Conversion device

Abstract

This conversion device (100) assesses whether or not a designated object is to be outputted, said assessment being made on the basis of protocol stack information that is obtained by analyzing a packet protocol stack, and on the basis of statistical key information that is a constituent component of flow statistics information. If the designated object is to be outputted, the conversion device (100) generates statistics information by aggregating the statistical key information in accordance with one or more aggregation patterns associated with the protocol stack information and the statistical key information. The conversion device (100) outputs the generated aggregated statistics information.

Description

Converter

[0001] The present invention relates to a conversion device.

[0002] Carrier networks often use encapsulation technology to accommodate multiple operators, and efficient network operation is achieved by collecting header samples of encapsulated packets, analyzing the protocol stack, and outputting flow statistics to visualize traffic.

[0003] Specifically, for network monitoring and traffic trend analysis, a format conversion technology is known that analyzes a header sample xFlow packet of a received encapsulated packet to identify the packet and output flow statistics based on outer header information or inner header information to an existing analysis device (see, for example, Non-Patent Document 1). Another known technology analyzes the protocol stack configuration of an xFlow packet and generically extracts flow statistics from the packet based on the position and size of each element constituting the protocol stack (see, for example, Non-Patent Document 2). Other known technologies include a technology that generates flow statistics using header information of a received packet and a technology that generates flow statistics by extracting the header portion itself. Upon receiving the flow statistics generated based on the above-described conventional technology, the analysis device aggregates the flow statistics to the required granularity, such as per line or per service, depending on the application of the analysis device, such as network service monitoring or traffic trend analysis, and performs analysis.

[0004] Nishioka, et al., "Proposal of Fast xFlow Proxy for Visualizing Traffic in Carrier Networks Accommodating Multiple Operators," Institute of Electronics, Information and Communication Engineers, General Conference, March 2021, B-6-33. Furuta, et al., "Study on Generalization of Statistical Information Output in Traffic Visualization Technology," Institute of Electronics, Information and Communication Engineers, Society Conference, September 2022, B-6-18.

[0005] However, due to the increase in traffic volume on carrier networks, the number of packets containing flow statistics information is increasing year by year, and the load on the analysis device for aggregating and processing the received flow statistics information is increasing. Furthermore, since the above-mentioned flow statistics information is statistical information on a per-flow basis, it has a high degree of analytical freedom and allows for fine-grained analysis and aggregation into various units, but the large amount of data increases the load of the aggregation process.

[0006] To address the increased processing load described above, the processing load of the analyzer can be reduced by transmitting statistical information aggregated in units appropriate for the analyzer's purpose to the analyzer. However, the conventional technology described above makes it difficult to flexibly aggregate and output flow statistical information. For example, the conventional technology can output flow statistical information for each outer header or each inner header, but cannot aggregate statistical information for a combination of outer and inner header information. Furthermore, the conventional technology extracts information predefined for each protocol stack from packets, regardless of the outer or inner header, and outputs flow statistical information, but cannot aggregate flow statistical information into various units. Furthermore, the conventional technology cannot aggregate flow statistical information for a single packet into multiple units. For example, even if line-based statistical information is used for all users and finer-grained flow-based statistical information for only a specific user, the conventional technology must output large amounts of flow statistical information for all users to the analyzer, and the analyzer itself must aggregate the flow statistical information by line.

[0007] In order to solve the above-mentioned problems and achieve the object, the conversion device of the present invention is characterized by having an output target determination unit that determines whether or not a packet is to be output based on protocol stack information obtained by analyzing the protocol stack configuration of the packet and statistical key information, which is a component of flow statistical information; an aggregated statistical information generation unit that, when the output target determination unit determines that a packet is to be output, aggregates the statistical key information according to one or more aggregation patterns associated with the protocol stack information and the statistical key information to generate statistical information; and an aggregated statistical information output unit that outputs the statistical information generated by the aggregated statistical information generation unit.

[0008] The present invention has the effect of enabling flow statistical information to be flexibly aggregated and output.

[0009] FIG. 1 is a diagram illustrating a conversion device according to this embodiment. FIG. 2 is a diagram illustrating an example of the overall configuration. FIG. 3 is a diagram illustrating an example of the configuration of a conversion device according to the first embodiment. FIG. 4 is a table diagram illustrating an example of an output target list according to the first embodiment. FIG. 5 is a table diagram illustrating an example of an aggregation process list according to the first embodiment. FIG. 6 is a table diagram illustrating an example of an aggregation hash table according to the first embodiment. FIG. 7 is a table diagram illustrating an example of an output information list according to the first embodiment. FIG. 8 is a diagram illustrating an example of aggregation processing according to the first embodiment. FIG. 9 is a flowchart illustrating an example of an aggregated information generation procedure according to the first embodiment. FIG. 10 is a diagram illustrating an overall configuration according to a second embodiment. FIG. 11 is a diagram illustrating an example of the configuration of multiple conversion devices according to the second embodiment. FIG. 12 is a diagram illustrating an overall configuration according to a third embodiment. FIG. 13 is a diagram illustrating an example of the configuration of multiple conversion devices according to the third embodiment. FIG. 14 is a diagram illustrating an example of a computer that executes aggregated information generation processing according to this embodiment.

[0010] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS Hereinafter, embodiments of the present invention will be described with reference to the accompanying drawings. Note that the embodiments are not limited to the following description.

[0011] <Description of the Conversion Device> Fig. 1 is a diagram illustrating a conversion device 100 according to this embodiment. The conversion device 100 shown in Fig. 1 is an example of a computer that provides a technology for performing determination processing and aggregation processing of flow statistical information to be output based on flow statistical information of received packets, and output processing of the aggregated statistical information.

[0012] First, an example of the overall configuration including the conversion device 100 according to this embodiment will be described with reference to Fig. 2. Fig. 2 is a diagram showing an example of the overall configuration. Fig. 2 shows an example in which flow statistical information is generated using a header sample xFlow packet of an encapsulated packet transmitted from a network (NW) device of a carrier network, and the generated flow statistical information is aggregated and output to a monitoring device, an analysis device, a data lake, or the like (hereinafter, these may be simply referred to as "predetermined device").

[0013] As shown in Figure 2, the conversion device 100 receives a header sample xFlow packet (hereinafter, sometimes simply referred to as a "packet") of an encapsulated packet transmitted from a network device 20 (20A or 20B) that constitutes a carrier network ((1-1) and (1-2) in Figure 2).

[0014] The converter 100 generates flow statistics using received packets. For example, the converter 100 analyzes the protocol stack configuration of the received packets using the conventional technology described above and acquires information predefined for each protocol stack from the packets. In this way, the converter 100 uses the information acquired from the packets to generate flow statistics, which are statistical information for each flow.

[0015] Next, the conversion device 100 aggregates the generated flow statistics information to generate statistics information appropriate for a specific device as an output destination, and then outputs the generated statistics information to the specific device ((2) in FIG. 2).

[0016] 1, the flow statistics information determination process, aggregation process, and output process performed by the conversion device 100 according to this embodiment will be described. As described above, the conversion device 100 generates flow statistics information and protocol stack information using the header sample xFlow packet of the encapsulated packet received from the network device or the like ((1) in FIG. 1).

[0017] The conversion device 100 determines whether the generated flow statistical information is to be output based on the protocol stack information obtained by analyzing the protocol stack configuration of the packet and the statistical key information, which is a component of the flow statistical information. For example, the conversion device 100 determines whether the flow statistical information is to be output to a predetermined device based on whether the condition statistical key information and protocol stack information set in advance as conditions for determining whether the flow statistical information is to be output match the statistical key information and protocol stack information related to the generated flow statistical information ((2) in FIG. 1).

[0018] For each flow statistical information determined to be output, in which the protocol stack information and aggregated statistical key information match, the conversion device 100 aggregates the statistical key information corresponding to the output statistical key based on the aggregation pattern associated with the above-mentioned condition statistical key and protocol stack information, and generates aggregated statistical information ((3) in Figure 1).

[0019] The conversion device 100 converts the generated aggregated statistical information into an output format appropriate for the specified output device corresponding to the protocol stack information and aggregation pattern ((4-1) in FIG. 1). Then, the conversion device 100 outputs the aggregated statistical information such as statistical information for aggregation unit A (e.g., statistical information per line) or statistical information for aggregation unit B (e.g., per outer and inner address) to the specified output device (30A or 30B) ((4-2) in FIG. 1).

[0020] In this way, the conversion device 100 can aggregate statistical key information according to an aggregation pattern that corresponds to the conditions of the output target and generate statistical information for each aggregated unit, thereby enabling a wide variety of aggregations to be performed, such as aggregating flow statistical information determined to be output target into various units or aggregating one flow statistical information into multiple units. As a result, the conversion device 100 according to this embodiment can output statistical information that is flexibly aggregated according to the purpose and use of network monitoring and operation.

[0021] First Embodiment In the first embodiment, an example will be described in which the determination process of generated flow statistical information, the aggregation process, and the output process of the aggregated statistical information are realized by a configuration of only the conversion device 100.

[0022] (Conversion device 100) The configuration of the conversion device 100 will now be described. FIG. 3 is a diagram showing an example of the configuration of the conversion device 100 according to the first embodiment. As shown in FIG. 3, the conversion device 100 has a communication unit 110, a storage unit 120, and a control unit 130. Although not shown in FIG. 3, the conversion device 100 may also include an input unit such as a keyboard or mouse for receiving input such as operations by an administrator or the like. The conversion device 100 may also include a display unit such as a display for displaying the results of the determination process and aggregation process to an administrator or the like.

[0023] (Communication Unit 110) The communication unit 110 performs data communication to acquire packets from network devices and the like and output aggregated statistical information to a specified device. The communication unit 110 is realized by a NIC (Network Interface Card) or the like, and controls communication via electrical communication lines such as a LAN (Local Area Network) or the Internet. The communication unit 110 is connected to a network via a wired or wireless connection as necessary, and can transmit and receive information bidirectionally.

[0024] (Storage Unit 120) The storage unit 120 stores data and programs used for various processes by the control unit 130, as well as various data acquired through operation of the control unit 130. The storage unit 120 is realized by a semiconductor memory element such as a random access memory (RAM) or a flash memory, or a storage device such as a hard disk or an optical disk. As shown in FIG. 3 , the storage unit 120 includes a flow statistics information DB 121, an output target list DB 122, an aggregation processing information DB 123, and an output information list DB 124.

[0025] (Flow Statistical Information DB 121) The flow statistical information DB 121 is a database that stores flow statistical information and protocol stack information generated by a flow statistical information generating unit 131 (to be described later).

[0026] (Output target list DB122) The output target list DB122 is a database that stores an output target list used by the output target determination unit 132 (described later) to determine whether flow statistical information is to be output. Specifically, the output target list DB122 stores, as output target conditions, protocol stack information and one or more condition statistical keys, and an aggregation ID that identifies an aggregate pattern, in association with each other.

[0027] The above-mentioned protocol stack information is information for identifying a protocol stack configuration analyzed using packet header information, etc. For example, the protocol stack information may be a protocol stack configuration ID generated by the above-mentioned reference technology.

[0028] The condition statistical key information includes a statistical key (condition statistical key) and its value used to determine whether the generated flow statistical information is to be output. The aggregation ID is information that identifies the aggregation process that the aggregated statistical information generation unit 133 (described later) performs using the flow statistical information to be output.

[0029] Here, an example of the output target list stored in the output target list DB 122 will be described. Fig. 4 is a table diagram showing an example of the output target list according to the first embodiment. As shown in Fig. 4, the output target list DB 122 stores, in association with each other, protocol stack information "P1", condition statistical key information "Outer_Dst_IP=A" (none in the case of "-"), aggregation ID "1", etc.

[0030] Note that one or more aggregation IDs may be set for one set of output target conditions. For example, as shown in Fig. 4, the output target list DB 122 can store multiple aggregation IDs for one set of condition statistical key information, such as protocol stack information "P1", condition statistical key information "Outer_Dst_IP=A" and "Tunnel_id=C", and aggregation IDs "1, 2". The value of the aggregation ID here is an example and does not need to be a numeric value.

[0031] (Aggregation processing information DB123) The aggregation processing information DB123 is a database that stores an aggregation processing list used for the aggregation processing performed by the aggregated statistical information generation unit 133 described below, and an aggregation hash table that contains the aggregation results (aggregated statistical information) of the output statistical key corresponding to the combination of protocol stack information, aggregation ID, and aggregated statistical key.

[0032] Specifically, the aggregation process information DB 123 stores protocol stack information, an aggregation ID, one or more aggregated statistical keys, and one or more output statistical keys in association with each other as an aggregation process list. The aggregation process information DB 123 also stores protocol stack information, an aggregation ID, one or more aggregated statistical key information, and one or more output statistical key information in association with each other as an aggregation hash table.

[0033] The aggregated statistical key information includes a statistical key (aggregated statistical key) used to identify an aggregation unit, such as an IP address or communication identification information, etc. The output statistical key information includes a statistical key (output statistical key) to be output to a specific device, such as communication volume (octets, etc.) or number of packets.

[0034] Here, an example of an aggregation process list stored by the aggregation process information DB 123 will be described. Fig. 5 is a table diagram showing an example of an aggregation process list according to the first embodiment. As shown in Fig. 5, when the aggregation process list has protocol stack information "P1" and an aggregation ID of "1", the aggregation process information DB 123 stores, in association with each other, the aggregated statistics keys "Outer_Dst_IP", "Outer_Src_IP", "Tunnel_id", and "Session_id" as well as the output statistics keys "Octets" and "Packets".

[0035] Furthermore, when the protocol stack information is the same but the aggregation IDs are different, the aggregation process information DB 123 stores an aggregation process list including different combinations of aggregation statistics keys and output statistics keys. For example, when the aggregation process list has protocol stack information "P1" and an aggregation ID "2," the aggregation process information DB 123 associates and stores the aggregation statistics keys "Outer_Dst_IP," "Outer_Src_IP," "Tunnel_id," "Session_id," "Inner_Dst_IP," and "Inner_Src_IP" and the output statistics keys "Octets" and "Packets."

[0036] Next, an example of an aggregation hash table stored by the aggregation processing information DB 123 will be described. FIG. 6 is a table diagram showing an example of an aggregation hash table according to the first embodiment. The aggregation hash table is set for each pair of protocol stack information and aggregation ID. As shown in FIG. 6 , when the protocol stack information is "P1" and the aggregation ID is "1," the aggregation processing information DB 123 aggregates the output statistical key information for flow statistics information whose aggregated statistical key information matches the flow statistics information, and stores the aggregated statistical key information in the aggregation hash table. For example, the aggregation processing information DB 123 aggregates the values ​​of the output statistical key, Octets and Packets, for flow statistics information whose Outer_Dst_IP is "A," Outer_Src_IP is "B," Tunnel_id is "C," and Session_id is "D," and stores the values ​​in the aggregation hash table each time the aggregation is performed.

[0037] The above example means that the aggregated Octets value for flow statistics information that satisfies the above combination of aggregated statistical key information is "200" and the Packets value is "20." Note that the alphabets for each of the above aggregated statistical key information "A" to "D" are merely examples, and in reality, they may be IP addresses, numbers, text, etc. The aggregation process will be explained later in the section on an example of aggregation process.

[0038] (Output Information List DB 124) The output information list DB 124 is a database that stores an output information list in which an output format is associated with each predetermined output target device. Specifically, the output information list DB 124 stores protocol stack information, aggregation IDs, output format information, and output destination information in association with each other as the output information list.

[0039] The output format information is information relating to the format of output data used for each predetermined device, such as binary, JSON (JavaScript Object Notation), etc. The output destination information is information for identifying a predetermined device to which the aggregated statistical information output unit 134 (described later) outputs the aggregated statistical information.

[0040] Here, an example of the output information list stored in the output information list DB 124 will be described. FIG. 7 is a table diagram showing an example of the output information list according to the first embodiment. As shown in FIG. 7, the output information list DB 124 stores, as an output information list, information such as output format information "binary" and output destination information "1" in association with protocol stack information "P1" and aggregation ID "0". These values ​​are merely examples, and the output destination information corresponds to information required for transmission to the output destination device, such as the IP address of the output destination device.

[0041] (Control Unit 130) The explanation will be continued by returning to Fig. 3. The control unit 130 has an internal memory for temporarily storing programs that define various processing procedures and the like of the conversion device 100 and processing data, and is realized by electronic circuits such as a CPU (Central Processing Unit) and an MPU (Micro Processing Unit), and integrated circuits such as an ASIC (Application Specific Integrated Circuit) and an FPGA (Field Programmable Gate Array). As shown in Fig. 3, the control unit 130 has a flow statistics information generation unit 131, an output target determination unit 132, an aggregated statistics information generation unit 133, and an aggregated statistics information output unit 134.

[0042] (Flow Statistical Information Generator 131) The flow statistical information generator 131 analyzes received packets and generates flow statistical information and protocol stack information. For example, the flow statistical information generator 131 analyzes the protocol stack configuration of the received packets and extracts information from the packets based on the position and size of the packets that are preset for each protocol stack, to generate flow statistical information and protocol stack information. Note that the flow statistical information generator 131 can use any known method, without any particular limitations, as long as it is within the scope of the method for generating flow statistical information and protocol stack information. The flow statistical information generator 131 stores flow statistical information including statistical key information, which is a component of the flow statistical information, and protocol stack information that identifies the protocol stack in the flow statistical information DB 121.

[0043] (Output target determination unit 132) The output target determination unit 132 determines whether the protocol stack information of the flow statistics information generated by the flow statistics information generation unit 131 and the statistical key information related to the flow statistics information match the predetermined conditions for determining the flow statistics information to be output.

[0044] Specifically, the output target determination unit 132 determines that the generated flow statistics are flow statistics to be output if the statistical key information and protocol stack information of the generated flow statistics satisfy predetermined conditions. For example, the output target determination unit 132 determines that the flow statistics are output if the statistical key information and protocol stack information included in the flow statistics satisfy the conditions of the conditional statistical key information and protocol stack information preset as the output target list described in FIG. 4. Here, if the flow statistics are determined to be output, the output target determination unit 132 obtains an aggregation ID corresponding to the combination of the conditional statistical key information and protocol stack information related to the flow statistics determined to be output from the output target list. Then, the output target determination unit 132 outputs the aggregation ID and protocol stack information corresponding to the flow statistics to the aggregated statistical information generation unit 133, which will be described later.

[0045] If the aggregation ID is a predetermined value such as "0" which means that aggregation processing is not to be performed, the output target determination unit 132 outputs the flow statistics information determined to be the output target, the acquired aggregation ID, and the protocol stack information to the aggregated statistics information output unit 134 without performing aggregation processing. In addition, the output target determination unit 132 performs processing to discard flow statistics information determined not to be the output target because it does not satisfy the above-mentioned conditions.

[0046] (Aggregated Statistical Information Generation Unit 133) When the output target determination unit 132 determines that the condition is satisfied, the aggregated statistical information generation unit 133 aggregates statistical key information according to the aggregation pattern associated with the condition to generate statistical information. Note that when there are multiple aggregation IDs output by the output target determination unit 132, the aggregated statistical information generation unit 133 executes all of the aggregation processes corresponding to the multiple output aggregation IDs.

[0047] Specifically, the aggregated statistical information generation unit 133 acquires aggregated statistical key information and output statistical key information associated with the aggregation ID output by the output target determination unit 132 from the flow statistics determined to be output. Next, the aggregated statistical information generation unit 133 aggregates the output statistical key information for each flow statistics information whose protocol stack information and aggregated statistical key information match, and stores the aggregated statistical key information in an aggregation hash table. Note that an aggregation hash table is provided for each combination of aggregation ID and protocol stack information.

[0048] In addition, if the combination of aggregated statistical key information contained in the flow statistical information determined by the output target determination unit 132 to be an output target is not registered, the aggregated statistical information generation unit 133 stores the aggregated statistical key information and the output statistical key information in the aggregation processing information DB 123 of the memory unit 120.

[0049] An example of the aggregation process will now be described. Fig. 8 is a diagram showing an example of the aggregation process according to the first embodiment. Fig. 8 shows an example of a process in which the aggregated statistical information generation unit 133 aggregates the flow statistical information (1) and (2) to be output, which have been output by the output target determination unit 132, into an aggregation hash table.

[0050] First, the aggregated statistical information generating module 133 receives the flow statistical information (1) and (2) to be output.

[0051] 5, and acquires the aggregated statistical key and output statistical key corresponding to the aggregation ID. For example, the aggregated statistical information generation unit 133 acquires the statistical keys "Outer_Dst_IP," "Outer_Src_IP," "Tunnel_id," and "Session_id," which are the aggregated statistical keys, and the statistical keys "Octets" and "Packets," which are the output statistical keys, which correspond to the aggregation ID "1" in the aggregation process list.

[0052] On the other hand, the aggregated statistical information generation unit 133 acquires the aggregated statistical key information and output statistical key information acquired by referring to the aggregation process list from the flow statistical information to be output. For example, the aggregated statistical information generation unit 133 acquires the following from the flow statistical information (1) to be output: Outer_Dst_IP is "A", Outer_Src_IP is "B", Tunnel_id is "C", Session_id is "D", Octets is "150", and Packes is "15". Also, the aggregated statistical information generation unit 133 acquires the following from the flow statistical information (2) to be output: Outer_Dst_IP is "A", Outer_Src_IP is "B", Tunnel_id is "C", Session_id is "D", the Octets value is "50", and the Packets value is "5".

[0053] Next, the aggregated statistical information generation unit 133 aggregates and stores the flow statistical information (1) and (2) to be output that have matching aggregated statistical key values, such as Outer_Dst_IP being "A", Outer_Src_IP being "B", Tunnel_id being "C", and Session_id being "D", as the Octets value being "150 + 50 = 200" and the Packes value being "15 + 5 = 20", etc.

[0054] On the other hand, if the aggregated statistical key information of the flow statistical information to be output is not registered, the aggregated statistical information generation unit 133 registers the aggregated statistical key information in the aggregation hash table. Then, the aggregated statistical information generation unit 133 performs the aggregation process described above.

[0055] (Aggregated Statistical Information Output Unit 134) The aggregated statistical information output unit 134 outputs the aggregated statistical information generated by the aggregated statistical information generation unit 133. Specifically, the aggregated statistical information output unit 134 identifies a predetermined device as the output destination based on an output information list of pre-registered output formats, output destination information, etc. Then, the aggregated statistical information output unit 134 converts the aggregated statistical information into binary, JSON format, or the like required for each predetermined device, and outputs the aggregated statistical information to the predetermined device.

[0056] Here, an example of the conversion and output process of aggregated statistical information will be described. The aggregated statistical information output unit 134 acquires aggregated statistical key information and aggregated output statistical key information corresponding to protocol stack information and aggregation IDs from the aggregation hash table as aggregated statistical information. Next, the aggregated statistical information output unit 134 references the output information list to acquire output format information and output destination information corresponding to the protocol stack information and aggregation IDs. The aggregated statistical information output unit 134 then converts the aggregated statistical information based on the output format information and outputs it to a specified device identified by the output destination information.

[0057] Furthermore, if the aggregation ID received from the output target determination unit 132 is a predetermined value such as "0" which means that aggregation processing is not to be performed, the aggregated statistical information output unit 134 outputs the unaggregated flow statistics directly to the predetermined target device. Note that the aggregated statistical information output unit 134 may exclude from the list items that are determined regardless of the protocol stack information or the aggregation ID.

[0058] (Processing Procedure) Hereinafter, a description will be given of an aggregated information generation procedure of the conversion device 100 according to the first embodiment. Fig. 9 is a flowchart showing an example of the aggregated information generation procedure according to the first embodiment.

[0059] The flow statistic information generating unit 131 generates flow statistic information and protocol stack information using a received packet (S101). The output target determining unit 132 determines whether the flow statistic information is to be output (S102).

[0060] Here, if the output target determination unit 132 determines that the flow statistical information is not to be output (No in S103), the conversion device 100 discards the flow statistical information (S104) and ends the process.

[0061] On the other hand, if the output target determination unit 132 determines that the flow statistics are to be output (Yes in S103), the aggregated statistics generation unit 133 aggregates the output statistical key information for each piece of flow statistics whose protocol stack information and aggregated statistical key information match (S105). Note that if there are multiple aggregation IDs related to the flow statistics determined by the output target determination unit 132 to be to be output, the aggregated statistics generation unit 133 executes all of the aggregation processes corresponding to the respective aggregation IDs.

[0062] Next, the aggregated statistical information output unit 134 converts the aggregated statistical information, including the aggregated statistical Key information and the aggregated output statistical Key information, into a predetermined format (S106).The aggregated statistical information output unit 134 then outputs the aggregated statistical information to a predetermined device (S107).Then, the conversion device 100 ends the process.

[0063] (Effects) The effects of the conversion device 100 according to the first embodiment will now be described. The conversion device 100 according to the first embodiment determines whether statistical key information, which is a component of flow statistical information generated from a packet, and protocol stack information obtained by analyzing the protocol stack configuration of the packet match a predetermined condition for determining flow statistical information to be output. Next, if it is determined that the condition is met, the conversion device 100 aggregates the statistical key information according to one or more aggregation patterns associated with the protocol stack information and the statistical key information to generate statistical information. The conversion device 100 then outputs the generated aggregated statistical information.

[0064] Therefore, the conversion device 100 aggregates and outputs only the flow statistical information that is determined to be output into units that are suited to the intended use of the specified device, thereby reducing the processing load without reducing the analytical accuracy of the analysis device, etc.

[0065] Furthermore, since the conversion device 100 can aggregate flow statistics information for one packet into multiple units, it has the effect of eliminating the need to output flow statistics information with excessively fine granularity to a specified device.

[0066] Furthermore, while in the past, multiple predetermined devices aggregated the same flow statistics information, the conversion device 100 can output the aggregated statistics information to the multiple predetermined devices, thereby reducing the amount of aggregation processing performed by the multiple predetermined devices. In other words, the conversion device 100 can reduce the total processing load of each device on the network.

[0067] <Second Embodiment> The functions described in the first embodiment can be distributed among a plurality of devices, such as the conversion device 100 and the conversion device 200. Therefore, as a second embodiment, an example will be described in which a function for generating flow statistics is provided in the conversion device 100, and a function for determining the flow statistics generated by the conversion device 100, a function for aggregating the flow statistics to be output, and a function for outputting the aggregated statistics are provided in the conversion device 200. Fig. 10 is a diagram illustrating the overall configuration according to the second embodiment.

[0068] 10, in the second embodiment, the conversion device 100 generates flow statistics information and protocol stack information and outputs them to the conversion device 200, and the conversion device 200 performs determination processing, aggregation processing, and output processing on the generated flow statistics information. Note that the generation processing, determination processing, aggregation processing, and output processing of the flow statistics information described above can be realized by the same functions as in the first embodiment, so a description thereof will be omitted in this section.

[0069] (Conversion device 100) Hereinafter, a configuration example of the conversion device 100 according to the second embodiment will be described. Fig. 11 is a diagram showing an example of the configuration of a plurality of conversion devices (conversion device 100 and conversion device 200) according to the second embodiment. As shown in Fig. 11, the conversion device 100 has a communication unit 110, a storage unit 120, and a control unit 130.

[0070] (Communication Unit 110) As shown in FIG. 11, the communication unit 110 according to the second embodiment performs bidirectional communication via a communication unit 210 of the conversion device 200.

[0071] 11, the storage unit 120 according to the second embodiment includes a flow statistic information DB 121. Note that the flow statistic information DB 121 is realized by the same functions as the flow statistic information DB 121 according to the first embodiment, and therefore a description thereof will be omitted here.

[0072] (Control Unit 130) As shown in FIG. 11, the control unit 130 according to the second embodiment includes a flow statistics information generating unit 131.

[0073] (Flow Statistical Information Generator 131) The flow statistic information generator 131 according to the second embodiment analyzes received packets and generates flow statistic information and protocol stack information, similar to the first embodiment. The flow statistic information generator 131 then outputs the generated flow statistic information and protocol stack information to the conversion device 200.

[0074] (Conversion device 200) Next, a conversion device 200 according to a second embodiment will be described. The conversion device 200 according to the second embodiment aggregates the flow statistical information output from the conversion device 100 into units corresponding to each predetermined device, and outputs the aggregated statistical information. As shown in FIG. 11 , the conversion device 200 includes a communication unit 210, a storage unit 220, and a control unit 230.

[0075] (Communication Unit 210) As shown in FIG. 11, the communication unit 210 performs bidirectional communication via the communication unit 110 of the conversion device 100.

[0076] 11 , the storage unit 220 includes a flow statistics information DB 221, an output target list DB 222, an aggregation processing information DB 223, and an output information list DB 224. Note that the output target list DB 222, the aggregation processing information DB 223, and the output information list DB 224 are realized by the same functions as those of the respective DBs in the first embodiment, and therefore descriptions thereof will be omitted here.

[0077] (Flow Statistical Information DB 221) The flow statistical information DB 221 is a database that stores the flow statistical information and protocol stack information output from the conversion device 100.

[0078] 11 , the control unit 230 has an output target determination unit 231, an aggregated statistical information generation unit 232, and an aggregated statistical information output unit 233. Note that the output target determination unit 231, the aggregated statistical information generation unit 232, and the aggregated statistical information output unit 233 are realized by functions similar to those of the respective functional units in the first embodiment, and therefore descriptions thereof will be omitted here.

[0079] <Third Embodiment> Hereinafter, as a third embodiment which is another embodiment of the second embodiment, an example of an embodiment will be described in which a function for generating flow statistics and a function for determining whether the generated flow statistics are to be output are provided in the conversion device 100, and a function for aggregating the flow statistics to be output which are output by the conversion device 100 and a function for outputting the aggregated statistics are provided in the conversion device 200. Fig. 12 is a diagram illustrating the overall configuration according to the third embodiment.

[0080] 12, in the third embodiment, the conversion device 100 generates flow statistics and protocol stack information, performs a determination process on the generated flow statistics, and then outputs the flow statistics, protocol stack information, and aggregation ID to the conversion device 200, and the conversion device 200 performs an aggregation process and an output process on the flow statistics to be output. Note that the generation process, determination process, aggregation process, and output process of the flow statistics described above can be realized by the same functions as in the first embodiment, and therefore a description thereof will be omitted in this section.

[0081] (Conversion device 100) From here, an example configuration of the conversion device 100 according to the third embodiment will be described. FIG. 13 is a diagram showing an example configuration of a plurality of conversion devices (conversion device 100 and conversion device 200) according to the third embodiment. As shown in FIG. 13, the conversion device 100 has a communication unit 110, a storage unit 120, and a control unit 130. Note that the communication unit 110 according to the third embodiment is realized by the same functions as the communication unit 110 according to the second embodiment, and therefore description thereof will be omitted in this section.

[0082] 13, the storage unit 120 according to the third embodiment includes a flow statistical information DB 121 and an output target list DB 122. Note that the flow statistical information DB 121 and the output target list DB 122 are realized by the same functions as the flow statistical information DB 121 and the output target list DB 122 according to the first embodiment, and therefore a description thereof will be omitted here.

[0083] 13, the control unit 130 according to the third embodiment includes a flow statistical information generation unit 131 and an output target determination unit 132. Note that the flow statistical information generation unit 131 is realized by the same functions as the flow statistical information generation unit 131 according to the second embodiment, and therefore a description thereof will be omitted here.

[0084] (Output target determination unit 132) Similar to the output target determination unit 132 according to the first and second embodiments, the output target determination unit 132 according to the third embodiment determines whether the flow statistics generated by the flow statistics information generation unit 131 is an output target. Then, the output target determination unit 132 outputs the flow statistics determined to be an output target, the protocol stack information, and the aggregation ID to the conversion device 200.

[0085] (Conversion device 200) Next, the configuration of the conversion device 200 according to the third embodiment will be described. As shown in Fig. 13, the conversion device 200 has a communication unit 210, a storage unit 220, and a control unit 230. Note that the communication unit 210 is realized by the same functions as those in the first and second embodiments, and therefore a description thereof will be omitted in this section.

[0086] 13, the storage unit 220 according to the third embodiment includes a flow statistics information DB 221, an aggregation processing information DB 223, and an output information list DB 224. Note that the flow statistics information DB 221, the aggregation processing information DB 223, and the output information list DB 224 are realized by the same functions as those of the respective DBs in the first and second embodiments, and therefore descriptions thereof will be omitted here.

[0087] 13, the control unit 230 according to the third embodiment has an aggregated statistical information generation unit 232 and an aggregated statistical information output unit 233. Note that the aggregated statistical information generation unit 232 and the aggregated statistical information output unit 233 are realized by functions similar to those of the respective functional units in the first and second embodiments, and therefore descriptions thereof will be omitted here.

[0088] <Modifications> Modifications realized by the conversion device 100 and the conversion device 200 according to this embodiment will be described below.

[0089] (Data, etc.) The flow statistics information, output target list, aggregation process list, aggregation hash table, output information list, protocol stack information, aggregation ID, statistical key information, statistical key, condition statistical key, aggregated statistical key, output statistical key, output format information, output destination information, names of functional parts of the conversion device 100 and the conversion device 200, steps, processes, names of steps or processes, etc. used in the description of the above embodiments are merely examples and can be changed as desired. Note that the steps in the flowcharts, etc. may be interchanged within a consistent range, and some steps may not be implemented.

[0090] (Aggregation Processing, etc.) The conversion device 100 or the conversion device 200 has been described as aggregating output statistical key information by accumulating (adding) each piece of flow statistical information to be output based on aggregated statistical key information, but this is not limiting. For example, the conversion device 100 or the conversion device 200 may perform aggregation processing by adding the output statistical key information to the relevant table without adding or accumulating the output statistical key information to be aggregated.

[0091] (Flow Statistical Information, etc.) In the second and third embodiments, the format of the flow statistical information generated by the conversion device 100 is not particularly limited. For example, the flow statistical information generated in the second and third embodiments may be in binary format.

[0092] (Regarding the conversion device 200) The conversion device 200 according to the second and third embodiments is not limited to a conversion device, and may be an information processing device having other functions. For example, the conversion device 200 may be a JSON registration device that has the function of converting binary flow statistics information received from the conversion device 100 into JSON data. In this case, the JSON registration device does not need to include the aggregated statistics information output unit 233.

[0093] (System) The information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0094] Furthermore, the components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown. In other words, all or part of the devices can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc.

[0095] <Hardware Configuration> The components of each device shown in the figure are conceptual functional components and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown, and all or part of them can be functionally or physically distributed and integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic.

[0096] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can also be performed manually using known methods. In addition, the information including the processing procedures, control procedures, specific names, various data, and parameters shown in the drawings can be changed as desired unless otherwise specified.

[0097] <Program> In one embodiment, the various devices constituting the conversion device 100 and the conversion device 200 can be implemented by installing a conversion program as package software or online software on a desired computer. For example, by executing the conversion program on an information processing device, the various devices constituting the conversion device 100 and the conversion device 200 can function. The information processing device referred to here includes desktop and notebook personal computers. Furthermore, other information processing devices also include mobile communication terminals such as smartphones and mobile phones, as well as slate terminals such as PDAs (Personal Digital Assistants).

[0098] 14 is a diagram showing an example of a computer that executes the aggregated information generation process according to this embodiment. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0099] The memory 1010 includes a ROM (Read Only Memory) 1011 and a RAM 1012. The ROM 1011 stores a boot program such as a BIOS (Basic Input Output System). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0100] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, programs that define the processes of the various devices that make up the conversion device 100 and the conversion device 200 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configurations of the various devices that make up the conversion device 100 and the conversion device 200 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0101] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. The CPU 1020 then reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0102] The program module 1093 and program data 1094 are not limited to being stored in the hard disk drive 1090, but may also be stored in, for example, a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a LAN or a WAN (Wide Area Network)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0103] Although the present embodiment has been described above, the present embodiment is not limited by the descriptions and drawings that form a part of the disclosure. In other words, other embodiments, examples, operational techniques, etc. that are made by those skilled in the art based on the present embodiment are all included in the scope of the present embodiment.

[0104] 100, 200 Conversion device 110, 210 Communication unit 120, 220 Storage unit 121, 221 Flow statistical information DB 122, 222 Output target list DB 123, 223 Aggregation processing information DB 124, 224 Output information list DB 130, 230 Control unit 131 Flow statistical information generation unit 132, 231 Output target determination unit 133, 232 Aggregated statistical information generation unit 134, 233 Aggregated statistical information output unit

Claims

1. A conversion device comprising: an output target determination unit which determines whether or not a packet is to be output based on protocol stack information obtained by analyzing the protocol stack configuration of a packet and statistical key information, which is a component of flow statistics information; an aggregated statistical information generation unit which, when the output target determination unit determines that a packet is to be output, aggregates the statistical key information in accordance with one or more aggregation patterns associated with the protocol stack information and the statistical key information to generate statistical information; and an aggregated statistical information output unit which outputs the statistical information generated by the aggregated statistical information generation unit.

2. The conversion device described in claim 1, characterized in that the output target determination unit determines the flow statistical information to be output when the statistical key information and protocol stack information of the generated flow statistical information match predetermined conditional statistical key information and protocol stack information, and outputs the flow statistical information determined to be output and information identifying an aggregation process corresponding to the combination of the conditional statistical key information and the protocol stack information related to the flow statistical information.

3. The conversion device described in claim 2, characterized in that the aggregated statistical information generation unit obtains aggregated statistical key information and output statistical key information corresponding to the information identifying the aggregation process output by the output target determination unit from the flow statistical information determined to be the output target, and aggregates the output statistical key information for each of the flow statistical information that matches the aggregated statistical key information, thereby generating the aggregated statistical information.

Images