Stream monitoring method, relay device, network system, stream monitoring program, and monitoring terminal

Abstract

The stream monitoring method (11) monitors frames identified by streams. The frame monitoring unit (106) monitors each of a plurality of stream groups at a monitoring time period using the received frame count storage unit (105), and determines whether the number of received frames received during the monitoring time is normal or abnormal based on the number of received frames received during the monitoring time and an expected value. The received frame count storage unit (105) stores the number of received frames for each single or multiple stream groups, each of which has a single or multiple streams. The frame monitoring unit (106) corrects the lower limit and upper limit of the expected value based on the past history of the number of received frames received during the monitoring time.

Description

[Technical field]

[0001] The present disclosure relates to a stream monitoring system, a relay device, a network system, a stream monitoring method, a stream monitoring program, and a monitoring terminal. [Background technology]

[0002] In a CAN or Ethernet network, there is a monitoring method that periodically monitors frames transmitted from each terminal to detect terminal failures or the intrusion of unauthorized frames. CAN is an abbreviation for Controller Area Network.

[0003] For example, Patent Document 1 discloses a communication monitoring method for determining anomalies in CAN frames without using time information. In Patent Document 1, CAN frames with the same transmission cycle are grouped into one group. Then, for each group, if one CAN frame is received within a determination period, it is determined to be normal, otherwise it is determined to be abnormal. Here, the determination period is, for example, a period during which three receptions are performed if three types of CAN frames A, B, and C belong to a certain group. [Prior art documents] [Patent documents]

[0004] [Patent Document 1] JP 2020-102771 A Summary of the Invention [Problem to be solved by the invention]

[0005] In conventional technology, multiple types of streams are grouped into one group, streams are identified within that group, and communication anomalies are detected for each stream. A stream is a series of frames transmitted from a source node to a destination node, and is identified by parameters such as the L2 header, L3 header, forwarding path, and transmission cycle. Hereafter, the frame identifier equivalent to the CAN ID handled in a CAN network will be generalized as a "stream." ID is an abbreviation of IDentifier.

[0006] In the conventional technology, each stream is identified and the communication volume of each stream is periodically monitored, so there is a problem that the processing load on the processor increases in proportion to the increase in the number of streams.

[0007] An object of the present disclosure is to realize communication monitoring on a group basis with the same level of accuracy as communication monitoring on a stream basis, and to perform communication monitoring with a reduced processing load on a processor. [Means for solving the problem]

[0008] The present disclosure provides a stream monitoring method for monitoring frames identified by a stream, comprising: a frame identification unit that identifies a received frame for each of a single or multiple stream groups, each of which includes a single or multiple streams; The system includes a frame monitoring unit that monitors each stream group of the single or multiple stream groups at a monitoring time period using a frame reception count memory unit that stores the number of received frames for each stream group of the single or multiple stream groups, and determines whether the number of received frames received during the monitoring time is normal or abnormal based on the number of received frames received during the monitoring time and an expected value, and corrects a lower limit and an upper limit of the expected value based on a past history of the number of received frames received during the monitoring time. Effect of the Invention

[0009] The stream monitoring method according to the present disclosure enables communication monitoring in units of stream groups in which a single or multiple streams are aggregated. Compared to monitoring in units of streams, the stream monitoring method according to the present disclosure can reduce the memory amount, the processing load of the processor, or the scale of the calculation circuit. In addition, by constructing a network system including multiple relay devices equipped with the stream monitoring method according to the present disclosure, abnormalities in each stream group of the multiple relay devices are collected. This makes it easier to identify the location of an abnormality in the network system or narrow down the range of the abnormality. [Brief description of the drawings]

[0010] [Figure 1] FIG. 2 is a diagram showing an example of a functional configuration of a relay device according to the first embodiment. [Diagram 2] FIG. 2 is a diagram showing an example of a hardware configuration of a relay device according to the first embodiment. [Diagram 3] FIG. 4 is a flowchart showing an example of the operation of the relay device according to the first embodiment. [Figure 4] FIG. 4 is a diagram showing an example of grouping rules according to the first embodiment. [Diagram 5] 5 is a diagram for explaining a procedure for correcting an expected value of the number of received frames within a current monitoring time from the number of received frames within a past monitoring time in the first embodiment. [Figure 6] FIG. 4 is a diagram for explaining a method for appropriately calculating a monitoring time in the first embodiment. [Figure 7] FIG. 13 is a diagram showing an example of the configuration of a network system according to a second embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0011] Hereinafter, the present embodiment will be described with reference to the drawings. In each drawing, the same or corresponding parts are given the same reference numerals. In the description of the embodiment, the description of the same or corresponding parts will be omitted or simplified as appropriate. The arrows in the drawing mainly indicate the flow of data or the flow of processing. In addition, the relationship of the size of each component in the following drawings may differ from the actual one. In addition, in the description of the embodiment, directions or positions such as up, down, left, right, front, back, front, and back may be indicated. These notations are for convenience of explanation and do not limit the arrangement, direction, or orientation of devices, instruments, parts, etc.

[0012] Embodiment 1 ***Configuration Description*** FIG. 1 is a diagram illustrating an example of a functional configuration of a relay device 10 according to the present embodiment. The relay device 10 is a node that relays frames. The relay device 10 is provided with a stream monitoring system 11 that monitors the frames that it receives. A stream is a series of frames transmitted from a source node to a destination node, and has parameters such as the L2 header, L3 and higher headers, payload information, transmission path, transmission period, frame length, burst size, priority, allowable transmission delay, and transmission delay fluctuation time. In this embodiment, an Ethernet network is assumed. For example, in a CAN network, a data area is provided in a frame to store CAN ID information. Therefore, it is possible to identify a frame by reading the CAN ID information. However, an Ethernet frame does not have such an identifier data area. Therefore, when the relay device 10 receives a frame, it identifies the stream to which the frame belongs based on the frame's L2 header, L3 and higher headers, payload information, transfer path, transmission cycle, frame length, burst size, priority, allowable transfer delay, transfer delay fluctuation time, etc.

[0013] The relay device 10 includes a port 100, a frame receiving section 101, a frame identifying section 102, a frame multiplexing / demultiplexing section 103, a frame transmitting section 104, a frame reception count storage section 105, and a frame monitoring section . The frame identification unit 102 includes an input interface 121 and a grouping rule 122 . The frame monitoring unit 106 includes an input interface 161 and an output interface 162 .

[0014] The frame receiving unit 101 checks the FCS or frame length of a frame input to the port 100. FCS is an abbreviation for Frame Check Sequence. If an ACL is set in the relay device, the frame receiving unit 101 checks whether the frame matches an entry in the ACL. ACL is an abbreviation for Access Control List. If the frame matches an entry in the ACL, the frame receiving unit 101 executes the action associated with that entry, that is, frame forwarding or discarding.

[0015] When the frame identification unit 102 receives a frame, it determines, based on the grouping rule 122, to which of a plurality of stream groups the frame belongs. A single or multiple streams are aggregated in each of the multiple stream groups, or in other words, a single or multiple streams belong to each of the multiple stream groups. The frame identification unit 102 uses the grouping rules 122 to check which of the entries in the header information of the frame associated with each stream group ID matches. For example, the rule for allocating to stream group ID=0 is MAC DA=12:34:56:78:9A:BC and VLAN ID of the VLAN tag=100. If the values ​​of the MAC DA and VLAN ID of the VLAN tag of a received frame match these values, the frame is identified as stream group ID=0. Although the L2 header has been described as an example above, the grouping rules may use information on L3 or higher headers or payloads, and are not limited to L2 headers. The grouping rules may be set by a network administrator using a console port, or may be set using the input interface 121 via the network. The grouping rules may also be included in the startup program in advance.

[0016] When the frame identification unit 102 identifies a received frame as a stream group, it counts up a counter for each stream group stored in the received frame count storage unit 105. That is, the received frame count storage unit 105 stores the number of received frames for each of a plurality of stream groups, each of which has a plurality of streams. The frame identification unit 102 then transfers the frame to the frame multiplexing / demultiplexing unit 103 .

[0017] The frame multiplexing / demultiplexing unit 103 transfers the frame to a predetermined port 100 in accordance with the frame transfer rules.

[0018] The frame transmitting unit 104 holds multiple class queues for each port 100, and after distributing the frames to the corresponding class queues according to the priority of the frames, transmits the frames based on a scheduling algorithm such as Strict Priority. Note that in this embodiment, the scheduling algorithm is not particularly limited.

[0019] The stream monitoring system 11 includes a frame monitoring unit 106 . The frame monitoring unit 106 monitors each of the multiple stream groups at a monitoring time period using the received frame count storage unit 105. The frame monitoring unit 106 determines whether the number of received frames received during the monitoring time is normal or abnormal based on the number of received frames received during the monitoring time and an expected value. For example, the frame monitoring unit 106 determines that the number of received frames received during the monitoring time is normal if it is within the expected value range, and determines that the number of received frames is abnormal if it is not within the expected value range. The frame monitoring unit 106 detects and notifies a sign of an abnormality in the stream group based on the result of judging whether the number of received frames received during the monitoring time is normal or abnormal. Alternatively, the frame monitoring unit 106 judges that an abnormality has occurred in the number of received frames in the stream group when the number of received frames in the stream group continues a certain number of times, and notifies the result. The frame monitoring unit 106 also corrects the lower limit and upper limit of the expected value based on the past history of the number of received frames received during the monitoring time.

[0020] When the frame monitoring unit 106 determines that the number of received frames received during the monitoring time is abnormal, it generates an abnormality determination result for the stream group determined to be abnormal. Then, the frame monitoring unit 106 stores the abnormality determination result in memory. Alternatively, the frame monitoring unit 106 may notify the abnormality determination result to the outside. Note that the notification to the outside may be displayed on a console via a console port. Alternatively, a frame notifying another device of the abnormality determination result may be transmitted via the frame transmitting unit 104. Alternatively, it may be realized by other methods.

[0021] Furthermore, the frame monitoring unit 106 corrects the lower and upper limits of the expected value based on the past history of the number of received frames received during the monitoring time. For example, the frame monitoring unit 106 sets the upper limit of the expected value by a method of setting the monitoring time to a value equal to or less than T-2α based on the frame transmission period T and the fluctuation α of the frame reception period. As an example of this embodiment, a case will be described in which the error caused by the clock deviation between the device performing stream monitoring and the source terminal of the stream is included in the above 2α. The error caused by the clock deviation is the error between the frame transmission period T recognized as prior information by the device performing stream monitoring and the period in which the source terminal of the stream actually transmits frames.

[0022] Specifically, the following applies: Frame monitoring unit 106 periodically reads the counter for each stream group in received frame count storage unit 105, compares it with the expected value of the number of received frames for each stream group, and judges it to be normal if it is within the range of the expected value, or abnormal if it is not. If it judges it to be abnormal, it holds the abnormality judgment result inside frame monitoring unit 106, or generates a frame for notifying the abnormality judgment result, and transmits the frame from output interface 162. The network administrator sets parameters required for stream monitoring from the frame receiving unit 101 via a console port or the network, via the input interface 161 of the frame monitoring unit 106. The parameters required for stream monitoring are, for example, parameters such as the frame transmission period of each stream and the allowable fluctuation in the reception period.

[0023] FIG. 2 is a diagram illustrating an example of a hardware configuration of the relay device 10 according to the present embodiment. As shown in FIG. 2, the relay device 10 includes a frame transmission / reception interface 201, an arithmetic circuit 202, a processor 203, and a memory 204.

[0024] 2 shows m frame transmission and reception interfaces 201, from frame transmission and reception interface 201-1 to frame transmission and reception interface 201-m. Each port 100 in FIG. 1 is configured with each frame transmission and reception interface 201 in FIG. 2. The frame transmission and reception interface 201 may include an interface having the functions of a PHY electrical interface and an SFP optical interface. The frame transmission and reception interface 201 may also include an RJ45 connector or an M12 connector.

[0025] The arithmetic circuit 202 is realized by an ASIC or FPGA circuit. ASIC is an abbreviation for Application Specific Integrated Circuit. FPGA is an abbreviation for Field Programmable Gate Array.

[0026] The processor 203 is a CPU, a system LSI, etc. CPU is an abbreviation for Central Processing Unit. LSI is an abbreviation for Large Scale Integration.

[0027] The memory 204 is a RAM, a ROM, a CAM, a tCAM, etc. RAM is an abbreviation for Random Access Memory. ROM is an abbreviation for Read Only Memory. CAM is an abbreviation for Content Addressable Memory. tCAM is an abbreviation for Ternary CAM.

[0028] The frame receiving section 101, the frame multiplexing / demultiplexing section 103, and the frame transmitting section 104 in FIG. The frame identification unit 102 is realized by an arithmetic circuit 202 , a processor 203 , and a memory 204 . The received frame count storage unit 105 is realized by the memory 204 .

[0029] The frame monitoring unit 106 is realized by an arithmetic circuit 202 , a processor 203 and a memory 204 . A stream monitoring program that realizes the functions of the frame monitoring unit 106 is read into the arithmetic circuit 202 or the processor 203 and executed by the arithmetic circuit 202 or the processor 203 . The "part" of frame identification unit 102 and frame monitoring unit 106 may be interpreted as a "circuit," "step," "procedure," "processing," or "circuitry." The stream monitoring program causes a computer to execute a stream monitoring process. The "processing" of the stream monitoring process may be interpreted as a "program," "program product," "computer-readable storage medium storing a program," or "computer-readable recording medium recording a program." In addition, the stream monitoring method is a method performed by relay device 10 executing the stream monitoring program. The stream monitoring program may be provided in a state stored in a computer-readable recording medium, or may be provided as a program product.

[0030] The processor 203, the arithmetic circuit 202, and the memory 204 are also called processing circuitry. In other words, the functions of the relay device 10 in Fig. 1 are realized by the processing circuitry. Note that the processor 203 and the arithmetic circuit 202 may be called processing circuitry, and the functions of the relay device 10 in Fig. 1 may be realized by the processing circuitry and the memory 204.

[0031] ***Explanation of Operation*** Next, a description will be given of the operation of the relay device 10 according to the present embodiment. The operation procedure of the relay device 10 corresponds to a stream monitoring method.

[0032] FIG. 3 is a flow diagram showing an example of the operation of the relay device 10 according to the present embodiment. A procedure for periodically monitoring a stream group in the relay device 10 will be described with reference to Fig. 3. In the following, the stream group to be subject to periodic monitoring is designated as stream group #x.

[0033] In step S101, the streams to be allocated to each stream group are determined. The grouping rules 122 determine which streams are allocated to each stream group.

[0034] FIG. 4 is a diagram showing an example of the grouping rule 122 according to the present embodiment. In the grouping rule 122 in Fig. 4, a stream ID for identifying a stream, a transmission period of frames in the stream, header information, and a stream group ID to which the stream is to be allocated are set. Examples of the header information include MAC DA, MAC SA, Ethertype, and VLAN ID. Note that the grouping rule 122 is not limited to this, and the stream identification may include information on L3 or higher headers, payloads, and receiving ports. In this stream monitoring method, the transmission periods of streams allocated to each stream group must be the same, and the grouping rule 122 must satisfy this condition. In addition to the information on the transmission period, a criterion may be set for allocating streams having the same or similar allowable delay, delay fluctuation time, etc., to the same stream group. Frame identification unit 102 determines to which stream group frames in each stream should be allocated by referring to grouping rules 122. Specifically, frame identification unit 102 identifies, as one stream group, a single stream or multiple streams whose transmission periods are the same or whose transmission period difference is within 2α when the fluctuation in the frame reception period is α.

[0035] In step S102, the frame monitoring unit 106 calculates the monitoring time of the stream group #x and the expected value of the number of received frames within the monitoring time. A specific calculation method will be described later.

[0036] In step S103, the frame monitoring unit 106 starts monitoring the stream group #x. In step S104, the frame monitoring unit 106 determines whether the monitoring time has elapsed since the start of monitoring the stream group #x. When the monitoring time has elapsed since the start of monitoring of stream group #x, the process proceeds to step S106. If the monitoring time has not elapsed since the start of monitoring of stream group #x, step S104 is repeated until the monitoring time has elapsed.

[0037] In step S106, frame monitoring unit 106 reads the number of received frames of stream group #x within the monitoring time. In step S107, the frame monitoring unit 106 determines whether a certain period of time has elapsed since starting monitoring of the stream group #x. If a certain amount of time has passed since the start of monitoring of stream group #x, the process proceeds to step S108. If the certain time has not elapsed since the start of monitoring of stream group #x, the process proceeds to step S105.

[0038] In step S105, the frame monitoring unit 106 determines whether or not a monitoring time has elapsed since the previous reading of the number of received frames. When the monitoring time has elapsed since the previous read of the number of received frames, the process proceeds to step S106. If the monitoring time has not elapsed since the previous read of the number of received frames, step S105 is repeated until the monitoring time has elapsed. That is, frame monitoring unit 106 repeatedly reads the number of received frames of stream group #x within the monitoring time after the previous reading of the number of received frames, until a certain time has elapsed since starting monitoring of stream group #x. Here, the fixed time is the time required for the history of the number of frames received within each monitoring period to be accumulated.

[0039] In step S108, the frame monitoring unit 106 determines whether the number of received frames within the monitoring time is within the expected value range. If the number of received frames within the monitoring time is within the expected range (YES in step S108), the process proceeds to step S109, where frame monitoring unit 106 determines that stream group #x is normal during that monitoring time. Then, in step S110, the frame monitoring unit 106 corrects the expected number of received frames within the next and subsequent monitoring times based on the past history of the number of received frames within the monitoring time, After that, the frame monitoring unit 106 returns to step S105.

[0040] If the number of received frames within the monitoring time is not within the expected range (NO in step S108), the process proceeds to step S111, where the frame monitoring unit 106 determines that the stream group #x is abnormal during that monitoring time. Then, in step S112, frame monitoring unit 106 generates an abnormality notification frame for notifying of the abnormality, and transmits the abnormality notification frame from output interface 162. Alternatively, frame monitoring unit 106 may internally hold the abnormality determination result for stream group #x as a log. The notification of the abnormality determination result and the retention of the log may be performed every time an abnormality is detected in each stream group. Alternatively, the abnormality notification may be performed on the condition that an abnormality is detected a certain number of times or more within a certain period in each stream group. As described above, the criteria for determining that an abnormality or failure has occurred in the network system from the detection of an abnormality in a stream are not particularly limited. After that, the frame monitoring unit 106 returns to step S103 and restarts monitoring of the stream group #x in order to reset the past history of the number of frames received within each monitoring time period up to this point.

[0041] FIG. 5 is a diagram for explaining a procedure for correcting an expected value of the number of received frames within a current monitoring time from the number of received frames within a past monitoring time in this embodiment.

[0042] In Fig. 5, stream #0 and stream #1, which have the same transmission cycle, are assigned to stream group #0. Note that although the stream parameters are transmission cycles, they become reception cycles for frame monitoring unit 106. Fig. 5 shows the frame reception timing along the time axis of each stream, and the number of received frames in stream group #0 within each monitoring time.

[0043] FIG. 5 shows an example in which the monitoring time is set shorter than the stream transmission cycle so that both streams #0 and #1 are received in the pattern of "1 → 1 → 1 → 0 → (and repeat)" for each monitoring time. Here, attention is paid to monitoring time #k. At monitoring time #k, the number of received frames in stream group #0 is "1", and it is determined that the number of received frames in either one of the streams is "0", and that the number of received frames in either one of the streams is "1" in the following three monitoring times. The following three monitoring times are #k+1, #k+2, and #k+3. In other words, the number of received frames in stream group #0 is at least "1" in the following three monitoring times (#k+1, #k+2, #k+3), and the lower limit of the expected number of received frames in stream group #0 can be set to "1".

[0044] If the history of the number of past received frames is not referenced, the expected number of received frames for each stream will be "0 or 1", and in the example of Figure 5 where two streams are aggregated, the expected number of received frames for stream group #0 will be "0, 1, or 2". Therefore, the lower limit is "0". By referencing the history of the number of past received frames as described above, the range of the expected value can be narrowed and corrected.

[0045] The above is an example of correcting the lower limit, but it is also possible to correct the upper limit by utilizing the fact that the number of received frames becomes 0 only once per cycle of the stream reception pattern. As mentioned above, in Figure 5, the number of received frames becomes "0" once every four monitoring times of "1→1→1→0". The upper limit may be corrected in this way. In addition, the upper limit can be corrected using the same procedure as above by setting the monitoring time longer than the stream period so that the pattern of the number of received frames of the stream is basically "0", such as "0→0→0→1".

[0046] FIG. 6 is a diagram for explaining a method for appropriately calculating the monitoring time in this embodiment. By using the transmission period T of the streams to be assigned to the stream group and the fluctuation α of the reception period of the streams to be assigned to the stream group, and setting the monitoring time to "T-2α" or a time less than this, it is possible to achieve a certain number of consecutive monitoring periods during which the number of received frames is always "1". FIG. 6 shows an example in which the number of received frames is determined by consecutive monitoring times as a result of setting the monitoring time to "T-2α". In FIG. 6, the monitoring time is 10 ms because the transmission period T is 12 ms and the fluctuation α of the receiving period is 1 ms. Although a time shorter than "T-2α" can be set, it is desirable to set the monitoring time to "T-2α" because a short monitoring time has the disadvantage of increasing the processing load of the processor. In addition, a time longer than "T-2α" can be set, but since the number of received frames determined by a certain number of consecutive monitoring times is "2 or more" instead of "1", it is necessary to consider that the reception pattern of the stream ("1→1→1→0" in FIG. 5) is different from the case in which the monitoring time is "T-2α". Note that it is assumed that the frame identification unit 102 receives frames in each of the 2α time periods in FIG. 6 when the stream is normal. In FIG. 6, the monitoring time appears six times (60 ms÷10 ms=6) within 60 ms, which is the least common multiple time of the monitoring time and T. Identifiers #k to #k+5 are set for each monitoring time. In FIG. 6, the width 2α of the frame reception fluctuation of monitoring time #k and monitoring time #k+5 is located at the boundary of the monitoring time, and it is not certain whether the number of received frames will be 0 or 1. On the other hand, in the four monitoring times of monitoring times #k+1 to #k+4, the width 2α of the frame reception fluctuation is within each monitoring time, so it is certain that the number of received frames will be 1. The start time of monitoring time #k is set as the reference time, and the reception time of the first frame received after the reference time is set as the offset. In this case, when the above three parameters (monitoring time, transmission cycle T, and fluctuation α of the reception cycle) are determined, the fixed number of consecutive monitoring times (four times in FIG. 6) at which the number of received frames is always "1" does not depend on the offset.

[0047] In addition, when the frame lengths of streams to be allocated to a certain stream group are different, by monitoring the number of bytes of the received frames at the same monitoring time period in addition to monitoring the number of received frames for each stream group as described above, it is possible to identify a stream in a stream group in which an abnormality has occurred. For example, in FIG. 5, if the frame lengths of streams with stream IDs=0 and 1 are 100 bytes and 200 bytes, respectively, the number of received bytes at monitoring time #k is 100 bytes. As shown in FIG. 5, the number of received frames at monitoring time #k is 1, so the stream that was not received at monitoring time #k can be determined to be stream #1. Here, if the number of received frames of stream group #0 at monitoring time #k+1 is 0, as described above, if stream #1 is normal, the number of received frames will always be "1" at monitoring times #k+1 to #k+3, so it can be determined that an abnormality has occurred in stream #1. When a stream in which an abnormality has occurred is identified as described above, the ID of the stream group determined to be abnormal and the ID of the stream are combined and the abnormality determination result is retained or notified. As described above, the frame monitoring unit 106 monitors the number of received frames for each stream group at the monitoring time period, and also monitors the number of bytes of the received frames at the same monitoring time period. Alternatively, when the frame monitoring unit 106 determines that the number of received frames received during the monitoring time is abnormal, it checks the number of bytes of the received frames during the monitoring time.

[0048] ***Explanation of the Effects of the Present Embodiment*** As described above, the relay device according to the present embodiment has a stream monitoring method that monitors a stream group in which a single or multiple streams are aggregated at a fixed monitoring time period, and determines that the number of received frames during the monitoring time is within the range of the expected value, and that the number of received frames during the monitoring time is normal, and that the number of received frames during a fixed number of monitoring times thereafter is abnormal, based on the history of the number of received frames during past monitoring times. Thus, the relay device according to the present embodiment enables communication monitoring on a stream group basis in which a single or multiple streams are aggregated, and can reduce the processing load on the processor compared to monitoring on a stream basis. In addition, the relay device according to the present embodiment corrects the lower and upper limits of the expected value based on the history of the number of received frames during past monitoring times. Therefore, the relay device according to the present embodiment can reduce the processing load of the processor by monitoring communication on a group basis while maintaining the same level of accuracy as that of communication monitoring on a stream basis without reducing the accuracy of anomaly detection.

[0049] In the above first embodiment, each unit of the relay device has been described as an independent functional block. However, the configuration of the relay device is only an example, and the configuration may not be as in the above-described embodiment. The functional blocks of the relay device may have any configuration as long as they can realize the functions described in the above-described embodiment. In addition, a plurality of parts of the first embodiment may be combined and implemented. Alternatively, only one part of this embodiment may be implemented. In addition, this embodiment may be combined in any manner as a whole or in part and implemented. That is, in the first embodiment, it is possible to freely combine parts of the embodiments, or to modify any of the components of the embodiments, or to omit any of the components of the embodiments.

[0050] Embodiment 2 In this embodiment, differences from and additions to the first embodiment will be mainly described. In this embodiment, components having the same functions as those in the first embodiment are given the same reference numerals, and the description thereof will be omitted.

[0051] In this embodiment, a network system 500 including a plurality of relay devices 10 described in embodiment 1 will be described. In the network system 500, a stream monitoring result 61 is shared between the relay devices 10, or a monitoring terminal connected to the network aggregates the stream monitoring results 61 transmitted by the relay devices 10, thereby identifying the location of a stream abnormality. In this embodiment, the frame monitoring unit 106 generates a determination result of whether the number of received frames is normal or abnormal as a stream monitoring result 61 for each stream group. Then, the frame monitoring unit 106 transmits the stream monitoring result 61 to at least one relay device among the multiple relay devices. That is, the stream monitoring results 61 for each stream group are aggregated in one relay device.

[0052] FIG. 7 is a diagram showing an example of a configuration of a network system 500 according to the present embodiment. The network system 500 includes a plurality of relay devices 10. In the example of Fig. 7, the network system 500 includes relay devices #1, #2, and #3. The configuration of each relay device is the same as that explained in the first embodiment.

[0053] FIG. 7 shows an example in which relay device #1 collects stream monitoring results 61 from relay device #2 and relay device #3. The stream monitoring result 61 may be notified to other relay devices only when there is an abnormality, or may be notified regardless of whether there is a normal or abnormality, or may be notified when there is a change from normal to abnormal or when there is a change from abnormal to normal. 7, in the stream monitoring result 61 of relay device #1 itself, stream #1 is set as abnormal and stream #2 is set as normal. In addition, in the stream monitoring result 61 of relay device #2, stream #1 is set as normal. In the stream monitoring result 61 of relay device #3, stream #2 is set as normal. Relay device #1 collects these three stream monitoring results 61.

[0054] Relay device #1 can determine that stream #1 was normal up to frame identification unit 102 of relay device #2, but that an abnormality has occurred in stream #1 in the section from frame multiplexing / demultiplexing unit 103 of relay device #2 to frame identification unit 102 of relay device #1 itself. This determination result may be held within relay device #1, or may be notified to the outside from output interface 162 of frame monitoring unit 106. Note that stream monitoring result notification frames from other relay devices are transferred from frame multiplexing / demultiplexing unit 103 to frame monitoring unit 106. Note that the aggregation of stream monitoring results and the identification of the location of the stream abnormality described above may be performed by each relay device as described above, or may be performed by another monitoring terminal connected to the network.

[0055] After identifying the location of the stream abnormality, the relay device may change the transfer path of the stream that includes the occurrence location to a transfer path that bypasses the occurrence location. The relay device may change the transfer process settings of each stream of the relay device in order to change the transfer path to a path that bypasses the occurrence location. Alternatively, the relay device may limit the bandwidth of the stream determined to be abnormal. Furthermore, the relay device may change the transfer process settings of each stream of the relay device in order to discard the stream determined to be abnormal. Furthermore, the above-mentioned response process to the occurrence of a stream abnormality may be performed individually by each relay device, or may be performed by determining the response process at another monitoring terminal, notifying the relay device of the determined content, and changing the settings of the relay device.

[0056] ***Explanation of the Effects of the Present Embodiment*** As described above, the network system according to this embodiment can identify the location of a stream abnormality in addition to the effect of embodiment 1. Also, based on the information on the location of the stream abnormality, it can control each relay device required for the operation of the network system to change the transfer route of a stream that includes the location of the stream abnormality to a transfer route that bypasses the location of the stream abnormality, limit the bandwidth of a stream determined to be abnormal, or discard a stream determined to be abnormal.

[0057] The above-mentioned first and second embodiments are essentially preferred examples, and are not intended to limit the scope of the present disclosure, the scope of the application of the present disclosure, and the scope of use of the present disclosure. The above-mentioned embodiments can be modified in various ways as necessary. For example, the procedures described using flow charts or sequence charts may be modified as appropriate. [Explanation of symbols]

[0058] 10 relay device, 11 stream monitoring method, 60 abnormality notification, 61 stream monitoring result, 100 port, 101 frame receiving unit, 102 frame identification unit, 103 frame multiplexing / demultiplexing unit, 104 frame transmitting unit, 105 frame reception count storage unit, 106 frame monitoring unit, 121, 161 input interface, 122 grouping rule, 162 output interface, 201 frame transmitting / receiving interface, 202 arithmetic circuit, 203 processor, 204 memory, 500 network system.

Claims

[

1. ] A frame identification unit that identifies a received frame and determines to which stream group it is assigned, using a frame reception count storage unit that stores the number of received frames for each single or multiple stream groups, monitors each of the single or multiple stream groups at a monitoring time period calculated based on the variation in the transmission period of the frames assigned to that stream group and the reception period of the frames, determines the normality or abnormality of the number of received frames received during the monitoring time based on the number of received frames received during the monitoring time and an expected value calculated based on the transmission period of the frames and the monitoring time, and corrects the lower limit value and upper limit value of the expected value based on the past history of the number of received frames received during the monitoring time, and a frame monitoring unit A stream monitoring method comprising the same. [

2. ] The frame identification unit identifies a single stream or multiple streams with the same transmission period or a difference in transmission period within 2α when the variation in the reception period of the frames is α as one stream group, according to the stream monitoring method of claim 1. [

3. ] The frame monitoring unit determines that it is normal if the number of received frames received during the monitoring time is within the range of the expected value, and determines that it is abnormal if the number of received frames is not within the range of the expected value, according to the stream monitoring method of claim 1. [

4. ] The frame monitoring unit sets the monitoring time to a value of T - 2α or less based on the transmission period T of the frames and the variation α in the reception period of the frames, according to the stream monitoring method of claim 1. [

5. ] The frame monitoring unit in addition to monitoring the number of received frames per stream group performed at the monitoring time period, also monitors the number of bytes of the received frames at the same monitoring time period, or, when determining that the number of received frames received during the monitoring time is abnormal, checks the number of bytes of the received frames during the monitoring time, according to the stream monitoring method of claim 1. [

6. ] The frame monitoring unit generates an abnormality determination result for each stream group when determining that the number of received frames received during the monitoring time is abnormal, according to the stream monitoring method of claim 1. [

7. ] The frame monitoring unit stores the abnormality determination result in a memory, according to the stream monitoring method of claim 6. [

8. ] The stream monitoring method according to claim 6, wherein the frame monitoring unit notifies the abnormal determination result to the outside.

9. In a relay device that relays frames identified by a stream, a frame reception number storage unit that stores the number of received frames for each of one or more stream groups to which one or more streams belong; the stream monitoring method according to any one of claims 1 to 8; A relay device comprising:

10. In a network system including a plurality of relay devices that relay frames identified by a stream, each of the plurality of relay devices, a frame reception number storage unit that stores the number of received frames for each of one or more stream groups to which one or more streams belong; the stream monitoring method according to any one of claims 1 to 8; A network system comprising:

11. The frame monitoring unit, generates a normal or abnormal determination result of the number of received frames as a stream monitoring result for each stream group, and transmits the stream monitoring result to at least one of the plurality of relay devices or a monitoring terminal that aggregates the stream monitoring results of each relay device. The network system according to claim 10.

12. In a stream monitoring program used for a relay device that relays frames identified by a stream, a frame identification process for identifying received frames for each of one or more stream groups to which one or more streams belong; using a frame reception number storage unit that stores the number of received frames for each of the one or more stream groups, each of the one or more stream groups is monitored at a cycle of a monitoring time, and based on the number of received frames received during the monitoring time and an expected value, determines the normality or abnormality of the number of received frames received during the monitoring time, and corrects the lower limit value and the upper limit value of the expected value based on the past history of the number of received frames received during the monitoring time. A frame monitoring process; A stream monitoring program for causing a computer to execute.

13. A relay device that aggregates the stream monitoring results transmitted by each of a plurality of relay devices provided with the stream monitoring method according to any one of claims 1 to 3, and identifies an abnormal occurrence location in the network.

14. A monitoring terminal that aggregates the stream monitoring results transmitted by each of a plurality of relay devices equipped with the stream monitoring method according to any one of claims 1 to 3 and identifies the location where an abnormality has occurred in the network.

Images