Methods for displaying network diagrams, network diagram display systems, and programs

Abstract

This technology provides a way to measure traffic volume effectively while intuitively understanding the state of traffic. [Solution] The solution includes: a third step in which a network device on which specific software is installed in the first step detects other network devices that have communicated with it as destination devices; a fourth step in which the network device on which the specific software is installed measures the amount of traffic between it and the destination devices detected in the third step at predetermined intervals; and a fifth step in which a display control unit causes the network diagram displayed on the display unit in the second step to display an image showing the communication transmission path between the network device and the destination devices on which the amount of traffic was measured in the fourth step, such that the display mode differs according to the measured amount of traffic.

Description

[Technical Field]

[0001] The present disclosure relates to a network diagram display method, a network diagram display system, and a program. [Background Art]

[0002] The inventor has developed technology for visualizing the configuration of a user's system in an easily recognizable form. For example, the network diagram display system disclosed in Patent Document 1, which is an invention of the inventor, displays a network diagram that visualizes a user system including communication transmission paths, which are paths for transmitting information via wired or wireless communication, and network devices communicatively connected to the communication transmission paths, and comprises a display control unit. The display control unit clarifies a responsibility demarcation point such that, among the network devices included in the user system, at least a network device with specific software installed is classified as a device within the scope of responsibility, is configured to draw a diagram using an image showing the communication transmission path and icon images showing the network devices, is configured to distinguish between the display state of icon images of network devices within the scope of responsibility and the display state of icon images of network devices outside the scope of responsibility, and performs control to cause a display unit to display the network diagram of the user system. This makes it possible to visualize the configuration of the user's system in a form that is visually easy to recognize and in a form that can clearly indicate the scope of responsibility.

[0003] Furthermore, the network diagram display system disclosed in Patent Document 1 further includes an anomaly detection unit. The anomaly detection unit detects whether at least one of one or more predetermined anomaly types has occurred in any network device included in the scope of responsibility. The display control unit then displays the network diagram on the display unit by differentiating the display state of the icon image of the network device for which the anomaly detection unit detected an anomaly from the display state of the icon image of the network device for which the anomaly detection unit did not detect an anomaly. As a result, when a predetermined anomaly occurs, the network device experiencing the anomaly can be distinguished and indicated in the network diagram, where the scope of responsibility is clearly indicated.

[0004] Thus, while Patent Document 1 was a visualization technology for network devices, i.e., "nodes," the inventors came to the realization that a visualization technology for communication transmission paths connecting network devices, i.e., "links," is also necessary as a technology to visualize the configuration of a user's system in an easily recognizable way. The traffic management system disclosed in Patent Document 2 comprises a plurality of network devices connected to each other so as to be able to communicate with each other via a network, a traffic management device that acquires information on the communication status from the plurality of network devices and generates a traffic management screen that shows the communication status, including the network traffic status, in three dimensions based on that information and displays it on a display unit, and an information terminal having a display unit and an input unit. The traffic management device displays a traffic image on the traffic management screen that includes device marks indicating network devices, a pair of tube-shaped line marks indicating upstream and downstream lines connecting network devices, granular fluid marks that move within the line marks according to the traffic state, and annular operation marks positioned on the outer perimeter of the device marks that rotate to indicate the operating status of network devices. The device also changes the display mode, including the thickness, color, and brightness of the line marks, the number, size, direction of movement, speed of movement, color, and brightness of the fluid marks, and the rotation speed, color, and brightness of the operation marks, according to the communication state. The traffic management device has an information collection unit that functions as an SNMP (Simple Network Management Protocol) manager, and periodically sends SNMP commands to each SNMP-compatible network device to obtain infrastructure information, including traffic information, from each network device and stores it in the storage unit. [Prior art documents] [Patent Documents]

[0005] [Patent Document 1] Patent No. 7572023 [Patent Document 2] Japanese Patent Publication No. 2022-066989 [Overview of the project] [Problems that the invention aims to solve]

[0006] The technology disclosed in Patent Document 2 presupposes the use of SNMP for collecting traffic information. However, in this case, there was room for improvement, such as (1) requiring configuration changes on the network device side, such as enabling SNMP and setting MIB (Management Information Base) files, (2) requiring proactive queries from traffic management devices, which puts a load on the network, (3) there being communications that cannot be captured by traffic management devices such as wireless, P2P (Peer to Peer), and VPN (Virtual Private Network), and (4) being prone to false positives from EDR (Endpoint Detection and Response) and security software.

[0007] This disclosure is made to solve the above-mentioned problems and aims to provide a technology that allows for the intuitive understanding of traffic conditions while suitably measuring traffic volume. [Means for solving the problem]

[0008] One of the methods for displaying network diagrams in this disclosure is: A display method for displaying a network diagram that visualizes a user system including a communication transmission path, which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, A first step of installing specific software on at least some of the network devices included in the user system, A second step involves the display control unit displaying a network diagram that visualizes the network devices included in the user system on a display unit, A third step involves a network device on which the aforementioned specific software is installed detecting other network devices that have communicated with it as communication destination devices. A fourth step in which a network device on which the aforementioned specific software is installed measures the amount of traffic between itself and the communication destination device detected in the third step at predetermined intervals, A fifth step involves the display control unit causing the network diagram displayed on the display unit in the second step to display an image showing the communication transmission path between the network device and the communication destination device, the amount of traffic measured in the fourth step, such that the display mode differs according to the measured amount of traffic. Includes.

[0009] One of the disclosures is a network diagram display system, A display system that displays a network diagram visualizing a user system including a communication transmission path, which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, Specific software is installed on at least some of the network devices included in the user system. Network devices on which the aforementioned specific software is installed, A detection unit that detects other network devices that have communicated with the device as communication destination devices, The system includes a measuring unit that measures the amount of traffic between the device and the communication destination device detected by the detection unit at predetermined intervals, The aforementioned display system is The system includes a display control unit that displays a network diagram visualizing the network devices included in the user system on the display unit, and controls the display of an image showing the communication transmission path between the network device and the communication destination device, where the traffic volume has been measured by the measurement unit of the network device on which the specific software is installed, on the network diagram displayed on the display unit, such that the display mode differs according to the measured traffic volume.

[0010] One of the programs disclosed here is A program for displaying a network diagram that visualizes a user system including a communication transmission path, which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, At least some of the network devices included in the user system have specific software installed, which includes at least a part of the program. A first display step involves the display control unit displaying a network diagram that visualizes the network devices included in the user system on the display unit, A detection step in which the network device on which the aforementioned specific software is installed is made to detect other network devices that have communicated with itself as communication destination devices, A measurement step in which a network device on which the aforementioned specific software is installed measures the amount of traffic between itself and the communication destination device detected in the detection step at predetermined intervals, A second display step involves the display control unit causing the network diagram displayed on the display unit in the first display step to display an image showing the communication transmission path between the network device and the communication destination device, the amount of traffic measured in the measurement step, such that the display mode differs according to the measured amount of traffic. Includes. [Effects of the Invention]

[0011] The technology disclosed herein allows for the intuitive understanding of traffic conditions while suitably measuring traffic volume. [Brief explanation of the drawing]

[0012] [Figure 1] Figure 1 is a block diagram illustrating a network diagram display system according to the first embodiment. [Figure 2] Figure 2 is a block diagram showing an example of a user system used in the display system shown in Figure 1. [Figure 3]FIG. 3 is a block diagram showing an example of a user system used in the display system of FIG. 1, which is different from the user system of FIG. 2. [Figure 4] FIG. 4 is an explanatory diagram conceptually illustrating a communication state between a management-side system and a user system in the display system of FIG. 1. [Figure 5] FIG. 5 is an explanatory diagram conceptually illustrating a communication state between an agent system and a user system in the display system of FIG. 1. [Figure 6] FIG. 6 is a conceptual diagram conceptually showing the configuration of a router device and a desktop personal computer when the router device provided in the user system of FIG. 3 has a function as a central device. [Figure 7] FIG. 7 is a block diagram that more specifically and conceptually explains the user system shown in FIG. 3. [Figure 8] FIG. 8 is a flowchart showing a startup sequence of a network diagram display method using a display system. [Figure 9] FIG. 9 is an explanatory diagram illustrating an example of a network diagram displayed on a display device. [Figure 10] FIG. 10 is a flowchart showing periodic processing executed by an agent. [Figure 11] FIG. 11 is a flowchart showing network diagram generation processing executed by a central device. [Figure 12] FIG. 12 is a flowchart showing display processing executed by a computer having a display device that displays a network diagram. [Figure 13] FIG. 13 is an explanatory diagram illustrating an example of a network diagram displayed on a display device. [Figure 14] FIG. 14 is a flowchart showing line switching processing executed by a central device according to a second embodiment. [Figure 15A] FIG. 15A is an explanatory diagram illustrating an example of a network diagram displayed on a display device. [Figure 15B] FIG. 15B is an explanatory diagram illustrating an example of a network diagram displayed on a display device. [Figure 15C] Figure 15C is an explanatory diagram illustrating a network diagram displayed on a display device. [Figure 15D] Figure 15D is an explanatory diagram illustrating a network diagram displayed on a display device. [Figure 15E] Figure 15E is an explanatory diagram illustrating a network diagram displayed on a display device. [Figure 16] Figure 16 is an explanatory diagram illustrating a network diagram displayed on a display device in the display system 1 according to the third embodiment. [Modes for carrying out the invention]

[0013] Each of the following [1] to

[12] is an example of the technology included in this disclosure.

[0014] [1] A display method for displaying a network diagram that visualizes a user system including a communication transmission path which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, A first step of installing specific software on at least some of the network devices included in the user system, A second step involves the display control unit displaying a network diagram that visualizes the network devices included in the user system on a display unit, A third step involves a network device on which the aforementioned specific software is installed detecting other network devices that have communicated with it as communication destination devices. A fourth step in which a network device on which the aforementioned specific software is installed measures the amount of traffic between itself and the communication destination device detected in the third step at predetermined intervals, A fifth step involves the display control unit causing the network diagram displayed on the display unit in the second step to display an image showing the communication transmission path between the network device and the communication destination device, the amount of traffic measured in the fourth step, such that the display mode differs according to the measured amount of traffic. How to display a network diagram including this information.

[0015] According to the network diagram display method described in [1] above, in the first step, specific software is installed on at least some of the network devices included in the user system. In the second step, a network diagram visualizing the network devices included in the user system is displayed on the display unit by the display control unit. Meanwhile, in the third step, other network devices that have communicated with the user are detected as destination devices by the network devices on which the specific software is installed. In the fourth step, the amount of traffic between the user and the destination devices detected in the third step is measured at predetermined intervals by the network devices on which the specific software is installed. As a result, the network devices on which the specific software is installed can measure the amount of traffic between the user and other network devices that have communicated with the user without receiving active inquiries from the outside. Finally, in the fifth step, an image showing the communication transmission path between the network devices and the destination devices whose traffic amount was measured in the fourth step is displayed on the network diagram displayed on the display unit in the second step by the display control unit, with the display mode varying according to the measured amount of traffic. Thus, the amount of traffic can be measured appropriately, and the state of traffic can be grasped intuitively.

[0016] [2] The fourth step is, A sixth step involves a network device on which the aforementioned specific software is installed acquiring the total amount of traffic transmitted and received by the device at predetermined intervals. The network device, which acquires the total amount of traffic transmitted and received by itself in the sixth step at the predetermined period, performs a seventh step in which it acquires the amount of short-window traffic between itself and the communication destination device multiple times in a short-window section set to a time shorter than the predetermined period, The network device, which acquires the total traffic amount transmitted and received by itself in the sixth step at predetermined intervals, estimates the ratio of traffic amounts between itself and the communication destination device in the predetermined interval based on the short-window traffic amount acquired in the seventh step, and calculates the traffic amount between itself and the communication destination device in the predetermined interval from the total traffic amount and the ratio in the eighth step. The method of displaying the network diagram described in [1], including.

[0017] The network diagram display method described in [2] above provides the following effects in addition to those of the network diagram display method described in [1] above. Specifically, in step 4, step 6 acquires the total amount of traffic transmitted and received by the local device at predetermined intervals by a network device on which specific software is installed. Also in step 4, step 7 acquires the amount of short-window traffic between the local device and the communication destination device multiple times in short-window intervals set to a shorter time than the predetermined period by a network device that acquires the total amount of traffic transmitted and received by the local device at predetermined intervals. Then, in step 4, step 8 estimates the ratio of traffic between the local device and the communication destination device at predetermined intervals based on the short-window traffic amount acquired in step 7 by a network device that acquires the total amount of traffic transmitted and received by the local device at predetermined intervals, and calculates the amount of traffic between the local device and the communication destination device at predetermined intervals from the total traffic amount and the estimated ratio. This makes it possible to accurately estimate the amount of traffic even when the network device cannot directly measure the amount of traffic between itself and the communication destination device.

[0018] [3] In the fifth step, the display control unit displays an image showing the communication transmission path between the network device and the communication destination device, the network device whose traffic volume was measured in the fourth step, on the network diagram displayed on the display unit in the second step, such that the display mode differs in stages according to the measured traffic volume. The method for displaying the network diagram described in [1] or [2].

[0019] The network diagram display method described in [3] above provides the following effects in addition to those of the network diagram display methods described in [1] or [2] above. Specifically, in the fifth step, an image showing the communication transmission path between the network device and the destination device, whose traffic volume was measured in the fourth step, is displayed by the display control unit on the network diagram displayed on the display unit in the second step, with the display mode varying in stages according to the measured traffic volume. This makes it possible to grasp the traffic status in the communication transmission path in a stepwise and easy-to-understand manner.

[0020] [4] In the fifth step, the display control unit displays an image showing the communication transmission path between the network device and the communication destination device, for which the traffic amount was measured in the fourth step, on the network diagram displayed on the display unit in the second step, in the first display mode when the traffic amount is less than or equal to the first threshold, in the second display mode when it exceeds the first threshold but is less than or equal to the second threshold, and in the third display mode when it exceeds the second threshold. [3] The method for displaying the network diagram described.

[0021] The network diagram display method described in [4] above provides the following additional effects in addition to those of the network diagram display method described in [3] above. Specifically, in the fifth step, an image showing the communication transmission path between the network device and the destination device, for which the traffic volume was measured in the fourth step, is displayed on the network diagram displayed on the display unit in the second step by the display control unit. This is done in the first display mode when the traffic volume is below the first threshold, in the second display mode when it exceeds the first threshold but is below the second threshold, and in the third display mode when it exceeds the second threshold. This makes it possible to intuitively understand whether the traffic status in the communication transmission path is normal, congested, or jammed.

[0022] [5] In the fourth step, even if the specific software is not installed on the communication destination device detected in the third step, the network device on which the specific software is installed can measure the amount of traffic between itself and the communication destination device at predetermined intervals. The method for displaying the network diagram described in any of [1] through [4].

[0023] The network diagram display method described in [5] above provides the following effect in addition to the effect of any of the network diagram display methods described in [1] to [4] above. Specifically, even if the destination device detected in the third step does not have specific software installed, the fourth step measures the amount of traffic between the local device and the destination device at predetermined intervals using network devices that have the specific software installed. As a result, even if the specific software is installed on only one of the network devices in a communication pair, the amount of traffic between these network devices can be measured, and an image showing this communication transmission path can be displayed on the network diagram displayed on the display unit in the second step, with the display mode varying according to the measured amount of traffic. Therefore, traffic between the local device and destination devices that do not have specific software installed can also be visualized.

[0024] [6] In the second step, after the first step, the network diagram of the user system is displayed on the display unit by the display control unit, with a configuration that clearly indicates the boundary of responsibility so that at least the network devices on which the specific software is installed among the network devices included in the user system are within the scope of responsibility, and a diagram is drawn using an image showing the communication transmission path and icon images showing the network devices, and a configuration that distinguishes between the display state of the icon images of the network devices within the scope of responsibility and the display state of the icon images of the network devices outside the scope of responsibility. The method for displaying the network diagram described in any of [1] through [5].

[0025] The network diagram display method described in [6] above provides the following effects in addition to those of any of the network diagram display methods described in [1] to [5] above. Specifically, in the second step, after the first step, the responsibility boundary is clearly defined so that at least network devices with specific software installed among the network devices included in the user system are considered to be within the scope of responsibility. A diagram is then drawn using images showing communication transmission paths and icon images showing network devices. Furthermore, the display state of the icon images of network devices within the scope of responsibility is distinguished from the display state of the icon images of network devices outside the scope of responsibility, and the network diagram of the user system is displayed on the display unit by the display control unit. As a result, the status of both network devices and communication transmission paths is integrated and displayed on the same screen, allowing the user to grasp the status of the entire user system at a glance.

[0026] [7] The abnormality detection step includes detecting whether at least one of one or more predetermined abnormality types has occurred in any of the network devices included in the scope of responsibility, by an abnormality detection unit. In the second step, the display state of the icon image of the network device for which the abnormality detection unit detected an abnormality in the abnormality detection step is made different from the display state of the icon image of the network device for which the abnormality detection unit did not detect an abnormality in the abnormality detection step, and the display control unit displays the network diagram on the display unit. In the fifth step, if the traffic amount measured in the fourth step exceeds the third threshold for the communication transmission path connected to the network device for which the anomaly detection unit detected an anomaly in the anomaly detection step, the display control unit displays an image of the communication transmission path on the network diagram displayed on the display unit in the second step, in a specific display mode different from the display mode of the image of the communication transmission path connected to the network device for which the anomaly detection unit did not detect an anomaly in the anomaly detection step. The method for displaying the network diagram described in [6].

[0027] The network diagram display method described in [7] above provides the following effects in addition to those of the network diagram display method described in [6] above. Specifically, the anomaly detection step detects whether at least one of one of the predetermined anomaly types has occurred in any network device included in the scope of responsibility. Then, in the second step, the network diagram is displayed on the display unit by the display control unit such that the display state of the icon images of network devices for which the anomaly detection unit detected an anomaly in the anomaly detection step is different from the display state of the icon images of network devices for which the anomaly detection unit did not detect an anomaly in the anomaly detection step. In addition, in the fifth step, if the amount of traffic measured in the fourth step exceeds the third threshold for a communication transmission path connected to a network device for which the anomaly detection unit detected an anomaly in the anomaly detection step, the display control unit displays an image showing the communication transmission path on the network diagram displayed on the display unit in the second step, in a specific display mode different from the display mode of the image showing the communication transmission path connected to a network device for which the anomaly detection unit did not detect an anomaly in the anomaly detection step. This allows for instantaneous assessment of the occurrence of an anomaly based on the status of both network equipment and communication transmission paths shown in the network diagram, thereby improving the speed and accuracy of the operator's decision-making in the event of an anomaly.

[0028] [8] The user system includes a router device that relays communications within the user system and also acts as a gateway for relaying communications with an external communication network. The router device has the aforementioned specific software or corresponding software installed. Step 9: The router device measures the amount of traffic passing through it, thereby supplementing the measurement results from Step 4. A method of displaying a network diagram as described in any of [1] to [7], including [1].

[0029] The network diagram display method described in [8] above provides the following effect in addition to the effect of any of the network diagram display methods described in [1] to [7] above. Specifically, in step 9, the amount of traffic passing through a router device that relays communication within the user system and also acts as a gateway relaying communication with an external communication network, and which has specific software or corresponding software installed on it, is measured, and the measurement results from step 4 are supplemented. When the router device is installed in a location that also operates as a gateway, all communication within the user system passes through the router device. This makes it possible to comprehensively visualize communication within the user system, including communication between network devices that do not have specific software installed.

[0030] [9] The user system is configured to be able to connect to multiple communication lines as communication lines for communicating with an external network, and includes a line switching unit that switches to one communication line from among the multiple communication lines to be used. Step 10: The display control unit causes the display control unit to display, in chronological order, the changes in the traffic state of the communication transmission path before and after the switching of the communication line by the line switching unit, as changes in the display mode of the image showing the communication transmission path, on the network diagram displayed on the display unit in step 2. A method of displaying a network diagram as described in any of [1] to [8], including [1].

[0031] The network diagram display method described in [9] above provides the following effects in addition to those of any of the network diagram display methods described in [1] to [8] above. Specifically, in the 10th step, the change in the traffic state of the communication transmission path before and after the switching of the communication line by the line switching unit is displayed in chronological order as a change in the display manner of the image showing the communication transmission path, on the network diagram displayed on the display unit in the 2nd step by the display control unit. This makes it possible to record and visualize in chronological order what happened in the user system before and after the switching of the communication line for any reason, and to facilitate subsequent analysis.

[0032]

[10] In the fourth step, the network device on which the specific software is installed reads network statistics information provided by its own operating system to obtain the amount of traffic between itself and the communication destination device detected in the third step at predetermined intervals, and does not make any queries based on the Simple Network Management Protocol. The method for displaying the network diagram described in any of [1] through [9].

[0033] The network diagram display method described in

[10] above provides the following effects in addition to those of any of the network diagram display methods described in [1] to [9] above. Specifically, in the fourth step, the amount of traffic between the local device and the communication destination device is obtained without making queries based on the Simple Network Management Protocol (SNMP). This eliminates the need to change the network device settings for SNMP. Furthermore, because there are no proactive queries from external sources via SNMP, the load on the user system can be reduced, and false positives from EDR and security software can be made less likely. In addition, communications that cannot be captured by SNMP can also be observed. Therefore, the amount of traffic can be measured appropriately.

[0034]

[11] In the fourth step, the traffic volume is measured separately in the transmission direction and the reception direction, In the fifth step, the display mode of the image showing the communication transmission path is changed depending on whether the transmission direction or reception direction is distinguished, or depending on the amount of traffic in either the transmission direction or reception direction. The method for displaying the network diagram described in any of [1] through

[10] . The network diagram display method described in

[11] above provides the following additional effects in addition to those of any of the network diagram display methods described in [1] to

[10] above. Specifically, in the fourth step, the traffic volume is measured separately for the transmission and reception directions. Then, in the fifth step, the network diagram displays images showing the communication transmission path in different ways, distinguishing between the transmission and reception directions, or depending on the traffic volume in either the transmission or reception direction. As a result, an administrator viewing the network diagram can understand the traffic status of the transmission and reception directions, or the traffic status of either the transmission or reception direction, for the communication transmission path.

[0035]

[12] A display system for displaying a network diagram that visualizes a user system including a communication transmission path which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, Specific software is installed on at least some of the network devices included in the user system. Network devices on which the aforementioned specific software is installed, A detection unit that detects other network devices that have communicated with the device as communication destination devices, The system includes a measuring unit that measures the amount of traffic between the device and the communication destination device detected by the detection unit at predetermined intervals, The aforementioned display system is The system includes a display control unit that displays a network diagram visualizing the network devices included in the user system on the display unit, and controls the display of an image showing the communication transmission path between the network device and the communication destination device, where the traffic volume has been measured by the measurement unit of the network device on which the specific software is installed, on the network diagram displayed on the display unit, with the display mode varying according to the measured traffic volume. A system for displaying network diagrams.

[0036] The network diagram display system described in

[12] above has the same effect as the network diagram display method described in [1] above.

[0037]

[13] A program for displaying a network diagram that visualizes a user system including a communication transmission path which is a path for transmitting information by wired or wireless communication, and a plurality of network devices which are connected to the communication transmission path in a communicative manner, At least some of the network devices included in the user system have specific software installed, which includes at least a part of the program. A first display step involves the display control unit displaying a network diagram that visualizes the network devices included in the user system on the display unit, A detection step in which the network device on which the aforementioned specific software is installed is made to detect other network devices that have communicated with itself as communication destination devices, A measurement step in which a network device on which the aforementioned specific software is installed measures the amount of traffic between itself and the communication destination device detected in the detection step at predetermined intervals, A second display step involves the display control unit causing the network diagram displayed on the display unit in the first display step to display an image showing the communication transmission path between the network device and the communication destination device, the amount of traffic measured in the measurement step, such that the display mode differs according to the measured amount of traffic. A program that includes this.

[0038] The program described in

[13] above produces the same effect as the method of displaying the network diagram described in [1] above.

[0039] Hereinafter, embodiments for implementing this disclosure will be described with reference to the attached drawings. The embodiments described below are all preferred specific examples of this disclosure. Therefore, the numerical values, shapes, materials, components, arrangement positions of components, and connection configurations shown in the following embodiments are examples and are not intended to limit this disclosure. Accordingly, components in the following embodiments that are not described in the independent claims representing the highest-level concepts of this disclosure will be described as optional components. Furthermore, in each figure, substantially identical components are denoted by the same reference numerals, and redundant explanations are omitted or simplified.

[0040] <First Embodiment> The following description relates to the first embodiment.

[0041] 1. Overview of the display system Figure 1 shows a network diagram display system 1 according to the first embodiment. This display system 1 is a system to which a network diagram display method is applied. The network diagram visualizes a user system 4 that includes a communication transmission path 12 (Figure 2), which is a path for transmitting information by wired or wireless communication, and a plurality of network devices 20 (Figure 2) that are connected to the communication transmission path 12 in a communicative manner. The display system 1 is also configured as a responsibility boundary point indication system that can clearly indicate the responsibility boundary points in each user system 4 on the network diagram. Furthermore, the display system 1 is also configured as a traffic volume indication system that can visually indicate the amount of traffic in the communication transmission path 12 between each network device 20 constituting the user system 4 on the network diagram.

[0042] As shown in Figure 1, the display system 1 is configured to include a user system 4, a management system 60, and an agent system 80. In the example in Figure 1, the management system 60 is capable of communicating with each agent system 80. Also in the example in Figure 1, the management system 60 is capable of communicating with some of the user systems 4. Note that the display system 1 can also be configured with a single user system 4 without the management system 60 or the agent system 80.

[0043] Figure 2 shows an example of a user system 4. A user system 4 configured to communicate with the management system 60 in Figure 1 may be configured as shown in Figure 2, and a user system 4 configured to communicate with the agent system 80 may be configured as shown in Figure 2. In addition, one user system 4 constituting the display system 1 may be configured as shown in Figure 2.

[0044] The user system 4 shown in Figure 2 is configured as a network system in which multiple network devices 20 are connected to each other in a manner that enables communication. The user system 4 includes a communication transmission path 12, which is a path for transmitting information by wired or wireless communication, and network devices 20, which are devices that are connected to the communication transmission path 12 in a manner that enables communication. The communication transmission path 12 only needs to be configured as a path that enables the transmission of information, and may be composed of communication cables such as LAN cables, or it may be configured as an area where wireless communication takes place.

[0045] In the example shown in Figure 2, the network equipment 20 includes a router 21A, a server 23A, hubs 22A and 24A, personal computers (hereinafter also referred to as PCs) 22B, 22C, 22D, 24C, 24D, and 24E, a multifunction printer 24B, an access point 24F, business phones 28A and 28B, a camera system 26A, tablet terminals (hereinafter also referred to as tablets) 29A and 29B, and a smartphone 29C. In the example shown in Figure 2, PCs 22B, 22C, 22D, 24C, 24D, and 24E are notebook personal computers (hereinafter also referred to as notebooks), but some or all of them may be desktop personal computers (hereinafter also referred to as desktop PCs), or other types of PCs.

[0046] In the example shown in Figure 2, transmission paths 31A, 32A, 32B, 34A, 34B, 36A, 38A, etc., are provided as the communication transmission path 12. Transmission paths 31A, 32A, 32B, 34A, 34B, 36A, 38A are configured, for example, with cables, and are configured as communication lines forming a wired communication path. Router device 21A is connected to the Internet communication network 90 in a communication-enabled manner. Server 23A is connected to router device 21A via transmission path 31A. Hub 22A is connected to server 23A via transmission path 32A. PCs 22B, 22C, and 22D are connected to hub 22A via transmission path 32B. Hub 24A is connected to router device 21A via transmission path 34A. PCs 24C, 24D, and 24E, multifunction printer 24B, and access point 24F are connected to hub 24A via transmission path 34B. Tablets 29A and 29B and smartphone 29C are connected wirelessly to access point 24F. Business phones 28A and 28B are connected to router device 21A via transmission path 38A. Camera system 26A is connected to router device 21A via transmission path 36A. In user system 4 of Figure 2, each network device 20 is capable of communicating with any other network device 20 in the same user system 4. Furthermore, at least some network devices 20 are capable of communicating with external systems (e.g., management system 60 and agent system 80) via router device 21A and the internet communication network 90.

[0047] Figure 3 shows an example of the user system 4 that differs from the configuration in Figure 2. The user system 4 configured to communicate with the management system 60 in Figure 1 may be configured as shown in Figure 3, and the user system 4 configured to communicate with the agent system 80 may be configured as shown in Figure 3. In addition, one of the user systems 4 constituting the display system 1 may be configured as shown in Figure 3.

[0048] The user system 4 shown in Figure 3 is configured as a network system in which multiple network devices 20 are connected to each other in a manner that enables communication. The user system 4 includes a communication transmission path 12, which is a path for transmitting information by wired or wireless communication, and network devices 20, which are devices connected to the communication transmission path 12 in a manner that enables communication. In Figure 3, the communication transmission path 12 only needs to be configured as a path that enables the transmission of information, and may be composed of communication cables such as LAN cables, or it may be configured as an area where wireless communication takes place.

[0049] In the example shown in Figure 3, the network equipment 20 includes a router 41, hubs 42 and 43, desktop computers 44, 45 and 47, a multifunction printer 46, and notebook computers 48 and 49. In the example shown in Figure 3, the communication transmission path 12 includes transmission lines 51, 52, 53, 54, 55, 56, 57 and 58. Transmission lines 51, 52, 53, 54, 55, 56, 57 and 58 are configured, for example, with cables, and are set up as communication lines forming a wired communication path. The router 41 is connected to the Internet communication network 90 in a communication-enabled manner. Desktop computers 44 and 45 and the multifunction printer 46 are connected to hub 42 via transmission lines 53, 54 and 55, respectively. Desktop computer 47 and notebook computers 48 and 49 are connected to hub 43 via transmission lines 56, 57 and 58, respectively.

[0050] For example, desktop computers 44, 45, 47 and notebook computers 48, 49 are capable of communicating with external systems (e.g., management system 60, agent system 80, and other systems) via hubs 42, 43, router device 41, and internet communication network 90. ​​Furthermore, desktop computers 44, 45, and multifunction printer 46 are capable of communicating with each other via communication transmission path 12, hub 42, and router device 41. Also, desktop computers 47 and notebook computers 48, 49 are capable of communicating with each other via communication transmission path 12, hub 43, and router device 41. Note that desktop computers 44, 45, 47, multifunction printer 46, and notebook computers 48, 49 may also be capable of communicating with each other via communication transmission path 12, hubs 42, 43, and router device 41. Alternatively, each of the desktop computers 44, 45, 47 and the notebook computers 48, 49 may be able to communicate with the management system 60 via the communication transmission path 12, the hubs 42, 43, the router device 41, and the internet communication network 90, and may also be able to communicate with the agent system 80.

[0051] Figure 4 conceptually illustrates a configuration in which a management system 60 and a user system 4 are able to communicate. The management system 60 may be implemented with multiple computers or with a single computer. The management system 60 may also include network devices other than computers. In the example in Figure 4, the management system 60 includes a computer 61 that has a storage device 62, an operating device 63, a display device 64, a communication device 65, a control device 66, etc., and is capable of performing various information processing and various controls. In the example in Figure 4, a desktop PC 44 (Figure 3) installed in the user system 4 and the computer 61 of the management system 60 communicate via the internet. In the example in Figure 4, a desktop PC 44 having a control device 44A, a storage device 44B, an operating device 44C, a display device 44D, a communication device 44E, etc., is exemplified, but the desktop PC 44 may be replaced with any of the desktop PCs 45, 47, a multifunction printer 46, a notebook computer 48, 49, or other information terminals such as a tablet or smartphone.

[0052] Here, the storage device 62 of the management system 60 may have specific software or corresponding software that corresponds to the specific software installed on it. The corresponding software is, for example, a program similar to the specific software or other dedicated program that works in cooperation with the specific software. The management system 60 functions as the central device or central system (hereinafter collectively referred to simply as the central device) of the display system 1, with the control device 66 executing this specific software or corresponding software to comprehensively control and manage the display system 1. In this case, the management system 60 acquires information for visualizing the user systems 4 from all or some of the user systems 4 that can communicate, and comprehensively controls and manages the display of network diagrams.

[0053] Figure 5 conceptually illustrates a configuration in which an agent system 80 and a user system 4 are able to communicate. Specifically, it shows how a desktop PC 44 (Figure 3) installed in the user system 4 and the computer 81 of the agent system 80 communicate via the internet. The agent system 80 may be implemented with multiple computers or with a single computer. The agent system 80 may also include network devices other than computers. In the example in Figure 5, the agent system 80 includes a computer 81 that has a storage device 82, an operating device 83, a display device 84, a communication device 85, a control device 86, etc., and is capable of performing various information processing and various controls. In the example in Figure 5, a desktop PC 44 having a control device 44A, a storage device 44B, an operating device 44C, a display device 44D, a communication device 44E, etc., is exemplified, but the desktop PC 44 may be replaced with any of the desktop PCs 45, 47, a multifunction printer 46, a notebook computer 48, 49, or other information terminals such as tablet terminals or smartphones.

[0054] Here, the storage device 82 of the agent system 80 may have the specific software described above or corresponding software installed. The agent system 80 can also function as a central device for the display system 1, with the control device 86 executing this specific software or corresponding software to comprehensively control and manage the display system 1. In this case, the agent system 80 acquires information for visualizing the user systems 4 from all or some of the user systems 4 that can communicate, and comprehensively controls and manages the display of network diagrams.

[0055] Figure 6 conceptually shows the configuration of the router device 41 and desktop PC 44 when the router device 41 installed in the user system 4 is given the function of a central device for the display system 1, comprehensively controlling and managing the display system 1. Although the hub 42 is omitted in Figure 6, as shown in Figure 3, the router device 41 and the desktop PC 44 are connected via a communication transmission path 12 through the hub 42. The router device 41 is a relay device that relays communication between network devices 20 within the user system 4, and also relays communication between network devices 20 within the user system 4 and external systems connected to the Internet communication network 90. ​​The display system 1 can also give this router device 41 the function of a central device for the display system 1. In the example in Figure 6, the router device 41 has a control device 41A, a storage device 41B, a communication device 41E, etc., and can perform various information processing and various controls.

[0056] In the case of Figure 6, the storage device 41B of the router device 41 has the specific software described above or corresponding software installed. The router device 41 functions as a central device when the control device 41A executes this specific software or corresponding software. That is, as a central device, the router device 41 acquires information for visualizing the user system 4 from network devices 20 such as desktop computers 44 that constitute the user system 4 in which the router device 41 is installed, and controls and manages the display of the network diagram. In the example of Figure 6, a desktop computer 44 having a control device 44A, storage device 44B, operating device 44C, display device 44D, communication device 44E, etc. is exemplified as a network device 20 that can communicate with the router device 41, but the desktop computer 44 may be replaced with any of the desktop computers 45, 47, multifunction printers 46, notebook computers 48, 49, or other information terminals such as tablet terminals and smartphones.

[0057] Furthermore, if a central device is provided within the user system 4 and the display system 1 is configured solely by the user system 4, the central device is not limited to being constructed by a router device 41 as shown in Figure 6, but may also be constructed by any of the network devices 20 within the user system 4. That is, a central device may be constructed on any of the network devices 20 within the user system 4 by installing specific software or corresponding software for specific software on the storage device of the network device 20, and then having the network device 20 execute the specific software or corresponding software.

[0058] As described above, in this embodiment, the display system 1 has a central device for each user system 4, which is one of the following: the management system 60, a plurality of agent systems 80, or network equipment 20 included in the user system 4. The management system 60 or agent system 80 designated as the central device may consist of one or more devices located at a different address from the user system 4 associated with it, and these devices are capable of communicating with the user system 4 associated with it. Furthermore, the user system 4 and the central device associated with it are capable of displaying the network diagram of the user system 4 in a common diagram. For example, one user system 4 may be associated with the management system 60 as the central device, and the one user system 4 and the management system 60 may be capable of displaying the network diagram of the one user system 4 in a common diagram. Alternatively, another user system 4 is associated with a certain agent system 80 as its central device, and the other user system 4 and the agent system 80 are able to display the network diagram of the other user system 4 in a common diagram.

[0059] As described above, the display device 64 of the computer 61 of the management system 60 shown in Figure 4, and the display device 84 of the computer 81 of the agent system 80 shown in Figure 5 are examples of the "display unit" of the present invention, and a network diagram visualizing the user system 4 is displayed using these display devices 64 or 84 as the display device 8. In addition, the display device 44D of the desktop PC 44 is also an example of the "display unit" of this disclosure, and a network diagram visualizing the user system 4 may be displayed using this display device 44D as the display device 8. Furthermore, the display device 8 corresponding to the "display unit" of this disclosure may be provided not only in the desktop PC 44, but also in desktop PCs 45, 47, multifunction printers 46, notebook computers 48, 49, etc., as well as other information terminals such as tablet terminals and smartphones, and these display devices 8 may be configured to display a network diagram.

[0060] 2. Visualization of network diagrams As described above, the user system 4 is configured as a system that includes a communication transmission path 12, which is a path for transmitting information by wired or wireless communication, and network devices 20 that are connected to the communication transmission path 12 in a way that enables communication. The display system 1 shown in Figure 1, in each user system 4, classifies whether the network devices 20 and the communication transmission path 12 belong to its scope of responsibility in a predetermined manner, and displays a network diagram that clearly indicates the scope of responsibility in a way that allows the boundary points of responsibility to be identified. In addition, the display system 1 measures the amount of traffic in the communication transmission path 12 between the network devices 20 in each user system 4, and displays a network diagram so that the amount of traffic in each communication transmission path 12 can be intuitively understood. In this way, the display system 1 realizes the method of displaying the network diagram.

[0061] The following describes an example of how to display a network diagram in display system 1, using display system 1 shown in Figures 3 and 7 as a representative example. In the representative example described in Figures 3 and 7, the router device 41 acts as the central device for the user system 4 shown in Figures 3 and 7, and the network diagram of the user system 4 shown in Figures 3 and 7 is displayed using the display method described above. Figure 7 is an explanatory diagram that provides a more detailed explanation of the user system 4 shown in Figure 3.

[0062] As a prerequisite for constructing the display system 1, the router device 41 is used with specific software or the corresponding software pre-installed and stored in the storage device 41B. The installation of this software on the router device 41 may be performed during the manufacturing stage. For example, the system provider that provides the display system 1 service may provide the administrator managing the user system 4 with specific software and a router device 41 with the specific software or the corresponding software installed, thereby providing the display system 1 service to the user system 4. The administrator of the user system 4 can receive the display system 1 service in the user system 4 by installing the router device 41 with the specific software or the corresponding software pre-installed within the user system 4 as a relay device for the user system 4.

[0063] In the examples in Figures 3 and 7, the router device 41 has the above-mentioned "corresponding software" installed. In addition, the desktop computers 44, 45, 47 and the notebook computer 48 have the above-mentioned "specific software" installed. In the following explanation based on the examples in Figures 3 and 7, it is assumed that the software installed on the router device 41 is the "corresponding software." However, if the router device 41 has the "specific software" installed, the operation will be explained by replacing "corresponding software" with "specific software." Also, in the following explanation based on the examples in Figures 3 and 7, it is assumed that the router device 41 functions as a central device due to the installed "corresponding software" (or "specific software"). However, as described above, by installing the "corresponding software" (or "specific software") on an external system (management system 60 or agent system 80) that is connected to the user system 4 in a communicative manner, that external system can function as a central device. When an external system functions as a central device, the operation will be explained in the following explanation based on the examples in Figures 3 and 7 by replacing the router device 41 with the external system. Furthermore, as described above, by installing "corresponding software" (or "specific software") on network devices 20 other than the router device 41 within the user system 4, those network devices 20 can be made to function as a central device. When a network device 20 is made to function as a central device, its operation is explained in the following explanation based on the examples in Figures 3 and 7 by replacing the router device 41 with a network device 20 on which the "corresponding software" (or "specific software") is installed.

[0064] (Startup sequence) Figure 8 shows the startup sequence of such a display system 1. The startup sequence is a sequence of steps necessary to implement a display method that shows the network diagram of user system 4 in display system 1.

[0065] In the startup sequence, first, as the first step, the administrator of the user system 4 receives "specific software" from the system provider of the display system 1, installs the "specific software" on the network device 20 that will be used to observe the status of the network device 20 and the amount of traffic that the network device 20 sends and receives between the network device 20 and the communication destination device, and starts it up (S1). This "specific software" includes a program that makes the network device 20 function as an agent, observes the status of the network device 20 and the amount of traffic that the network device 20 sends and receives between the network device 20 and the communication destination device, and transmits the observed information to the router device 41, which is the central device. In the first step, the "specific software" may be installed (stored) on one of the network devices 20 that make up the user system 4, or it may be installed (stored) on multiple network devices 20.

[0066] It should be noted that the "agent" function implemented by the network device 20 using "specific software" is completely separate from the agent system 80. In the following explanation, when simply referred to as "agent," it refers to the function implemented by the network device 20 using "specific software." In the examples in Figures 3 and 7, the "specific software" is installed on desktop computers 44, 45, 47 and notebook computer 48 in the first step of S1.

[0067] After the first step, the network device 20 (agent) on which the "specific software" is installed transmits its own identification information to the central device (router device 41) (S2). The router device 41, which is the central device, registers the identification information transmitted by each network device 20 on which the "specific software" is installed in step S2 by storing it in the router device 41's storage device 41B. Here, the above identification information is identification information for identifying each network device 20. The identification information of a network device 20 may include, for example, detailed information of that network device 20 (device name, display name, operating system used, manufacturer name, IP address, MAC address, etc.). The identification information may also include identification information indicating that it is the specific software. By receiving and registering the identification information transmitted by the network device 20 (agent) on which the "specific software" is installed in step S2, the router device 41 can identify the network device 20 on which the "specific software" is installed among the network devices 20 that make up the user system 4. For example, in the examples shown in Figures 3 and 7, the router device 41 receives and registers identification information from the desktop computers 44, 45, 47 and the notebook computer 48, on which the "specific software" was installed in the first step of S1, thereby enabling it to identify that the "specific software" is installed on the desktop computers 44, 45, 47 and the notebook computer 48.

[0068] After step S2, the router device 41, which functions as a central device, generates a network diagram (S3) that visualizes at least the network devices 20 included in the user system 4 that have the "specific software" installed, based on the identification information of the network devices 20 included in the user system 4 that were registered in step S2. Step S3 may also generate a network diagram that includes the router device 41 (which functions as a central device) that has the "corresponding software" installed. Furthermore, if, at the stage of step S3, the router device 41, which is the central device, has registered identification information of network devices 20 that do not have the "specific software" included in the user system 4 by some means, step S3 will generate a network diagram that includes the network devices 20 that do not have the "specific software" included in the user system 4, based on that identification information. The network diagram generated in step S3 is made public via an API (Application Programming Interface). This allows the network diagram of the user system 4 to be displayed on the network devices 20 that make up the user system 4 (desktop computers 44, 45, 47, multifunction printers 46, notebook computers 48, 49), external systems (management system 60, or agent system 80), and on the browser displayed on the display device 8 of a mobile information terminal (tablet, smartphone, etc.) used by the administrator of the user system 4.

[0069] Figure 9 illustrates the network diagram generated and displayed by the S3 process (the network diagram of the user system 4 in Figures 3 and 7). As shown in Figure 9, the S3 process displays the network diagram by showing each network device 20 that is registered with the router device 41, which is the central device, as an icon image corresponding to the type of network device 20, and by showing the communication transmission path 12 of each network device 20 as a simple graphic (such as a line). Specifically, the S3 process displays the network devices 20 included in the user system 4 that are registered with the router device 41 by the S2 process and have at least the above-mentioned "specific software" installed. In addition, if there are network devices 20 that do not have the "specific software" registered with the router device 41 by some means, those registered network devices 20 that do not have the "specific software" are also displayed in the network diagram.

[0070] Registration of network devices 20 that do not have the "specific software" installed to the central router device 41 may be performed, for example, by the administrator of the user system 4 operating the operating device of a computer (desktop PCs 44, 45, 47, notebook PCs 48, 49, computer 61 of the management system 60, computer 81 of the agent system 80, personal digital assistant, etc.) that has a display device 8 (display unit) that displays a network diagram, and inputting identification information (detailed information) regarding the network device 20 that does not have the "specific software" installed. Alternatively, when a network device 20 with the "specific software" installed communicates with a network device 20 that does not have the "specific software," the router device 41 may obtain the identification information (detailed information) of the network device 20 that does not have the "specific software" and transmit it to the router device 41.

[0071] In step S3, the responsibility boundary is clearly defined so that, among the network devices 20 included in the user system 4, at least the network devices 20 on which the "specific software" is installed, and the network devices 20 designated by the administrator of the user system 4 that do not have the "specific software," are considered devices within the scope of responsibility. The administrator of the user system 4 can designate one or more network devices 20 that do not have the "specific software" as devices within the scope of responsibility by operating the operating device of a computer (desktop PCs 44, 45, 47, notebook PCs 48, 49, computer 61 of the management system 60, computer 81 of the agent system 80, personal digital assistant, etc.) that has a display device 8 (display unit) that displays a network diagram. In addition, in step S3, the communication transmission path 12 between the network device 20 designated as a device within the scope of responsibility and another network device 20 designated as a device within the scope of responsibility is designated as a communication transmission path 12 within the scope of responsibility. Alternatively, all communication transmission paths 12 connected to the network device 20 designated as a device within the scope of responsibility may be designated as communication transmission paths 12 within the scope of responsibility.

[0072] In step S3, specifically, the network diagram of the user system 4 is displayed on the display device 8 (display unit) by a display control unit provided in the computer displaying the network diagram, using a configuration that draws a diagram using line images representing the communication transmission path 12 (images 12X, 12Y, 12Z in Figure 9) and icon images representing network equipment 20 (images 41Z, 42Z, 43Z, 44Z, 45Z, 46Z, 47Z, 48Z, 49Y in Figure 9), and is configured to distinguish between the display state of the icon images of network equipment 20 within the scope of responsibility and the display state of the icon images of network equipment 20 outside the scope of responsibility, and is configured to distinguish between the display state of the image of the communication transmission path 12 within the scope of responsibility and the display state of the image of the communication transmission path 12 outside the scope of responsibility. For example, the display control unit displays the network diagram on the display device 8 (display unit) in such a way that the icon images of network equipment 20 included in the scope of responsibility and the icon images of network equipment 20 not included in the scope of responsibility are displayed in different colors and / or with different thicknesses. In the example in Figure 9, the image of network device 20 shown with a thick line is displayed in a first color (e.g., blue), and the image of network device 20 shown with a thin line is displayed in a second color (e.g., gray). Also, the image of communication transmission path 12 shown with a thick line is displayed with a first thickness, and the image of communication transmission path 12 shown with a thin line is displayed with a second thickness that is thinner than the first thickness.

[0073] At this stage, the color of the image of the communication transmission path 12 is unified to a predetermined color (e.g., gray), regardless of whether it is within or outside the scope of responsibility. This is so that later, the image of the communication transmission path 12 can be represented in different colors depending on the amount of traffic in that communication transmission path 12. However, the image of the communication transmission path 12 may also be represented with different line thicknesses depending on the amount of traffic in that communication transmission path 12. In this case, at the stage of process S3, the display control unit may control the display so that the image of the communication transmission path 12 shown with a thick line in Figure 9 is displayed in a first color (e.g., blue), and the image of the communication transmission path 12 shown with a thin line is displayed in a second color (e.g., gray).

[0074] Here, the router device 41, which is the central device, may determine the detailed display characteristics (color, thickness, etc.) of the icon image representing the network device 20 in the network diagram, and the detailed display characteristics (color, thickness, etc.) of the image representing the communication transmission path 12. The display devices 8 (display units) of each computer may then display the icon image representing the network device 20 and the image representing the communication transmission path 12 in the detailed display characteristics determined by the router device 41. Furthermore, the router device 41 may determine only a designated number for the display mode of the icon image representing the network device 20 and the image of the communication transmission path 12 in the network diagram, according to the status of the network device 20 (whether it is within or outside its scope of responsibility, etc.) and the status of the communication transmission path 12 (whether it is within or outside its scope of responsibility, traffic volume, etc.). Each computer may then use the display control unit to determine the detailed display mode (color, thickness, etc.) of the icon image representing the network device 20 and the detailed display mode (color, thickness, etc.) of the image of the communication transmission path 12, corresponding to the designated number determined by the router device 41, and display the network diagram on the display device 8 (display unit) in the determined detailed display mode.

[0075] Returning to Figure 8, let's continue the explanation of the startup sequence. After step S3, each network device 20 (agent) with the "specific software" installed then begins acquiring its own network statistics (S4). Specifically, each network device 20 (agent) with the "specific software" installed first detects other network devices 20 that have communicated with it as destination devices. Then, each network device 20 (agent) with the "specific software" installed then acquires the current cumulative byte count Cd(a,p,t) for each destination device p and direction d (up (transmit) / down (receive)) of its own device a, provided by the network statistics information of its own operating system (OS), as the initial value of the connection counter, thereby beginning to acquire its own network statistics. Here, d indicates the communication direction, up indicates transmission, and down indicates reception. Also, a represents the own device, i.e., the network device 20 that performs the observation, and p represents the destination device (the other end of the link). Also, 't' represents the current time.

[0076] After step S4, each network device 20 (agent) with the "specific software" installed, and the central router device 41, each start a timer with a predetermined period T (for example, T = 10 seconds) (S5), and the startup sequence ends. Each network device 20 (agent) with the "specific software" installed starts the periodic processing shown in Figure 10 based on a timer interrupt from the timer that occurs at the set predetermined period T. As a result, the periodic processing is executed at the predetermined period T in each network device 20 (agent) with the "specific software" installed. In addition, the central router device 41 with the "corresponding software" installed starts the network diagram generation processing shown in Figure 11 based on a timer interrupt from the timer that occurs at the set predetermined period T. As a result, the network diagram generation processing is executed at the predetermined period T in the central router device 41 with the "corresponding software" installed.

[0077] (Periodic processing) Next, referring to Figure 10, the details of the periodic processing performed at predetermined intervals T (e.g., 10 seconds) on each network device 20 (agent) on which the "specific software" is installed will be explained. Figure 10 is a flowchart of this periodic processing. This periodic processing is the process by which the network device 20 (agent) on which the "specific software" is installed measures the amount of traffic to the connected device at predetermined intervals and sends the measured amount of traffic to the router device 41, which is the central device.

[0078] Each network device 20 (agent) with the "specific software" installed, upon starting periodic processing, first obtains the cumulative number of bytes Cd(a,p,t(k)) for each connected device p and direction d (up (transmit) / down (receive)) at the current time from the statistics of its own OS (Operating System) (S11). Here, k indicates that this is the kth execution of the periodic processing, and the measurement by this periodic processing is the measurement of the kth period, and t(k) indicates the end time of the kth period. That is, the kth period is the period from time t(k-1) to t(k). Note that time t(0) is the time when the cumulative number of bytes Cd(a,p,t) was obtained as the initial value of the connection counter in step S4 of the startup sequence.

[0079] Next, each network device 20 (agent) with the "specific software" installed calculates the traffic volume Ld(a,p,k) for the kth period, which is the measurement cycle, for each destination device p and direction d of the device a is connected to (S12). Specifically, according to the following equation (1), the traffic volume Ld(a,p,k) for each destination device p and direction d of the device a is connected to in the kth period is calculated by subtracting the cumulative number of bytes Cd(a,p,t(k-1)) measured in the previous period by the processing of S11 for each destination device p and direction d of the device a is connected to in the kth period from the cumulative number of bytes Cd(a,p,t(k)) measured in the current period by the processing of S11 for each destination device p and direction d of the device a is connected to in the current period.

[0080] Ld(a,p,k)=Cd(a,p,t(k))-Cd(a,p,t(k-1)) ...(1) Here, if there are multiple connections to the same destination device p within the same k-th period, the connections are aggregated for each destination device p.

[0081] The processing in S11-S12 constitutes the fourth step, which corresponds to the "measurement unit" and "measurement step" of the present invention. Through the processing in S11-S12, the amount of traffic between the local device a and the connected device p during the k-th cycle can be measured for each connected device p. In this way, the measurement of traffic amount by S11-S12 can be performed directly without approximation, simply by using the functions of the OS of each network device 20 (agent) on which the "specific software" is installed.

[0082] The traffic volume measurement methods described above (S11-S12) are illustrative examples and are not limiting; any method is acceptable as long as the traffic volume with the connected device can be measured at predetermined intervals. For example, depending on the OS of each network device 20 (agent) on which the "specific software" is installed, it may be difficult to obtain traffic volume statistics for each connected device p. Another example of a traffic volume measurement method described below is applicable when the OS of each network device 20 (agent) on which the "specific software" is installed does not provide traffic volume statistics for each connected device p, but does provide statistics on the total traffic volume Bd for each direction d at the network device 20.

[0083] In this case, first, as the sixth step, the network device 20 (agent) on which "specific software" is installed acquires, at predetermined intervals, from its own OS, the total traffic volume Bd(a,k) transmitted or received from its own device a during the kth period (the period from time t(k-1) to t(k)), for each direction d. Furthermore, the network device 20 that acquires the total traffic volume Bd(a,k) transmitted or received by its own device during the kth period at predetermined intervals in the sixth step, then, as the seventh step, sets up multiple (e.g., n) short window intervals i with a time length shorter than the predetermined period (e.g., 10 milliseconds in length), and for each short window interval i, acquires the short window traffic volume sd(a,p,i) for each direction d between its own device a and the communication destination device p multiple times (n times). Furthermore, in the eighth step, the network device 20, which acquires the total traffic volume Bd(a,k) transmitted or received by the device in the kth period at predetermined intervals in the sixth step, estimates the ratio of traffic volume between the device a and the communication destination device p in the kth period for each direction d, using the following equations (2) to (4), based on the short-window traffic volume sd(a,p,i) for each direction d acquired in the seventh step, and calculates the traffic volume Ld(a,p,k) between the device a and the communication destination device p in the kth period for each direction d from the total traffic volume Bd(a,k) and the estimated ratio. Note that in the following equation (2), Sd(a,p,k) is the sum of the n short-window traffic volumes sd(a,p,i) (i is an integer from 1 to n) for each direction d between the device a and the communication destination device p in the kth period, acquired in the seventh step. Furthermore, (Sd(a,p,k) / Sd(a,k)) in equation (4) is an estimated value for the ratio of traffic volume between the local device a and the communication destination device p in the kth period, separated by direction d. Here, it is assumed that Sd(a,k) > 0.

[0084] Sd(a,p,k)=Σ[i=1··n]sd(a,p,i)···(2) Sd(a,k)=Σ[p]Sd(a,p,k)...(3) Ld(a,p,k)=Bd(a,k)×(Sd(a,p,k) / Sd(a,k)) ...(4) Furthermore, if Sd(a,k) is 0, or if there is rounding residue or uncaptured data, it is classified as the traffic volume Ld(unknown) for unclassified links by direction d, and the equation Σ[p]Ld(a,p,k)+Ld(unknown)=Bd(a,k) is satisfied. This ensures the conservation law for the total traffic volume Bd(a,k) is maintained.

[0085] As described above, in this alternative example, the total traffic volume Bd(a,k) for the k-th period at the local device a is obtained from the OS's accurate total counter. On the other hand, bidirectional sampling using short window intervals is used to determine the allocation ratio of "what percentage of information was transmitted to which destination device p, in which direction d (uplink / downlink)," and the total traffic volume Bd(a,k) is apportioned according to that ratio. This allows the network device 20 to accurately measure the traffic volume Ld(a,p,k) for each destination device p and direction d in the k-th period, even if it is difficult for the OS to obtain traffic volume statistics for each destination device p and direction d. Furthermore, by making the short window interval short (e.g., 10 milliseconds), full capture at all times can be avoided, minimizing observation overhead and allowing for the acquisition of a representative sample of the instantaneous rate. Additionally, by sampling transmission and reception separately, it is possible to distinguish between uplink (transmission) concentration (e.g., data transfer) and downlink (reception) concentration (e.g., downloads, backups). Furthermore, by acquiring the short-window traffic volume sd(a,p,i) multiple times within the k-th period, the representativeness of the allocation ratio can be improved.

[0086] Once the traffic volume measurement process is complete, in the periodic processing, each network device 20 (agent) with "specific software" installed obtains a list of all IP addresses of connected devices p (list of communication partner IP addresses) from the OS of its own device a, and constructs a logical connection relationship between its own device a and connected devices p as a link (S13). This S13 process (third step) corresponds to the "detection unit" and "detection step" of the present invention.

[0087] Then, each network device 20 (agent) with the "specific software" installed sends measurement data to the central router device 41 (S14), which associates the IP address of the connected device p (destination IP address) obtained in processing S13 with each of the traffic amounts Ld(a,p,k) between the device a and the connected device p during the kth period, measured in S11 and S12, and terminates the periodic processing.

[0088] In this periodic processing, the destination device p whose traffic volume with the local device a is measured may be a network device 20 with the "specific software" installed, or a network device 20 without the "specific software". In other words, even if the "specific software" is installed on only one of the network devices 20 in a communication pair, the traffic volume between these network devices 20 will be measured.

[0089] (Network diagram generation process) Next, referring to Figure 11, the details of the network diagram generation process, which is performed every predetermined period T (for example, 10 seconds) on the router device 41, which functions as a central device and has the "corresponding software" installed, will be explained. Figure 11 is a flowchart of the network diagram generation process. In this network diagram generation process, the router device 41 (central device) works in cooperation with the "corresponding software" to generate a network diagram of the user system 4, which displays images of the communication transmission paths 12 included in the user system 4 in a display mode corresponding to the amount of traffic on those communication transmission paths 12.

[0090] When the router device 41 (central device) starts the network diagram generation process, it first receives the measurement data output by the periodic processing S14 (Figure 10) at each network device 20 (agent) on which the "specific software" is installed, aggregates the traffic volume Ld(a,p,k) for each connected destination device p and direction d at each agent (self-device a) in the kth period, and integrates the traffic volume for each pair of network devices 20 in the user system 4 to configure links between the network devices 20 that make up the nodes (S21). At this time, the router device 41 (self-device a) calculates the total traffic volume Ltotal(a,p,k) by adding the transmitted traffic volume Lup(a,p,k) and the received traffic volume Ldown(a,p,k) for each connected destination device p at each agent (self-device a) in the kth period using the following formula (5).

[0091] Ltotal(a,p,k)=Lup(a,p,k)+Ldown(a,p,k) ...(5) At this time, even if at least some of the communication destination devices p for each agent (local device a) are network devices 20 that do not have "specific software" installed (agent-less), the router device 41 (central device) calculates the total traffic volume Ltotal(a,p,k) of the communication transmission path 12 between the agent and the agent-less network devices 20 based solely on the measurement data on the agent side, thereby establishing a link between the agent and the agent-less network devices 20 (S22).

[0092] Next, the router device 41 (central device), which also operates as a gateway relaying communication with an external communication network (the Internet communication network 90 in the examples of Figures 3 and 7), performs the ninth step in which it observes all communications passing through the router device 41 as a relay device. For each communication, it extracts the IP address of the source (transmitter) network device 20, the IP address of the destination (receiver) network device 20, and the traffic volume of that communication. By periodically taking snapshots of these, it complements (corrects) the total traffic volume in each communication transmission path 12 between each network device 20 (S23). This makes it possible to configure and comprehensively visualize communications within the user system 4 as links, including communications between network devices 20 that do not have specific software installed. Note that the processing in S23 is optionally performed only when the router device 41, which also functions as a relay device (gateway), has the "corresponding software" installed and the router device 41 functions as a central device.

[0093] Next, as the fifth step, the router device 41 (central device) determines the total traffic amount Ltotal(a,p,k) of each link (communication transmission path 12) between the network devices 20 configured by the processes of S21 and S22, and which has been optionally supplemented by the process of S23, based on Table 1, and determines the display mode (display color) of the image of the link (communication transmission path 12) in the network diagram in stages (in this case, in three stages) (S24). The process of S23 corresponds to the "second display step" of the present invention. Specifically, the display mode for the image of the corresponding communication transmission path 12 is determined as follows: if the total traffic volume Ltotal(a,p,k) is less than or equal to the first threshold of 20MB / 10 seconds, it is displayed in green as the first display mode 12U (Figure 13); if it exceeds the first threshold of 20MB / 10 seconds but is less than or equal to the second threshold of 50MB / 10 seconds, it is displayed in yellow as the second display mode 12V (Figure 13); and if it exceeds the second threshold of 50MB / 10 seconds, it is displayed in red as the third display mode 12W (Figure 13).

[0094] [Table 1]

[0095] Furthermore, the method of differentiating the display of links (communication transmission paths 12) in the network diagram based on the total traffic volume Ltotal(a,p,k) is not limited to differentiating the display color as shown in Table 1, but may be done by any method. For example, the line thickness may be different, or the display of the link (communication transmission path 12) image may be differentiated by whether it is lit or blinking, or if it is blinking, the blinking interval may be different. In addition, two or more of the display color, line thickness, lit / blinking, and blinking interval may be combined to differentiate the display of links (communication transmission paths 12) in the network diagram based on the total traffic volume Ltotal(a,p,k).

[0096] Then, the router device 41 (central device) generates topology data (nodes / links) showing the network diagram of the user system 4 based on the display configuration of each link (communication transmission path 12) determined by the processing in S24, and the detailed information of each network device 20 obtained from each network device 20 (agent) on which "specific software" is installed through a process not shown, and based on the display configuration of the icons of each node (network device 20) determined by a process not shown, and publishes this as an API (S25), thus ending the network diagram generation process. This API publication allows the network diagram of the user system 4 to be displayed on browsers displayed on display devices 8 (display units) of various computers, such as the network devices 20 that make up the user system 4 (desktop PCs 44, 45, 47, multifunction printers 46, notebook computers 48, 49), external systems (management system 60, or agent system 80), and mobile information terminals (tablet terminals, smartphones, etc.) used by the administrator of the user system 4.

[0097] It should be noted that in the process of S25, topology data for a predetermined period, for example, topology data from the j-th cycle to the current k-th cycle (j<k), may be collectively disclosed via an API. Accordingly, a browser on the display device 8 (display unit) of various computers can display a network diagram of the user system 4 for each cycle included in the predetermined period from the topology data of the predetermined period. Therefore, an administrator who visually checks the network diagram via the browser can confirm changes in the state of the network devices 20 and the communication transmission paths 12 of the user system 4.

[0098] (Display Process) Next, with reference to FIG. 12, the details of display processing executed by a browser of one computer will be described. FIG. 12 is a flowchart showing said display processing. As described above, the topology data disclosed via API from the router device 41 (central device) includes network devices 20 (desktop computers 44, 45, 47, multifunction peripheral 46, notebook computers 48, 49) constituting the user system 4, an external system (the management-side system 60 or the agent system 80), and can be acquired by a browser displayed on the display device 8 (display unit) of various computers such as a portable information terminal (tablet terminal, smartphone, etc.) used by an administrator of the user system 4. Then, the browsers of these computers execute display processing to cause the display device 8 (display unit) to display the network diagram of the user system 4 based on the topology data disclosed via the API.

[0099] When the browser of one computer starts executing the display process, it periodically (for example, every 10 seconds, the same as a predetermined period) acquires topology data of the user system 4 that has been exposed via API from the router device 41 (central device) (S31). Then, the browser of one computer controls the display device 8 (display unit) to display the network diagram according to the acquired topology data (S32), and then terminates the display process. As a result, the display device 8 (display unit) of one computer displays a network diagram of the user system 4 in which images of each link (communication transmission path 12) are displayed in the display manner specified in the topology data, and icon images of each node (network device 20) are displayed in the display manner specified in the topology data. Using this network diagram displayed on the display device 8 (display unit) of one computer, the administrator of the user system 4 can suitably measure the traffic volume of each communication transmission path 12 in the user system 4 and intuitively grasp the traffic status of each communication transmission path 12. In addition, the user system 4 can intuitively grasp the status of the network devices 20 that constitute the user system 4 using this network diagram.

[0100] Figure 13 illustrates the network diagram (the network diagram of the user system 4 in Figures 3 and 7) displayed in a browser after the network diagram shown in Figure 9 has undergone periodic processing by the network device 20 on which the "specific software" is installed, the network diagram generation process of the router device 41 (central device) on which the "corresponding software" is installed, and the display process of a browser on a computer. In the example in Figure 13, the observed traffic volume for the communication transmission path 12 between desktop PC 44, which is an agent with the "specific software" installed, and desktop PC 45, which is an agent with the "specific software" installed, is 12 MB / 10 seconds; the observed traffic volume for the communication transmission path 12 between desktop PC 47, which is an agent with the "specific software" installed, and notebook PC 48, which is an agent with the "specific software" installed, is 52 MB / 10 seconds; and the observed traffic volume for the communication transmission path 12 between desktop PC 45, which is an agent with the "specific software" installed, and multifunction printer 46, which does not have an agent and therefore does not have the "specific software" installed, is 35 MB / 10 seconds. Furthermore, the diagram shows a case where the traffic volume of the communication transmission path 12 between the agent-less multifunction printer 46 (which does not have the "specific software") and the agent-less notebook computer 49 (which does not have the "specific software") is identified as 24 MB / 10 seconds, thanks to the traffic volume supplementation by the router device 41, which functions as a gateway. In reality, traffic volume is also measured for other communication transmission paths 12, but this is omitted in the example shown in Figure 13.

[0101] In the example shown in Figure 13, the image of the communication transmission path 12 between agent desktop PC 44 and agent desktop PC 45 is displayed in "green" (first display mode 12U) according to Table 1, corresponding to the traffic volume of 12 MB / 10 obtained from measurements by each agent. Similarly, the image of the communication transmission path 12 between agent desktop PC 47 and agent notebook PC 48 is displayed in "red" (third display mode 12W) according to Table 1, corresponding to the traffic volume of 52 MB / 10 obtained from measurements by each agent. Furthermore, even in a communication transmission path 12 where one end is a multifunction device 46 without an agent and the other end is an agent desktop PC 45, the traffic volume of 35 MB / 10 seconds measured based on observations by the agent desktop PC 45 at the other end is displayed in "yellow" (second display mode 12V) according to Table 1. In this way, the traffic status can be intuitively grasped.

[0102] As described above, an image showing the communication transmission path 12 between network devices 20, whose traffic volume is measured based on agent observations, is displayed on the network diagram with a display mode that varies according to the measured traffic volume. This allows an administrator viewing the network diagram to intuitively grasp the traffic status. Furthermore, the image showing the communication transmission path 12 is displayed on the network diagram with a display mode that varies in stages according to the measured traffic volume. This allows an administrator viewing the network diagram to easily and progressively grasp the traffic status in the communication transmission path 12. In particular, in this embodiment, the image showing the communication transmission path 12 is displayed on the network diagram with a display mode that varies in at least three stages according to the measured traffic volume. This allows an administrator viewing the network diagram to intuitively grasp whether the traffic status in the communication transmission path 12 is normal, congested, or jammed.

[0103] Furthermore, in the example of FIG. 13, even if the traffic volume cannot be observed by an agent and thus the traffic volume of the communication transmission path 12 between the multifunction peripheral 46 and the notebook computer 49, neither of which has an agent installed, cannot be measured, the present invention utilizes the property that all communications between network devices 20 in the user system 4 pass through the router device 41 that functions as a gateway. Accordingly, the traffic volume of the communication transmission path 12 between the two network devices 20 not equipped with an agent is observed and supplemented by the router device 41. Then, the image of the communication transmission path 12 between the multifunction peripheral 46 and the notebook computer 49, for which the traffic volume is obtained through this supplementation, is displayed in the "yellow" second display mode 12V according to Table 1, based on the traffic volume of 24MB / 10. This enables comprehensive visualization of communications in the user system 4 in the network diagram, including communications between network devices 20 on which specific software is not installed.

[0104] Note that the computer that displays the network diagram may be configured to store topology data for at least a predetermined period among the topology data acquired from the router device 41 (central device), for example, topology data from the j-th cycle to the current k-th cycle (j<k), in a storage device of the computer. Accordingly, a browser on the display device 8 (display unit) of various computers can display a network diagram of the user system 4 for each cycle included in the predetermined period, based on the topology data of that predetermined period. Therefore, an administrator viewing the network diagram via a browser can confirm changes in the status of the network devices 20 and the communication transmission paths 12 in the user system 4.

[0105] (Arrangement Position of Central Device When Installing the Central Device in User Network) In the user system 4 shown in Figures 3 and 7, the router device 41, which also functions as a gateway, is made to function as a central device by installing "corresponding software" (or "specific software"). However, the router device 41 does not necessarily have to be located in a position that functions as a gateway; it may be located at the apex of a subnetwork formed within the user system 4 with the gateway function turned off, and the router device 41 located at the apex of this subnetwork may be made to function as a central device by installing "corresponding software" or "specific software". Furthermore, when a central device is provided within the user system 4, it does not necessarily have to be implemented in the router device 41; the network device 20 may be made to function as a central device by installing "corresponding software" or "specific software" on some network device 20, or a dedicated central device with "corresponding software" or "specific software" installed may be provided. In this case, the central device may be located at the gateway location of the user system 4 as configuration pattern A, or it may be placed after the existing router device 41 with the WAN (Wide Area Network) function turned off as configuration pattern B, or it may be connected in parallel within the LAN (Local Area Network) of the user system 4 as configuration pattern C.

[0106] When the central device is configured according to arrangement pattern A, all communications within the user system 4 can pass through the central device. Therefore, as described above, step S23 of the network diagram generation process (Figure 11) performed by the central device observes all communications passing through and compensates (corrects) the traffic volume.

[0107] On the other hand, when the central device is configured according to arrangement pattern B, only some of the communications within the user system 4 pass through the central device. Therefore, in this case, step S23 of the network diagram generation process (Figure 11) performed by the central device may be configured to observe only the communications that pass through the central device. For each observed communication, the IP address of the source (transmitter) network device 20, the IP address of the destination (receiver) network device 20, and the traffic volume of that communication may be extracted to supplement (correct) the total traffic volume in each communication transmission path 12 between each network device 20. This makes it impossible to supplement the traffic volume based on all communications within the user system 4, but it is possible to supplement (correct) the traffic volume based on communications that can be observed by the central device, thereby increasing the number of communication transmission paths 12 for which traffic volume can be displayed in the network diagram shown on the display device 8 (display unit).

[0108] When the central device is deployed according to deployment pattern C, it is generally not possible to observe communications within the user system 4. Therefore, in this case, the network diagram generation process (Figure 11) performed by the central device may omit the process in S23, i.e., the process of observing communications passing through the central device and supplementing (correcting) the traffic volume. In this case, the network diagram is generated based on the traffic volume measured by the network device 20 (agent) on which the "specific software" is installed.

[0109] 3. Summary of the First Embodiment The network diagram display method using the network diagram display system 1 according to the first embodiment described above has the following effects.

[0110] (a) In the first step, specific software is installed on at least some of the network devices 20 included in the user system 4. In the second step, a network diagram visualizing the network devices 20 included in the user system 4 is displayed on the display unit by the display control unit. Meanwhile, in the third step, the network devices 20 with the specific software installed detect other network devices 20 that have communicated with the local device a as communication destination devices p. In the fourth step, the network devices 20 with the specific software installed measure the amount of traffic between the local device a and the communication destination devices p detected in the third step at predetermined intervals. As a result, the network devices 20 with the specific software installed can measure the amount of traffic between the local device a and other network devices 20 (communication destination devices p) that have communicated with the local device a without receiving active inquiries from the outside. Finally, in the fifth step, an image showing the communication transmission path 12 between the network devices 20 whose traffic amount was measured in the fourth step and the communication destination devices p is displayed on the network diagram, with the display mode varying according to the measured amount of traffic. Thus, the amount of traffic can be measured appropriately, and the state of traffic can be grasped intuitively.

[0111] (b) In the fourth step, the traffic volume between the local device a and the communication destination device p is obtained without performing an SNMP-based query. This eliminates the need to change the settings of the network device 20 for SNMP. Furthermore, because there are no proactive SNMP queries from outside, the load on the user system 4 can be reduced, and false positives from EDR and security software can be made less likely. In addition, traffic volume can be observed even for communications that cannot be captured by SNMP. Therefore, traffic volume can be measured appropriately.

[0112] (c) Even if the specific software is not installed on the communication destination device p detected in the third step, the fourth step measures the traffic volume between the local device a and the communication destination device p at predetermined intervals using a network device 20 on which the specific software is installed. As a result, even if the specific software is installed on only one of the network devices 20 in a communication pair of network devices 20, the traffic volume between these network devices 20 can be measured, and an image showing this communication transmission path 12 can be displayed on the network diagram in a display manner that differs according to the measured traffic volume. Therefore, even if the specific software is not installed on the communication destination device p, the traffic on the communication transmission path 12 with the communication destination device p can be visualized.

[0113] (d) In the second step, after the first step, the responsibility boundary is clearly defined so that at least the network devices 20 with specific software installed among the network devices 20 included in the user system 4 are within the scope of responsibility. A diagram is drawn using an image showing the communication transmission path 12 and icon images showing the network devices 20, and the display state of the icon images of network devices 20 within the scope of responsibility is distinguished from the display state of the icon images of network devices 20 outside the scope of responsibility, and the network diagram of the user system 4 is displayed. As a result, the status of both the network devices 20 and the communication transmission path 12 is displayed together on the same screen, allowing the user to grasp the status of the entire user system 4 at a glance.

[0114] Furthermore, the various effects and advantages described above can be obtained by each of the above-described configurations of the network diagram display system 1 and network diagram display method according to the first embodiment described above.

[0115] <Second Embodiment> Next, with reference to Figures 14 and 15A to 15E, the network diagram display system 1 according to the second embodiment and the method of displaying the network diagram using the display system 1 will be described. The network diagram display system 1 according to the second embodiment assumes that in the user system 4, a router device 41 or a gateway device having gateway functionality functions as a line switching unit and can switch between a main line and a secondary line as the communication line connecting to the external network, the Internet communication network 90. ​​Normally, the system connects to the Internet communication network 90 using a main line, such as an optical line, while monitoring the main line and having a function to automatically switch the communication line connecting to the Internet communication network 90 to a secondary line, such as a mobile line, if any failure occurs in the main line. In the following description, it is assumed that the router device 41 has "corresponding software" or "specific software" installed and functions as a central device. However, as in the first embodiment, the functions of the central device may be realized by an external system (management system 60, agent system 80), by network equipment 20 provided within the user system 4, or by dedicated equipment installed within the user system 4. Furthermore, when the central device is provided within the user system 4, its arrangement pattern may be any of arrangement pattern A, arrangement pattern B, or arrangement pattern C described in the first embodiment. In addition, the description will focus on the case where the router device 41 switches between two communication lines, a main line and a secondary line. However, it may also switch the communication lines to connect to the Internet communication network 90 using one of three or more communication lines that can connect to the Internet communication network 90.

[0116] Figure 14 is a flowchart showing the line switching process executed by the router device 41, which functions as a central device, in the second embodiment. The line switching process is executed when the communication line connecting the user system 4 to the Internet communication network 90 switches from the main line to the secondary line, and is started when a failure in the main line is detected. Figure 15A shows the network diagram displayed on the display device 8 (display unit) before a failure occurs in the main line in the user system 4 of Figures 3 and 7. However, Figure 15A (and similarly Figures 15B to 15E) omits the icon images representing the hub 43, the desktop PCs 47 and notebook PCs 48 and 49 connected to the hub 43, and the image representing the communication transmission path 12 connecting them. In the example of Figure 15A, the desktop PC 44 communicates with the Internet communication network 90A via the main line at a traffic volume of 30 MB / 10 seconds, and the network diagram shows the image 12S of the communication transmission path 12 corresponding to the main line displayed in yellow, which is the second display mode.

[0117] Now, when the router device 41 (central device) starts executing the line switching process, it first sets the image 12S of the communication transmission path 12 corresponding to the main line to grayed out based on the detection of a failure in the main line (S41). The information of the image 12S of the communication transmission path 12 corresponding to the main line that is set to grayed out is included in the topology data as link information representing the communication transmission path 12 corresponding to the main line in the network diagram generation process executed by the router device 41 (central device) immediately after this setting, regardless of the processing results of S21 to S24, by processing S25, and is made public via API. As a result, the image 12S of the communication transmission path 12 corresponding to the main line is grayed out on the display device 8 (display unit) that displays the network diagram, as shown in Figure 15B.

[0118] Next, when the router device 41 (central device) detects that the communication line between the user system 4 and the Internet communication network 90 is in the process of switching from the primary line to the secondary line, it sets the network diagram to display an animation indicating that the switching operation from the primary line to the secondary line is taking place (S42). As a result, the display device 8 (display unit) that displays the network diagram starts displaying an image 12T of the communication transmission path 12 corresponding to the secondary line, as shown in Figure 15C, and displays the image 12T of the communication transmission path 12 corresponding to the secondary line in a manner that makes it clear that the communication line between the user system 4 and the Internet communication network 90 is in the process of switching to the secondary line. The display manner here can be any manner that makes it clear that the communication line is in the process of switching to the secondary line. For example, by displaying the image 12T of the communication transmission path 12 corresponding to the secondary line repeatedly by wiping from top to bottom or from left to right, it is possible to display that the communication line between the user system 4 and the Internet communication network 90 is in the process of switching to the secondary line. In Figure 15C and the network diagrams shown in Figures 15D to 15E described later, the communication transmission path 12 corresponding to the main line is shown as being connected to the Internet network 90A, and the communication transmission path 12 corresponding to the secondary line is shown as being connected to the Internet network 90B. This is to make it clearer that the main line and the secondary line are separate communication lines, and the Internet network 90 is also shown as Internet network 90A and 90B. However, the Internet network 90 is actually one, and Internet network 90A and 90B each refer to the same Internet network 90. ​​Therefore, in the network diagram, the Internet network 90 may be shown as a single image to show that both the main line and the secondary line are connected to one Internet network 90.

[0119] Next, when the router device 41 (central device) detects that the switching to the secondary line has been completed as the communication line with the Internet communication network 90 in the user system 4, it controls the display of the image 12T of the communication transmission path 12 corresponding to the secondary line in a display manner corresponding to the traffic volume of the communication transmission path 12 corresponding to the secondary line (S43). The traffic volume of the communication transmission path 12 corresponding to the secondary line is measured by a periodic process executed by a network device 20 (agent) on which "specific software" is installed, immediately after the control by the process in S43. Then, in the network diagram generation process executed by the router device 41 (central device) immediately after this periodic process, the display manner of the image 12T of the communication transmission path 12 corresponding to the secondary line is determined based on the traffic volume measured by the above periodic process. As a result, if the traffic volume of the communication transmission path 12 between the desktop computer 44 and the internet communication network 90B via the secondary line is 28 MB / 10, the display device 8 (display unit) that displays the network diagram will always display the image 12T of the communication transmission path 12 in yellow, which is the second display mode, as shown in Figure 15D.

[0120] Subsequently, the router device 41 (central device) displays the image 12T of the secondary line communication transmission path 12 in a manner that indicates the secondary line is in use (S44). Here, the manner that indicates the secondary line is in use can be any manner that shows that the secondary line is being used as the communication line to the Internet communication network 90, rather than the primary line, as shown in Figure 15E. For example, the image 12T of the secondary line communication transmission path 12 may be displayed blinking or displayed with a dashed line.

[0121] Furthermore, as the tenth step, the router device 41 (central device) exposes an API to output topology data in chronological order from the occurrence of a failure in the main line to the completion of the switchover to the secondary line (S45). The topology data exposed by the API here may include data from before the occurrence of the failure in the main line for a predetermined period of time, and may also include data from after the completion of the switchover to the secondary line for a predetermined period of time. In other words, the API should include multiple sets of topology data so that the changes in the traffic state of the communication transmission path 12 before and after the switchover from the main line to the secondary line of the communication line can be displayed in chronological order as changes in the display mode of the image showing the communication transmission path 12. As a result, the browser of the display device 8 (display unit) of various computers can display a network diagram of the user system 4 before and after the switchover from the main line to the secondary line of the communication line from this topology data. Therefore, it is possible to record and visualize in chronological order what happened in the user system 4 before and after the switchover of the communication line with the Internet communication network 90 for some reason, and to facilitate subsequent analysis.

[0122] Furthermore, in a computer displaying a network diagram, topology data acquired from the router device 41 (central device), at least from the occurrence of a primary line failure to the completion of the switchover to the secondary line, may be saved chronologically in the computer's storage device. This allows the browser of the display device 8 (display unit) of various computers to display a network diagram of the user system 4 before and after the switchover from the primary line to the secondary line of the communication line, based on the topology data saved chronologically. Thus, it is possible to record and visualize in chronological order what happened within the user system 4 before and after a switchover of the communication line with the Internet communication network 90 for any reason, making subsequent analysis easier.

[0123] <Third Embodiment> Next, with reference to Figure 16, a network diagram display system 1 according to the third embodiment and a method for displaying a network diagram using the display system 1 will be described. In the network diagram according to the third embodiment, the network diagram display system 1 clearly indicates in the network diagram any network equipment 20 that has experienced at least one of one or more predetermined abnormality types, and also clearly indicates the communication transmission path 12 in which the abnormal network equipment 20 is involved and which is experiencing traffic congestion. In this embodiment, "one or more predetermined abnormality types" are defined as "communication errors" and "abnormalities other than communication errors." Furthermore, as "abnormalities other than communication errors," the following are defined for network equipment 20: a first abnormality where the average CPU usage rate over 10 minutes is below a first threshold, a second abnormality where the memory usage rate is below a second threshold, and a third abnormality where the hard disk drive usage rate is below a third threshold. In addition, the operation of network equipment 20 or the detection or infection of a computer virus in network equipment 20 by security software may be defined as a fourth abnormality.

[0124] For example, in user system 4, "specific software" installed on network device 20 causes the control unit of the network device 20 on which it is installed to function as an anomaly detection unit, and checks whether the above-mentioned "communication error" or "an anomaly other than a communication error" has occurred in the network device 20 on which it is installed or in an external network device 20. In this example, "the control unit of the network device 20 on which the "specific software" is installed," or "the control unit and the "specific software"" are examples of an anomaly detection unit.

[0125] For example, in the user system 4 shown in Figures 3 and 7, the "specific software" installed on the desktop computer 47 causes the control unit of the desktop computer 47 to function as an anomaly detection unit, and in an anomaly detection process, causes the control unit to check whether a first anomaly has occurred (whether the average usage rate of the desktop computer 47's CPU over 10 minutes is below the first threshold), whether a second anomaly has occurred (whether the memory usage rate of the desktop computer 47 is below the second threshold), whether a third anomaly has occurred (whether the hard disk drive usage rate of the desktop computer 47 is below the third threshold), or whether a fourth anomaly has occurred (whether a computer virus has been detected on the desktop computer 47, or whether the desktop computer 47 is infected with a computer virus). The "specific software" installed on the desktop computer 47 may also cause the control unit to check whether a communication error has occurred on the desktop computer 47 (for example, an error where the desktop computer 44 cannot communicate with the outside), or whether a communication error has occurred on network equipment 20 other than the desktop computer 47 in the user system 4 shown in Figure 7.

[0126] This anomaly detection unit can detect anomalies not only in the desktop computer 47, but also in other network devices 20 in the user system 4 shown in Figures 3 and 7 that have the "specific software" installed. The anomaly detection unit will not detect any of the above-mentioned anomalies in network devices 20 outside its scope of responsibility. Furthermore, for network devices 20 within its scope of responsibility that do not have the "specific software" installed, the anomaly detection unit may choose not to detect any of the above-mentioned anomalies, or it may perform the detection of any of the above-mentioned anomalies using devices that have the "specific software" installed.

[0127] Assuming that anomalies are detected by such an anomaly detection unit, in the network diagram generation process by the router device 41 (central device) or the display process by a computer equipped with a display device 8 (display unit) for displaying the network diagram, the display state of the icon image of network devices 20 within the scope of responsibility in which the anomaly detection unit has detected an anomaly is made different from the display state of the icon image of network devices 20 in which the anomaly detection unit has not detected an anomaly, and the network diagram is displayed on the display device 8 (display unit). For example, among the network devices 20 within the scope of responsibility, network devices 20 in which the anomaly detection unit has not detected an anomaly are set to a first color (e.g., blue), network devices 20 in which the anomaly detection unit has detected the above-mentioned communication error are set to a second color different from the first color (e.g., yellow), and network devices 20 in which the anomaly detection unit has detected an anomaly other than a communication error are set to a third color different from the first and second colors (e.g., red), and the network diagram is displayed in this manner.

[0128] As a specific example, when the above-mentioned inspection is performed on the user system 4 in Figures 3 and 7, and a network diagram like that shown in Figure 16 is displayed, if the abnormality detection unit does not detect any of the above abnormalities (the above-mentioned communication error, the above-mentioned first abnormality, the above-mentioned second abnormality, or the above-mentioned third abnormality) in any of the network devices 20 within any of the areas of responsibility, the network diagram will be displayed on the display device 8 (display unit) of the display system 1 so that the icon images of the network devices 20 within any of the areas of responsibility are displayed in the above-mentioned first color. On the other hand, when the above-mentioned inspection is performed on the user system 4 in Figures 3 and 7, and an abnormality other than the above-mentioned communication error (for example, any of the above-mentioned first abnormality, second abnormality, third abnormality, or fourth abnormality) is detected in the desktop computer 47, and no other abnormalities (the above-mentioned communication error, first abnormality, second abnormality, third abnormality, or fourth abnormality) are detected, the network diagram will be displayed on the display device 8 (display unit) so that the icon image of the desktop computer 44 is displayed in the color icon image 47W corresponding to the communication error, as shown in Figure 16.

[0129] Furthermore, in the third embodiment, in the S24 process (fifth step) of the network diagram generation process executed by the router device 41 (central device), it is determined whether the amount of traffic measured for the communication transmission path 12 connected to the network device 20 for which the anomaly detection unit detected an anomaly in the anomaly detection step exceeds the third threshold (50 MB / 10 seconds in the example in Table 1). If the amount of traffic for the communication transmission path 12 exceeds the third threshold and the state of the communication transmission path 12 is in a "congested" state, the fifth step displays an image of the communication transmission path 12 on the network diagram in a specific display mode that is different from the display mode of the image of the communication transmission path 12 connected to the network device 20 for which the anomaly detection unit did not detect an anomaly in the anomaly detection step. For example, the image of the communication transmission path 12 connected to the network device 20 for which no anomalies were detected is displayed on the network diagram in a display mode that is appropriate according to the amount of traffic. On the other hand, for a communication transmission path 12 connected to the network device 20 where an anomaly was detected, if the measured traffic volume is below the third threshold, an image of the communication transmission path 12 is displayed on the network diagram in a display mode corresponding to the traffic volume, as shown in Table 1. However, if the measured traffic volume exceeds the third threshold, the image of the communication transmission path 12 is displayed in a different display mode than usual, with red, thick lines, and rapid flashing. In the example in Figure 16, the measured traffic volume for a communication transmission path 12 connected to the desktop computer 47 where an anomaly was detected, specifically the one communicating with an external device connected to the Internet communication network 90, is 55 MB / 10 seconds, which exceeds the third threshold of 50 MB / 10 seconds. Therefore, the image 12R of that communication transmission path 12 is displayed on the network diagram in a display mode with red, thick lines, and rapid flashing. This allows for instantaneous understanding of the anomaly situation from the status of both the network device 20 and the communication transmission path 12 shown in the network diagram, improving the operator's decision-making speed and accuracy in the event of an anomaly.For example, if a network diagram reveals that an anomaly has occurred on desktop computer 47 and that a large amount of traffic is occurring in the communication transmission path 12 between desktop computer 47 and the internet network 90, it can be instantly determined that ransomware is encrypting data or that data exfiltration is possible.

[0130] <Other Embodiments> Although the present disclosure has been described above based on embodiments, it is easy to infer that the present disclosure is not limited in any way to the above embodiments, and that various improvements and modifications are possible without departing from the spirit of the present disclosure. For example, each embodiment may be configured by modifying the embodiment by adding some or more parts of the configuration of another embodiment to that embodiment, or by replacing some or more parts of the configuration of that embodiment. Also, the numerical values ​​given in the above embodiments are just examples, and it is of course possible to use other numerical values.

[0131] In the embodiment described above, a network device 20 on which "specific software" is installed is considered a network device 20 within the scope of responsibility. However, as described above, even if a network device 20 does not have "specific software" installed, if an operation is performed in a display system capable of displaying a network diagram of a user system 4 having the network device 20 to include the network device 20 within the scope of responsibility, the network device 20 may be registered as being within the scope of responsibility.

[0132] In the above-described embodiment, an example is adopted in which network devices 20 within the scope of responsibility are displayed with a first color, and network devices 20 outside the scope of responsibility are displayed with a second color, thereby differentiating the display state, but the system is not limited to this example. For example, the icon images of network devices 20 within the scope of responsibility and the icon images of network devices 20 outside the scope of responsibility may be represented with the same color or different colors, and the display state may be different in which the line thickness of the graphic of the icon image of network devices 20 within the scope of responsibility is greater than the line thickness of the graphic of the icon image of network devices 20 outside the scope of responsibility. Alternatively, the icon images of network devices 20 within the scope of responsibility and the icon images of network devices 20 outside the scope of responsibility may be represented with the same color or different colors, and the display state may be different in which the icon image of network devices 20 within the scope of responsibility is displayed in a continuously lit state, and the icon image of network devices 20 outside the scope of responsibility is displayed in a blinking state.

[0133] Similarly, in the above-described embodiment, an example is adopted in which the display state is made different by displaying the communication transmission path 12 within the scope of responsibility with a first thickness and the communication transmission path 12 outside the scope of responsibility with a second thickness, but the invention is not limited to this example. For example, the images of the communication transmission path 12 within the scope of responsibility and the images of the communication transmission path 12 outside the scope of responsibility may be represented with the same thickness or different thicknesses, and the display state may be made different by displaying the images of the communication transmission path 12 within the scope of responsibility with different colors and different colors. Alternatively, the images of the communication transmission path 12 within the scope of responsibility and the images of the communication transmission path 12 outside the scope of responsibility may be represented with the same thickness or different thicknesses, and the display state may be made different by displaying the images of the communication transmission path 12 within the scope of responsibility in a continuously lit state and the images of the communication transmission path 12 outside the scope of responsibility in a blinking state.

[0134] In the above-described embodiment, the case in which the display system 1 is also configured as a responsibility boundary point indication system capable of clearly indicating the responsibility boundary points in the user system 4 on the network diagram was explained. However, the display system 1 may also be configured not to indicate the responsibility boundary points.

[0135] In the embodiments described above, we explained a case in which images of communication transmission paths 12 whose traffic volume is measured by a network device 20 (agent) on which at least "specific software" is installed, regardless of whether they are within or outside the scope of responsibility, or communication transmission paths 12 whose traffic volume is supplemented by a router device 41 (central device) that also functions as a gateway, are displayed on a network diagram with the display mode changed according to the traffic volume. However, it is also possible to display images of communication transmission paths 12 only for communication transmission paths 12 within the scope of responsibility, or only for communication transmission paths 12 that are connected to a network device 20 within the scope of responsibility, or other communication transmission paths 12 that are involved with a network device 20 within the scope of responsibility, with the display mode changed based on the measured traffic volume or the supplemented traffic volume.

[0136] In the embodiment described above, an example of network equipment 20 was shown, but network equipment 20 can be any device capable of communication, and various devices such as UTM (Unified Threat Management), NVR (Network Video Recorder), and DVR (Digital Video Recorder) are included.

[0137] In the above-described embodiment, the corresponding software and the specific software described above provide fixed values ​​for the traffic volume thresholds that cause different display patterns of the image on the communication transmission path 12. However, the first, second, and third thresholds may be configurable.

[0138] In the above embodiment, a case was described in which the display mode of the image of the communication transmission path 12 in the network diagram is changed in three stages according to the amount of traffic. However, there may be any number of stages as long as there are multiple stages. In addition, the display mode of the image of the communication transmission path 12 may be controlled to change smoothly according to the amount of traffic as seen by the person viewing the network diagram.

[0139] In the above embodiment, for each communication transmission path 12, a total traffic amount Ltotal(a,p,k) is calculated at predetermined intervals by adding the uplink transmission traffic amount Lup(a,p,k) and the downlink reception traffic amount Ldown(a,p,k). In the network diagram, the display mode of the image of the communication transmission path 12 is changed in stages according to the total traffic amount Ltotal(a,p,k). Alternatively, in the network diagram, the images of each communication transmission path 12 may be displayed separately for the uplink (transmission direction) and downlink (reception direction). At predetermined intervals, the display mode of the image of the uplink communication transmission path 12 may be changed in stages according to the transmission traffic amount Lup(a,p,k), and the display mode of the image of the downlink communication transmission path 12 may be changed in stages according to the reception traffic amount Ldown(a,p,k). This allows administrators viewing the network diagram to understand the traffic status of the communication transmission path 12 in both the upstream and downstream directions. The display format used for the image of the upstream (transmission) communication transmission path 12 may differ from the display format used for the image of the downstream (reception) communication transmission path 12. This makes it clear whether the image of the communication transmission path 12 is an upstream or downstream image. Alternatively, the same display format may be assigned to the same traffic volume for both the upstream (transmission) and downstream (reception) communication transmission path 12 images. This prevents the display format from becoming overly complex and difficult to understand. Furthermore, in the network diagram, the display format of the communication transmission path 12 image may be gradually changed according to the traffic volume in either the upstream (transmission) or downstream (reception) direction. This allows administrators who view the network diagram to understand the traffic status in either the uplink (transmission direction) or downlink (reception direction) of the communication transmission path 12.Furthermore, in the network diagram, the display mode of the image of the communication transmission path 12 may be manually or automatically switched between different modes depending on the total traffic volume Ltotal(a,p,k), the uplink transmission traffic volume Lup(a,p,k), and the downlink reception traffic volume Ldown(a,p,k). [Explanation of symbols]

[0140] 1: Display System 4: User System 8:Display device 12: Communication transmission path 12R: Image 12S: Image 12T: Image 12U: 1st display mode 12V: 2nd display mode 12W: 3rd display mode 12X: Image 12Y: Image 12Z: Image 20: Network equipment 21A: Router device 22A: Hub 22B: Personal computer 22C: Personal computer 22D: PC 23A: Server 24A: Hub 24B: Multifunction device 24C: PC 24D: PC 24E: PC 24F: Access Point 26A: Camera System 28A: Business phone 28B: Business phone 29A: Tablet 29B: Tablet 29C: Smartphone 31A: Transmission line 32A: Transmission line 32B: Transmission line 34A: Transmission line 34B: Transmission line 36A: Transmission line 38A: Transmission line 41: Router device 41A: Control device 41B: Storage device 41E: Communication equipment 41Z: Image 42: Hub 42Z: Image 43: Hub 43Z: Image 44: Desktop PC 44A: Control device 44B: Storage device 44C: Operating device 44D:Display device 44E: Communication equipment 44Z: Image 45: Desktop PC 45Z: Image 46:Multifunction device 46Z: Image 47: Desktop PC 47W: Icon image 48: Laptop 49: Laptop 51: Transmission line 52: Transmission line 53: Transmission line 54: Transmission line 55: Transmission line 56: Transmission line 57: Transmission line 58: Transmission line 60: Management System 61: Computer 62: Storage device 63: Operating device 64:Display device 65: Communication equipment 66: Control device 80: Agent System 81: Computer 82: Storage device 83: Operating device 84:Display device 85: Communication equipment 86: Control device 90: Internet communication network 90A: Internet communication network 90B: Internet communication network

Claims

1. A display method for displaying a network diagram that visualizes a user system including a communication transmission path, which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a manner that enables communication, A first step of installing specific software on at least some of the network devices included in the user system, A second step involves displaying a network diagram, which visualizes the network devices included in the user system, on a display unit using a display control unit. A third step involves a network device on which the aforementioned specific software is installed detecting other network devices that have communicated with it as communication destination devices. A fourth step in which a network device on which the aforementioned specific software is installed measures the amount of traffic between itself and the communication destination device detected in the third step at predetermined intervals, A fifth step involves the display control unit causing the network diagram displayed on the display unit in the second step to display an image showing the communication transmission path between the network device and the communication destination device, the amount of traffic measured in the fourth step, such that the display mode differs according to the measured amount of traffic. How to display a network diagram including this information.

2. The aforementioned fourth step is, A sixth step involves a network device on which the aforementioned specific software is installed acquiring the total amount of traffic transmitted and received by the device at predetermined intervals. The network device, which acquires the total amount of traffic transmitted and received by itself in the sixth step at the predetermined period, performs a seventh step in which it acquires the amount of short-window traffic between itself and the communication destination device multiple times in a short-window section set to a time shorter than the predetermined period, The network device, which acquires the total traffic amount transmitted and received by itself in the sixth step at predetermined intervals, estimates the ratio of traffic amounts between itself and the communication destination device in the predetermined interval based on the short-window traffic amount acquired in the seventh step, and calculates the traffic amount between itself and the communication destination device in the predetermined interval from the total traffic amount and the ratio in the eighth step. A method for displaying a network diagram according to claim 1, including the following:

3. In the fifth step, the display control unit displays an image showing the communication transmission path between the network device and the communication destination device, whose traffic volume was measured in the fourth step, on the network diagram displayed on the display unit in the second step, such that the display mode differs in stages according to the measured traffic volume. A method for displaying a network diagram according to claim 1.

4. In the fifth step, the display control unit displays an image showing the communication transmission path between the network device and the communication destination device, for which the traffic amount measured in the fourth step was measured, on the network diagram displayed on the display unit in the second step, in a first display mode when the traffic amount is less than or equal to the first threshold, in a second display mode when it exceeds the first threshold but is less than or equal to the second threshold, and in a third display mode when it exceeds the second threshold. A method for displaying a network diagram according to claim 3.

5. In the fourth step, even if the specific software is not installed on the communication destination device detected in the third step, a network device on which the specific software is installed can measure the amount of traffic between itself and the communication destination device at predetermined intervals. A method for displaying a network diagram according to claim 1.

6. In the second step, after the first step, the network diagram of the user system is displayed on the display unit by the display control unit, with the following configuration: the boundary of responsibility is clearly defined so that at least the network devices on which the specific software is installed among the network devices included in the user system are within the scope of responsibility; and a diagram is drawn using an image showing the communication transmission path and icon images showing the network devices; and the display state of the icon images of the network devices within the scope of responsibility is distinguished from the display state of the icon images of the network devices outside the scope of responsibility. A method for displaying a network diagram according to claim 1.

7. The process includes an anomaly detection step in which an anomaly detection unit detects whether at least one of one or more predetermined anomaly types has occurred in any of the network devices included in the aforementioned scope of responsibility. In the second step, the display state of the icon image of the network device for which the abnormality detection unit detected an abnormality in the abnormality detection step is made different from the display state of the icon image of the network device for which the abnormality detection unit did not detect an abnormality in the abnormality detection step, and the display control unit displays the network diagram on the display unit. In the fifth step, if the amount of traffic measured in the fourth step exceeds the third threshold for the communication transmission path connected to the network device for which the anomaly detection unit detected an anomaly in the anomaly detection step, the display control unit displays an image of the communication transmission path on the network diagram displayed on the display unit in the second step, in a specific display mode different from the display mode of the image of the communication transmission path connected to the network device for which the anomaly detection unit did not detect an anomaly in the anomaly detection step. The method for displaying a network diagram according to claim 6.

8. The user system includes a router device that relays communications within the user system and also acts as a gateway for relaying communications with external communication networks. The router device has the aforementioned specific software or corresponding software installed. A ninth step in which the router device measures the amount of traffic passing through it, thereby supplementing the measurement results from the fourth step. A method for displaying a network diagram according to claim 1, including the following:

9. The user system is configured to be connectable to multiple communication lines for communicating with an external network, and includes a line switching unit that switches to one communication line from among the multiple communication lines to be used. Step 10: The display control unit causes the display control unit to display, in chronological order, the changes in the traffic state of the communication transmission path before and after the switching of the communication line by the line switching unit, as changes in the display mode of the image showing the communication transmission path, on the network diagram displayed on the display unit in step 2. A method for displaying a network diagram according to claim 1, including the following:

10. In the fourth step, the network device on which the specific software is installed reads network statistics information provided by its own operating system to obtain the amount of traffic between itself and the communication destination device detected in the third step at predetermined intervals, and does not perform queries based on SNMP (Simple Network Management Protocol). A method for displaying a network diagram according to claim 1.

11. In the fourth step, the traffic volume is measured separately in the transmission direction and the reception direction. In the fifth step, the display mode of the image showing the communication transmission path is changed depending on whether the transmission direction or reception direction is distinguished, or depending on the amount of traffic in either the transmission direction or reception direction. A method for displaying a network diagram according to claim 1.

12. A display system that displays a network diagram visualizing a user system including a communication transmission path, which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, Specific software is installed on at least some of the network devices included in the user system. Network devices on which the aforementioned specific software is installed, A detection unit that detects other network devices that have communicated with the device as communication destination devices, The system includes a measuring unit that measures the amount of traffic between the device and the communication destination device detected by the detection unit at predetermined intervals, The aforementioned display system is The system includes a display control unit that displays a network diagram visualizing the network devices included in the user system on the display unit, and controls the display of an image showing the communication transmission path between the network device and the communication destination device, where the traffic volume has been measured by the measurement unit of the network device on which the specific software is installed, on the network diagram displayed on the display unit, with the display mode varying according to the measured traffic volume. A system for displaying network diagrams.

13. A program for displaying a network diagram that visualizes a user system including a communication transmission path, which is a path for transmitting information by wired or wireless communication, and a plurality of network devices that are connected to the communication transmission path in a communicative manner, At least some of the network devices included in the user system have specific software installed, which includes at least a part of the program. A first display step involves the display control unit displaying a network diagram that visualizes the network devices included in the user system on a display unit, A detection step in which the network device on which the aforementioned specific software is installed is made to detect other network devices that have communicated with itself as communication destination devices, A measurement step in which a network device on which the aforementioned specific software is installed measures the amount of traffic between itself and the communication destination device detected in the detection step at predetermined intervals, A second display step involves the display control unit causing the network diagram displayed on the display unit in the first display step to display an image showing the communication transmission path between the network device and the communication destination device, the amount of traffic measured in the measurement step, such that the display mode differs according to the measured amount of traffic. A program that includes this.

Images