Detection device, detection method, and detection program

Abstract

A detection device 1 for detecting a communication abnormality of a service comprises a determination unit 12 for extracting only a small-size packet smaller than a prescribed threshold value from traffic related to the service and determining a communication abnormality of the service on the basis of the magnitude of a difference in the number of small-size packets from a normal time.

Description

Detection device, detection method, and detection program

[0001] The present disclosure relates to a detection device, a detection method, and a detection program.

[0002] In Non-Patent Document 1, flows are decomposed into port numbers and the like, and the resulting decomposed flows are called metrics, and the focus is on metrics related to control signals. For multiple metrics related to control signals, a degradation in service quality is detected based on the number of anomalous metrics (co-occurrence count) that show an abnormal increase in traffic volume.

[0003] Hayashi, et al., "Proposal of a Service Quality Degradation Detection Technology Focusing on Time-Series Co-occurrence of Multiple Indicators," Institute of Electronics, Information and Communication Engineers, 2023 General Conference, B-14-10, March 8, 2023

[0004] However, in Non-Patent Document 1, only the metrics of control signals are used and metrics of communication content signals related to communication content are excluded, so an increase in control signals included in the metrics of communication content signals cannot be detected, and therefore, communication abnormalities of services in which increasing control signals are included only in metrics mainly consisting of communication content signals cannot be detected.

[0005] In this regard, it is possible to use metrics of communication content signals. However, even with the metrics of communication content signals, an increase in control signals and an increase and decrease in communication content signals may occur simultaneously during an abnormality, so it is not possible to determine a communication abnormality of a service from an increase or decrease in traffic volume regarding the metrics of communication content signals.

[0006] The present disclosure has been made in consideration of the above circumstances, and an object of the present disclosure is to provide a technology that can improve the accuracy of detecting a degradation in service quality.

[0007] A detection device according to one aspect of the present disclosure is a detection device that detects communication abnormalities in a service, and includes a determination unit that extracts only small-sized packets that are smaller than a predetermined threshold from traffic related to the service, and determines the communication abnormality in the service based on the magnitude of the difference between the number of small-sized packets and normal traffic.

[0008] A detection method according to one aspect of the present disclosure is a detection method for detecting communication anomalies in a service, in which a detection device extracts only small-sized packets that are smaller than a predetermined threshold from traffic related to the service, and determines a communication anomaly in the service based on the magnitude of the difference between the number of small-sized packets in a normal state and that in a normal state.

[0009] A detection program according to one aspect of the present disclosure is a detection program that causes a computer to function as the detection device.

[0010] According to the present disclosure, it is possible to provide a technology that can improve the accuracy of detecting a deterioration in service quality.

[0011] Fig. 1 is a configuration diagram illustrating an overview of the present disclosure. Fig. 2 is a diagram illustrating a functional block configuration of a detection device. Fig. 3 is a diagram illustrating a processing flow of the detection device. Fig. 4 is a diagram illustrating an example of determining a service abnormality. Fig. 5 is a diagram illustrating a hardware configuration of the detection device.

[0012] Hereinafter, embodiments of the present disclosure will be described with reference to the drawings. In the description of the drawings, the same parts are designated by the same reference numerals and the description thereof will be omitted.

[0013] [Summary] The present disclosure utilizes the fact that the packet size of control signals is smaller than the packet size of communication content signals, and detects an increase in the number of small-sized packets corresponding to control signals compared to steady-state (normal, usual) conditions, thereby detecting a communication abnormality in a service.

[0014] 1, a detection device 1 extracts only small packets smaller than a predetermined threshold from traffic flowing through a communication network, and constantly monitors the number of small packets per unit time or the cumulative number across multiple traffic streams. If the number or cumulative number of small packets increases from a steady state, the detection device 1 notifies a monitoring network or service administrator that there is an abnormality in the service.

[0015] In this way, because the presence or absence of a service abnormality is determined based on an increase in small-sized packets, a service abnormality can be detected even when no change is observed in the metrics of the control signal, thereby improving the accuracy of detecting a deterioration in service quality.

[0016] 2 is a diagram showing a functional block configuration of the detection device 1 according to this embodiment. The detection device 1 is a detection device that detects communication abnormalities of a service. The detection device 1 includes an acquisition unit 11, a determination unit 12, and a notification unit 13.

[0017] The acquisition unit 11 has a function of acquiring, from a flow collector 2 connected to the communication network N, traffic flows relating to a predetermined service currently distributed in the communication network N. The acquisition unit 11 also has a function of decomposing the flows acquired from the flow collector 2 according to a predetermined classification axis (for example, port number, protocol number), and setting each of the multiple decomposed flows as metrics.

[0018] The determination unit 12 has a function of determining whether the average packet size per unit time is large or small for each of the plurality of metrics based on a predetermined threshold. The determination unit 12 also has a function of calculating the cumulative number of small-sized packets for the plurality of metrics per unit time for small-sized packets determined to have a small average packet size, and determining whether the cumulative number of small-sized packets has increased compared to a steady state.

[0019] Note that the result of decomposing a flow may be one metric. In this case, the determination unit 12 determines whether the average packet size per unit time is large or small for one metric. Furthermore, for small-sized packets determined to have a small average packet size, the determination unit 12 calculates the number of small-sized packets per unit time and determines whether the number of small-sized packets has increased compared to the steady state.

[0020] That is, the determination unit 12 extracts only small-sized packets smaller than a predetermined threshold from traffic related to a predetermined service, and determines whether a communication abnormality has occurred for the service based on the cumulative number of small-sized packets or the magnitude of the difference in the number from normal times.

[0021] The notification unit 13 has a function of notifying a monitoring network or a service administrator of a communication abnormality of a service when the cumulative number or number of small size packets increases from the normal state.

[0022] FIG. 3 is a diagram showing a processing flow of the detection device 1.

[0023] Step S1: The acquisition unit 11 acquires the flow of traffic currently circulating in the communication network N from the flow collector 2. Then, the acquisition unit 11 breaks down the acquired flow, for example, by port number, and sets each of the multiple broken down flows as metrics.

[0024] Step S2: The determining unit 12 determines whether the average packet size per unit time is large or small for each of the metrics of each port number. This will be described in detail below with reference to FIG.

[0025] The determination unit 12 pre-calculates the average packet size PS1 within a unit time (for example, the time interval for generating statistical information by the flow collector 2) for each metric of each port number based on steady-state traffic data (step S2-1).

[0026] Next, the determination unit 12 calculates the average packet size PS2 at multiple different times for each metric of each port number based on the traffic data acquired in step S1, and calculates the variance of the average packet size PS2 using the average packet size PS1 based on the steady-state traffic data calculated in step S2-1 (step S2-2).

[0027] Next, the judgment unit 12 checks the variance of the average packet size PS2 between the metrics of each port number, and classifies each port number as having a large variance or a small variance (e.g., color-codes) based on a comparison with a preset threshold, for example (step S2-3).

[0028] Here, for metrics belonging to large variance port numbers, it is necessary to distinguish between large and small packet sizes because the average packet size PS2 is prone to fluctuation. Therefore, the determination unit 12 calculates a threshold value for determining whether a packet is a small size packet for each metric of each port number (step S2-5).

[0029] For example, the determination unit 12 observes traffic for each metric and sets a small-size packet determination threshold for each metric. The determination unit 12 also determines the small-size packet determination threshold based on the median value with respect to the minimum packet size, a statistical confidence interval (a time interval during which the service is normal), the average value and variance of the sizes of packets that flow steadily in the metric, the packet transmission time interval, etc.

[0030] For metrics belonging to port numbers with small variance, the average packet size PS2 does not fluctuate much, so no small packet determination threshold is set.

[0031] Finally, for each of the metrics of each port number, the determination unit 12 determines that the average packet size PS2 of packets that belong to a port number with a large variance and whose average packet size is less than or equal to the small size packet determination threshold is a small packet size (step S2-6).

[0032] The determining unit 12 also determines that the average packet size PS2 of all packets belonging to the port number with the small variance is also a small packet size (step S2-6).

[0033] Step S3: The determining unit 12 determines whether the cumulative number of small size packets has increased, as will be described in detail below with reference to FIG.

[0034] First, the determination unit 12 accumulates the number of small-sized packets for the metrics of all port numbers for each unit time, and sets the accumulated number of small-sized packets as the total number of small-sized packets (step S3-1). Because the accumulation makes changes in the number of small-sized packets more noticeable, it is easier to detect abnormalities in the service than by grasping changes in the number of small-sized packets for each individual metric.

[0035] Next, the determination unit 12 detects a large increase in the cumulative number of small-sized packets from a steady state (step S3-2). For example, the determination unit 12 calculates the distribution of the cumulative number of small-sized packets in advance based on traffic data at multiple different times, and determines that a service abnormality has occurred when the increase in the cumulative number of small-sized packets falls below 10% of the confidence interval.

[0036] Step S4: If the cumulative number of small size packets has increased significantly from a normal state, the notification unit 13 notifies the monitoring network and the service manager that an abnormality has occurred in the service since the time of the large increase.

[0037] [Effect] According to this embodiment, only small-sized packets smaller than a predetermined threshold are extracted from the overall traffic related to the service, and a communication abnormality of the service is determined based on the magnitude of the difference between the number of small-sized packets in normal times and that in normal times. Therefore, even if no change is observed in the metrics of the control signal, a service abnormality can be detected.

[0038] In other words, it is not limited to the metrics of control signals, but can also detect an increase in control signals within the metrics of communication content signals.In other words, because it is possible to use both the metrics of control signals and the metrics of communication content signals, the range in which it is possible to detect when a service is not connected or has difficulty connecting can be expanded, and the accuracy of detecting a deterioration in service quality can be improved.

[0039] [Others] The present disclosure is not limited to the above-described embodiments, and various modifications are possible within the scope of the gist of the present disclosure.

[0040] The detection device 1 of the present embodiment described above can be realized, for example, by using a general-purpose computer system including a CPU 901, a memory 902, a storage 903, a communication device 904, an input device 905, and an output device 906, as shown in Fig. 5. The memory 902 and the storage 903 are storage devices. In the computer system, the CPU 901 executes a predetermined program loaded onto the memory 902, thereby realizing each function of the detection device 1.

[0041] The detection device 1 may be implemented by one computer, or by multiple computers, or may be a virtual machine implemented on a computer.

[0042] The program for the detection device 1 can be stored in a computer-readable recording medium such as a HDD, SSD, USB memory, CD, or DVD. The computer-readable recording medium is, for example, a non-transitory recording medium. The program for the detection device 1 can also be distributed via a communication network.

[0043] REFERENCE SIGNS LIST 1 detection device 11 acquisition unit 12 determination unit 13 notification unit 2 flow collector 901 CPU 902 memory 903 storage 904 communication device 905 input device 906 output device

Claims

1. A detection device for detecting communication anomalies in a service, comprising: a determination unit that extracts only small-sized packets smaller than a predetermined threshold from traffic related to the service, and determines a communication anomaly in the service based on the magnitude of the difference between the number of small-sized packets in a normal state and the number of small-sized packets in a normal state.

2. The detection device according to claim 1, wherein the determination unit observes the traffic for each metric obtained by breaking down the traffic along a predetermined reference axis, and sets the predetermined threshold for each metric.

3. The detection device according to claim 2, wherein the determination unit sets the predetermined threshold value according to the average and variance of the size of packets flowing steadily in the metrics and the transmission time interval of the packets.

4. A detection device as described in claim 2 or 3, wherein the determination unit accumulates small size packets related to a plurality of metrics and determines a communication abnormality of the service based on a difference between the accumulated number of small size packets and a normal state.

5. A detection method for detecting a communication anomaly of a service, comprising: a detection device extracting only small-sized packets smaller than a predetermined threshold from traffic related to the service, and determining a communication anomaly of the service based on the magnitude of the difference between the number of small-sized packets in a normal state and the number of small-sized packets in a normal state.

6. A detection program that causes a computer to function as the detection device according to claim 1.

Images