Analysis device and analysis method

Abstract

An analysis device (10) has an acquisition unit (11), a normalization unit (12), and an analysis unit (13). The acquisition unit (11) acquires, as data, an interface statistic or the time series of an optical channel state from each of two network interfaces adjacent to each other among network interfaces provided in a plurality of router devices for transferring an IP packet and one or more transmission devices connecting the plurality of router devices. The normalization unit (12) normalizes the data acquired by the acquisition unit (11). The analysis unit (13) analyzes the data normalized by the normalization unit (12).

Description

Analytical device and analytical method

[0001] The present invention relates to an analytical device and an analytical method.

[0002] In large-scale carrier networks operated by telecommunications carriers, router devices (hereafter referred to as "forwarding devices") that forward IP packets and optical transmission devices (hereafter referred to as "transmission devices") that connect these devices across geographically separated sections are used. In the following explanation, the forwarding devices and transmission devices may be referred to as communication devices without distinction.

[0003] An optical path connecting two transfer devices may be formed by multiple transmission devices. Furthermore, transmission devices can simultaneously accommodate multiple optical paths within a single optical fiber using wavelength multiplexing technology.

[0004] Among the IF statistics (number of packets, number of bytes, etc.) and optical channel conditions (light intensity, error rate in optical transmission, etc.) obtained at the network IF (Interface) of a communication device and the network IF of an adjacent communication device, those that correspond to each other are linked.

[0005] For example, the network IF of a communication device that transmits an IP packet corresponds to the network IF of a communication device that receives the IP packet. Similarly, the IF statistics for IP packets are linked between the network IFs of two adjacent transfer devices via a transmission device.

[0006] Here, the layer of the network that focuses on the transmission and reception of IP packets between transfer devices is called the transport layer. Also, the layer of the network that focuses on the transmission and reception of IP packets between transmission devices is called the transport layer.

[0007] If it is possible to monitor the correlation of values ​​between adjacent IFs across the transport layer and transmission layer and analyze any disruption in the correlation, this will be useful as a means of detecting network anomalies or identifying the section where an anomaly has occurred.

[0008] Conventionally, SNMP Poring (see, for example, Non-Patent Document 1) and Telemetry (see, for example, Non-Patent Document 2) are known as methods for acquiring IF statistics and optical channel conditions of communication devices in a carrier.

[0009] SNMP polling and telemetry are performed by configuring each communication device to emit IF statistics and optical channel status, and the emitted data is received and collected by the operation management system. In addition, in the event of a failure or trouble, multiple IF statistics and optical channel statuses are checked by the operation management system, and using these as one of the criteria, a monitoring person manually identifies the faulty device or section.

[0010] RFC1157 "A Simple Network Management Protocol (SNMP)", [Retrieved February 14, 2024], Internet (https: / / datatracker.ietf.org / doc / html / rfc1157) RFC9232 "Network Telemetry Framework", [Retrieved February 14, 2024], Internet (https: / / datatracker.ietf.org / doc / html / rfc9232)

[0011] However, the conventional technology has a problem in that it is not possible to accurately analyze the linkage of data acquired at each of two adjacent network interfaces.

[0012] For example, the timing of data acquisition may differ for each communication device or each network IF. For example, consider a case where the number of packets transmitted from the transmitting network IF is acquired every five minutes from the hour (e.g., 10:00, 10:05, ...), and the number of packets received by the receiving network IF is acquired every five minutes from the hour (e.g., 10:01, 10:06, ...). In this case, it is not possible to simply compare the number of transmitted packets with the number of received packets, making it difficult to analyze the linkage of the data.

[0013] In order to solve the above-mentioned problems and achieve the objectives, the analysis device is characterized by having an acquisition unit that acquires IF statistics or time series of optical channel states as data from each of two adjacent network IFs among multiple router devices that forward IP packets and network IFs provided in one or more transmission devices that connect the multiple router devices, a normalization unit that normalizes the data acquired by the acquisition unit, and an analysis unit that analyzes the data normalized by the normalization unit.

[0014] According to the present invention, it is possible to analyze with high accuracy the linkage of data acquired by each of two adjacent network interfaces.

[0015] FIG. 1 is a diagram illustrating an example of a network configuration. FIG. 2 is a diagram illustrating a problem in analyzing interlocking. FIG. 3 is a diagram illustrating a problem in analyzing interlocking. FIG. 4 is a diagram illustrating a problem in analyzing interlocking. FIG. 5 is a diagram illustrating a problem in analyzing interlocking. FIG. 6 is a diagram illustrating an example of a configuration of an analysis device according to a first embodiment. FIG. 7 is a diagram illustrating an example of normalization. FIG. 8 is a diagram illustrating an example of normalization. FIG. 9 is a diagram illustrating an example of normalization. FIG. 10 is a diagram illustrating an example of normalization. FIG. 11 is a diagram illustrating an example of normalization. FIG. 12 is a diagram illustrating an example of processing by a normalization unit. FIG. 13 is a flowchart illustrating the flow of processing by the analysis device according to the first embodiment. FIG. 14 is a diagram illustrating an example of a computer that executes an analysis program.

[0016] DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS The present invention will be described in detail below with reference to the accompanying drawings, in which: FIG.

[0017] A network to be analyzed in this embodiment will be described with reference to Fig. 1. Fig. 1 is a diagram showing an example of the configuration of a network.

[0018] As shown in FIG. 1, the network includes a transfer device 20, a transfer device 40, and n transmission devices (transmission device 30_1, transmission device 30_2, ..., transmission device 30_n) that form optical paths connecting the transfer devices (where n≧1).

[0019] The forwarding device is a router device that forwards IP packets in a carrier network, and the transmission device is an optical transmission device that connects the forwarding devices in geographically separated sections.

[0020] Each communication device has a network IF for transmitting and receiving IP packets via optical fiber. The transfer device 20 has IF202. The transfer device 30_1 has IF301_1a, IF301_1b, and IF302_1. The transfer device 30_2 has IF301_2 and IF302_2. The transfer device 30_n has IF301_n, IF302_na, and IF302_nb. The transfer device 40 has IF401.

[0021] An IP packet transmitted by the IF 202 of the transfer device 20 is received by the IF 301_1a of the transmission device 30_1. Also, an IP packet transmitted by the IF 302_1 of the transmission device 30_1 is received by the IF 301_2 of the transmission device 30_2. In this way, the network IF that transmits an IP packet and the network IF that receives the IP packet are adjacent to each other.

[0022] Two adjacent network IFs may exist only in either the transfer layer or the transmission layer, or may exist across both the transfer layer and the transmission layer. For example, when focusing on the transfer layer, it can be said that the IF202 of the transfer device 20 is adjacent to the IF401 of the transfer device 40. Furthermore, when focusing on both the transfer layer and the transmission layer, it can be said that the IF202 of the transfer device 20 is adjacent to the IF301_1a of the transfer device 30_1 across the transfer layer and the transmission layer.

[0023] As described above, the IF statistics and optical channel states acquired at adjacent network IFs are linked together unless an abnormality occurs.

[0024] When adjacent network IFs are linked, the following phenomenon occurs. For example, the number of output packets of the sending network IF is almost the same as the number of input packets of the adjacent receiving network IF. Also, for example, if the output optical intensity of the sending network IF decreases, the input optical intensity of the adjacent receiving network IF decreases.

[0025] As mentioned above, conventional techniques may not be able to accurately analyze the interlocking of data (IF statistics and optical channel conditions). A case where the interlocking cannot be accurately analyzed will be described using Figures 2 to 5. Figures 2 to 5 are diagrams explaining the issues involved in analyzing the interlocking. It is assumed that the time of each communication device is kept accurate using NTP (Network Time Protocol) or the like.

[0026] In the following description, it is assumed that the data to be analyzed is IF statistics (e.g., the number of packets). The IF statistics in the following description may be replaced with optical channel conditions as appropriate. For example, the IF statistics and the optical channel conditions are both expressed as time-series numerical data.

[0027] 2 to 5, the upper row shows the number of transmitted packets obtained from the network IF on the transmitting side, and the lower row shows the number of received packets obtained from the network IF on the receiving side. The network IF on the transmitting side and the network IF on the receiving side are adjacent to each other and have a corresponding relationship.

[0028] As shown in Figure 2, the intervals between the number of transmitted packets and the number of received packets are the same, 5 minutes, but there may be a time difference. In this case, it is not possible to analyze the correlation between the number of transmitted and received packets at the same time.

[0029] As shown in Figure 3, the timing at which the number of transmitted packets and the number of received packets start to be acquired are the same, but the acquisition intervals may not be the same. This can occur due to the specifications or constraints of the communication device. In this case, it is not possible to analyze the correlation between the number of packets transmitted and received at a certain time.

[0030] As shown in Figure 4, there are cases where both the events in Figures 2 and 3 occur simultaneously. In this case, it is not possible to analyze the correlation between the number of packets transmitted and received at the same time.

[0031] As shown in Figure 5, there are cases where the number of transmitted packets is acquired as a cumulative value and the number of received packets is acquired as a value at each time. In this case, the data format of the number of transmitted and received packets is different, so it is not possible to analyze the correlation.

[0032] 1, the analysis device 10 acquires data from the network IF and analyzes the acquired data. Based on the analysis results, the analysis device 10 determines whether or not there is an abnormality in the network.

[0033] The analysis device 10 solves the problems described above and can accurately analyze the interrelationship of data acquired by each of two adjacent network interfaces.

[0034] The configuration of the analysis device according to the first embodiment will be described with reference to Fig. 6. Fig. 6 is a diagram showing an example of the configuration of the analysis device according to the first embodiment.

[0035] As shown in FIG. 6, the analysis device 10 includes an acquisition unit 11, a normalization unit 12, an analysis unit 13, and a determination unit 14.

[0036] The acquiring unit 11 acquires data (IF statistics and optical channel state) from the network IF. For example, the acquiring unit 11 acquires at least one of the IF statistics such as the number of packets and the number of bytes, and the optical channel state such as the optical intensity and the error rate as data. The acquiring unit 11 may also accept input of data.

[0037] The acquisition unit 11 may acquire data via an operation management system used in SNMP Poling and Telemetry. In particular, the acquisition unit 11 acquires data from each of two adjacent network IFs.

[0038] The normalization unit 12 normalizes the data acquired by the acquisition unit 11. By performing normalization by the normalization unit 12, the problems described with reference to Figures 2 to 5 are solved, and it becomes possible to analyze the linkage of the data. Details of normalization by the normalization unit 12 will be described later.

[0039] The analysis unit 13 analyzes the data normalized by the normalization unit 12. For example, the analysis unit 13 calculates the difference between the numerical data acquired from each of two adjacent network IFs.

[0040] The determination unit 14 determines whether or not there is an abnormality in the network and the communication device based on the analysis result by the analysis unit 13. For example, if the difference calculated by the analysis unit 13 exceeds a threshold, the determination unit 14 determines that an abnormality has occurred in the network or the communication device. The determination result by the determination unit 14 at each time corresponds to the output data of the analysis device 10.

[0041] [Details of Normalization] Details of normalization by the normalizer 12 will be described using Figures 7 to 11. Figures 7 to 11 are diagrams showing examples of normalization. As shown in Figure 6, for example, the acquirer 11 acquires IF statistics (j types from 1 to j) of IF 302_1 and IF statistics (k types from 1 to k) of IF 301_2 as input data. Note that the input data may be each piece of IF statistics data, each piece of optical channel state data, or any combination of these data. As shown in Figure 1, IF 302_1 and IF 301_2 are adjacent to each other.

[0042] 7, the normalization unit 12 performs pass-through, which means that input data is passed to the analysis unit 13 as is without being normalized.

[0043] For example, if the data format (accumulated value or value at each time) of the IF statistics of IF302_1 and IF statistics of IF301_2 is the same and the acquired time is the same, the normalization unit 12 performs pass-through.

[0044] (Time Interpolation Processing / Resampling Processing) As shown in FIG. 8, the normalization unit 12 performs either or both of a time interpolation processing and a resampling processing on the IF statistics, thereby outputting a time-interpolated waveform of the IF statistics.

[0045] The normalization unit 12 interpolates and outputs counter values ​​(plotted with white squares) for times that do not exist in the IF statistics (10:00, 10:00, ..., 10:35) based on the counter values ​​(plotted with black circles) for times that exist in the input IF statistics (10:01, 10:06, ..., 10:36).

[0046] The normalization unit 12 performs interpolation using a method such as linear interpolation, polynomial interpolation, or spline interpolation.

[0047] Furthermore, the normalization unit 12 can perform upsampling by increasing the number of time points obtained by interpolation from the original number of samples. For example, the normalization unit 12 can interpolate samples at one-minute intervals, such as 10:02, 10:03, 10:04, ..., 10:35, and 10:36.

[0048] Conversely, the normalization unit 12 can perform downsampling processing by reducing the number of time points obtained by interpolation processing to be less than the original number of samples.

[0049] For example, the normalization unit 12 can make the IF statistics comparable in the cases of FIGS. 2, 3, and 4 by performing time interpolation / resampling.

[0050] 9, the normalization unit 12 performs normalization by calculating statistics of multiple counter values. For example, the normalization unit 12 calculates the average and variance (standard deviation) of m consecutive past counter values, including the counter value at the i-th time, as the counter value at the i-th time after normalization (where i≧m).

[0051] In the example of FIG. 9, the normalization unit 12 calculates the normalized counter value at 10:11 based on the counter values ​​at 10:01, 10:06, and 10:11 of the input IF statistics (i=3, m=3).

[0052] For example, even when counter values ​​at the same time cannot be compared in a case such as that shown in FIG. 2, the normalization unit 12 can make the trends of changes appearing in the statistics comparable.

[0053] (Conversion of cumulative value to time value) As shown in Fig. 10, the normalization unit 12 performs normalization by converting the cumulative value into a value for each time. For example, the normalization unit 12 calculates the difference between the counter value at the i-th time and the counter value at the (i-1)-th time, and sets this difference as the counter value at the i-th time after normalization. However, the normalization unit 12 does not need to calculate the normalized counter value for the counter value at i = 1.

[0054] In the example of Figure 10, the normalization unit 12 calculates the counter value at 10:06 after normalization by subtracting the counter value at 10:01 from the counter value at 10:06 of the input IF statistics (i = 2).

[0055] For example, the normalization unit 12 can make the IF statistical values ​​comparable in the case of FIG. 5 by converting the cumulative value to the time value.

[0056] 11, the normalization unit 12 may perform normalization by calculating the difference between two pieces of input data. For example, the normalization unit 12 calculates the difference between the counter values ​​at the i-th time of the two pieces of input data (the first IF statistic and the second IF statistic), and sets the difference as the counter value at the i-th time after normalization.

[0057] This allows the normalization unit 12 to analyze not only whether the data acquired from adjacent network IFs is the same, but also how much the data differs, or the tendency of changes in the degree of deviation.

[0058] As shown in Fig. 12, the normalization unit 12 can combine the normalization techniques described above. Fig. 12 is a diagram illustrating an example of processing by the normalization unit.

[0059] In the example of Fig. 12, the normalization unit 12 first performs time interpolation / resampling on multiple data, then performs cumulative value-to-time value conversion and statistical calculations on some of the results. Furthermore, the normalization unit 12 performs difference calculations on some of the normalization results. This allows the analysis unit 13 to analyze data that has resolved the issues in each of the cases shown in Figs. 2 to 5.

[0060] Furthermore, the normalization methods to be combined in the normalization unit 12 may be written in advance in a configuration file and can be switched as needed, allowing the normalization unit 12 to flexibly perform normalization according to the input data.

[0061] The flow of processing by the analysis device 10 will be described with reference to Fig. 13. Fig. 13 is a flowchart showing the flow of processing by the analysis device according to the first embodiment.

[0062] 13, the analysis device 10 acquires data from a first network IF of the transfer device or transmission device (step S101), and acquires data from a second network IF of the transfer device or transmission device (step S102).

[0063] The first network IF and the second network IF are adjacent to each other, and the acquired data is one or more of data included in IF statistics and optical channel conditions.

[0064] Next, the analysis device 10 normalizes the acquired data in accordance with the config file (step S103). The analysis device 10 normalizes the data by time interpolation, resampling, statistical calculation, conversion from cumulative values ​​to time values, or difference calculation.

[0065] Next, the analysis device 10 analyzes the interrelationship based on the normalized data (step S104), determines whether there is an abnormality in the interrelationship (step S105), and outputs the determination result (step S106).

[0066] [System Configuration, etc.] The components of each device shown in the figure are conceptual functional units and do not necessarily have to be physically configured as shown. In other words, the specific form of distribution and integration of each device is not limited to that shown in the figure, and all or part of the devices can be functionally or physically distributed or integrated in any unit depending on various loads, usage conditions, etc. Furthermore, all or any part of the processing functions performed by each device can be realized by a CPU (Central Processing Unit) and a program analyzed and executed by the CPU, or can be realized as hardware using wired logic. The program may be executed not only by the CPU but also by other processors such as a GPU.

[0067] Furthermore, among the processes described in this embodiment, all or part of the processes described as being performed automatically can be performed manually, or all or part of the processes described as being performed manually can be performed automatically using a known method.In addition, the information including the processing procedures, control procedures, specific names, various data and parameters shown in the above documents and drawings can be changed as desired unless otherwise specified.

[0068] [Program] In one embodiment, the analysis device 10 can be implemented by installing an analysis program that executes the above-described processes as package software or online software on a desired computer. For example, by executing the above-described analysis program on an information processing device, the information processing device can function as the analysis device 10. The information processing device referred to here includes desktop and notebook personal computers. Other information processing devices also include mobile communication terminals such as smartphones, mobile phones, and PHS (Personal Handyphone Systems), as well as slate terminals such as PDAs (Personal Digital Assistants).

[0069] The analysis device 10 can also be implemented as a server device that provides services related to the above processing to a client terminal device used by a user. For example, the server device is implemented as a server device that receives data included in IF statistics and optical channel state as input and outputs the presence or absence of an abnormality. In this case, the server device may be implemented as a web server or as a cloud that provides services related to the above processing through outsourcing.

[0070] 14 is a diagram showing an example of a computer that executes an analysis program. The computer 1000 includes, for example, a memory 1010 and a CPU 1020. The computer 1000 also includes a hard disk drive interface 1030, a disk drive interface 1040, a serial port interface 1050, a video adapter 1060, and a network interface 1070. These components are connected by a bus 1080.

[0071] The memory 1010 includes a read-only memory (ROM) 1011 and a random access memory (RAM) 1012. The ROM 1011 stores a boot program such as a basic input / output system (BIOS). The hard disk drive interface 1030 is connected to a hard disk drive 1090. The disk drive interface 1040 is connected to a disk drive 1100. A removable storage medium such as a magnetic disk or optical disk is inserted into the disk drive 1100. The serial port interface 1050 is connected to a mouse 1110 and a keyboard 1120, for example. The video adapter 1060 is connected to a display 1130, for example.

[0072] The hard disk drive 1090 stores, for example, an OS 1091, an application program 1092, a program module 1093, and program data 1094. That is, the programs that define each process of the analysis device 10 are implemented as program modules 1093 in which computer-executable code is written. The program modules 1093 are stored, for example, in the hard disk drive 1090. For example, the program modules 1093 for executing processes similar to those of the functional configuration of the analysis device 10 are stored in the hard disk drive 1090. The hard disk drive 1090 may be replaced by an SSD (Solid State Drive).

[0073] Furthermore, setting data used in the processing of the above-described embodiment is stored as program data 1094, for example, in the memory 1010 or the hard disk drive 1090. Then, the CPU 1020 reads the program module 1093 or the program data 1094 stored in the memory 1010 or the hard disk drive 1090 into the RAM 1012 as necessary, and executes the processing of the above-described embodiment.

[0074] The program module 1093 and program data 1094 may not necessarily be stored in the hard disk drive 1090, but may also be stored in a removable storage medium and read by the CPU 1020 via the disk drive 1100 or the like. Alternatively, the program module 1093 and program data 1094 may be stored in another computer connected via a network (such as a local area network (LAN) or a wide area network (WAN)). The program module 1093 and program data 1094 may then be read by the CPU 1020 from the other computer via the network interface 1070.

[0075] 10 Analysis device 11 Acquisition unit 12 Normalization unit 13 Analysis unit 14 Determination unit 20, 40 Transfer device 30_1, 30_2, 30_n Transmission device 202, 301_1a, 301_1b, 302_1, 301_2, 302_2, 301_n, 302_na, 302_nb, 401 IF

Claims

1. An analysis device comprising: an acquisition unit that acquires IF statistics or time series data of optical channel conditions from each of two adjacent network IFs among multiple router devices that forward IP packets and network IFs provided in one or more transmission devices that connect the multiple router devices; a normalization unit that normalizes the data acquired by the acquisition unit; and an analysis unit that analyzes the data normalized by the normalization unit.

2. The analytical device according to claim 1, characterized in that the normalization unit normalizes the data by one of time interpolation processing, resampling processing, statistical calculation, conversion from cumulative values ​​to time values, or difference calculation.

3. The analysis device according to claim 1, characterized in that the acquisition unit acquires as the data at least one of the number of packets and the number of bytes, which are IF statistics, and the optical intensity and the error rate, which are optical channel conditions.

4. An analysis method executed by an analysis device, comprising: an acquisition step of acquiring IF statistics or time series of optical channel conditions as data from each of two adjacent network IFs among a plurality of router devices that forward IP packets and network IFs provided in one or more transmission devices that connect the plurality of router devices; a normalization step of normalizing the data acquired by the acquisition step; and an analysis step of analyzing the data normalized by the normalization step.

Images