Traffic monitoring device and traffic monitoring system

Abstract

A traffic monitoring device according to the present invention extracts field information on an input packet on the basis of a first pattern table in which a field pattern of a packet is registered, identifies a monitoring target flow by collating the extracted field information with a first rule table in which field information on the monitoring target flow is registered, determines whether an abnormality has occurred in the monitoring target flow by using statistical information of the monitoring target flow, identifies the pattern of a field corresponding to the abnormality type of the occurring abnormality in an abnormality type pattern table in which a field pattern of a packet is registered for each abnormality type, and generates a second pattern table including the pattern of a field corresponding to the abnormality type and a second rule table including field information corresponding to the pattern of the field corresponding to the abnormality type.

Description

Traffic monitoring device and traffic monitoring system

[0001] The present invention relates to a traffic monitoring device for monitoring network traffic.

[0002] 9 shows the configuration of a conventional traffic monitoring device 10 that combines an FPGA and a general-purpose server to visualize traffic for each flow (see, for example, Non-Patent Document 1). The conventional traffic monitoring device 10 taps from a monitoring point (probe point) of a monitored network (NW) 100 and receives copied or mirrored packets flowing through the NW.

[0003] The header analysis unit 11 extracts header information according to a pattern table in which patterns of fields to be extracted are registered. The flow identification unit 12 identifies the flow of the packet from the extracted header information by comparing the header information with a rule table 40 in which rules corresponding to each flow are registered. The statistical information compilation unit 13 periodically compiles communication volume such as the number of packets and the number of bytes for each flow as statistical information based on the identification result of the flow identification unit 12. The statistical information visualization unit 16 visualizes the statistical information compiled by the statistical information compilation unit 13.

[0004] In addition to the statistical information visualization unit 16, the traffic monitoring device 10 also has a jitter latency measurement unit 15 that measures the amount of jitter latency by analyzing packets with sequence numbers, such as RTP (Realtime Transport protocol) packets for carrying audio / video in real time, and a capture function unit 14 that captures packets of a specified flow in order to analyze the packets in more detail.

[0005] In the traffic monitoring device 10 of Non-Patent Document 1, the flow to be visualized is, for example, a fixed protocol (e.g., IPv4, TCP, UDP, etc.) that is predetermined in the traffic monitoring device 10. On the other hand, there is also a technique that can create a rule that specifies a field in an arbitrary packet in an area in the fixed header of the packet, and visualize the flow using the rule.

[0006] Specifically, a pattern table 30 containing multiple patterns is prepared, with each pattern being a combination of the start bit position and end bit position of the field to be visualized for the number of fields to be visualized. The flow can be visualized by setting specific field values ​​to be visualized in the patterns defined in the pattern table 30 in a rule table 40 (see, for example, Patent Document 1).

[0007] In this way, in addition to fixed protocols, a specific flow can be visualized using rules that combine field values ​​arbitrarily specified by the user. By using such pattern table 30 and rule table 40, it becomes possible to visualize even flows that include fields that represent communication quality, enabling efficient network fault analysis.

[0008] Patent No. 7220814

[0009] Ikeda et al., "Hardware Accelerator-Enabled Virtualization-Compatible Traffic Monitoring System (1) - System Architecture for Traffic Visualization -" Institute of Electronics, Information and Communication Engineers General Conference, March 2020

[0010] The above-mentioned conventional technology can visualize flows that represent communication quality, but there is a limit to the maximum number of flows that can be visualized. If an attempt is made to visualize fields deeper than the 5-tuple (source IP, source port number, destination IP, destination port number, protocol number) that represent communication quality, the number of field combinations becomes enormous, and it may not be possible to visualize all flows.

[0011] Even if it were possible to visualize all combinations of flows, the number of flows to be checked would increase, making the process of analyzing the failure cumbersome, and so the failure analyst may overlook the failure when it occurs.Furthermore, because there are a wide variety of causes of failures in a network, it may be difficult to identify flows that could cause a failure before the failure occurs and visualize them in advance.

[0012] The present invention has been made to solve the above-mentioned problems, and has an object to provide a traffic monitoring device that efficiently identifies the cause of a network failure.

[0013] In order to solve the above problems, the traffic monitoring device of the present invention is a traffic monitoring device that monitors the traffic of packets flowing through a network to be monitored, and includes a header analysis unit that extracts field information of an input packet based on a first pattern table in which field patterns of the packet are registered, a flow identification unit that identifies the flow to be monitored by comparing the field information extracted by the header analysis unit with a first rule table in which field information of the flow to be monitored is registered, a statistical information aggregation unit that aggregates statistical information of the flow to be monitored, and a statistical information aggregation unit that uses the statistical information to determine whether an abnormality has occurred in the flow to be monitored and, if so, and a rule generation unit that rewrites the first pattern table and the first rule table according to the determination result of the abnormality determination unit to generate a second pattern table and a second rule table, wherein the rule generation unit specifies a field pattern corresponding to the abnormality type in an abnormality type pattern table in which packet field patterns are registered for each abnormality type, generates the second pattern table including the field pattern corresponding to the abnormality type, and generates the second rule table including field information corresponding to the field pattern corresponding to the abnormality type.

[0014] According to the present invention, it is possible to provide a traffic monitoring device that efficiently identifies the cause of a network failure.

[0015] FIG. 1 is a block diagram showing a configuration example of a traffic monitoring device according to a first embodiment; FIG. 2 is a flowchart showing the operation of the traffic monitoring device according to the first embodiment; FIG. 3 is a diagram for explaining a pattern table according to the first embodiment; FIG. 4 is a diagram for explaining a rule table according to the first embodiment; FIG. 5 is a block diagram showing a configuration example of a traffic monitoring device according to a second embodiment; FIG. 6 is a flowchart showing the operation of the traffic monitoring device according to the second embodiment; FIG. 7 is a block diagram showing a configuration example of a traffic monitoring system according to a third embodiment; FIG. 8 is a block diagram showing a configuration example of a traffic monitoring system according to the third embodiment; FIG. 9 is a block diagram showing a configuration example of a conventional traffic monitoring device;

[0016] 1 is a block diagram showing an example of the configuration of a traffic monitoring device according to a first embodiment. Similar to conventional traffic monitoring devices, the traffic monitoring device 10 of this embodiment can be configured by combining an FPGA and a general-purpose server. For example, the functions of the header analysis unit 11 and the flow identification unit 12 can be realized by an FPGA, and the functions of the statistical information visualization unit 16 and the like can be realized by a general-purpose server.

[0017] The traffic monitoring device 10 of this embodiment comprises a header analysis unit 11, a flow identification unit 12, a statistical information collection unit 13, a capture function unit 14, and a jitter / latency measurement unit 15, similar to conventional traffic monitoring devices.

[0018] The header analysis unit 11 extracts header information according to a pattern table 30 (first pattern table) in which patterns of fields to be extracted are registered. The flow identification unit 12 identifies the flow of the packet from the extracted header information by comparing the header information with a rule table 40 (first rule table) in which rules corresponding to each flow are registered. The statistical information compilation unit 13 periodically compiles communication volume such as the number of packets and the number of bytes for each flow as statistical information based on the identification results of the flow identification unit 12. The statistical information visualization unit 16 visualizes the statistical information compiled by the statistical information compilation unit 13.

[0019] In addition to the configuration of a conventional traffic monitoring device, the traffic monitoring device 10 of this embodiment includes an abnormality determination unit 17 that determines whether an abnormality has occurred in a monitored flow using statistical information and identifies the type of abnormality depending on the content of the abnormality in the monitored flow that has been determined to be abnormal, and a rule generation unit 18 that generates a new pattern table (second pattern table) and a rule table (second rule table) using the determination result of the abnormality determination unit 17.

[0020] 2 is a flowchart showing the operation of the traffic monitoring device according to the first embodiment. The process shown in this flowchart is performed at a predetermined interval. For example, it may be performed at each statistical information collection interval or at a multiple of that interval.

[0021] 2, the anomaly determination unit 17 determines whether an anomaly has occurred in the monitored flow (step S1-1). Possible methods for determining whether an anomaly has occurred include, for example, a method of determining an anomaly by setting a threshold for the amount of communication traffic and determining whether the traffic exceeds or falls below the threshold, or a method of using anomaly detection in which normal traffic patterns are registered and traffic that differs from the registered normal traffic patterns is determined to be abnormal.

[0022] The abnormality determination unit 17 identifies the rule of the flow determined to be abnormal, identifies the pattern of the identified rule (step S1-2), and stores the rule and pattern of the abnormal flow (step S1-3).The abnormality determination unit 17 identifies the abnormality type (abnormality number) according to the content of the abnormality in the flow determined to be abnormal (step S1-4).

[0023] The traffic monitoring device 10 includes an abnormality type pattern table 50 for visualizing the causes of abnormalities identified by the abnormality determination unit 17. The abnormality type pattern table 50 stores, for each abnormality type, patterns of field combinations for visualizing possible causes of abnormalities.

[0024] For example, if the anomaly type is an anomaly in the traffic volume of a flow transmitting video information, a field combination pattern that enables extraction of a communication quality flag from a packet of the anomaly-occurring flow is registered. By configuring the pattern table 30 according to this field combination pattern, it becomes possible to extract the communication quality flag and visualize the cause of the anomaly in the anomaly-occurring flow.

[0025] The rule generation unit 18 refers to the abnormality type pattern table 50 to identify the pattern of the combination of fields corresponding to the abnormality type identified by the abnormality judgment unit 17, and rewrites the pattern of the pattern table 30 in accordance with the identified pattern of the combination of fields to generate a new pattern table 31 (second pattern table) (step S1-5).

[0026] The rule generation unit 18 generates a new rule table 41 (second rule table) by rewriting or adding field information according to the pattern of field combinations corresponding to the abnormality type identified by the abnormality determination unit 17 (step S1-6).

[0027] After the new pattern table 31 and the new rule table 41 are generated, the header analysis unit 11 extracts header information in accordance with the new pattern table 31. The flow identification unit 12 compares the header information with the new rule table 41, and identifies the flow of the packet from the extracted header information.

[0028] The statistical information collecting unit 13 collects statistical information of the flows to be monitored based on the identification result of the flow identifying unit 12 performed using the new rule table 41. The statistical information visualizing unit 16 uses the statistical information collected by the statistical information collecting unit 13 to visualize the cause of the abnormality in the abnormality-occurring flow.

[0029] 3 is a diagram for explaining the pattern table according to the first embodiment. In the abnormality type pattern table 50 in FIG. 3, combinations of start bits and end bits of fields are registered for each abnormality type.

[0030] 3, when an abnormality with abnormality type number 1 occurs, the start bit: aa and end bit: bb of field 1 of abnormality number 1 and the start bit: cc and end bit: dd of field N are identified, and the pattern of the field with pattern number 2 in the pattern table is rewritten according to the pattern of these fields. This enables the header analysis unit 11 to extract field information of the fields for visualizing the cause of the abnormality in the flow where the abnormality occurred.

[0031] 4 is a diagram for explaining the rule table according to the first embodiment. As described above, after generating the new pattern table, the rule generating unit 18 prepares a plurality of additional rule tables for each abnormality type, selects a rule to be added from the plurality of additional rule tables based on the abnormality type determined by the abnormality determining unit 17, and adds the selected rule to the rule table 40, thereby generating a new rule table 41, as shown in FIG.

[0032] 4, a new rule table 41 is generated in which rules with rule numbers Rmid to Rmax have been added. All possible field values ​​according to the field patterns for each abnormality type may be registered in advance in the added rule table.

[0033] In this embodiment, the number of rules initially registered in the rule table 40 is set to be less than the maximum number of rules that can be registered, and the occurrence of an abnormality in the monitored flow is used as a trigger to generate a new pattern table 31 and a new rule table 41 in order to visualize the cause of the abnormality that has occurred.

[0034] The new pattern table 31 and the new rule table 41 may be reconfigured by stopping the traffic monitoring device 10, or may be updated automatically without stopping the traffic monitoring device 10, using technology such as that described in Patent Document 2 (International Publication No. 2022 / 269678).

[0035] According to this embodiment, new rules are registered based on the occurrence of an abnormality in the monitored flow, rather than pre-registering rules that can be considered for all types of abnormality. This makes it possible to efficiently analyze network faults with a smaller number of registered rules.

[0036] [Second embodiment] In the first embodiment, all possible field values ​​must be registered in advance in the additional rule table according to the field pattern for each anomaly type, as explained in Fig. 4. Therefore, field values ​​that are not actually flowing in the network as packets may be registered in the rule table, which may result in unnecessary resource consumption in the rule table.

[0037] The traffic monitoring device 10 according to the second embodiment is configured to add the minimum necessary rules when an abnormality occurs while analyzing packets flowing through the network. Fig. 5 is a block diagram showing an example of the configuration of the traffic monitoring device according to the second embodiment.

[0038] The traffic monitoring device 10 of the second embodiment differs from the traffic monitoring device 10 of the first embodiment in that it includes a distribution unit 20 and a packet analysis unit.

[0039] The distribution unit 20 is configured to distinguish and distribute packets input to the traffic monitoring device between registered packets registered in the rule table 40 and unregistered packets not registered.

[0040] The registered packets are transferred to the statistical information collection unit 13, and the unregistered packets are transferred to the packet analysis unit 14. The packet analysis unit is configured to analyze the unregistered packets in response to an abnormality occurring in the monitored flow as a trigger, and extract field values ​​of the unregistered packets.

[0041] The operations of collecting statistical information in the statistical information collecting unit 13 and of determining abnormality in the abnormality determining unit 17 are the same as those in the first embodiment. The operation of generating a rule table in the rule generating unit 18 in the second embodiment is different in that a new rule table 41 is generated using the field values ​​of unregistered packets.

[0042] 6 is a flowchart showing the operation of the traffic monitoring device according to the second embodiment. The operation of the abnormality determination unit 17 (steps S2-1 to S2-4) is the same as the operation of the abnormality determination unit 17 in FIG. 2 (steps S1-1 to S1-4) described in the first embodiment. The operation of the rule generation unit 18 to generate a pattern table (step S2-5) is the same as the operation of the rule generation unit 18 in FIG. 2 (step S1-5) described in the first embodiment.

[0043] The packet analysis unit extracts field values ​​of the unregistered packet that match the pattern according to the field corresponding to the abnormality type identified by the abnormality determination unit 17 (step 2-6). The field pattern corresponding to the abnormality type can be identified by referring to the abnormality type pattern described in FIG.

[0044] The packet analysis unit ends the analysis of the packet at a predetermined timing (step S2-7). The analysis may be ended after a certain time has elapsed since the start of the analysis, or may be configured to end the analysis at the discretion of the user after the start of the analysis.

[0045] The rule generating unit 18 generates a new rule table 41 using the field values ​​extracted from the unregistered packet (step S2-8).

[0046] In the second embodiment, only the field values ​​extracted by the packet analysis unit are used to generate the new rule table 41. According to this embodiment, the new rule table 41 is generated in accordance with packet information flowing within the network, which reduces the memory required for additional rule tables that need to be stored in advance and also makes it possible to effectively utilize the generated rule table.

[0047] In the first and second embodiments, the occurrence of an abnormality is determined based on statistical information obtainable by a single traffic monitoring device. In an actual network failure, the occurrence of a traffic abnormality may be determined by comprehensively considering information from multiple traffic monitoring devices.

[0048] FIG. 7 is a block diagram showing an example configuration of a traffic monitoring system according to a third embodiment. The traffic monitoring system 1 of the third embodiment comprises a plurality of probes (70-1 to 70-N) that analyze mirrored packets from a plurality of subnetworks (200-1 to 200-N) that constitute the integrated network 200 to be monitored and generate statistical information, and at least one controller 60 that aggregates the plurality of probes (70-1 to 70-N) and visualizes the statistical information collectively. The third embodiment is a traffic monitoring system that determines abnormalities in the monitored flow based on statistical information from the plurality of probes (70-1 to 70-N). The controller 60 and the plurality of probes (70-1 to 70-N) are assumed to be synchronized using time information provided by a common time source 80.

[0049] 8 is a block diagram showing an example configuration of a traffic monitoring system according to a third embodiment. The probes (70-1 to 70-N) have the same configuration as the conventional traffic monitoring device 10 except for the statistical information visualization unit 16, and are equipped with an interface for outputting statistical information to the outside. The controller 60 includes a statistical information visualization unit 61 that visualizes the statistical information output from the probes (70-1 to 70-N), an abnormality determination unit 62, and a rule generation unit 63, which are described in the first and second embodiments.

[0050] The controller 60 further includes a latency calculation unit 64 that calculates the latency of the same flow between any two points from statistical information of a plurality of probes (70-1 to 70-N), and a packet loss calculation unit 65 that calculates packet loss.

[0051] The latency calculation unit 64 calculates latency using timestamps that are stamped when packets are input to each probe (70-1 to 70-N). Specifically, the flow to be measured for latency is set in the probes (70-1 to 70-N) and the controller 60, and the latency is calculated by calculating the difference between the timestamps of the set flow.

[0052] The packet loss calculation unit 65 sets the probes and flows at two points to be calculated, and uses the number of packets contained in the statistical information to calculate the packet loss rate from the difference in the number of packets at each probe (70-1 to 70-N) for each statistical information collection interval.

[0053] In this embodiment, in addition to the statistical information described in the first embodiment, information on the latency and packet loss rate between two probes calculated by the controller is added as information input to the abnormality determination unit 62.

[0054] The abnormality determination unit 62 in the third embodiment can determine an abnormality in the monitoring flow based on the calculation results of the latency and packet loss rate. The rule generation unit 63 generates new patterns and rules based on the results of the abnormality determination by the abnormality determination unit 62, as in the first and second embodiments.

[0055] Although the configuration of the third embodiment has been described above based on the configuration of the first embodiment, the traffic monitoring system may also be configured based on the configuration of the second embodiment.

[0056] According to this embodiment, it is possible to determine the occurrence of traffic abnormalities by taking into account statistical information from multiple monitored networks in an integrated manner, thereby realizing a traffic monitoring system that can identify the causes of failures in a greater number of networks.

[0057] [Extending the Embodiments] The present invention has been described above with reference to the embodiments, but the present invention is not limited to the above embodiments. Various modifications that can be understood by those skilled in the art can be made to the configuration and details of the present invention within the scope of the present invention. Furthermore, the embodiments can be implemented in any combination within a consistent range.

[0058] Some or all of the above-described embodiments can be described as, but are not limited to, the following supplementary notes.

[0059] [Supplementary Note 1] A traffic monitoring device for monitoring packet traffic flowing through a network to be monitored, comprising: a header analysis unit that extracts field information of an input packet based on a first pattern table in which patterns of the fields of the packet are registered; a flow identification unit that identifies the flow to be monitored by comparing the field information extracted by the header analysis unit with a first rule table in which field information of the flow to be monitored is registered; a statistical information collection unit that collects statistical information of the flow to be monitored; an abnormality determination unit that determines whether an abnormality has occurred in the flow to be monitored using the statistical information and identifies an abnormality type in the flow to be monitored in which it is determined that an abnormality has occurred; and a rule generation unit that rewrites the first pattern table and the first rule table according to the determination result of the abnormality determination unit to generate a second pattern table and a second rule table, wherein the rule generation unit identifies a field pattern corresponding to the abnormality type in an abnormality type pattern table in which patterns of the fields of the packet are registered for each of the abnormality types, A traffic monitoring device that generates the second pattern table including field patterns corresponding to the abnormality types, and generates the second rule table including field information corresponding to the field patterns corresponding to the abnormality types.

[0060] [Supplementary Note 2] A traffic monitoring device according to Supplementary Note 1, further comprising: a distribution unit that distributes packets identified by the flow identification unit into registered packets registered in the rule table and unregistered packets that are not registered; and a packet analysis unit that, when the abnormality determination unit determines that an abnormality has occurred in the monitored flow, extracts field information from the unregistered packets that corresponds to a field pattern corresponding to the abnormality type, and the rule generation unit generates the second rule table including the field information extracted by the packet analysis unit.

[0061] and a rule generation unit that rewrites the first pattern table and the first rule table in accordance with a determination result of the abnormality determination unit to generate a second pattern table and a second rule table. [Supplementary Note 3] A traffic monitoring system that monitors packet traffic flowing through an integrated network consisting of a plurality of subnetworks, comprising: a plurality of probes for monitoring traffic in each of the plurality of subnetworks; and at least one controller that collects statistical information from the plurality of probes, wherein the probe comprises: a header analysis unit that extracts field information of an input packet based on a pattern table in which field patterns of the packet to be extracted are registered; a flow identification unit that identifies the flow to be monitored by comparing the extracted field information with a rule table in which field information of the flow to be monitored is registered; and a statistical information collection unit that collects statistical information of the flow to be monitored, wherein the controller comprises: an abnormality determination unit that determines whether an abnormality has occurred in the flow to be monitored by using the statistical information, and identifies an abnormality type in the flow to be monitored that has been determined to be abnormal; and a rule generation unit that rewrites the first pattern table and the first rule table in accordance with a determination result of the abnormality determination unit to generate a second pattern table and a second rule table.

[0062] [Appendix 4] The traffic monitoring system according to Appendix 3, further comprising a calculation unit that calculates at least one of latency and packet loss between two probes using the statistical information collected by the plurality of probes, wherein the abnormality determination unit determines whether an abnormality has occurred in the monitored flow using the statistical information and the calculation result of the calculation unit.

[0063] The present invention can be applied to a traffic monitoring device that monitors network traffic.

[0064] 1...traffic monitoring system, 10...traffic monitoring device, 11...header analysis unit, 12...flow identification unit, 13...statistical information aggregation unit, 14...capture function unit, 15...jitter / latency measurement unit, 16...statistical information visualization unit, 17...abnormality determination unit, 18...rule generation unit, 30...pattern table, 31...new pattern table, 40...rule table, 41...new rule table, 100...monitored network.

Claims

1. A traffic monitoring device for monitoring packet traffic flowing through a monitored network, comprising: a header analysis unit that extracts field information of an input packet based on a first pattern table in which patterns of the packet fields are registered; a flow identification unit that identifies the monitored flow by comparing the field information extracted by the header analysis unit with a first rule table in which field information of the monitored flow is registered; a statistical information collection unit that collects statistical information of the monitored flow; an abnormality determination unit that uses the statistical information to determine whether an abnormality has occurred in the monitored flow and identifies an abnormality type in the monitored flow in which it is determined that an abnormality has occurred; and a rule generation unit that rewrites the first pattern table and the first rule table according to the determination result of the abnormality determination unit to generate a second pattern table and a second rule table, wherein the rule generation unit identifies a field pattern corresponding to the abnormality type in an abnormality type pattern table in which patterns of the packet fields are registered for each of the abnormality types, A traffic monitoring device that generates the second pattern table including field patterns corresponding to the abnormality types, and generates the second rule table including field information corresponding to the field patterns corresponding to the abnormality types.

2. A traffic monitoring device as described in claim 1, further comprising: a distribution unit that distributes packets identified by the flow identification unit into registered packets registered in the rule table and unregistered packets that are not registered; and a packet analysis unit that, when the abnormality determination unit determines that an abnormality has occurred in the monitored flow, extracts field information from the unregistered packets that corresponds to the pattern of a field corresponding to the abnormality type, and the rule generation unit generates the second rule table including the field information extracted by the packet analysis unit.

3. A traffic monitoring system for monitoring packet traffic flowing through an integrated network consisting of multiple subnetworks, comprising: multiple probes for monitoring traffic in each of the multiple subnetworks; and at least one controller for aggregating statistical information from the multiple probes, wherein the probe comprises: a header analysis unit for extracting field information from an input packet based on a first pattern table in which patterns of fields in the extracted packets are registered; a flow identification unit for identifying the flow to be monitored by comparing the extracted field information with a first rule table in which field information of the flow to be monitored is registered; and a statistical information aggregation unit for aggregating statistical information from the flow to be monitored, wherein the controller comprises: an abnormality determination unit for determining whether an abnormality has occurred in the flow to be monitored using the statistical information, and specifying the type of abnormality in the flow to be monitored that has been determined to be abnormal; and a rule generation unit for rewriting the first pattern table and the first rule table in accordance with the determination result of the abnormality determination unit to generate a second pattern table and a second rule table.

4. A traffic monitoring system as described in claim 3, further comprising a calculation unit that uses the statistical information collected by the multiple probes to calculate at least one of the latency and packet loss between two probes, and wherein the abnormality determination unit uses the statistical information and the calculation results of the calculation unit to determine whether an abnormality has occurred in the monitored flow.

Images