JP2008244640A - System, method, and program for analyzing monitoring information, network monitoring system, and management device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To analyze different monitoring viewpoints integrally by solving the difference in a network monitoring method and by integrating information between a network and a system. <P>SOLUTION: A monitoring information analysis system has: one or a plurality of monitoring system means that are provided in each of a plurality of network systems and monitor each prescribed object to be monitored according to each original monitoring method; a monitoring information request means for requesting monitoring information managed by each monitoring system means to whole or one portion of respective monitoring system means on respective network systems; and an integration analysis processing means for receiving the monitoring information from respective monitoring system means requested by the monitoring information request means and performing integral analysis processing based on the monitoring information from respective monitoring system means. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a monitoring information analysis system, a monitoring information analysis method, a monitoring information analysis program, a network monitoring system, and a management device. For example, the present invention is applied to a multipoint broadband traffic monitoring system that observes traffic flow information on a broadband network at multiple points. Can do.

  In recent years, complicated and sophisticated viruses and failures have occurred on the network every day. In addition, with the progress of network technology in recent years, networks are generally widely spread, but it is expected that broadband networks will be widely introduced and penetrated as a social infrastructure in the future due to further technological progress. Therefore, a system that can monitor not only an existing scale network but also a large-scale broadband network and efficiently detect a network abnormality is strongly desired.

  There are various technologies as a conventional network traffic monitoring system, and one of them is a technology for monitoring traffic information such as the amount of communication packets based on packet information of packets passing through the network (patent). Reference 1).

  The network traffic monitoring system collects packets passing through routers, switching hubs, etc. using protocols such as SNMP (Simple Network Management Protocol), sFlow, and RMON (Remote Monitoring MIB) as shown in FIG. Then, there are a method for monitoring the traffic volume, and a method for monitoring the traffic volume by collecting packets via the mirror port, for example, as shown in FIG.

  Information that can be monitored by each of these monitoring methods is different. Therefore, the network administrator determines a monitoring method to be monitored for each segment as necessary, sets a monitoring target for each segment, and outputs and displays a monitoring result for each segment.

  By the way, network traffic monitoring and system monitoring are implemented from different viewpoints. In other words, while network traffic monitoring is for monitoring whether or not a packet is flowing normally on the network, system monitoring is normal for a specific monitoring target device (for example, a mail server or a WWW server). It monitors whether or not it is operating.

  Conventionally, a network administrator who manages a plurality of segments monitors both a plurality of network traffic monitoring by a monitoring method determined for each segment as described above and a plurality of system monitoring for monitoring a mail server or the like. is doing.

  Therefore, when some kind of failure or virus infection occurs on the network, the network administrator analyzes the failure individually while referring to the results of many monitoring systems that are not linked to each other. We are trying to elucidate the relationship between and investigate the causes of disabilities.

JP-A-5-260063

  As described above, since the conventional network traffic monitoring system has different monitoring methods, it is necessary to perform monitoring setting for each segment. In addition to the network traffic monitoring system, it is necessary to provide system monitoring for monitoring a monitoring target device such as a mail server.

  Therefore, it is necessary for the network administrator to perform analysis processing using the results of a wide variety of monitoring systems that are not linked to each other, and there is a problem that the burden on the network administrator at the time of analysis is large. In addition, as the network becomes larger and more complicated, it is more important to solve this problem.

  Furthermore, since the early response is required due to the importance of security management in recent years, the efficiency of the conventional complicated analysis processing is strongly desired.

  Therefore, a monitoring information analysis system, a monitoring information analysis method, a monitoring information analysis program, a network monitoring system, and a management for solving differences in network monitoring methods, integrating information between networks and systems, and analyzing different monitoring viewpoints in an integrated manner A device is sought.

  In order to solve such a problem, the monitoring information analysis system according to the first aspect of the present invention is (1) monitoring a predetermined monitoring object according to a unique monitoring method provided in each of a plurality of network systems. A plurality of monitoring system means; (2) monitoring information requesting means for requesting monitoring information managed by each monitoring system means for all or part of each monitoring system means on each network system; and (3) monitoring. And an integrated analysis processing means for receiving monitoring information from each monitoring system means requested by the information requesting means and performing integrated analysis processing based on the monitoring information from each monitoring system means.

  A network monitoring system according to a second aspect of the present invention includes: (1) one or a plurality of monitoring system means provided in each of a plurality of network systems, each for monitoring a predetermined monitoring target according to a unique monitoring method; ) Monitoring information requesting means for requesting monitoring information managed by each monitoring system means for all or part of each monitoring system means on each network system; and (3) each monitoring requested by the monitoring information requesting means. And integrated analysis processing means for receiving monitoring information from the system means and performing integrated analysis processing based on the monitoring information from each monitoring system means.

  The management device according to the third aspect of the present invention includes one or a plurality of monitoring system devices that are provided in each of a plurality of network systems and that respectively monitor a predetermined monitoring target according to a unique monitoring method, and from each monitoring system device In a management apparatus constituting a network monitoring system comprising a management apparatus that manages predetermined aggregate information based on monitoring information, (1) each monitoring system for all or a part of each monitoring system apparatus on each network system Monitoring information requesting means for requesting monitoring information managed by the system apparatus; (2) receiving monitoring information from each monitoring system apparatus requested by the monitoring information requesting means, and integrating information based on the monitoring information from each monitoring system apparatus And integrated analysis processing means for performing analysis processing.

  According to a fourth aspect of the present invention, there is provided a monitoring information analysis method comprising: monitoring information managed by one or a plurality of monitoring system means for monitoring a predetermined monitoring target according to a unique monitoring method provided in each of a plurality of network systems. A monitoring information analyzing method for analyzing, wherein (1) the monitoring information requesting unit requests monitoring information managed by each monitoring system unit from all or a part of each monitoring system unit on each network system. And (2) integration in which the integrated analysis processing means receives monitoring information from each monitoring system means requested by the monitoring information request means and performs integrated analysis processing based on the monitoring information from each monitoring system means. And an analysis processing step.

  The monitoring information computerized ruin program according to the fifth aspect of the present invention is the monitoring information managed by one or a plurality of monitoring system means for monitoring each predetermined monitoring object according to a unique monitoring method provided in each of the plurality of network systems. A monitoring information analysis program for requesting monitoring information managed by each monitoring system means to all or a part of each monitoring system means on each network system. Means (2) receiving monitoring information from each monitoring system means requested by the monitoring information requesting means, and functioning as integrated analysis processing means for performing integrated analysis processing based on the monitoring information from each monitoring system means .

  According to the monitoring information analysis system, the monitoring information analysis method, the monitoring information analysis program, the network monitoring system, and the management apparatus of the present invention, the difference between the network monitoring methods, the information integration between the network and the system, and the different monitoring viewpoints It can be analyzed in an integrated manner.

(A) First Embodiment Hereinafter, a first embodiment of a monitoring information analysis system, a monitoring information analysis method, a monitoring information analysis program, a network monitoring system, and a management apparatus according to the present invention will be described with reference to the drawings.

(A-1) Configuration of the First Embodiment FIG. 4 is a configuration diagram showing the overall configuration of the network monitoring system of the first embodiment. 4, in the network monitoring system 6 of the first embodiment, a plurality (four in FIG. 4) of networks 9-1 to 9-4 are connected through the relay device 5, respectively.

  In FIG. 4, for the sake of easy understanding, the state of connection by the relay devices 5-1 and 5-2 is shown only between the network 9-1 and the network 9-2. Are also connected through a relay device.

  Further, for convenience of explanation, the network 9-1 is assumed to include a main system that integrally manages the security of a plurality of networks, and the networks 9-2 to 9-4 are described as managed networks.

  Each of the networks 9-1 to 9-4 is a network system that is operated according to an autonomous management policy. One network is one segment, for example, a network system such as an ISP (Internet Service Provider). Is applicable. Moreover, as a network medium of each of the networks 9-1 to 9-4, for example, a wired line such as an electric line or an optical fiber line, or a part having all or part of a wireless line can be applied. The protocol corresponding to the transport layer of the OSI basic reference model is not particularly limited, and for example, TCP, UDP, ICMP, or the like can be applied.

  In addition, the system configuration of each of the networks 9-1 to 9-4 can include components according to each system operation.

  The network 9-1 includes at least a manager device 1, a collection probe device 2, an administrator terminal 7, another traffic monitoring device 4-1, a system monitoring device 8-1, and a relay device 5-1.

  Each of the networks 9-2 to 9-4 includes at least other traffic monitoring devices 4-2 to 4-4, system monitoring devices 8-2 to 8-4, and a relay device 5 (5-2). Configured.

  The other traffic monitoring devices 4-1 to 4-4 are network traffic monitoring devices that monitor network traffic on the respective networks 9-1 to 9-4 by a predetermined monitoring method. The other traffic monitoring devices 4-1 to 4-4 can apply existing network traffic monitoring devices. For example, a monitoring system management device using the SNMP protocol or the like, a monitoring system using sFlow, RMON, or the like. Or a management device that collects packet information of packets passing through the relay device.

  The system monitoring devices 8-1 to 8-4 are system monitors that monitor the management target devices (for example, application servers such as a mail server, a WWW server, and an FTP server) on the respective networks 9-1 to 9-4. Device. The system monitoring devices 8-1 to 8-4 correspond to, for example, firewall servers, unauthorized intrusion detection devices (for example, IDS (Intrusion Detection System), IPS (Intrusion Prevention System)), and the like.

  In FIG. 4, the relay device 5 (5-1 to 5-2) is assumed to be a router that connects the networks 9-1 to 9-4. However, the relay device 5 (5-1 to 5-2) is not limited to this, and the relay device such as a switching hub is used. Also applies.

  The collection probe device 2 is connected to, for example, the relay device 5-1, acquires all the packets that pass on the relay device 5-1, and based on the packet information of all the packets, the traffic corresponding to a predetermined collection condition is acquired. It measures the traffic volume (hereinafter also referred to as traffic flow statistical information).

  Further, the collection probe apparatus 2 gives the measured traffic flow statistical information to the manager apparatus 1 constantly or periodically. When the collection probe apparatus 2 receives the setting information to be monitored from the manager apparatus 1, the collection probe apparatus 2 sets collection conditions for collecting packet information according to the setting information. The collection probe apparatus 2 can set a plurality of collection conditions, and measures traffic flow statistical information for each collection condition.

  Furthermore, a plurality of collection probe devices 2 can be installed on the network 9-1, whereby traffic flow statistical information measured at multiple locations can be collected in the manager device 1. For convenience of explanation, the collection probe device 2 is installed only in the network 9-1. However, one or more collection probe devices 2 may be provided on another network (other segment).

  FIG. 5 is a functional block diagram showing main internal functions of the collection probe apparatus 2. As illustrated in FIG. 5, the collection probe apparatus 2 includes at least a packet acquisition unit 201, a packet information holding unit 202, a collection target selection unit 203, a manager transmission / reception unit 204, an analysis unit 205, and a traffic amount storage unit 206.

  The packet acquisition unit 201 captures all communication packets that pass through the relay device 5. As an acquisition method of the packet acquisition unit 201, for example, a method of acquiring from the relay device 5 (for example, a router or a switching hub) using a protocol such as SNMP, or a connection to the mirror port of the relay device 5 and flowing over the network A method of acquiring a packet can be applied.

  The packet information holding unit 202 holds packet information of all communication packets acquired by the packet acquisition unit 201 in association with reception times. Various methods can be applied as the packet information holding method.

  The collection target selection unit 203 selects conditions for collecting packet information according to the setting information from the manager device 1. In addition, the collection target selection unit 203 may select a plurality of collection target conditions, or may select a time condition to be monitored in the past time range.

  Here, the setting information from the manager device 1 specifies, for example, a monitoring condition for specifying a monitoring target (for example, a transmission source IP address, a transmission destination IP address, a VLAN tag number, a communication port number, etc.) and a monitoring time range. Packet information analysis rule information having time conditions (for example, monitoring start time, monitoring end time, etc.), alert setting information (for example, setting information of unauthorized communication such as port scan or IP sweep, threshold value in units of ports or applications) Etc.) and the like.

  The manager transmission / reception unit 204 exchanges various types of information with the manager device 1. The manager transmission / reception unit 204 transmits traffic flow statistical information stored in the traffic amount storage unit 206 to the manager device 1 at predetermined time intervals. The time interval for transmitting the traffic flow statistical information can be arbitrarily set / changed, and may be set / changed in accordance with an instruction from the manager device 1.

  The analysis unit 205 measures the traffic volume of the traffic to be collected by counting the number and size of currently passing packets according to the collection conditions selected by the collection target selection unit 203 for each unit time. Thereby, the traffic flow statistical information to be monitored can be obtained in real time.

  Further, when the collection target selection unit 203 selects a plurality of collection conditions, the analysis unit 205 may measure traffic flow statistical information according to each collection condition, or the collection target selection When the unit 203 selects a collection condition for monitoring a past time range, the database 203 (not shown in FIG. 5) acquired and held in the past is used to follow the collection condition within the past time range. Traffic flow statistical information may be measured.

  The traffic amount storage unit 206 stores the traffic flow statistical information obtained by the analysis unit 205. The traffic flow statistical information stored in the traffic volume storage unit 206 is transmitted to the manager device 1 by the manager transmission / reception unit 204 constantly or periodically.

  Returning to FIG. 4, the manager device 1 will be described. The manager device 1 acquires traffic information collected by a plurality of collection probe devices 2 constantly or periodically, and aggregates traffic flow information for each predetermined monitoring target. Thereby, it is possible to aggregate the traffic flow statistical information from each of the collection probe devices 2 arranged at multiple points. Furthermore, by processing these traffic flow statistical information, the traffic analysis of the entire broadband network can be performed. Obtainable.

  Further, the manager device 1 requests the other traffic monitoring devices 4-1 to 4-4 for the observation information observed by each of the other traffic monitoring devices 4-1 to 4-4, and the other traffic 4-1 to 4-4. Each piece of observation information received from 4-4 is managed, and predetermined traffic flow statistical information is analyzed using each piece of observation information.

  Thereby, not only the aggregation analysis of the traffic flow statistical information from the collection probe apparatus 2, but also the aggregation analysis using the traffic observation information on the other networks 4-2 to 4-4 can be performed.

  Generally, the monitoring methods of the other traffic monitoring devices 4-1 to 4-4 are different for each network (for each segment), and the observation information is also different. Therefore, conventionally, the observation information of each of the traffic monitoring devices 4-1 to 4-4 cannot be linked, but the manager device 1 uses the observation information from each of the other traffic monitoring devices 4-1 to 4-4. By performing the aggregate analysis, it is possible to perform the aggregate analysis in an integrated manner even when the monitoring method and observation information are different.

  Furthermore, the manager device 1 requests the communication log information of the management target device monitored by each of the system monitoring devices 8-1 to 8-4 from the system monitoring devices 8-1 to 8-4, and each system monitoring device. In addition to managing the communication log information from 8-1 to 8-4, when the failure of the management target device occurs, the analysis processing is performed using the information related to the failure.

  As a result, it is possible to perform cooperation processing with the system monitoring devices 8-1 to 8-4. As a result, whether the failure cause of the management target device is a failure in the management target device or a failure through the network. It is possible to take an integrated analysis process in consideration of network traffic.

  FIG. 1 is a functional block diagram illustrating a main functional configuration of the manager device 1 according to the first embodiment. As illustrated in FIG. 1, the manager device 1 includes at least an observation information setting unit 101, an integrated analysis unit 102, an output control unit 103, and an information integrated database unit 104.

  The observation information setting unit 103 requests observation information from the other traffic monitoring devices 4-1 to 4-4 and the system monitoring devices 8-1 to 8-4 in response to an instruction from the administrator terminal 7. It is.

  The other traffic monitoring devices 4-1 to 4-4 and the system monitoring devices 8-1 to 8-4 monitor the monitoring targets set in advance according to their own monitoring methods, and manage the monitoring results. The observation information setting unit 103 according to the first embodiment collects management information (observation information) managed by the other traffic monitoring devices 4-1 to 4-4 and the system monitoring devices 8-1 to 8-4 in an integrated manner. To contribute.

  Here, the observation information setting unit 103 specifies and requests a desired information item for the observation information to be acquired under the instruction of the administrator terminal 7.

  6 and 9 are explanatory diagrams illustrating examples of information items specified by the observation information setting unit 103 when requesting observation information.

  6 and 9, the observation information setting unit 103 can specify, for example, monitoring conditions and time conditions as information item examples to be specified when requesting observation information. Examples of the monitoring condition include a transmission source IP address, a transmission destination IP address, a transmission source port number, a transmission destination port number, and a VLAN number. The time condition includes, for example, a monitoring start time and a monitoring end time.

  Regarding the information items, all of the items shown in FIG. 6 may be designated items, or a part may be designated items.

  Also, as the time condition, the monitoring start range is not specified as in “No. 1” in FIG. 6 or the monitoring time range is not specified, as in “No. 2” to “No. 4” in FIG. The time and the monitoring end time can be specified.

  The observation information setting unit 103 can specify a plurality of items of observation information. Further, the observation information setting unit 103 may make a request to all the other traffic monitoring devices 4-1 to 4-4 and the system monitoring devices 8-1 to 8-4, or from the administrator terminal 7. The request may be made to a part of the devices instructed according to the instruction. At this time, different observation information items may be designated for each of the other traffic monitoring devices 4 and system monitoring devices 8 to be requested.

  The observation information setting unit 103 is not limited to an instruction from the administrator terminal 7, but receives, for example, information on the occurrence of an abnormality from the other traffic monitoring device 4 or the system monitoring device 8, and sets the observation information based on this information notification. You may request. When this information notification includes all or a part of information such as a transmission source IP address, transmission destination IP address, transmission source port number, transmission destination port number, VLAN number, abnormality detection time, etc., observation information The setting unit 103 requests observation information by designating information items included in the information notification.

  Based on the traffic flow statistical information acquired from one or a plurality of collection probe devices 2, the integrated analysis unit 102 processes the data by a predetermined aggregation method and performs an aggregation analysis.

  In addition, the integrated analysis unit 102 refers to the information integration database unit 104 as necessary, and observes the observation information of each of the other traffic monitoring devices 4-1 to 4-4 and the information of each of the system monitoring devices 8-1 to 8-4. Based on the communication path information, it is processed by a predetermined aggregation method to perform aggregation analysis.

  Here, as a method of aggregation by the integrated analysis unit 102, various processes can be applied. For example, an aggregation method from a physical viewpoint, an aggregation method from a logical viewpoint, an aggregation method from a temporal viewpoint, A method of combining one or more of these can be applied.

  For example, as an aggregation method from a physical point of view, (a) traffic volume by network (by segment), (b) traffic volume by protocol (for example, TCP / IP, ATM, OC3, SONET) adopted by the network (C) A method of aggregating from a viewpoint such as a traffic amount by network for a specific communication destination.

  Further, for example, as a method of aggregation from a logical viewpoint, (e) traffic volume for a specific communication destination, (f) special data used for a security attack (for example, a Syn packet or an attribute error) Packet) and the like.

  Further, for example, as an aggregation method from a time point of view, (g) For example, traffic volume at time intervals such as minutes, hours, days, etc., (h) Time range (for example, past time range, past start time) This is an aggregation method from the viewpoint of the traffic volume of the current time range. For example, it is possible to aggregate information such as aggregate information for every minute, week, month, or “amount of traffic per minute from XX month, XX hour x minute to XX hour □”.

  The output control unit 103 acquires the traffic flow statistical information analyzed by each of the collection probe devices 2-1 to 2-2 from all the collection probe devices 2-1 to 2-2, and performs predetermined processing based on each traffic flow statistical information. A processing process (for example, an aggregation process or the like) is performed, and the processing result is output to the administrator terminal 7.

  The information integration database unit 104 uses the observation information of the other traffic monitoring devices 4-1 to 4-4 received from the other traffic monitoring devices 4-1 to 4-4, and the other traffic monitoring devices 4-1 to 4- It is held every 4th. Further, the information integration database unit 104 receives communication log information of the management target devices managed by the system monitoring devices 8-1 to 8-4 from the system monitoring devices 8-1 to 8-4, and receives these communication logs. Information is held for each of the system monitoring devices 8-1 to 8-4.

  Further, the observation information of each of the other traffic monitoring devices 4-1 to 4-4 and the communication log information of each of the system monitoring devices 8-1 to 8-4 held by the information integration database unit 104 are given to the integrated analysis unit 102. .

  Returning to FIG. 4, the administrator terminal 7 is a terminal operated by the administrator of the network monitoring system 6 of the first embodiment, and corresponds to an information processing apparatus such as a personal computer. The administrator terminal 7 receives the setting information of the monitoring target in response to the operation of the administrator, gives the setting information of the monitoring target to the manager device 1, and receives the operation of the administrator, In cooperation, it displays the traffic flow statistical results that have been subjected to predetermined processing.

(A-2) Operation of the First Embodiment Next, in the network monitoring system 6 of the first embodiment, processing conditions for automatically adding network traffic monitoring conditions and monitoring the network will be described with reference to the drawings. While explaining.

  In FIG. 1, first, all packets passing through the relay device 5 are acquired in the collection probe device 2, packet information of all packets is held, and traffic flow statistical information corresponding to a predetermined collection condition is measured. Then, in the collection probe device 2, the measured traffic flow statistical information is transmitted to the manager device 1 at predetermined time intervals (step S1).

  The above processing is a flow of basic network monitoring processing of the network monitoring system 6. As a result, the manager device 1 obtains an aggregate result obtained by performing a predetermined processing process based on the traffic flow statistical information collected from all the collection probe devices 2, and sends the aggregate result to the administrator terminal 7. Can be output.

  Thereafter, it is assumed that some abnormality occurs in any of the networks 9-1 to 9-4.

  In this case, in response to the operation of the administrator, the instruction information indicating that the observation results observed by the other traffic monitoring devices 4-1 to 4-4 and the system monitoring devices 8-1 to 8-4 should be acquired is the administrator. Notification is sent from the terminal 7 to the observation information setting unit 101 of the manager device 1 (step S2).

  At this time, the instruction information from the administrator terminal 7 includes information items to be acquired (for example, transmission source IP address, transmission destination IP address, transmission source port number, transmission destination port number, VLAN number, monitoring start time, monitoring All or some items such as end time) are designated.

  Then, the observation information setting unit requests observation information from the other traffic monitoring device 4 and the system monitoring device 8 (step S3). At this time, the information item instructed from the administrator terminal 7 is also notified at the same time.

  When the observation information request is received from the observation information setting unit 101 of the manager device 1, the other traffic monitoring device 4 and the system monitoring device 8 read the specified observation information, and the specified observation information is sent to the manager device 1. It is transmitted (step S4).

  Observation information from the other traffic monitoring device 4 and the system monitoring device 8 is held in the information integrated database unit 104 of the manager device 1, and the observation information held in the information integrated database unit 104 is given to the integrated analysis unit 102 (step). S5).

  The integrated analysis unit 102 obtains a predetermined traffic amount according to a predetermined aggregation method using each observation information held in the information integration database unit 104, and the obtained traffic amount is controlled by the output control unit 103. The output is displayed on the display unit of the administrator terminal 7 (steps S6 and S7).

  In the following description, for example, when each network 9-2 to 9-4 performs a different network monitoring method, the manager device 1 performs integrated aggregation in cooperation with the other network monitoring devices 4-2 to 4-4. An example in the case of performing analysis will be described with reference to FIGS.

  FIG. 7 is an explanatory diagram showing a time-series change in the traffic volume of a certain communication that has occurred on segment C. FIG. FIG. 8 is an explanatory diagram showing an analysis result analyzed by the integrated analysis unit 102.

  For example, it is assumed that the traffic monitoring apparatus 4-2 of the segment A is a method of monitoring network traffic by collecting packets flowing on the network 9-2.

  In addition, it is assumed that the traffic monitoring apparatus 4-3 of the segment B is a method of monitoring network traffic using SNMP from a relay apparatus such as a router or a switch.

  Further, it is assumed that the traffic monitoring device 4-4 of the segment C is a method of monitoring network traffic using sFlow and RMON from a relay device such as a router or a switch.

  For example, when abnormal traffic such as a worm or unauthorized communication is detected on the segment C, it may affect other segments. Therefore, based on the transmission source IP address, transmission destination IP address, transmission source port number, transmission destination port number, VLAN number, time information, etc., indicating the abnormality that occurred in segment C, the traffic volume of other segments is analyzed. To do.

  In the following, a case where a time-series change in the traffic volume of a certain communication is analyzed is exemplified, but the analysis method is not limited to this.

  In FIG. 7, it is assumed that an abnormality in the traffic amount of a certain communication in segment C occurs, for example, near 12:00 on 3/1.

  Therefore, when the traffic volume is rapidly increasing in a specific time zone (in FIG. 7, around 11:00 of 3/1), for example, 12:00 of 3/1 is set as the time condition of the monitoring start time, The administrator terminal 7 sets the observation information of the manager device 1 using information that causes traffic abnormality (for example, transmission source IP address, transmission destination IP address, transmission source port number, transmission destination port number, VLAN number, etc.) as monitoring conditions. The instruction information is notified to the unit 101.

  Thereafter, the observation information setting unit 101 of the manager device 1 performs the other traffic monitoring device 4-2 on the segment A (network 9-2) and the other traffic monitoring device 4-3 on the segment B (network 9-3). Request observation information.

  In response to this, desired observation information is transmitted to the manager device 1 from the other traffic monitoring devices 4-2 and 4-3 of the segment A (network 9-2) and the segment B (network 9-3).

  When the observation information from the other traffic monitoring devices 4-2 and 4-3 is given to the information integrated database unit 104 of the manager device 1, the integrated analysis unit 102 of the manager device 1 performs a time series of traffic amounts corresponding to the monitoring conditions. Change is analyzed for each segment.

  That is, first, the integrated analysis unit 102 obtains a traffic amount per predetermined unit time based on observation information from the other traffic monitoring device 4-3 of the segment B (network 9-3), and based on the traffic amount. To obtain time series changes.

  Next, the integrated analysis unit 102 obtains a traffic amount per predetermined unit time based on the observation information from the other traffic monitoring device 4-2 of the segment A (network 9-2), and based on the traffic amount. Find time series changes.

  Then, in a state where the time-series changes in the traffic volume for each segment can be compared, for example, as shown in FIG. The output is displayed on the terminal 7.

  Further, as shown in FIG. 8B, the time series change of the traffic volume in the segment C is also superimposed on the result of superposing the time series change of the traffic volume of the segment A and the segment B, and the administrator terminal 7 is output and displayed.

  From FIG. 8B, in the segment B adjacent to the segment C where the abnormality occurred, the traffic volume abnormality occurred in the segment C around 3/18: 00, which is about 6 hours behind the abnormality occurrence time. It can be seen that an abnormality of the feature that approximates the feature that identifies

  Further, as shown in FIG. 8B, also in segment A adjacent to segment B, a feature abnormality that approximates the feature that identifies the traffic amount abnormality that occurred in segment C has occurred after a lapse of time. Recognize.

(A-3) Effect of First Embodiment As described above, according to the first embodiment, the manager device cooperates with another monitoring system on another network, so that another monitoring system can Information to be managed can be collected and management information of other monitoring systems can be integrated and analyzed. As a result, failure / event analysis by each monitoring system can be made unnecessary.

  Also, for example, a monitoring system using SNMP is a system monitoring target connected to the IP network, but according to the first embodiment, management information is collected from a system monitoring device that monitors an application server or the like. Since the integrated analysis is performed, not only the network traffic monitoring but also information such as the status of the Web server, the record information of the immigration system, and the operation information of the network connection device can be simultaneously monitored.

(B) Other Embodiments (B-1) In the first embodiment, one manager device is provided in one network, but a plurality of manager devices may be provided. In this case, an overall management device that further supervises a plurality of manager devices may be provided.

  Further, one observation probe device may observe a traffic flow passing through a plurality of relay devices. In this case, the observation probe device needs to identify which router the traffic flow has passed through is statistical information.

(B-2) The functional units included in the collection probe device described in the first embodiment may not be physically mounted on the same collection probe device. That is, as long as cooperation processing can be achieved between the functional units and the functions described in the first embodiment can be realized, the functional units may be separately distributed. Similarly, each functional unit included in the manager device of the first embodiment may be separately distributed.

  The manager device may have a part or all of the functional units of the collection probe device, or the collection probe device may have some or all of the functional units of the manager device.

  Furthermore, the relay device may be mounted with part or all of the functional units included in the collection probe device, or may be mounted with part or all of the functional units included in the manager device. Further, the relay device may be mounted with a part or all of the functional units of the collection probe device and a part or all of the functional units of the manager device.

(B-3) In the first embodiment, the manager device 1 has shown a case where the monitoring target setting information of all the collection probe devices 2 is managed in common. However, the manager device 1 may manage the setting information to be monitored for each one or a plurality of collection probe devices 2.

(B-4) The observation information setting unit is not limited to receiving an instruction from the administrator terminal. When the detection information such as a failure or a virus is received from another monitoring system, the observation information setting unit is based on the detection information. You may make it request | require. Further, the observation information may be requested at predetermined time intervals.

(B-5) The collection probe device and the manager device described in the first embodiment can be realized by software processing realized by a hardware resource (for example, a CPU) executing a program. That is, various functions of the collection probe device and the manager device are stored as programs. Note that the processing of the collection probe device and the manager device may be realized by hardware.

It is a block diagram which shows the internal structure of the manager apparatus of 1st Embodiment. It is explanatory drawing explaining the conventional network monitoring system (the 1). It is explanatory drawing explaining the conventional network monitoring system (the 2). 1 is a configuration diagram illustrating an overall configuration of a network monitoring system according to a first embodiment. It is a functional block diagram which shows the internal structure of the collection probe apparatus of 1st Embodiment. It is explanatory drawing explaining the information item example of the observation information of 1st Embodiment (the 1). FIG. 6 is an explanatory diagram showing a time-series change in traffic volume on a segment C in the first embodiment. It is explanatory drawing which shows the integrated analysis result in 1st Embodiment. It is explanatory drawing explaining the example of the information item of the observation information of 1st Embodiment (the 2).

Explanation of symbols

  DESCRIPTION OF SYMBOLS 1 ... Manager apparatus, 2 ... Collection probe apparatus, 4-1 to 4-4 ... Other traffic monitoring apparatus, 5-1 to 5-2 ... Relay apparatus, 6 ... Network monitoring system, 7 ... Administrator terminal, 8-1 -8-4 ... system monitoring device, 9-1 to 9-4 ... network, 101 ... observation information setting unit, 102 ... integrated analysis unit, 103 ... output control unit, 104 ... information integration database unit.

Claims (8)

One or a plurality of monitoring system means provided in each of the plurality of network systems, each for monitoring a predetermined monitoring object according to a unique monitoring method;
Monitoring information requesting means for requesting monitoring information managed by each of the monitoring system means to all or a part of each of the monitoring system means on each of the network systems;
Integrated analysis processing means for receiving the monitoring information from each of the monitoring system means requested by the monitoring information request means and performing integrated analysis processing based on the monitoring information from each of the monitoring system means. Monitoring information analysis system.   Each of the monitoring system means is network traffic monitoring system means for monitoring traffic of each network system and / or system monitoring means for monitoring one or a plurality of monitoring target devices on each network system. The monitoring information analysis system according to claim 1.   The monitoring information analysis system according to claim 1 or 2, wherein when the monitoring information request means requests the monitoring information, an information item of the monitoring information to be requested is designated. One or a plurality of monitoring system means provided in each of the plurality of network systems, each for monitoring a predetermined monitoring object according to a unique monitoring method;
Monitoring information requesting means for requesting monitoring information managed by each of the monitoring system means to all or a part of each of the monitoring system means on each of the network systems;
Integrated analysis processing means for receiving the monitoring information from each of the monitoring system means requested by the monitoring information request means and performing integrated analysis processing based on the monitoring information from each of the monitoring system means. Network monitoring system. A plurality of collection means for obtaining traffic flow information of a predetermined collection condition based on packet information of all communication packets flowing on one or a plurality of monitoring lines;
The network monitoring system according to claim 4, wherein the integrated analysis unit performs an integrated analysis process using the traffic flow information from each of the collection units. One or a plurality of monitoring system devices provided in each of a plurality of network systems, each for monitoring a predetermined monitoring target according to a unique monitoring method;
In the management device constituting a network monitoring system comprising: a management device that manages predetermined aggregate information based on monitoring information from each of the monitoring system devices;
Monitoring information requesting means for requesting monitoring information managed by each monitoring system device to all or a part of each monitoring system device on each network system;
Integrated analysis processing means for receiving the monitoring information from each of the monitoring system devices requested by the monitoring information requesting means and performing integrated analysis processing based on the monitoring information from each of the monitoring system devices. Management device. A monitoring information analysis method for analyzing monitoring information managed by one or a plurality of monitoring system means for monitoring each predetermined monitoring object according to a unique monitoring method provided in each of a plurality of network systems,
A monitoring information requesting step for requesting monitoring information managed by each of the monitoring system means to all or a part of each of the monitoring system means on each network system;
Integrated analysis processing step, wherein the integrated analysis processing means receives the monitoring information from each of the monitoring system means requested by the monitoring information request means, and performs integrated analysis processing based on the monitoring information from each of the monitoring system means And a monitoring information analyzing method characterized by comprising: A monitoring information analysis program for analyzing monitoring information managed by one or a plurality of monitoring system means for monitoring each predetermined monitoring object according to a unique monitoring method provided in each of a plurality of network systems,
On the computer,
Monitoring information requesting means for requesting monitoring information managed by each monitoring system means to all or a part of each monitoring system means on each network system;
Monitoring information analysis for receiving the monitoring information from the monitoring system means requested by the monitoring information requesting means and functioning as an integrated analysis processing means for performing an integrated analysis process based on the monitoring information from the monitoring system means program.

Images