can assign an identifier for identifying a virtual network, that is, a line, to the flow. Thereby, the analysis system 1 can analyze the communication behavior for each line based on the flow.

[0018] The communication carrier holds information for associating a line with a user as contract information. Therefore, the analysis system 1 can associate the flow with the user by referring to the contract information.

[0019] TAP11 and TAP12 acquire optical signals from the carrier network N1. Using FIG. 2, the operations of TAP11 and TAP12 will be described. FIG. 2 is a diagram for explaining the operation of the TAP.

[0020] In FIG. 2, the operation of TAP12 will be described as an example. The operation of TAP11 is the same as that of TAP12. TAP12 is connected to the upper network N11 via the upper device 71. Also, TAP12 is connected to the lower network N12 via the lower device 72. The upper device 71 and the lower device 72 are included in the carrier network N1. Also, the upper network N11 and the lower network N12 may be a part of the carrier network N1 or may be a network external to the carrier network N1. Networks external to the carrier network N1 are, for example, the Internet, a network connected to CPE (Customer Premises Equipment), a mobile network, etc.

[0021] Communication in the direction from the upper network N11 to the lower network N12 is Inbound communication. Communication in the direction from the lower network N12 to the upper network N11 is Outbound communication.

[0022] TAP12 copies optical signals by spectral analysis. TAP12 spectrally analyzes the inbound communication optical signal into channel A and forwards it to port 2211 of NPB-CL221. TAP12 spectrally analyzes the outbound communication optical signal into channel B and forwards it to port 2212 of NPB-CL221. Note that NPB-CL221 is part of NPB22. Details of NPB-CL221 will be described later.

[0023] This allows NPB22 to identify outbound and inbound optical signals based on the port from which they are acquired. NPB21 can acquire optical signals from TAP11 in the same manner as NPB22.

[0024] NPB21 and NPB22 add information to the communication data. NPB21 and NPB22 then forward the information-added communication data to a function for analysis. NPB21 does not add a VLAN ID for line identification to the communication data. On the other hand, NPB22 adds a VLAN ID for line identification to the communication data. The communication data consists of packets based on optical signals obtained from TAP11 and TAP12.

[0025] The configuration of NPB21 will be explained using Figure 3. Figure 3 shows an example of an NPB configuration without assigning a VLAN ID for line identification. As shown in Figure 3, NPB21 has NPB-CL211, NPB-DL212, and NPB-AG213.

[0026] NPB21 receives packets via TAP11. Packets received by NPB21 contain an IPv4 address (e.g., Src or DstIP address) "aaaa". Packets received by NPB21 may or may not have a VLANID:u (where u is a specific value).

[0027] The NPB-CL211 identifies the line corresponding to the packet using its IPv4 address. The NPB-CL211 then assigns VLANID:y to forward the packet to the function desired by the user of the identified line.

[0028] The NPB-CL211 can assign VLANID:y by referring to the destination information. Figure 4 shows an example of destination information when no VLANID for line identification is assigned. For example, if the user requests "Detection means #1" and "Flow acquisition means #1" as functions for analysis, the NPB-CL211 will delete VLANID:u from the packet and assign "4" as VLANID:y. However, it is assumed that the channel of the optical signal on which the packet is based is "Bch". Note that if VLANID:u is not set in the packet, the NPB-CL211 will assign VLANID:y without deleting the VLANID.

[0029] NPB-CL211 forwards packets with VLANID:y to NPB-DL212. NPB-DL212 aggregates the received packets and forwards them to NPB-AG213. NPB-AG213 forwards the packets to the function corresponding to VLANID:y.

[0030] In the example in Figure 1, FE31 and FE32 correspond to flow acquisition means. For example, the flow acquisition means is a Flow Exporter, which converts packets into flow data. Flow data is flow data such as NetFlow.

[0031] Furthermore, the detection means is a threat detection device, which performs threat detection on packets and, if a threat is detected, sends a syslog to the analysis device 50.

[0032] Next, the configuration of NPB22 will be explained using Figure 5. Figure 5 shows an example of an NPB configuration that assigns VLAN IDs for line identification. As shown in Figure 5, NPB22 has NPB-CL221, NPB-DL222, and NPB-AG223.

[0033] NPB22 receives packets via TAP12. Packets received by NPB22 include an IPv4 address (e.g., Src or Dst) "aaaa". Packets received by NPB21 have VLANID:u (where u is a specific value) attached to them.

[0034] The NPB-CL221 identifies the line corresponding to the packet using VLANID:u. Then, the NPB-CL221 sets VLANID:x to forward the packet to the function desired by the user of the identified line.

[0035] The NPB-CL221 assigns VLANID:x to the packet by referring to the destination information. Figure 6 shows an example of destination information when assigning a VLANID for line identification. For example, if the user requests "Detection Means #1" and "Flow Acquisition Means #1" as functions for analysis, the NPB-CL211 removes VLANID:u from the packet and assigns "3002" as VLANID:x.

[0036] Furthermore, the NPB-CL221 refers to the VLAN ID information for line identification and assigns the VLAN ID:α for line identification to the packet. Here, the VLAN ID:u used in carrier network N1 may be the same across different lines or across different users. In other words, VLAN ID:u may not be able to uniquely identify lines and users.

[0037] On the other hand, the VLAN ID:α assigned by NPB-CL221 for line identification allows for unique identification of the line and user. Figure 7 shows an example of VLAN ID information for line identification. As shown in Figure 7, NPB-CL221 determines VLAN ID:α based on the TAP from which the packet was acquired, the VLAN ID:u attached to the packet, and the channel. Note that VLAN ID:x may be common across different channels.

[0038] For example, if the source TAP of the packet is "TAP_1", the VLANID:u attached to the packet is "1001", and the channel is "Bch", then NPB-CL221 will assign "2" as VLANID:α to the packet.

[0039] NPB-CL221 forwards packets with VLANID:x and VLANID:α to NPB-DL222. NPB-DL222 aggregates the received packets and forwards them to NPB-AG223. NPB-AG223 forwards the packets to the function corresponding to VLANID:x. At that time, NPB-AG223 identifies the destination function and then removes VLANID:x.

[0040] In this way, NPB22 assigns VLANID:α to communication data based on VLANID:u, which identifies communication data in carrier network N1, and information identifying the device (TAP) that extracted communication data from carrier network N1. NPB22 forwards packets with VLANID:α to a function that analyzes the flow of carrier network N1 (e.g., FE32 and analysis device 50). VLANID:u is an example of a first circuit identifier and a first VLANID. VLANID:α is an example of a second circuit identifier and a second VLANID.

[0041] This makes it possible to analyze the communication behavior of each user in the flow analysis function.

[0042] Furthermore, NPB22 adds a VLANID:x to the packet to identify the destination. NPB22 removes VLANID:x from the packet and forwards it to the destination indicated by VLANID:x. This allows NPB22 to simplify the configuration of the packets it forwards. VLANID:x is an example of a third VLANID.

[0043] The forwarding destination information and VLAN ID information for line identification may be stored by NPB21 or NPB22, or they may be stored in an external device and referenced as appropriate by NPB21 or NPB22.

[0044] The analysis device 50 performs communication analysis. As shown in Figure 8, the analysis device 50 accepts flow data input. Figure 8 is a diagram illustrating the operation of the analysis device. The analysis device 50 can receive flow data from FE31 and FE32. The analysis device 50 receives flow data with VLANID:α assigned to it from FE31.

[0045] The analysis device 50 converts the received flow data into a JSON file. For flow data that does not have a VLAN ID assigned, the analysis device 50 creates a JSON file for each IPv4 address. For flow data that has a VLAN ID:α assigned, the analysis device 50 creates a JSON file for each VLAN ID:α. In other words, at least one line and one user are corresponding to the JSON file created for each VLAN ID:α.

[0046] The analysis device 50 performs communication analysis for each line or user. The analysis device 50 may perform the analysis using known flow analysis methods.

[0047] The analysis device 50 can analyze the communication behavior for each group of flows classified by VLANID:α. For example, the analysis device 50 detects communications that deviate from predetermined normal behavior for each group. A group may consist of one or more lines corresponding to one user. Alternatively, a group may consist of multiple lines corresponding to multiple users.

[0048] For example, behavior could be a change in the amount of data transmitted over time. Suppose normal behavior is defined as the amount of data transmitted during a specific time period (e.g., 0:00 to 9:00) not exceeding a threshold. In this case, if the flow indicates that the amount of data transmitted by a group during that time period has exceeded the threshold, the analysis device 50 detects that communication that deviates from normal behavior has occurred for that group.

[0049] In addition to the analysis device 50, known detection algorithms can also be used, such as methods based on static rules like pattern matching, and methods that use the degree of deviation from a model that has learned statistical information about the user's communications using machine learning and AI.

[0050] For example, the analysis device 50 can perform behavior detection using unsupervised machine learning techniques. In this case, the analysis device 50 generates a feature space based on the flow values ​​obtained from normal communication (e.g., IP address, number of packets, etc.). Then, the analysis device 50 detects whether the flow to be analyzed is normal or not based on the distance between the features of the flow to be analyzed and the generated feature space.

[0051] If the analysis device 50 detects communication that deviates from normal behavior, it will notify the user associated with VLANID:α of the group corresponding to the communication. For example, the analysis device 50 will automatically send an email to the email address set for each user indicating that an anomaly has been detected. In addition to email, the analysis device 50 can use other known notification methods such as telephone, SMS (Short Message Service), notifications to smartphone apps, and notifications on the customer portal site screen.

[0052] Furthermore, the analysis device 50 analyzes the relationship between the logs of an information system used by a user associated with VLANID:α and connected to a carrier network line, and the logs of communications corresponding to flows included in the group corresponding to VLANID:α.

[0053] For example, an information system includes servers within a LAN, communication equipment, cloud services (SaaS, PaaS, IaaS, IDaaS, etc.), IoT (Internet of Things) devices, and OT (Operational Technology) devices such as robots.

[0054] It is difficult to understand the behavior of the user's information system based solely on information obtained from the carrier network N1. Therefore, the analysis device 50 receives information system logs from the user. The analysis device 50 then compares the information system logs with the communication behavior based on the flow and performs an analysis. For example, through such an analysis, the analysis device 50 can identify the information system equipment that was operating on the date and time when an abnormal increase in communication volume was observed.

[0055] The processing flow of analysis system 1 will be explained using Figure 9. Figure 9 is a flowchart showing the processing flow of the analysis system. Here, the processing flow when NPB22 receives communication data via TAP12 will be explained.

[0056] As shown in Figure 9, first, NPB22 receives the signal from carrier network N1 from TAP12 (step S101).

[0057] Next, NPB22 obtains VLANID:u, which is assigned to the signal-based packet, and VLANID:α, which is assigned to TAP11, from the VLANID information for line identification (step S102). NPB22 also assigns the obtained VLANID:α to the packet (step S103).

[0058] Next, FE32 retrieves the flow for each assigned VLANID:α (step S104).

[0059] The analysis device 10 analyzes the communication behavior for each group of flows classified by VLANID (step S105). The analysis device 10 outputs the analysis results (step S106). For example, the analysis device 10 notifies the user of the analysis results.

[0060] [System configuration, etc.] Furthermore, the components of each illustrated device are functionally conceptual and do not necessarily need to be physically configured as shown. In other words, the specific forms of distribution and integration of each device are not limited to those shown, and all or part of them can be functionally or physically distributed or integrated in any unit according to various loads and usage conditions. Moreover, each processing function performed by each device can be implemented, in whole or in any part, by a CPU (Central Processing Unit) and a program that is analyzed and executed by the CPU, or by hardware using wired logic. Note that the program may be executed not only by the CPU but also by other processors such as a GPU.

[0061] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically by known methods. In addition, the processing procedures, control procedures, specific names, and information including various data and parameters shown in the above document and drawings can be arbitrarily changed unless otherwise specified.

[0062] [program] As one embodiment, NPB22 can be implemented by installing a generation program that performs the above processing as packaged software or online software on a desired computer. For example, by having the above generation program run on an information processing device, the information processing device can function as NPB22. The information processing device referred to here includes desktop or notebook personal computers. In addition, the category of information processing device also includes mobile communication terminals such as smartphones, mobile phones and PHS (Personal Handyphone System), and slate terminals such as PDA (Personal Digital Assistant).

[0063] Furthermore, NPB22 can also be implemented as a server device that uses a user's terminal device as a client and provides the above-mentioned information provision processing to that client. For example, the server device can be implemented as a server device that takes operations on canvas data as input and outputs the canvas data screen. In this case, the server device may be implemented as a web server, or it may be implemented as a cloud that provides the above-mentioned information provision processing through outsourcing.

[0064] Figure 10 shows an example of a computer running a generation program. Computer 1000 has, for example, memory 1010 and a CPU 1020. Computer 1000 also has a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0065] Memory 1010 includes ROM (Read Only Memory) 1011 and RAM (Random Access Memory) 1012. ROM 1011 stores, for example, a boot program such as BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to the hard disk drive 1090. The disk drive interface 1040 is connected to the disk drive 1100. For example, a removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to, for example, a mouse 1110 and a keyboard 1120. The video adapter 1060 is connected to, for example, a display 1130.

[0066] The hard disk drive 1090 stores, for example, the OS 1091, application programs 1092, program modules 1093, and program data 1094. That is, the programs that define each process of NPB22 are implemented as program modules 1093 in which executable code for the computer is written. The program modules 1093 are stored, for example, on the hard disk drive 1090. For example, a program module 1093 for performing processes similar to the functional configuration in NPB22 is stored on the hard disk drive 1090. Note that the hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0067] Furthermore, the configuration data used in the processing of the above-described embodiment is stored as program data 1094 in, for example, memory 1010 or hard disk drive 1090. The CPU 1020 then reads the program module 1093 and program data 1094 stored in memory 1010 or hard disk drive 1090 into RAM 1012 as needed and executes the processing of the above-described embodiment.

[0068] Furthermore, the program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090; for example, they may be stored in a removable storage medium and read by the CPU 1020 via a disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (LAN (Local Area Network), WAN (Wide Area Network), etc.). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via a network interface 1070.

[0069] The functions of the elements disclosed herein may be implemented using circuits or processing circuitry that include general-purpose processors, special-purpose processors, integrated circuits, ASICs (Application Specific Integrated Circuits), FPGAs (Field Programmable Gate Arrays), conventional circuits, and / or combinations thereof that are programmed using one or more programs stored in one or more memories, or otherwise configured to perform the disclosed functions. A processor is considered processing circuitry or circuitry because it includes transistors and other circuits. A processor may be a programmed processor that executes programs stored in memory. In this disclosure, circuits, units, or means are hardware that performs the enumerated functions, or hardware programmed to perform the enumerated functions. Hardware may be any hardware disclosed herein that is programmed or configured to perform the enumerated functions.

[0070] There is memory for storing a computer program that includes computer instructions. These computer instructions provide logic and routines that enable hardware (e.g., processing circuitry or circuitry) to perform the methods disclosed herein. This computer program can be implemented in commonly known forms, such as computer-readable storage media, computer program products, memory devices, recording media such as CD-ROMs and DVDs, and / or memory of FPGAs and ASICs. [Explanation of Symbols]

[0071] N1 Carrier Network 1. Analysis System 11, 12 TAP 21, 22 NPB 31, 32 FE 50 Analyzer

Claims

1. An assignment unit assigns to the communication data a first line identifier, which is the VLAN ID of the communication data in the carrier network, and a second line identifier that uniquely identifies the device and channel from which the communication data was extracted from the carrier network. A transfer unit that transfers the aforementioned communication data, A generating device having the following features.

2. The assignment unit assigns a second VLAN ID, which is the second line identifier, to the packet based on the first VLAN ID, which is the first line identifier, and information identifying the device and channel from which the packet, which is the communication data, was extracted. The generating apparatus according to claim 1.

3. The forwarding unit forwards the packet to which the second VLAN ID has been assigned to the function that analyzes the flow of the carrier network. The generating apparatus according to claim 2.

4. The assignment unit further assigns a third VLAN ID to the packet to identify the forwarding destination. The forwarding unit removes the third VLAN ID from the packet and forwards the packet to the destination indicated by the third VLAN ID. The generating apparatus according to claim 2.

5. A step of assigning to the communication data a first line identifier which is the VLAN ID of the communication data in the carrier network, and a second line identifier which uniquely identifies the device and channel from which the communication data was extracted from the carrier network, A transfer process for transferring the aforementioned communication data, A method of generation that a computer executes.

6. A step of assigning to the communication data a first line identifier which is the VLAN ID of the communication data in the carrier network, and a second line identifier which uniquely identifies the device and channel from which the communication data was extracted from the carrier network, A transfer step for transferring the aforementioned communication data, A generation program that causes a computer to execute something.

7. An analysis system comprising a generating device for generating communication data for analysis, and an analysis device, The generating apparatus is A first line identifier, which is the VLAN ID of the communication data in the carrier network, and a second line identifier that uniquely identifies the device and channel from which the communication data was extracted from the carrier network are assigned to the communication data. The flow of the aforementioned communication data is obtained, The aforementioned analytical device is For each group of flows classified by the second line identifier, the communication behavior corresponding to the flow is analyzed. Analysis system.

8. The aforementioned analytical device is For each of the aforementioned groups, communication that deviates from predetermined normal behavior is detected. The analysis system according to claim 7.

9. The aforementioned analytical device is If communication exhibiting behavior different from the normal behavior is detected, a notification is sent to the user associated with the second line identifier of the group corresponding to the communication. The analysis system according to claim 8.

10. The aforementioned analytical device is This analysis examines the relationship between the logs of an information system used by a user associated with the second line identifier, which is connected to the carrier network line, and the logs of communications corresponding to the flow included in the group corresponding to the second line identifier. The analysis system according to any one of claims 7 to 9.

Images