JP2009212654A - System, method, and program for network operation equipment evaluation - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a network operation equipment evaluation system, determining the quality for existing equipments in a future instant, while assuming a situation such as occurrence of faults which have not occurred until now and increase of the number of users. <P>SOLUTION: The network operation equipment evaluation system includes a data collection means, a data storage means, a fault simulation means, a prediction data mining means, and an evaluation means. The data collection means collects data, including a traffic amount at least, for communication performance actually used or communication performance observed in an object network. The data storage means stores the data. The fault simulation means predicts a traffic amount at the time of faults for each pattern of faults which may occur in the object network, based on a traffic amount at the time of normal operation. The prediction data mining means predicts a traffic amount up to a some point in future, based on the data stored in the data storage means at least. The evaluation means evaluates the quality of equipments in the object network, based on the prediction result by the fault simulation means and the prediction result by the prediction data mining means. <P>COPYRIGHT: (C)2009,JPO&INPIT

Description

  The present invention relates to a network operation facility evaluation system, a network operation facility evaluation method, and a network operation facility evaluation program for evaluating facilities related to network operation.

  In many cases, the evaluation of facilities related to network operation is performed depending on the experience and feeling of network operation experts. For example, there is a problem that even if traffic data is collected, there is a part that depends on the know-how of a specific person in the data utilization process, or the technology cannot be shared that only a specific engineer can perform. In addition, there is a problem that a large amount of man-hours are required for manual work.

  Regarding systematization of facility evaluation related to network operation, for example, Patent Document 1 uses data representing a relationship between a traffic volume already measured and a traffic volume measured at a time later than the measurement time. A traffic monitoring device is described that estimates a traffic volume at a later time and predicts a resource shortage based on the estimated traffic volume.

  Patent Document 2 discloses a system performance measurement for collecting a line monitoring function for monitoring a line state when a system failure occurs, an emulation test function for each device, and system performance information used for system failure prediction. A functional device control system is described.

JP 2007-265245 A Japanese Patent Application Laid-Open No. 07-023478

  However, in the prediction based on the traffic estimation method described in Patent Document 1, only data that represents a fixed relationship between the first time and the second time is generated. It is impossible to predict whether a shortage will occur.

  In addition, the device control system described in Patent Document 2 collects control data flowing on an actual control channel, identifies a fault location of the system, and performs a sequence test or the like on the identified fault location. Thus, the cause of the failure can be elucidated, but no consideration is given to obtaining information on a failure that may occur in the future.

  Even if information on faults that have occurred in the past is used to estimate based on the traffic volume at the time of the fault, there is a problem in that it is impossible to determine whether the current equipment is good for faults that have not occurred.

  Therefore, the present invention provides a network operation facility evaluation system and a network that can determine the quality of current facilities at a future point in time while assuming situations such as the occurrence of failures and an increase in the number of users that have not occurred so far. An object is to provide an operation facility evaluation method and a network operation facility evaluation program.

  A network operation facility evaluation system according to the present invention is a network operation facility evaluation system for evaluating facilities related to network operation, and includes at least traffic volume, communication performance actually used in a network to be evaluated, or A data collection means for collecting data relating to the observed communication performance, a data storage means for storing at least the data collected by the data collection means, and a pattern of failures that may occur in the target network, Based on data collected by at least the data collection means stored in the data storage means, a failure simulation means for predicting the traffic volume when a failure occurs for each generated pattern based on the traffic volume at normal time The future is Based on the prediction data mining means for predicting the traffic volume to the point, the prediction result by the failure simulation means, and the prediction result by the prediction data mining means, the quality of the equipment related to the operation of the target network up to a certain time in the future And an evaluation means for evaluating.

  A network operation facility evaluation method according to the present invention is a network operation facility evaluation method for evaluating facilities related to network operation, and includes communication that is actually used in a network to be evaluated, including at least traffic volume. Collect data related to performance or observed communication performance, accumulate at least the collected data in a data storage device, generate a failure pattern that can occur in the target network, and generate a failure for each generated pattern. A failure simulation process for predicting the traffic volume in the case of occurrence of a failure based on the normal traffic volume, and at a certain time in the future based on at least the data collected by the data collection means stored in the data storage means Predict traffic volume to Performing measurement data mining processing, and evaluating the quality of equipment related to the operation of the target network up to a certain time in the future based on the prediction result by the failure simulation processing and the prediction result by the prediction data mining processing, To do.

  The network operation facility evaluation program according to the present invention is a network operation facility evaluation program for evaluating a facility related to network operation, and is actually included in a network to be evaluated including at least a traffic amount in a computer. Data collection processing that collects data related to the used communication performance or observed communication performance, generates a failure pattern that can occur in the target network, and normalizes the traffic volume when a failure occurs for each generated pattern Failure simulation processing for predicting based on traffic volume at the time, prediction data mining processing for predicting traffic volume up to a future point in time based on at least the collected data stored in a predetermined data storage device, and the failure Simulation A prediction result by tio down process, on the basis of the prediction result of the prediction data mining process, characterized in that to execute the evaluation process for evaluating the quality of the equipment according to the operation of the target network to some point in the future.

  According to the present invention, it is possible to determine whether or not the current equipment is good at a future point in time while assuming situations such as the occurrence of a failure that has not occurred so far and the increase in the number of users.

  Embodiments of the present invention will be described below with reference to the drawings. FIG. 1 is a block diagram showing a configuration example of a network operation facility evaluation system according to the present invention. As shown in FIG. 1, the network operation facility evaluation system according to the present invention includes data collection means 11, data storage means 21, failure simulation means 12, prediction data mining means 13, and evaluation means 14.

  The data collection unit 11 collects data relating to communication performance actually used or observed communication performance in the network to be evaluated, including at least traffic volume. The data collection unit 11 uses, for example, network configuration data indicating what kind of device and connection the target network is configured with, the amount of traffic measured by each device constituting the target network, and the target network User number data indicating the number of users to be collected may be collected.

  The data storage unit 21 stores at least the data collected by the data collection unit.

  The failure simulation means 12 generates a pattern of failures that can occur in the target network, and predicts the traffic volume when a failure occurs for each of the generated patterns based on the normal traffic volume. The failure simulation means 12 may predict the amount of traffic at the time of failure, for example, by adding the amount of traffic that normally arrives at the node or link as the failure occurrence location to the detour route side.

  The predicted data mining means 13 predicts the traffic volume up to a future point in time based on at least the data collected by the data collecting means 11 accumulated in the data storage means 21. For example, the prediction data mining means 13 derives a prediction model that defines a causal relationship between a change in traffic volume due to the passage of days and a change based on time variation and an increase in the number of users. The amount of traffic up to a certain point in time may be predicted. Here, the change based on time fluctuation refers to a change (so-called periodic change) caused by time, day of the week, season, or the like.

  The evaluation unit 14 evaluates the quality of the facilities related to the operation of the target network up to a future time point based on the prediction result by the failure simulation unit 12 and the prediction result by the prediction data mining unit 13.

  For example, the evaluation unit 14 causes the failure simulation unit 12 to predict the amount of traffic for each generated pattern when a failure occurs at the current time, and then accumulates the prediction data mining unit 13 in the data storage unit 21. Based on the data collected by the collected data collecting means and the traffic volume at the time of failure predicted by the failure simulation means 12, the traffic volume at the time of failure up to a certain time in the future is predicted. You may evaluate the quality of the facilities which are related to the operation of the target network up to a certain point. In such a case, the failure simulation unit 12 may predict the traffic amount when a failure occurs at the present time for each generated pattern based on the current traffic amount at the normal time.

  Further, for example, the evaluation unit 14 causes the prediction data mining unit 13 to predict the normal traffic amount up to a certain time in the future based on the data collected by the data collection unit stored in the data storage unit. In addition, by causing the failure simulation unit 12 to predict the amount of traffic when a failure occurs in the target network at a certain future time for each generated pattern, the operation of the target network up to a certain future time is concerned. You may evaluate the quality of an installation. In such a case, the failure simulation unit 12 may perform prediction based on the normal traffic amount up to a certain time in the future predicted by the prediction data mining unit 13.

  Hereinafter, more specific embodiments will be described. FIG. 2 is a block diagram illustrating a configuration example of the network operation facility evaluation system according to the present embodiment. The network operation facility evaluation system shown in FIG. 2 includes a data collection function unit 101, a failure simulation function unit 102, a prediction data mining function unit 103, an evaluation function unit 104, and an evaluation database 201.

  The data collection function unit 101 collects various data in the target network. The data to be collected is information related to the current communication performance of the target network, such as network configuration information data, traffic volume data, and user count data.

  The network configuration information data, for example, when the network operator inputs a configuration to each device that configures the target network such as each router or switch (registration of setting values), the contents are registered in a predetermined database. It is information held by. This information indicates what device and connection the target network is configured with.

  The traffic volume data is information indicating the result of constantly measuring and observing the traffic volume at each device (router, switch, etc.) constituting the target network, for example. The traffic volume data may be collected using, for example, a tool for monitoring the network load. In the present embodiment, the maximum traffic volume on the previous day at a certain point is set as the traffic volume on the previous day. For example, on December 26, 2007, the maximum traffic volume on the previous day (December 25, 2007) is calculated, and is set as the traffic length on December 15, 2007. The traffic volume for each day is output as a traffic data file. The traffic data file includes information associating the date with the traffic volume. The data collection function unit 101 may collect information on failure information (device failure or link failure) that has occurred in the target network together with traffic volume data.

  The number-of-users data is information regarding the number of users who use the target network. For example, it is information held by the network operator registering the number of subscribers of the target network in a predetermined database. Note that the number of subscribers of the target network may include the number of planned subscribers. The number-of-users data is updated at any time according to the change in the number of subscribers of the target network.

  For example, the data collection function unit 101 may collect data by accessing a database holding each of the data (or files) at a predetermined cycle and reading the data. In the present embodiment, the data collection function unit 101 stores the collected data in the evaluation database 201. The data collection function unit 101 collects data at a pace of once a day, for example, and collects information (network configuration information data, traffic volume data, user count data) in association with the collected date information. May be stored. Note that network configuration information data and user count data are newly registered only when the contents are changed, and when the contents are not changed, reference information to the already registered data is provided. You may make it relate.

  The failure simulation function unit 102 simulates the traffic amount when a failure occurs based on the traffic amount data and network configuration information data collected by the data collection function unit 101. The failure simulation function unit 102, for example, a failure pattern that can occur in the network (hereinafter referred to as failure pattern) such as a device failure of each device constituting the target network indicated by the network configuration information or a link failure connecting each device. Is generated). Then, the affected part is determined from the generated failure pattern, and the traffic amount at the time of failure is predicted (calculated) based on the collected traffic amount data.

  FIG. 3 is an explanatory diagram illustrating an example of a simulation result based on a failure pattern. FIG. 3 shows a result of simulating a device failure of the device b for the communication path α from the node A to the node B. That is, assuming that a failure has occurred in the device b, the traffic amount scheduled to pass through the device b (assumed to be x) is detoured, for example, as in the communication path β. It is predicted that the total traffic amount of the maximum traffic amount (assuming y) and the maximum traffic amount x detoured due to the failure of the device b will be reached. As described above, the simulation is performed by obtaining the maximum predicted traffic amount at the time of failure of the device affected by the failure for each failure pattern. Specifically, the maximum traffic amount to the detour route side may be added for each pattern. If there are a plurality of detour routes, a value obtained by dividing the route may be added.

  The failure simulation function unit 102 uses the data held in the evaluation database 201, for example, with the above-described simulation (maximum predicted traffic at the time of failure) at a predetermined cycle such as once a week (for example, early morning on Sunday). Amount calculation processing) may be performed. The simulation result is stored in the evaluation database 201 as a simulation result data file, for example. The simulation result data file includes information in which the simulation date and information indicating the failure pattern are associated with the maximum predicted traffic volume. The information indicating the failure pattern only needs to be able to identify the assumed failure occurrence location, for example.

  The prediction data mining function unit 103 combines various data and performs a sign (prediction) of the transition of the traffic amount up to a certain point in the future. In the present embodiment, the traffic volume at the normal time and the traffic volume at the time of failure simulation up to a set future time point (for example, two months ahead) are predicted using the prediction data mining engine. Here, the predictive data mining engine refers to a means for deriving a law between data using a predetermined data analysis method. It is also possible to use an existing data mining tool as the prediction data mining engine. In the present embodiment, it is necessary to be able to determine the relationship between data by understanding the cycle as in TrendLiner (trend analysis engine). TrendLiner uses a probabilistic model to represent time-series data, and derives an optimization model by learning this using a hierarchical modeling method that individually models long periodicity and short periodicity. It is a tool engine (processing software) that predicts the future.

  The traffic volume at the normal time is calculated by performing a predicted data mining process based on the daily traffic volume collected by the data collection function unit 101 and the user count data. The forecast data mining process derives a forecast model that defines the causal relationship between daily changes in traffic volume as a result of periodic changes and an increase in the number of users, and based on that, the normal time at a specified future time point is derived. Estimate (calculate) the amount of traffic. In addition, when using an existing data mining tool, for example, a set of information that associates the day of the week and the season with the number of users as information on the traffic amount of a certain day and the condition on the day when the traffic amount is observed. As an input, a traffic amount corresponding to the set day condition at a future time point may be output.

  The traffic volume at the time of failure is calculated based on the traffic volume at the time of failure calculated by the failure simulation means 13 (here, the weekly traffic volume for each pattern) and the number of users data. Calculate by doing. As for the prediction of traffic volume at the time of failure, a prediction model that defines the causal relationship as the change in the maximum predicted traffic volume at the time of failure every week due to the periodic change and the increase in the number of users is derived. Based on this, the traffic volume at the time of failure at the specified future time is calculated. When calculating the predicted value of traffic volume at the time of failure, first, information on the actually observed failure is given as an input, and the frequency of failure occurrence and the causal relationship between other failure occurrence locations or traffic volume with respect to the failure occurrence location are given. Obtain a prescribed prediction model, derive a failure occurrence pattern that can occur at a set future time point based on the prediction model, and calculate the traffic volume at the time of failure for the failure occurrence pattern and the failure pattern under a predetermined condition. May be calculated.

  Note that the prediction data mining function unit 103 derives a failure occurrence pattern that is likely to occur at a certain time in the future, and the failure simulation function unit 102 uses the prediction data for a predetermined failure occurrence pattern including the failure occurrence pattern. By performing a simulation using the normal traffic volume obtained by the mining function unit 103, it is also possible to calculate the traffic volume at the time of failure at a certain time in the future.

  The evaluation function unit 104 evaluates the network performance by comparing with a predetermined threshold based on the simulation result by the failure simulation function unit 102 and the prediction data mining result by the prediction data mining function unit 103. The threshold value may be set, for example, as a traffic usage rate (for example, 90%) at each point in network operation. Also, a preliminary threshold value (for example, 80%) may be provided so that attention is urged before a warning due to exceeding the threshold value. The evaluation function unit 104, for example, for the top number pattern that is dangerous to the threshold, or the failure pattern predicted to exceed the threshold or the reserve threshold in the specified period, the predicted value along with the change of the situation due to the passage of days By displaying, notification may be made so that the network operator can easily understand visually. Also, adjust the degree of risk by distinguishing colors such as red for those predicted to exceed the threshold or reserve threshold within one month, and yellow for those predicted to exceed the threshold or reserve threshold within three months. You may make it inform.

  In the present embodiment, the data collection function unit 101, the failure simulation function unit 102, the prediction data mining function unit 103, and the evaluation function unit 104 are realized by a CPU that operates according to a program, for example. The evaluation database 201 is realized by a storage device, for example. Note that it may be realized by a database system including a control device that accesses the storage device.

  Next, the operation of this embodiment will be described. FIG. 4 is a flowchart showing an operation example of the network operation facility evaluation system of this embodiment. In the example shown in FIG. 4, first, the data collection function unit 101 periodically collects predetermined data from the target network (step S101). For example, the data collection function unit 101 may collect data from the target network at all times, and calculate the maximum traffic volume of the measurement point from the collected data in a cycle such as once a day. The data collected here is stored in the evaluation database 201.

  Next, in step S102, the prediction data mining function unit 103 performs a normal prediction data mining process using data held in the evaluation database 201 at a predetermined cycle (for example, once a week). Do. For example, when traffic volume is collected at a pace of once a day, if two weeks have passed since the system was operating, the traffic volume for the past 11 days is used at the specified future time point. Predictive data mining is performed to determine the normal traffic volume. It may be determined in advance how many days in the past the data is to be input. It should be noted that it is sufficient for the time point to be specified to have the time required to prepare the equipment when it is determined that the equipment investment is necessary. For example, if it takes two months to arrange a router, at least two months ahead can be specified.

  Further, the prediction data mining function unit 103 performs prediction data mining processing at the time of failure using data held in the evaluation database 201 at a predetermined cycle (for example, once a week) (step S103). . For example, if the traffic volume at the time of failure is calculated at a pace of once a week by simulation, if the system has been operating and two weeks have passed, the future specified using the simulation results for two times Predictive data mining processing for obtaining the traffic volume at the time of failure at the time of is executed. Note that it may be determined in advance how many times data is input in the past.

  Next, in step S104, the failure simulation function unit 102 uses the data stored in the evaluation database 201 at a predetermined cycle (for example, once a week), and uses the data stored in the evaluation database 201 to determine a failure pattern under a predetermined condition. For the failure. The failure simulation function unit 102 generates and generates a failure pattern to be simulated based on the conditions indicated according to the criteria on the network operation side, such as guaranteeing the bandwidth if there are failures up to two places. A simulation is performed for each failure pattern. In this example, a simulation is performed for all patterns that cause a one-point fault and a two-point fault.

  Next, in step S <b> 105, the evaluation function unit 104 evaluates the network performance based on the simulation result by the failure simulation function unit 102 and the prediction data mining result by the prediction data mining function unit 103. Then, the evaluation result is notified to the network operator (step S106). For example, the evaluation function unit 104 may notify the network operator only when it is determined that danger or caution is necessary as a result of the evaluation.

  FIG. 5 is an explanatory diagram showing a display example of the evaluation result. In the example shown in FIG. 5, the predicted value at the time of failure and the predicted value at normal time for a certain failure pattern are displayed in a graph with the date as an axis, thereby representing a change in the situation due to the passage of days. In addition, the example shown in FIG. 5 is an example of the evaluation result on the 16th (Tue) of a certain month. In other words, each circle connected by a solid line before the 16th is an actual measurement value of the traffic amount at the normal time. Each circle connected by a dotted line after the 16th is a predicted value of the normal traffic amount obtained by the predicted data mining process. A triangle indicates the maximum traffic usage rate when a failure occurs for a certain failure pattern.

  As shown in FIG. 5, periodic changes are observed on a weekly basis, such that Monday is slightly more in one week, Tuesday is less than that, and it is in an upward tone from Wednesday to Friday, and Saturdays and Sundays are extremely few. In addition, a change in the situation has been observed in which the traffic volume gradually increases as the number of users increases. Further, it is shown that there is a possibility that the traffic volume at the time of failure and normal time may exceed the reserve threshold on the 26th (Friday). In the example shown in FIG. 5, for the sake of easy understanding, it is shown as a result of a prediction that the preliminary threshold value is exceeded in a short period of time. In some cases, a graph that can display at least two months ahead is displayed. It is also possible to display a plurality of failure patterns on one graph. In addition, you may make it display also about the information of the fault location assumed with the fault pattern currently displayed.

  As described above, according to the present embodiment, based on real network data and past accumulated data, the amount of traffic that can occur in the future is predicted by using both the failure simulation process and the predicted data mining process. It is possible to determine whether or not the current equipment is good at a future point in time while assuming a situation such as the occurrence of a failure that has not occurred so far and an increase in the number of users. In addition, the network operator can grasp the future traffic trend without worrying about the technical bias due to manual labor, and can easily perform the capital investment plan.

  The present invention can be suitably applied to a large-scale network system such as a communication carrier network in which the number of users does not increase or decrease.

It is a block diagram which shows the structural example of the network operation equipment evaluation system by this invention. It is a block diagram which shows the more specific structural example of a network operation equipment evaluation system. It is explanatory drawing which shows an example of the simulation result by a failure pattern. It is a flowchart which shows the operation example of the network operation equipment evaluation system of this embodiment. It is explanatory drawing which shows the example of a display of an evaluation result.

Explanation of symbols

DESCRIPTION OF SYMBOLS 11 Data collection means 12 Failure simulation means 13 Prediction data mining means 14 Evaluation means 21 Data storage means 101 Data collection function part 102 Failure simulation function part 103 Prediction data mining function part 104 Evaluation function part 201 Evaluation database

Claims (9)

A network operation equipment evaluation system for evaluating equipment related to network operation,
Data collection means for collecting data relating to communication performance actually used or observed in the network to be evaluated, including at least traffic volume;
Data storage means for storing at least the data collected by the data collection means;
A failure simulation means for generating a failure pattern that can occur in the target network, and predicting the traffic volume when a failure occurs for each generated pattern based on the traffic volume at normal time;
Predictive data mining means for predicting traffic volume up to a future time point based on data collected by the data collecting means accumulated at least in the data storage means;
Evaluation means for evaluating the quality of equipment related to operation of the target network up to a certain time in the future based on the prediction result by the failure simulation means and the prediction result by the prediction data mining means. Network operation facility evaluation system. The data collection means includes network configuration data indicating what devices and connections the target network is configured with, the amount of traffic measured by each device constituting the target network, and the number of users using the target network. User count data indicating
The prediction data mining means derives a prediction model that defines the causal relationship between the change in traffic volume due to the passage of days and the increase in the number of users based on changes in time, and uses the derived prediction model to The network operation facility evaluation system according to claim 1, wherein the traffic amount is predicted. The network according to claim 1 or 2, wherein the failure simulation means predicts the traffic amount at the time of failure by adding, to the detour route side, the traffic amount that normally reaches the node or link as the failure occurrence point. Operational equipment evaluation system. The failure simulation means predicts the traffic volume when a failure occurs at the current time for each generated pattern based on the current traffic volume at the normal time,
The predicted data mining means is based on the data collected by the data collecting means accumulated in the data storage means and the traffic volume at the time of failure predicted by the failure simulation means, at the time of failure up to a certain point in the future. The network operation facility evaluation system according to any one of claims 1 to 3, wherein the traffic amount is predicted. The predictive data mining means predicts normal traffic volume up to a certain time in the future based on the data collected by the data collecting means accumulated in the data storage means,
The failure simulation means converts the traffic volume when a failure occurs in the target network at a future time point into the normal traffic volume up to a future time point predicted by the prediction data mining means for each generated pattern. The network operation facility evaluation system according to any one of claims 1 to 3, wherein the network operation facility evaluation system is predicted. A network operation facility evaluation method for evaluating facilities related to network operation,
Collect data related to the communication performance actually used or observed in the network to be evaluated, including at least the traffic volume,
Storing at least the collected data in a data storage device;
A failure simulation process that generates a failure pattern that can occur in the target network and predicts the traffic volume when a failure occurs based on the normal traffic volume for each generated pattern,
Based on at least the data collected by the data collection means stored in the data storage means, a prediction data mining process for predicting the traffic volume up to a certain time in the future is performed,
A network operation facility evaluation method characterized by evaluating the quality of facilities related to the operation of the target network up to a future time point based on the prediction result by the failure simulation processing and the prediction result by the prediction data mining processing. Network configuration data indicating what devices and connections the target network is configured with, traffic volume measured by each device that configures the target network, and user count data indicating the number of users using the target network And collect and
In the forecast data mining process, a forecast model that defines the causal relationship between the change in traffic volume due to the passage of days and the increase in the number of users based on changes in time is derived. The network operation facility evaluation method according to claim 6, wherein the traffic amount up to is predicted. A network operation facility evaluation program for evaluating facilities related to network operation,
On the computer,
A data collection process that collects data related to the communication performance actually used or observed in the network to be evaluated, including at least the traffic volume,
A failure simulation process that generates a failure pattern that can occur in the target network and predicts the traffic volume when a failure occurs for each generated pattern based on the normal traffic volume,
Predictive data mining processing for predicting traffic volume up to a certain time in the future based on at least the collected data accumulated in a predetermined data storage device, prediction results by the failure simulation processing, and the predictive data mining processing A network operation facility evaluation program for executing an evaluation process to evaluate the quality of facilities related to the operation of the target network up to a certain point in the future based on the prediction results of On the computer,
Network configuration data that indicates what devices and connections the target network is configured in the data collection process, the amount of traffic measured by each device that makes up the target network, and the number of users using the target network User number data indicating
In the forecast data mining process, a forecast model that defines the causal relationship between the change in traffic volume due to the passage of days and the increase in the number of users based on the change in time is derived. The network operation facility evaluation program according to claim 8, wherein the traffic amount up to a point in time is predicted.

Images