JP2006279727A - Network control system and method therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid flapping at a time of traffic restriction. <P>SOLUTION: A plurality of control rules describing control commands of a network device to be issued when load of a server exceeds a predetermined threshold value are to be prepared previously. At this time, amount of traffic restrictions caused by the control commands is made to be adaptively small in response to lowness of the threshold value of the load. When the load of the server increases and exceeds the threshold value among the control rules, the control commands among the control rules are to be transmitted to the network device with a constant interval in the ascending order of the threshold value. When the load decreases conversely, one of the control commands having a larger threshold value i.e. having larger amount of traffic restrictions among the control rules whose load falls under the threshold value is to be released in turn with the constant interval. This series of operations are to be achieved by using a stack. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to one or more devices to be evaluated such as an intrusion detection system (IDS) that detects unauthorized access from a Web server, FTP server, or remote computer, and a router connected to the device to be evaluated. The present invention relates to a network control technique, device, and program for controlling network devices such as network switches and firewalls.

  In recent years, services that allow remote computers to access information stored in Web servers and FTP servers connected to networks such as the Internet have been provided. These servers are monitored using an intrusion detection system (IDS) for the purpose of detecting an intrusion attack from an unauthorized remote user (for example, see Non-Patent Document 1).

  In the IDS of the prior art, it is necessary for an operator to manually analyze a detection result (alert) to be obtained and distinguish an important alert from an alert that is not so. However, the amount of alerts obtained from IDS is enormous, and there is a problem that the above analysis work takes an enormous amount of time.

  Also, with conventional IDS operations for monitoring purposes or manual analysis, when the server is subjected to a huge number of intrusion attacks from unauthorized remote users, the server falls into an overload state and the request is processed normally. There was a situation in which it was impossible or system down, and normal user traffic and requests were invalidated.

  In addition, when a large number of requests are concentrated on the server at a time, the conventional IDS cannot perform the process of reducing (dropping) the number of requests, and thus there is a problem that the overload state of the server cannot be prevented.

  The inventors automatically identify the importance of the information obtained from the Web server and IDS, and automatically perform network control according to the importance, thereby promptly responding to an emergency situation of the server and operating costs of network management. A network control system that realizes reduction has already been proposed (Japanese Patent Application No. 2005-47437, not disclosed at the time of filing this application).

  In addition, in this system, when a server is overloaded, depending on the load of the server, the traffic of unauthorized remote users is preferentially regulated or the traffic of remote users is regulated and received by the server. By reducing the number of requests to be made, it is possible to recover from an overloaded state of the server.

"Current status of research on intrusion detection systems", Takeshi Atsushi, Information Processing, Vol. 42, No. 12, issued in December 2001

  In the above system, whether or not the server is overloaded is determined based on whether or not the load information acquired by monitoring the server exceeds a threshold value. When the load information exceeds the threshold, network control such as limiting the number of requests is performed accordingly.

  At this time, if the limit amount is too large, the load on the server is significantly reduced. Then, the network control is released in response to the load reduction of the server. As a result, a phenomenon in which the load on the server repeatedly increases and decreases (flapping) occurs, and the resources cannot be used efficiently. Therefore, a mechanism for avoiding this flapping is required.

  The present invention has been made under such a background, and an object thereof is to provide a network control system and method capable of avoiding the flapping as described above.

  In the present invention, in order to avoid flapping, the command issue order is controlled using a stack. In the present invention, first, a plurality of control rules describing a control command for a network device to be issued when the server load exceeds a certain threshold value are prepared. At this time, the traffic restriction amount by the control command is adaptively reduced according to the low load threshold.

  When the server load increases and exceeds the threshold value in the control rule, the control command of the control rule is transmitted to the network device at regular intervals in order from the threshold value set lower. On the other hand, when the load decreases, among the control rules whose load is less than the threshold value, the control commands having the larger threshold value, that is, the control commands having the larger traffic restriction amount are sequentially released at regular intervals.

  In the present invention, this series of operations is realized by using a stack. That is, when the load on the server exceeds the threshold set in the rule, the control rule is stacked on the stack and a control command is issued at the same time. At this time, the control rules are set in a stack at regular intervals in order from the control rule set with a lower threshold. Conversely, when the load on the server falls below the threshold value in the control rule, the control command is canceled at regular intervals and then loaded and unloaded from the stack.

  As a result, control commands with smaller traffic control amounts corresponding to the increase in server load are issued to the servers in order, and when the server load starts to decrease, the control commands are released in descending order of control commands. Therefore, it is possible to automatically adjust the traffic regulation amount so that the load can be maintained at a level while avoiding an overload of the server.

  That is, according to the first aspect of the present invention, load event detection means for detecting a load on a predetermined server, traffic restriction means for restricting the amount of traffic associated with communication, and load detected by the load event detection means. And a control means for adjusting a restriction amount of the traffic restriction means.

  Here, a feature of the present invention is that a plurality of stages of restriction amounts are set in advance as a plurality of control rules in accordance with a plurality of stages of load amounts, and the control rules are assigned to the traffic restriction means for each of the control rules. An issuance load condition, which is a lower limit load condition for determining whether to apply or not, and a release load condition, which is an upper limit load condition for canceling the issuance load condition, are determined in advance and correspond to the control rule. A database in which these issuance load conditions and release load conditions are recorded, and the control means searches the database based on the detection result of the load event detection means to find the corresponding issuance load conditions. Sometimes a restriction to issue a traffic volume partial restriction control command to the traffic restriction means based on the issue load condition A command issuing means, a recording means for recording an issuance history of the control command based on the issuing load condition by the restriction command issuing means according to a predetermined procedure, and searching the database based on a detection result of the load event detecting means, When satisfaction of the release load condition with respect to the issue load condition corresponding to the issue load condition corresponding to the issue history recorded in the recording means is retrieved, the issue history corresponding to the issue load condition is deleted, and the traffic restriction means causes traffic based on the release load condition There is a release command issuing means for issuing a control command for canceling the amount partial restriction.

  In this way, by providing a plurality of control rules and partially limiting and canceling the traffic amount in small increments, it is possible to avoid a significant traffic limitation, thereby avoiding flapping.

  Alternatively, the present invention provides a load event detecting means for detecting a load on a predetermined server, an alert event detecting means for detecting a communication abnormality, a traffic limiting means for limiting a traffic amount accompanying communication, and the load event detecting means. And a control unit that adjusts a limit amount of the traffic limiting unit in accordance with the load detected by the alert event or the abnormality detected by the alert event detecting unit.

  Here, a feature of the present invention is that a plurality of stages of restriction amounts are set in advance as a plurality of control rules in accordance with a plurality of stages of load amounts or abnormality occurrence frequencies, and the control rules for each of these control rules Issuance alert condition that is the lower limit load condition or abnormality occurrence frequency condition for determining whether to apply to traffic restriction means, and release that is the upper limit load condition or abnormality occurrence frequency condition for releasing this issuance alert condition Alert conditions are determined in advance, and a database in which these issued alert conditions and release alert conditions are recorded corresponding to the control rules is provided, and the control means includes the load event detection means or the alert event detection means. Search the database based on the detection result and issue the relevant alert When a search is found, a restriction command issuing means for issuing a traffic volume partial restriction control command based on the issue alert condition to the traffic restriction means, and a control command issuance history based on the issue alert condition by the restriction command issuing means And a release means for searching for the database based on the detection result of the load event detecting means or the alert event detecting means and canceling the issue alert condition corresponding to the issue history recorded in the recording means A release command issuing means for deleting an issuance history corresponding to the issued alert condition when a satisfaction of the alert condition is searched and issuing a control command for releasing the traffic amount partial restriction based on the release alert condition to the traffic restricting means; Where we prepared That.

  Thus, the combined use of the load event and the alert event can improve the detection accuracy of the traffic abnormality. At this time, a usage pattern in which a load event and an alert event are used together in a logical sum (OR) and a usage pattern in which a load event and an alert event are used together in a logical product (AND) are considered.

  In the case of a usage form that is used in conjunction with the logical sum, if either the load event detection means or the alert event detection means detects a traffic abnormality, the traffic abnormality is double-monitored by performing traffic restriction. Can avoid overlooking traffic anomalies.

  In addition, as a usage form used in conjunction with the logical product, for example, a limit amount of a plurality of stages is set as a plurality of control rules in advance according to a combination of a load amount of a plurality of stages and an abnormality occurrence frequency. Issuing alert condition that is a combination of a lower limit load condition and an abnormality occurrence frequency condition for determining whether or not to apply the control rule to the traffic restriction means, and an upper limit load for canceling the issuance alert condition A release alert condition that is a combination of a condition and an abnormality occurrence frequency condition is determined in advance, and a database in which these issued alert conditions and release alert conditions are recorded corresponding to the control rule is provided, and the control means includes Based on the detection results of the load event detection means and the alert event detection means Database, and when the corresponding issue alert condition is searched, a restriction command issuing means for issuing a traffic volume partial restriction control command based on the issue alert condition to the traffic restriction means, and the issue by the restriction command issuing means Recording means for recording a control command issuance history based on an alert condition in accordance with a predetermined procedure, and issuance recorded in the recording means by searching the database based on detection results of the load event detecting means and the alert event detecting means When fulfillment of the release alert condition corresponding to the issue alert condition corresponding to the history is searched, the issue history corresponding to the issue alert condition is deleted and the traffic amount partial restriction release control command based on the release alert condition is sent to the traffic restriction means From It can comprise a release command issuing means for.

  According to this, since the load event detecting means and the alert event detecting means limit the traffic only when the traffic abnormality is detected at the same time, even if any one of the detecting means erroneously detects the traffic abnormality, the other If the detecting means operates normally and does not detect a traffic abnormality, it is possible to avoid malfunction due to erroneous detection of one traffic abnormality.

  In addition, an identifier of a group to which the control rule belongs is set in the control rule, and the recording unit detects the identifier and recognizes the issuance history of control commands issued based on the control rule belonging to the same group. It is possible to provide a means for recording in a predetermined area distinguished for each.

  According to this, since the issuance history of the control command for each of a plurality of groups can be recorded in one recording means, it is possible to cope with a plurality of traffic limiting means with one recording means. Alternatively, when a plurality of traffic restriction patterns are applied to one traffic restriction unit, grouping is performed for each different traffic restriction pattern, and the group applied to the traffic restriction may be switched.

  Further, the recording means recognizes the issue history of the control commands issued based on the issue alert condition with the same type of abnormality detected by the alert event detection means as one group, and is distinguished for each group. Means for recording in a predetermined area may be provided. According to this, since grouping can be automatically performed for each type of abnormality, an appropriate control rule can be applied for each type of abnormality.

  In addition, a priority is set for the control rule, and the recording unit includes a unit that records the issuance history of control commands in a stack in order from the lowest priority based on the priority as the predetermined procedure. be able to.

  By stacking the issue histories in a stack in this way, the release process can be executed in order from the top of the stack, thus simplifying the process. For example, if the priority of the control rule that is applied in the event of an emergency situation is set high, this control rule will always be loaded on the top level of the stack, and this control will be promptly performed when the emergency situation is released. Rules can be released. Thereby, this control rule can be made to wait for the next emergency occurrence.

  The priority level may be determined based on the load amount specified in the issue load condition or the release load condition and the abnormality occurrence frequency for each abnormality type specified in the issue alert condition or the release alert condition.

  For example, when the load amount or abnormality type indicates the occurrence of an emergency, if the priority is determined to be high, the priority of the control rule for dealing with the emergency can be set high as described above. .

  Further, the recording means includes means for stacking and recording in order from an issue history of control commands issued based on a control rule having a low lower limit of the load amount specified in the issue load condition as the predetermined procedure. it can.

  For example, under a situation where the load gradually increases, the restriction is initially made from a small traffic restriction amount, and the control is gradually shifted to a restriction with a large traffic restriction amount. In such a case, if the load is gradually reduced by stacking the control commands issued based on the control rules with the lower load lower limit specified in the issue load condition in order, It is possible to cancel the regulation efficiently.

  In addition, a control rule with a low priority in the group to which the control rule belongs is defined as the lower limit of the load amount specified in the issue load condition of the control rule and the lower limit of the abnormality occurrence frequency for each abnormality type specified in the issue alert condition. The lower limit of the load amount and the lower limit of the abnormality occurrence frequency can be set to be the same value or smaller.

  According to this, the priority when stacked on the same stack can be made to follow the order in which both the issue load condition and the issue alert condition are satisfied.

  In addition, the upper limit of the load amount specified in the release load condition of the control rule and the upper limit of the abnormality occurrence frequency for each abnormality type specified in the release alert condition are determined by the control rule having a low priority in the group to which the control rule belongs. The upper limit of the load amount and the upper limit of the abnormality occurrence frequency can be set to be the same value or smaller.

  According to this, the order of unloading from the same stack can be made to follow the order which satisfies both cancellation | release load conditions and cancellation | release alert conditions.

  According to a second aspect of the present invention, there is provided a network control method for adjusting a traffic restriction amount according to a load on a predetermined server. The feature of the present invention is that a plurality of steps are performed according to a plurality of load amounts. A limit amount is set in advance as a plurality of control rules, and an issue load condition that is a lower limit load condition for determining whether to apply the control rule to traffic restriction for each of the control rules, and the issue load condition A release load condition that is an upper limit load condition for release is determined in advance, and the issuance load condition and the release load condition are recorded in a database corresponding to the control rule, and the database is based on the load detection result. When the corresponding issuance load condition is retrieved, the control command for restricting the traffic amount based on the issuance load condition is searched. The issuance history of this control command is recorded according to a predetermined procedure, the database is searched based on the load detection result, and the satisfaction of the release load condition for the issuance load condition corresponding to the recorded issuance history is retrieved. When issued, the issuance history corresponding to the issuance load condition is deleted, and a control command for releasing the traffic amount partial restriction based on the release load condition is issued.

  Alternatively, the present invention is a network control method for adjusting a traffic limit amount in accordance with a predetermined server load or traffic abnormality, and a feature of the present invention is that the load amount or abnormality occurrence frequency is determined in a plurality of stages. Accordingly, a plurality of limit amounts are set in advance as a plurality of control rules, and for each of these control rules, a lower limit load condition or abnormality occurrence frequency condition for determining whether to apply the control rule to traffic restriction An issuance alert condition and an upper limit load condition for canceling this issuance alert condition or a cancellation alert condition that is an abnormality occurrence frequency condition are determined in advance, and these issuance alert conditions and cancellation alert conditions are associated with the control rule. Is recorded in the database, and the data is based on the load or abnormality detection result. When the corresponding issuance alert condition is retrieved, a control command for restricting the traffic volume based on the issuance alert condition is issued, and the issuance history of this control command is recorded in accordance with a predetermined procedure, and the load or abnormality is The database is searched on the basis of the detection result, and when the satisfaction of the release alert condition with respect to the issue alert condition corresponding to the recorded issue history is searched, the issue history corresponding to the issue alert condition is deleted and the traffic amount portion The control command for releasing the restriction is being issued.

  Alternatively, whether or not to apply the control rule to the traffic restriction for each of the control rules is set in advance as a plurality of control rules according to the combination of the load amount and the abnormality occurrence frequency in a plurality of stages. A release alert condition that is a combination of the lower limit load condition and the abnormality occurrence frequency condition for determining the occurrence alert condition, and a release alert condition that is a combination of the upper limit load condition and the abnormality occurrence frequency condition for releasing the issue alert condition, Is recorded in advance in response to the control rule, and the database is searched based on the load and abnormality detection results to find the corresponding issue alert condition. The traffic volume limit based on the issued alert condition Issue a command, record the issuance history of the control command according to a predetermined procedure, search the database based on the detection result of load and abnormality, and set the release alert condition for the issuance alert condition corresponding to the recorded issuance history. When the satisfaction is retrieved, the issuance history corresponding to the issuance alert condition can be deleted and a control command for releasing the traffic volume partial restriction can be issued.

  In addition, an identifier of a group to which the control rule belongs is set in the control rule, and this identifier is detected, and the issuance history of control commands issued based on the control rule belonging to the same group is recognized and distinguished for each group. It is possible to record in a predetermined area.

  In addition, the issuance history of the control commands issued based on the issuance alert condition with the same detected abnormality type can be recognized as one group and recorded in a predetermined area distinguished for each group.

  Further, priority is set in the control rule, and the issuance history of control commands can be stacked and recorded in order from the lowest priority based on the priority as the predetermined procedure.

  At this time, the priority may be determined based on the load amount specified in the issue load condition or the release load condition and the abnormality occurrence frequency for each abnormality type specified in the issue alert condition or the release alert condition.

  Further, as the predetermined procedure, the control commands issued based on the control rule with a low lower limit of the load amount specified in the issue load condition can be sequentially stacked and recorded.

  In addition, a control rule with a low priority in the group to which the control rule belongs is defined as the lower limit of the load amount specified in the issue load condition of the control rule and the lower limit of the abnormality occurrence frequency for each abnormality type specified in the issue alert condition. The lower limit of the load amount and the lower limit of the abnormality occurrence frequency can be set to be the same value or smaller.

  In addition, the upper limit of the load amount specified in the release load condition of the control rule and the upper limit of the abnormality occurrence frequency for each abnormality type specified in the release alert condition are determined by the control rule having a low priority in the group to which the control rule belongs. The upper limit of the load amount and the upper limit of the abnormality occurrence frequency can be set to be the same value or smaller.

  A third aspect of the present invention is a program that, when installed in an information processing apparatus, realizes a function of causing the information processing apparatus to execute a procedure corresponding to the network control method of the present invention.

  A fourth aspect of the present invention is the information processing apparatus-readable recording medium on which the program of the present invention is recorded. By recording the program of the present invention on the recording medium of the present invention, the information processing apparatus can install the program of the present invention using this recording medium. Alternatively, the program of the present invention can be directly installed in the information processing apparatus via a network from a server holding the program of the present invention.

  Thus, the network control system and the network control method of the present invention can be realized using a general-purpose information processing apparatus.

  According to the present invention, flapping during traffic restriction can be avoided, so that the server can be operated efficiently.

  Embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a block diagram showing the configuration of the network control system of this embodiment. In this embodiment, the device under evaluation 1 can be used alone, or both the device under evaluation 1 and the device under evaluation 2 can be used simultaneously. When both are used at the same time, the usage form using either one of the results of the evaluated device 1 or the evaluated device 2 and the result of the evaluated device 1 or the evaluated device 2 are logically combined (OR). And a usage mode in which results of the device under evaluation 1 or the device under evaluation 2 are used together in a logical product (AND) manner.

  In the case of a usage mode that is logically used together, when either one of the device under evaluation 1 or the device under evaluation 2 detects a traffic abnormality, the traffic abnormality is double-monitored by performing traffic restriction. Can avoid overlooking traffic anomalies.

  In addition, when logically used together, the device under evaluation 1 and the device under evaluation 2 perform traffic restriction only when the traffic abnormality is detected at the same time, so when one of them erroneously detects the traffic abnormality. However, if the other is operating normally and no traffic abnormality is detected, a malfunction due to erroneous detection of one traffic abnormality can be avoided.

  In FIG. 1, an evaluated device 1 is a server such as a Web server or an FTP server. The server of the device under evaluation 1 performs communication processing with an external device via the network 10, monitors the load state itself, and transmits the result as a load event to the event processing unit 7 of the network control device 3. .

  The device under evaluation 2 is an intrusion detection system (IDS), which detects a traffic abnormality or intrusion attack sent from a remote external device (not shown) and generates a detection result (alert). The IDS that is the device to be evaluated 2 transmits information about the alert to the network control device 3 as an alert event.

  The alert event includes a traffic abnormality such as “DoS attack”, “buffer overflow”, and “information indicating that meaningless access has been performed” and the type of intrusion attack.

  The importance of the alert is expressed using numerical values, or expressed using words such as “emergency”, “slightly urgent”, and “caution”. The evaluated device 2 can be executed with the same calculation resources as the evaluated device 1.

  The network device 4 has a function of appropriately transferring the communication traffic received by the network device 4 according to the destination. In addition, it has a function of changing the content of traffic regulation such as priority control by command transmission from the outside. When the setting of the command transmitted from the outside is completed, the network device 4 notifies the command sender of the command setting completion event. At this time, it is not necessary to notify the command sender of the command setting completion command directly from the network device 4. For example, after a sufficient time has passed for setting the command in the network device 4, the command sender It is also possible to send a command setting completion event.

  The network control device 3 includes an event evaluation unit 5, event counting units 6-1 to 6 -N, and an event processing unit 7. When the event evaluation unit 5 detects an alert event from the evaluated device 2, the event evaluation unit 5 classifies the alert event based on the stored intrusion attack type and information indicating the importance. This classification is called alert complaint.

  Next, the event is transferred to the event counting units 6-1 to 6-N prepared for each alert class. At this time, the event counting units 6-1 to 6-N can be shared between different alert classes. The event counting units 6-1 to 6-N measure the occurrence frequency for each alert event. As a measuring method, (1) the number of events per unit time, (2) the water surface height of the leaky bucket, and the like are used.

  Here, a leaky bucket is a model of changes in the height of the water surface when water is poured into a bucket with a hole, and whether or not an arbitrary event has occurred at a certain frequency. Used when evaluating

  In the leaky bucket, when any event occurs, the water level of the corresponding leaky bucket is raised. On the other hand, the water level of the leaky bucket is decreased regularly. Therefore, when an event occurs at a frequency higher than the water surface reduction rate, the water level of the leaky bucket increases. Conversely, when the event occurrence frequency is lower than the water surface reduction rate, the water surface height of the leaky bucket decreases.

  The event counting units 6-1 to 6-N transmit the alert event content and the occurrence frequency measurement result to the event processing unit 7 as an alert evaluation event.

  The event processing unit 7 includes a control rule database 8 for issuing an appropriate command to the network device 4 in accordance with each event transmitted from the evaluated device 1 or 2.

  Here, a configuration example of the control rule is shown in FIG. The control rule includes a condition necessary for issuing a command (issue condition), a command used for controlling the network device 4 (control command), a condition for releasing the control command (release condition), and a release of the control command. A pair of commands to be used (release commands) is described.

  Here, a lower limit can be set for the server load as an issuance condition. That is, when the server load exceeds the lower limit set in the issuance condition, it is considered that the issuance condition is satisfied. This is called an issue load condition.

  In addition, an upper limit can be set for the server load as the release condition. That is, when the server load falls below the upper limit set in the release condition, it is considered that the release condition is satisfied. This is called a release load condition.

  Similarly, an upper limit can be set for the alert occurrence frequency measurement result for each alert class as an issuance condition (issue alert condition), and a lower limit can be set for the alert occurrence frequency measurement result for each alert class as a release condition (Cancel alert condition).

Furthermore, the logical product of the issue load condition and the issue alert condition can be used as the issue condition. At this time, the release condition is a logical sum of the release load condition and the release alert condition. On the other hand, a logical sum of an issue load condition and an issue alert condition can be used as the issue condition. At this time, the release condition is a logical product of the release load condition and the release alert condition. The control command includes a specific traffic discard (regulation) and a priority change. In the example of the control rule in FIG. 2, both the issue / release load condition and the issue / release alert condition are set. At this time, the logical product of the issue load condition and the issue alert condition is used as the issue condition, and the logical sum of the release load condition and the release alert condition is used as the release condition. In addition, the leaky bucket is used to measure the occurrence frequency of alerts and is set as follows.
-Control command: Bandwidth restricted to 1 Mbps-Issuing conditions-Server load is 80% or more-The alert class "DoS" leaky bucket water level is 10 alerts or more-Release condition-Server load Less than 70% or-The water level of the leaky bucket of alert class "DoS" is less than 1 alert

  In this embodiment, control command issue order control is performed using a stack (the stack here is conceptual and may not be actually implemented as software / hardware). In other words, the stack is shared among control rules that want to issue commands in order. Then, when the control rules satisfying the issue conditions are stacked on the stack, the control command is issued to the network device 4. Further, when a control rule satisfying the release condition is removed from the stack, the release command is issued to the network device 4.

  There are the following methods for classifying control rules that should share a stack (stack sharing group) and assigning priorities when stacking the stack.

-Stack sharing group-Explicitly specified in control rules. For example, a field for designating a stack sharing group is newly provided in the control rule shown in FIG.
-Control rules related to the same alert class shall belong to the same stack sharing group. At this time, the control rule for which the issue / cancel alert condition is not set belongs to the stack sharing group for the control rule that is not set.

  For example, since the issuance history of control commands for a plurality of groups can be recorded in one database 8, a single database 8 can correspond to a plurality of network devices 4. Alternatively, when a plurality of traffic restriction patterns are applied to one network device 4, grouping is performed for each different traffic restriction pattern, and the group applied to the traffic restriction may be switched.

Stack stack priority-Explicitly specified in control rules. For example, a field for designating the stack stack priority is newly provided in the control rule shown in FIG.
-Define a function that derives the stack stack priority from the upper limit value of the issuance load / alert condition and the lower limit value of the release load / alert condition. That is, the upper limit value of the issuance alert condition and the lower limit value of the release alert condition of the control rule Ri are respectively Asi and Aci. Similarly, the upper limit value of the issuance load condition and the lower limit value of the release load condition are Usi and Uci, respectively. At this time, the priority Pi of the control rule Ri is given by Pi = F (Asi, Aci, Usi, Uci) using the function F (Asi, Aci, Usi, Uci). If control rules Ri and Rj belonging to the same stack sharing group exist and Pi> Pj holds, Ri is stacked on the stack first. As a special example of this method, F (Asi, Aci, Usi, Uci) = − Usi.

  -Set the following restrictions when describing control rules. That is, it is assumed that the control rules Ri and Rj (i ≠ j) belong to the same stack sharing group. At this time, when Ri is stacked on the stack before Rj, Asi ≦ Asj and Usi ≦ Usj. Similarly, Aci ≦ Aci and Uci ≦ Ucj. As a result, the control rule that should be stacked first in the stack satisfies the issuing condition first. In addition, the control rule that is unloaded first from the stack satisfies the release condition first.

  Therefore, the control rules may be added to the stack in the order in which the issuance conditions are satisfied, and the control rules may be removed from the stack in the order in which the release conditions are satisfied.

  For example, if the priority of the control rule that is applied in the event of an emergency situation is set high, this control rule will always be loaded on the top level of the stack, and this control will be promptly performed when the emergency situation is released. Rules can be released. Thereby, this control rule can be made to wait for the next emergency occurrence.

  Alternatively, under a situation in which the load amount gradually increases, the restriction is initially performed from a small traffic restriction amount, and the control is gradually shifted to a restriction with a large traffic restriction amount. In such a case, if the load is gradually reduced by stacking the control commands issued based on the control rules with the lower load lower limit specified in the issued load condition, the stacks are stacked in order. It is possible to cancel the regulation efficiently.

  FIG. 3 represents the operation of the network control system of this embodiment using a state transition diagram of the control rule. In FIG. 3, the control rule is expressed as “control rule XY”. Here, X indicates the stack sharing group, and Y indicates the stack stacking priority within the stack sharing group. The control rule takes one of the following three states.

Issuance disabled state: A state in which the control command has not yet been transmitted to the network device 4 or a cancel command has been transmitted and the issuance conditions are not satisfied. Initial state of control rule / Issuing wait state: The issuance condition is satisfied, but the control command is not transmitted to the network device 4. Issued state: The control command is transmitted to the network device 4 State

  A control rule in the “Issuance impossible” state transitions its state to “Waiting for issuance” when the issuance condition is satisfied. When the control rule in the “waiting for issuance” state is stacked on the stack, the control command is transmitted to the network device 4 and the state is changed to “issue”. If the release condition is satisfied before being stacked on the stack, the state is changed to “Issuance not possible”. The control rule in the “issue” state transmits the release command to the network device 4 when the release condition is satisfied and removed from the stack, and the state is changed to the issue disabled state.

  FIG. 4 is a state transition diagram used for determining whether or not the network device 4 is ready to receive a command. That is, the command transmitted from the network control device 3 is in a “busy” state while the network device 4 is performing setting processing. When the command setting is completed and the network device 4 can process the next command, that is, when the network device 4 receives a command setting completion event, the “free” state is set.

  Next, the operation when receiving this event will be described with reference to FIG. Here, the events are an alert evaluation event, a load event, and a command setting completion event.

  In the control rule state transition process from “Issuance not possible” to “Waiting for issuance”, it is determined whether or not the issuance condition is satisfied for all control rules in the “Issuance impossible” state by the received event. The state of the control rule satisfying the issue condition is changed from “Issuance impossible” to “Waiting for issue” (S1).

  In the control rule state transition process “waiting for issue” to “not ready for issue”, it is determined whether or not the release condition is satisfied for all the control rules in the “wait for issue” state according to the received event. The state of the control rule satisfying the release condition is changed from “Waiting for issuance” to “Issuance impossible” (S2).

  In the network device state transition process “busy” to “free”, when the command setting completion event is received, the state of the network device 4 is changed from “busy” to “free” so that the next command can be issued (S3). ).

  In the network device state determination, it is determined whether or not a command can be transmitted to the network device 4 (S4). That is, when the network device 4 is in the “free” state, the process proceeds to control command transmission permission / inhibition determination (S5). On the other hand, when the network device 4 is in the “busy” state, the series of processing ends.

  In the control command transmission enable / disable determination (S5), the control rule in the issuance waiting state is inspected to determine whether or not the control command can be transmitted to the network device 4. In other words, if all the control rules belonging to the same stack sharing group have higher stacking priority on the stack than the control rule to be inspected, the control rule to be inspected is controlled. It is assumed that the command can be sent. When one or more control rules that can transmit a control command exist, one control rule is selected according to an arbitrary rule. On the other hand, if there is no control rule that can be transmitted, the process ends.

  In the control rule state transition process “waiting for issuance” to “issuing”, the state of the control rule selected in the determination of whether or not to transmit the control command is changed from waiting for issuance to issuance (S6), and stacked on the stack. Also, a control command is acquired from the control rule.

  In the determination of whether or not the cancel command can be transmitted, it is checked whether or not the cancel condition is satisfied for the control rule located at the top of the stack (S7). When one or more control rules satisfy the release condition, one control rule is selected based on an arbitrary rule. If there is no control rule that satisfies the cancellation condition, the process ends.

  In the control rule state transition process “Waiting for issue” to “Issuance”, the state of the control rule selected in the release command transmission determination is changed from “Issuance” to “Issuance is impossible” (S8), and loaded from the stack. Also, a release command is acquired from the control rule.

  In the network device state transition process “free” to “busy”, the state of the network device 4 is changed from “free” to “busy” so that the next command cannot be transmitted to the network device 4 (S9). .

  In the command transmission process, the acquired control / release command is transmitted to the network device 4 (S10).

  This embodiment can be implemented as a program that, when installed in a general-purpose information processing apparatus, causes the information processing apparatus to realize functions corresponding to the network control apparatus 3 of the present embodiment. The program is recorded on a recording medium and installed in the information processing apparatus, or installed in the information processing apparatus via a communication line, whereby the event evaluation unit 5 and the event counting units 6-1 to 6-1 are installed in the information processing apparatus. Corresponding functions can be realized in 6-N, event processing unit 7 and control rule database 8, respectively.

  According to the present invention, since it is possible to avoid flapping when traffic is limited, the server can be operated efficiently. Thereby, it can contribute to management of an efficient network system.

The block diagram which shows the structure of the network control system of a present Example. The figure which shows the structural example of a control rule. The figure which shows issue / release of the command using a stack, and the state transition of a control rule. The figure which shows the state transition of a network apparatus. The flowchart which shows the operation | movement at the time of event reception.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1, 2 Device to be evaluated 3 Network control device 4 Network device 5 Event evaluation unit 6-1 to 6-N Event counting unit 7 Event processing unit 8 Control rule database 9 Calculation processing unit 10 Network

Claims (22)

Load event detection means for detecting a load of a predetermined server;
Traffic limiting means for limiting the amount of traffic associated with communication;
A network control system comprising: a control unit that adjusts a limit amount of the traffic limiting unit according to a load detected by the load event detecting unit;
Depending on the amount of load of multiple stages, the limit amount of multiple stages is set as multiple control rules in advance,
For each of these control rules, there are an issuance load condition which is a lower limit load condition for determining whether or not to apply the control rule to the traffic restriction means, and an upper limit load condition for canceling this issuance load condition. Release load conditions are predetermined,
A database in which these issuance load conditions and release load conditions are recorded corresponding to the control rules is provided,
The control means includes
A restriction command that searches the database based on the detection result of the load event detection means and issues a control command for restricting the traffic amount based on the issue load condition to the traffic restriction means when the issue load condition is found. Issuing means;
Recording means for recording a control command issuance history based on the issuance load condition by the restriction command issuing means according to a predetermined procedure;
When the database is searched based on the detection result of the load event detection means, and the satisfaction of the release load condition with respect to the issue load condition corresponding to the issue history recorded in the recording means is searched, the issue corresponding to the issue load condition is issued A network control system comprising: release command issuing means for deleting a history and issuing a traffic volume partial restriction release control command based on the release load condition to the traffic restriction means. Load event detection means for detecting a load of a predetermined server;
An alert event detecting means for detecting a communication abnormality;
Traffic limiting means for limiting the amount of traffic associated with communication;
A network control system comprising: a control unit that adjusts a limit amount of the traffic limiting unit according to a load detected by the load event detecting unit or an abnormality detected by the alert event detecting unit;
Depending on the load amount of multiple stages or the frequency of occurrence of abnormalities, the limit amount of multiple stages is set in advance as multiple control rules,
For each of these control rules, a lower limit load condition for determining whether to apply the control rule to the traffic restricting means or an issue alert condition that is an abnormality frequency condition, and an upper limit for canceling this issue alert condition The release alert condition that is the load condition or abnormality occurrence frequency condition of the
Corresponding to the control rule, a database in which these issue alert conditions and release alert conditions are recorded is provided,
The control means includes
The database is searched based on the detection result of the load event detection means or the alert event detection means, and when the corresponding issue alert condition is searched, a traffic volume partial restriction control command based on the issue alert condition is sent to the traffic restriction A restriction command issuing means for issuing to the means;
Recording means for recording a control command issuance history based on the issuance alert condition by the restriction command issuing means according to a predetermined procedure;
The database is searched based on the detection result of the load event detection means or the alert event detection means, and when the release alert condition is satisfied for the issue alert condition corresponding to the issue history recorded in the recording means, the issue is issued A network control system comprising: release command issuing means for deleting an issuance history corresponding to an alert condition and issuing a control command for releasing a traffic volume partial restriction based on the release alert condition to the traffic restriction means. Depending on the combination of the load amount of multiple stages and the frequency of occurrence of abnormalities, the limit amount of multiple stages is set in advance as multiple control rules,
For each of the control rules, an issuance alert condition that is a combination of a lower limit load condition and an abnormality occurrence frequency condition for determining whether or not the control rule is applied to the traffic restriction means and the issuance alert condition are canceled. The release alert condition that is a combination of the upper limit load condition and the abnormality occurrence frequency condition is predetermined,
Corresponding to the control rule, a database in which these issue alert conditions and release alert conditions are recorded is provided,
The control means includes
Based on the detection results of the load event detection means and the alert event detection means, the database is searched, and when the corresponding issuance alert condition is found, a traffic volume partial restriction control command based on the issuance alert condition is sent to the traffic restriction. A restriction command issuing means for issuing to the means;
Recording means for recording a control command issuance history based on the issuance alert condition by the restriction command issuing means according to a predetermined procedure;
The database is searched based on the detection results of the load event detection means and the alert event detection means, and when the satisfaction of the release alert condition for the issue alert condition corresponding to the issue history recorded in the recording means is searched, the issue 3. The network control system according to claim 2, further comprising: release command issuing means for deleting an issue history corresponding to the alert condition and issuing a control command for releasing the traffic volume partial restriction based on the release alert condition to the traffic restriction means. In the control rule, an identifier of a group to which the control rule belongs is set,
The recording means comprises means for detecting this identifier, recognizing the issuance history of control commands issued based on control rules belonging to the same group, and recording them in a predetermined area distinguished for each group. 4. The network control system according to any one of 3. The recording means recognizes the issuance history of the control command issued based on the issuance alert condition with the same type of abnormality detected by the alert event detecting means as one group, and distinguishes between predetermined groups The network control system according to claim 1, further comprising means for recording in the area. Priorities are set for the control rules,
4. The network according to claim 1, wherein the recording unit includes a unit that records the issuance history of control commands in a stack in order from the lowest priority based on the priority as the predetermined procedure. 5. Control system.   7. The network according to claim 6, further comprising means for determining the priority based on the load amount specified in the issue load condition or the release load condition and the abnormality occurrence frequency for each abnormality type specified in the issue alert condition or the release alert condition. Control system. The recording means comprises means for stacking and recording in order from the issuance history of control commands issued based on a control rule with a low lower limit of the load amount specified in the issuance load condition as the predetermined procedure. 4. The network control system according to any one of items 3 to 3.   The load that the control rule with the low priority in the group to which the control rule belongs has the lower limit of the load amount specified in the issue load condition of the control rule and the lower limit of the abnormality occurrence frequency for each abnormality type specified in the issue alert condition The network control system according to claim 2 or 3, wherein the lower limit of the quantity and the lower limit of the frequency of abnormality occurrence are set to be the same value or smaller.   The load that the control rule with the lower priority in the group to which the control rule belongs has the upper limit of the load amount specified in the release load condition of the control rule and the upper limit of the occurrence frequency of each abnormality type specified in the release alert condition The network control system according to claim 9, wherein the network control system is set so that the upper limit of the quantity and the upper limit of the abnormality occurrence frequency are the same value or smaller. In a network control method for adjusting a traffic limit amount according to a load of a predetermined server,
Depending on the amount of load of multiple stages, the limit amount of multiple stages is set as multiple control rules in advance,
For each of these control rules, an issuance load condition, which is a lower limit load condition for determining whether to apply the control rule to traffic restriction, and a release load, which is an upper limit load condition for canceling this issuance load condition Conditions are predetermined,
In response to the control rule, these issuance load conditions and release load conditions are recorded in a database,
When the database is searched based on the load detection result and the corresponding issuance load condition is retrieved, a control command for traffic volume partial restriction based on the issuance load condition is issued,
Record the issuance history of this control command according to a predetermined procedure,
The database is searched based on the load detection result, and when the release load condition satisfying the issue load condition corresponding to the recorded issue history is searched, the issue history corresponding to the issue load condition is deleted and the release is canceled A network control method characterized by issuing a control command for canceling a traffic volume partial restriction based on a load condition. In a network control method for adjusting a traffic limit amount according to a predetermined server load or traffic abnormality,
Depending on the load amount of multiple stages or the frequency of occurrence of abnormalities, the limit amount of multiple stages is set in advance as multiple control rules,
For each of these control rules, a lower limit load condition for determining whether to apply the control rule to traffic restriction or an issue alert condition that is an abnormality occurrence frequency condition, and an upper limit load for releasing this issue alert condition Release alert conditions that are conditions or abnormal occurrence frequency conditions are predetermined,
In response to the control rule, these issued alert conditions and release alert conditions are recorded in the database,
Search the database based on the detection result of the load or abnormality, and when the corresponding issue alert condition is searched, issue a control command for traffic volume partial restriction based on the issue alert condition,
Record the issuance history of this control command according to a predetermined procedure,
The database is searched based on the detection result of the load or abnormality, and when the satisfaction of the release alert condition for the issue alert condition corresponding to the recorded issue history is searched, the issue history corresponding to the issue alert condition is deleted. A network control method, characterized by issuing a control command for canceling a traffic volume partial restriction. Depending on the combination of the load amount of multiple stages and the frequency of occurrence of abnormalities, the limit amount of multiple stages is set in advance as multiple control rules,
For each of these control rules, an issuance alert condition that is a combination of a lower limit load condition for determining whether to apply the control rule to traffic restriction and an abnormality occurrence frequency condition, and for releasing this issuance alert condition A release alert condition that is a combination of an upper limit load condition and an abnormality occurrence frequency condition is predetermined,
In response to the control rule, these issued alert conditions and release alert conditions are recorded in the database,
Search the database based on the detection result of load and abnormality, and when the corresponding issue alert condition is searched, issue a control command for traffic volume partial restriction based on the issue alert condition,
Record the issuance history of this control command according to a predetermined procedure,
The database is searched based on the detection result of load and abnormality, and when the satisfaction of the release alert condition with respect to the issue alert condition corresponding to the recorded issue history is searched, the issue history corresponding to the issue alert condition is deleted. The network control method according to claim 12, wherein a control command for canceling traffic volume partial restriction is issued. In the control rule, an identifier of a group to which the control rule belongs is set,
The network control according to any one of claims 11 to 13, wherein the identifier is detected, and an issuance history of a control command issued based on a control rule belonging to the same group is recognized and recorded in a predetermined area distinguished for each group. Method.   14. The control command issuance history issued based on the issuance alert condition having the same detected abnormality type is recognized as one group and recorded in a predetermined area distinguished for each group. The network control method according to claim 1. Priorities are set for the control rules,
The network control method according to claim 11, wherein as the predetermined procedure, control command issue histories are stacked and recorded in order from the lowest priority based on the priority.   The network control method according to claim 16, wherein the priority is determined based on a load specified in the issue load condition or the release load condition and an abnormality occurrence frequency for each abnormality type specified in the issue alert condition or the release alert condition.   The network according to any one of claims 11 to 13, wherein the network is stacked and recorded in order from the issuance history of control commands issued based on a control rule with a lower load limit specified in an issuance load condition as the predetermined procedure. Control method.   The load that the control rule with the lower priority in the group to which the control rule belongs has the lower limit of the load amount specified in the issue load condition of the control rule and the lower limit of the abnormality occurrence frequency for each abnormality type specified in the issue alert condition The network control method according to claim 12 or 13, wherein the lower limit of the quantity and the lower limit of the abnormality occurrence frequency are set to be the same value or smaller.   The load that the control rule with the lower priority in the group to which the control rule belongs has the upper limit of the load amount specified in the release load condition of the control rule and the upper limit of the occurrence frequency of each abnormality type specified in the release alert condition The network control method according to claim 19, wherein the upper limit of the quantity and the upper limit of the frequency of occurrence of abnormality are set to be the same value or smaller.   A program that, when installed in an information processing apparatus, realizes a function of causing the information processing apparatus to execute a procedure corresponding to the network control method according to any one of claims 11 to 20.   A recording medium readable by the information processing apparatus on which the program according to claim 21 is recorded.

Images