JP7619485B2 - Traffic monitoring device, traffic monitoring method, and program - Google Patents

Description

The present invention relates to a traffic monitoring device, a traffic monitoring method, and a program.

In order to grasp the communication status of a communication network, particularly traffic abnormalities of flows that are collections of packets with a common destination and/or source flowing through a communication network, it is common to acquire all packets flowing through the communication network and monitor the traffic of all flows (for example, Non-Patent Document 1). Here, due to factors such as the virtualization of communication networks, which has led to multiple communication networks being configured on a single physical structure, a large number of flows exist on the communication network.

Michal Kekely, Jan Korenek, “Mapping of P4 Match Action Tables to FPGA,” 2017 27th International Conference on Field Programmable Logic and Applications (FPL)

When there are a large number of flows on a communication network, it is not realistic to monitor all the flows, so it is better to monitor only a portion of the flows.

The objective of the present invention is to appropriately select flows to be monitored.

In order to solve the above problems, the traffic monitoring device according to the present invention is a traffic monitoring device that monitors traffic in a communication network for each flow, and includes a receiving unit that sequentially receives a plurality of packets flowing through the communication network, a packet identification unit that sequentially identifies whether or not each of the plurality of packets sequentially received by the receiving unit belongs to a flow to be monitored, an aggregation unit that aggregates packets identified by the packet identification unit as belonging to the flow to be monitored, an output unit that outputs the results of the aggregation by the aggregation unit, and a flow monitoring unit that aggregates flows for which the traffic flow rate or its increase rate has become greater than a first criterion based on the plurality of packets sequentially received by the receiving unit. a packet sampling unit that samples a portion of the plurality of packets sequentially received by the receiving unit; a high-flow flow detection unit that estimates an average traffic flow rate before sampling of a flow to which each of the portion of packets belongs based on the portion of packets sampled by the packet sampling unit and detects a flow for which the estimated average traffic flow rate is higher than a second criterion as a high-flow flow; and a monitoring target control unit that adds the flow detected as the burst flow to the monitoring target and adds the flow detected as the high-flow flow to the monitoring target.

The traffic monitoring method according to the present invention is a traffic monitoring method for monitoring traffic in a communication network for each flow, and includes a packet identification step for sequentially identifying whether or not each of a plurality of packets flowing through the communication network, which are sequentially received by a receiving unit, belongs to a flow to be monitored; an aggregation step for tallying up packets identified by the packet identification step as belonging to the flow to be monitored; a burst flow detection step for detecting a flow whose traffic flow rate or its increase rate has become greater than a first criterion as a burst flow based on the plurality of packets sequentially received by the receiving unit; a packet sampling step for sampling a portion of the plurality of packets sequentially received by the receiving unit; a high-flow flow detection step for estimating an average traffic flow rate before sampling of the flow to which each of the portion of packets belongs based on the portion of packets sampled by the packet sampling step, and detecting a flow whose estimated average traffic flow rate is greater than a second criterion as a high-flow flow; and a monitoring target control step for adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high-flow flow to the monitoring target.

The program of the present invention also causes a computer that monitors traffic in a communication network for each flow to execute a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network that are sequentially received by a receiving unit belongs to a flow to be monitored; a counting step of counting packets identified by the packet identification step as belonging to the flow to be monitored; a burst flow detection step of detecting a flow whose traffic flow rate or its increase rate has become greater than a first criterion as a burst flow based on the plurality of packets sequentially received by the receiving unit; a packet sampling step of sampling a portion of the plurality of packets sequentially received by the receiving unit; a high-flow flow detection step of estimating an average traffic flow rate before sampling of the flow to which each of the portion of packets belongs based on the portion of packets sampled by the packet sampling step, and detecting a flow whose estimated average traffic flow rate is greater than a second criterion as a high-flow flow; and a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high-flow flow to the monitoring target.

According to the present invention, the flows to be monitored are appropriately selected.

FIG. 1 is a diagram showing the configuration of a traffic monitoring device according to an embodiment of the present invention. FIG. 2 is a diagram illustrating an example of a data structure of a packet. FIG. 3 is a diagram showing an example of the structure of the rule table. FIG. 4 is a graph showing a change in traffic flow rate when a microburst occurs. FIG. 5 is a graph showing the change in traffic flow rate of a high-flow rate flow. FIG. 6 is a flowchart of the first rule control process. FIG. 7 is a flowchart of the second rule control process. FIG. 8 is a diagram showing the configuration of the traffic monitoring device of FIG. 1 implemented by a computer.

Below, an embodiment of the present invention is explained with reference to the drawings.

As shown in Fig. 1, the traffic monitoring device 10 according to the present embodiment includes a receiving unit 11, a packet identification unit 12, a counting unit 13, and an output unit 14. The traffic monitoring device 10 further includes a burst flow detection unit 15, a packet sampling unit 16A, a high-flow rate flow detection unit 16B, a monitoring target control unit 17, and a memory unit 19. The traffic monitoring device 10 thus configured is configured to monitor the traffic of the communication network NW for each flow.

At least a part of each of the above units 11 to 17 is composed of a logic circuit written in, for example, an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). At least a part of each of the units 11 to 17 may be composed of a processor such as a CPU (Central Processing Unit) that executes a program. The storage unit 19 is composed of an appropriate non-volatile storage device such as a flash memory or an SSD (Solid State Drive). The storage unit 19 may be composed of at least a part of a memory such as an FPGA (Field-Programmable Gate Array) or an ASIC (Application Specific Integrated Circuit). Each of the units 11 to 17 may be composed of a memory that temporarily holds data being processed, etc.

The receiver 11 sequentially receives multiple packets (more specifically, mirroring packets) being transmitted and received in the communication network NW one by one. As shown in FIG. 2, a packet is composed of data (also called payload) and a header placed before the data. Each piece of data constituting the header is assigned a meaning for each number of bits. This bit-separated data with a meaning is called a header field value, and a group of packets with matching header field values is called a flow. Therefore, the header field value is also information that identifies a flow. The header field value may include each IP (Internet Protocol) address indicating the source and destination of the L3 header. A flow may be, for example, a collection of packets that have a common header field value indicating at least one of the destination, source, and communication protocol.

Returning to Figure 1, each packet received by the receiving unit 11 is input to each of the packet identification unit 12, burst flow detection unit 15, and packet sampling unit 16A, which are arranged in parallel with each other as viewed from the receiving unit 11.

The packet identification unit 12 identifies whether each of the multiple packets received sequentially by the receiving unit 11 belongs to a flow to be monitored. A flow to be monitored is a flow that has been detected as a burst flow or a high-volume flow, as described below, and has been added to the list of flows to be monitored.

For example, the packet identification unit 12 extracts a header field value from a packet to be processed. Furthermore, the packet identification unit 12 refers to a rule table 19A stored in the memory unit 19. Rules that specify packets that belong to a flow to be monitored are registered in the rule table 19A. As shown in FIG. 3, a rule is registered for each flow to be monitored, and one rule includes the header field value of the flow, a flow ID associated with the header field value, and a monitoring cause (burst flow or high-flow rate flow) for which the flow became a target for monitoring. The flow ID may consist of a rule ID that identifies the rule.

The packet identification unit 12 searches the rule table 19A for the header field value extracted above. If the search is a hit, the packet to be processed this time is identified as belonging to the flow to be monitored. In this case, the packet identification unit 12 obtains the flow ID and monitoring cause corresponding to the header field value used in the search from the rule table 19A. The packet identification unit 12 further measures the data amount of the packet to be processed this time. Here, the number of bytes is counted as the data amount. The packet identification unit 12 then outputs the obtained flow ID and monitoring cause, as well as the measured data amount, to the counting unit 13. If the search is not a hit, the flow to which the packet to be processed this time belongs is not being monitored. In this case, the packet identification unit 12 does not output the flow ID, monitoring cause, and data amount to the counting unit 13.

In this way, the packet identification unit 12 compares each of the multiple packets received sequentially by the receiving unit 11 with the rules that specify packets that belong to the flow to be monitored and are registered in the rule table 19A. The packet identification unit 12 identifies the packets that match the rules as packets that belong to the flow to be monitored.

The tallying unit 13 tallies packets identified by the packet identification unit 12 as belonging to a flow to be monitored. Here, the tallying unit 13 counts the number of times a flow ID has been received from the packet identification unit 12 for each flow ID, i.e., for each flow. The counted number of times of reception can also be said to be the number of packets received by the receiving unit 11, i.e., the number of packets. The tallying unit 13 accumulates the amount of data for each flow ID, i.e., for each flow. For each fixed period, the tallying unit 13 outputs to the output unit 14 the number of packets and the amount of data counted or accumulated during the fixed period, as well as the flow ID and the monitoring cause, as the tallying result. The tallying result may be either the number of packets or the number of bytes. The tallying result is also output to the monitoring target control unit 17.

The output unit 14 outputs the counting result from the counting unit 13. The output unit 14 may output at least the latter of the flow ID (or the name of the flow or rule identified from the flow ID) and the number of packets and the accumulated data amount for each flow as the counting result. The output unit 14 displays the counting result, for example, on a display device provided in the traffic monitoring device 10 or external to the traffic monitoring device 10. The output unit 14 may output the counting result to a processing unit provided inside or outside the traffic monitoring device 10, and the processing unit may determine the presence or absence of a traffic abnormality for each flow based on the counting result. The processing unit may execute a process of displaying a flow determined to have a traffic abnormality on the display device, and/or a process of blocking communication in the flow.

The burst flow detection unit 15 detects, based on multiple packets received sequentially by the receiving unit 11, a flow in which the traffic flow rate or its increase rate exceeds a first criterion as a burst flow. Figure 4 shows a burst flow detected by the burst flow detection unit 15. A burst flow is a sudden increase in traffic volume. A burst flow has a sudden large impact on the behavior of the communication network NW.

Returning to FIG. 1, the burst flow detection unit 15 monitors, for example, the number of packets and the total data amount of packets for each fixed period P for each flow (for each header field value) as a traffic flow rate. The burst flow detection unit 15 determines whether the number of packets or the total data amount for the most recent period P exceeds a predetermined threshold. If the number of packets or the total data amount exceeds a predetermined threshold, the traffic flow rate in that flow begins to increase (such as period T in FIG. 4), and the flow is detected as a burst flow. The traffic flow rate to be monitored may be only one of the number of packets and the total data amount. The method for detecting a burst flow may be performed by the method for detecting the occurrence of burst traffic described in International Publication WO/2021/014552. The detection of burst traffic in this publication corresponds to the detection of a burst flow. The burst flow detection unit 15 may monitor the time change in the traffic flow rate when the number of packets or the total data amount per unit time is taken as the traffic flow rate, and detect a flow in which the increase in the traffic flow rate exceeds a predetermined threshold as a burst flow. The burst flow detection unit 15 supplies the monitoring target control unit 17 with the field values of the packets to which the detected burst flow belongs.

The packet sampling unit 16A samples a portion of the packets received sequentially by the receiving unit 11. This allows a portion of packets to be randomly extracted from all packets received sequentially by the receiving unit 11. The packet sampling unit 16A sequentially supplies only the portion of packets obtained by sampling to the downstream high-flow rate flow detection unit 16B.

Based on a portion of packets sampled by the packet sampling unit 16A, the high-flow flow detection unit 16B estimates the average traffic flow rate before sampling of the flow to which each of the portion of packets belongs. The high-flow flow detection unit 16B detects as a high-flow flow a flow whose estimated average traffic flow rate is greater than a second criterion. The second criterion may be different for each flow. Figure 5 shows high-flow flows detected by the high-flow flow detection unit 16B. A high-flow flow is one in which the traffic flow rate is high over a long period of time. A high-flow flow has a long-term impact on the behavior of the communication network NW.

The high-flow flow detection unit 16B holds, for example, the packets sampled from the packet sampling unit 16A for each flow (for each header field value). When the high-flow flow detection unit 16B holds a new packet, it estimates the average traffic flow rate of the flow of all the original packets before sampling, that is, when sampling was not performed, based on the new packet and the packets held in the same flow (header field value) as the new packet. This average traffic flow rate is, for example, the average or representative value of the number of packets or the total data amount (traffic amount) per unit time in a predetermined period including the holding timing of the new packet. The estimation method is performed by any method using the sampling theorem, etc. The estimation method may be a method learned by machine learning, etc. The high-flow flow detection unit 16B determines whether the estimated average traffic flow rate exceeds a predetermined threshold. When it is determined that the average traffic flow rate exceeds the predetermined threshold, the flow to which the new packet belongs is detected as a high-flow flow with a large traffic flow rate. At this time, high-flow rate flow detection unit 16B supplies the header field value of the new packet to monitoring target control unit 17. By estimating the traffic flow rate of the original flow after sampling, the influence of a sudden decrease in traffic flow rate due to a microburst or the like is reduced, and high-flow rate flows are detected with high accuracy.

The monitoring target control unit 17 adds flows detected as burst flows by the burst flow detection unit 15 to the monitoring targets. Furthermore, the monitoring target control unit 17 adds flows detected as high-flow rates by the high-flow rate flow detection unit 16B to the monitoring targets. This addition is performed here by additionally registering rules that specify packets belonging to each flow, that is, combinations of flow IDs and header field values, in the rule table 19A.

The monitoring target control unit 17 adds the above flow to the monitoring target by, for example, executing the first rule control process shown in Figure 6. The monitoring target control unit 17 executes the first rule control process from the time the traffic monitoring device 10 is started up.

In the rule control process, the monitored object control unit 17 first determines whether a header field value has been supplied from the burst flow detection unit 15 (step S11). If the result of this determination is positive, the monitored object control unit 17 determines whether the supplied header field value is registered in the rule table 19A (step S12). If the result is positive, the flow of that header field value is already being monitored. In this case, the monitored object control unit 17 proceeds to the process of step S21.

If the determination result in step S12 is negative, the monitoring target control unit 17 acquires a flow ID corresponding to the currently supplied header field value (step S13). The monitoring target control unit 17 acquires a flow ID corresponding to the currently supplied header field value, for example, by referring to a table showing the correspondence between flow IDs and header field values stored in the memory unit 19 or the like. If the currently supplied header field value is not registered in the table, the monitoring target control unit 17 acquires the flow ID by issuing a new flow ID. In this case, the monitoring target control unit 17 also registers the flow ID and header field value in the table.

The monitoring target control unit 17 associates the header field value supplied this time with the flow ID obtained in step S13 as one rule and registers them in the rule table 19A (step S14).

After step S14, if the determination result of step S11 is negative, or if the determination result of step S12 is positive, the monitored object control unit 17 determines whether a header field value has been supplied from the high-flow rate flow detection unit 16B (step S21). If the determination result is positive, the monitored object control unit 17 executes the processing of steps S22 to S24. Steps S22 to S24 are the same processing as steps S12 to S14, respectively, and therefore detailed explanations are omitted. After step S24, if the determination result of step S21 is negative, or if the determination result of step S22 is positive, the monitored object control unit 17 executes step S11 again.

The monitoring target control unit 17 deletes the flows to be monitored, for example, by executing the second rule control process shown in Figure 7. The monitoring target control unit 17 executes the second rule control process from the time the traffic monitoring device 10 is started up.

In the second rule control process, the monitored object control unit 17 first determines whether the counting result has been supplied from the counting unit 13 (step S31). If the determination result is positive, the monitored object control unit 17 determines whether the number of packets or the amount of data, i.e., the traffic flow rate, included in the counting result for each of the flows to be monitored is lower than the third criterion (step S32). If the determination result is positive, the monitored object control unit 17 determines that the flow to be determined has become normal, and deletes the rule including the flow ID included in the counting result of the processing object from the rule table 19A (step S33). As a result, the flow that has become normal is deleted from the monitored object. If the determination result of step S31 or S32 is negative or after step S33, step S31 is executed again. The third criterion may be different for each flow and/or each monitoring cause.

As described above, the monitoring target control unit 17 excludes from the monitoring targets any flows whose number of packets or data volume, i.e., traffic flow rate, included in the aggregation result is lower than the third standard as flows that have become normal.

Through the above series of processes, burst flows and high-flow flows are added to the monitoring targets by the packet identification unit 12. As described above, burst flows and high-flow flows affect the behavior of the communication network NW in different ways. Here, burst flows change abruptly (see FIG. 4), and are difficult to detect using a detection method using sampling by the packet sampling unit 16A and the high-flow flow detection unit 16B. On the other hand, high-flow flows change little (see FIG. 5), and are difficult to detect by the burst flow detection unit 15. In this embodiment, the burst flow detection unit 15, the packet sampling unit 16A, and the high-flow flow detection unit 16B each detect burst flows and high-flow flows separately using a method suitable for detecting each flow. The detected flows are then added to the flows to be monitored by the packet identification unit 12 by the monitoring target control unit 17. Therefore, two types of flows that give the behavior of the communication network NW can be appropriately added to the monitoring targets, and the selection of the flows to be monitored is appropriately performed. Furthermore, the rule table 19A is used to manage the flows to be monitored, which makes it easier to manage the flows to be monitored.

Furthermore, in this embodiment, flows whose number of packets or data volume, i.e., traffic flow rate, included in the aggregation result is lower than the third standard are deemed to be normal flows and are excluded from monitoring, thereby preventing normal flows from remaining among the flows to be monitored and allowing appropriate selection of flows to be monitored.

Figure 8 shows a hardware configuration diagram of the traffic monitoring device 10 when configured by a computer. The traffic monitoring device 10 comprises a processor 101 such as a CPU, a main memory 102 of the processor 101, and a non-volatile storage device 103 that stores programs and various data and constitutes the storage unit 19 of Figure 1. The traffic monitoring device 10 further comprises a NIC (Network Interface Card) 104 that is connected to the communication network NW and relays packets. The processor 101 executes or uses the programs and data stored in the storage device 103 and read into the main memory 102 to operate as each of the above-mentioned units 11 to 17. The receiving unit 11 and the output unit 14 may be realized by a combination of the processor 101 that executes programs and the NIC 104.

[Scope of the present invention]
The present invention is not limited to the above-mentioned embodiment and modification. For example, the present invention includes various modifications to the above-mentioned embodiment and modification that can be understood by a person skilled in the art within the scope of the technical idea of the present invention. The configurations listed in the above-mentioned embodiment and modification can be appropriately combined within a range without contradiction. In addition, it is also possible to delete any of the above-mentioned configurations. The above-mentioned various programs may be stored in a non-transient computer-readable storage medium, not limited to the non-volatile storage device 103. The "device" and "part" may be an object in which the configuration for realizing the operation is housed in one housing, or an object (system) in which the configuration for realizing the operation is distributed and housed in multiple housings.

10...traffic monitoring device, 11...receiving unit, 12...packet identification unit, 13...counting unit, 14...output unit, 15...burst flow detection unit, 16A...packet sampling unit, 16B...high-flow rate flow detection unit, 17...monitoring target control unit, 19...memory unit, 19A...rule table, 101...processor, 102...main memory, 103...memory device, NW...communication network.

Claims (5)

A traffic monitoring device that monitors traffic in a communication network for each flow, comprising:
a receiving unit that sequentially receives a plurality of packets transmitted through the communication network;
a packet identification unit that sequentially identifies whether or not each of the plurality of packets sequentially received by the receiving unit belongs to a flow that is a monitoring target;
a counting unit that counts packets identified by the packet identification unit as belonging to the flow to be monitored;
an output unit that outputs a result of the counting by the counting unit;
a burst flow detection unit that detects, based on the plurality of packets sequentially received by the receiving unit, a flow in which a traffic flow rate or an increase rate thereof becomes greater than a first reference as a burst flow;
a packet sampling unit that samples some of the plurality of packets sequentially received by the receiving unit;
a high-flow-rate flow detection unit that estimates an average traffic flow rate before sampling of a flow to which each of the partial packets belongs based on the partial packets sampled by the packet sampling unit, and detects a flow in which the estimated average traffic flow rate is higher than a second criterion as a high-flow-rate flow;
a monitoring target control unit that adds the flow detected as the burst flow to the monitoring target and adds the flow detected as the high flow rate flow to the monitoring target;
A traffic monitoring device comprising: the packet identification unit compares each of the plurality of packets sequentially received by the receiving unit with a rule that is registered in a rule table and that specifies packets that belong to the flow to be monitored, and identifies a packet that matches the rule among the plurality of packets as a packet that belongs to the flow to be monitored;
when adding the burst flow or the high-flow rate flow to the flows to be monitored, the monitoring target control unit adds a rule that specifies packets belonging to the burst flow or the high-flow rate flow to the rule table.
2. A traffic monitoring device according to claim 1. the monitoring target control unit deletes, based on the counting result by the counting unit, flows whose traffic flow rate is lower than a third criterion from the monitoring targets.
3. A traffic monitoring device according to claim 1 or 2. A traffic monitoring method for monitoring traffic in a communication network for each flow, comprising the steps of:
a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network, which are sequentially received by a receiving unit, belongs to a flow to be monitored;
a counting step of counting packets identified as belonging to the flow to be monitored by the packet identification step;
a burst flow detection step of detecting, as a burst flow, a flow whose traffic flow rate or its increase rate has become greater than a first reference based on the plurality of packets sequentially received by the receiving unit;
a packet sampling step of sampling some of the plurality of packets sequentially received by the receiving unit;
a high-flow-rate flow detection step of estimating an average traffic flow rate before sampling of a flow to which each of the partial packets belongs based on the partial packets sampled by the packet sampling step, and detecting a flow in which the estimated average traffic flow rate is higher than a second criterion as a high-flow-rate flow;
a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high flow rate flow to the monitoring target;
A traffic monitoring method comprising: A computer that monitors the traffic of a communication network for each flow.
a packet identification step of sequentially identifying whether or not each of a plurality of packets flowing through the communication network, which are sequentially received by a receiving unit, belongs to a flow to be monitored;
a counting step of counting packets identified as belonging to the flow to be monitored by the packet identification step;
a burst flow detection step of detecting, as a burst flow, a flow whose traffic flow rate or its increase rate has become greater than a first reference based on the plurality of packets sequentially received by the receiving unit;
a packet sampling step of sampling some of the plurality of packets sequentially received by the receiving unit;
a high-flow-rate flow detection step of estimating an average traffic flow rate before sampling of a flow to which each of the partial packets belongs based on the partial packets sampled by the packet sampling step, and detecting a flow in which the estimated average traffic flow rate is higher than a second criterion as a high-flow-rate flow;
a monitoring target control step of adding the flow detected as the burst flow to the monitoring target and adding the flow detected as the high flow rate flow to the monitoring target;
A program that executes the following.

Images