JP2011254179A - Network analysis support device, network analysis support method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a network analysis support device that collects telegraphic messages flowing over a plurality of networks and associates them with each other.SOLUTION: A first telegraphic message collection section 101 collects telegraphic messages flowing over a first network 50 and stores the messages in a first storage section 103. A second telegraphic message collection section 102 collects telegraphic messages flowing over a second network 60 and stores the messages in a second storage section 104. A telegraphic message association section 105 holds a mapping table where correspondence between telegraphic messages flowing from the first network 50 to a gateway device and telegraphic messages flowing from the gateway device to the second network 60 and the like are defined. The telegraphic message association section 105 associates the telegraphic messages stored in the first storage section 103 and the telegraphic messages stored in the second storage section 104 with each other by referring to the mapping table. A result of the association is displayed by a control section 107 on a display section 106.

Description

  The present invention relates to a network analysis support device, a network analysis support method, and a program.

  In recent years, building management systems that comprehensively manage, monitor, and control equipment such as air conditioners and illuminators installed in buildings are well known. In this type of building management system, generally, a central monitoring device connected to an upper network controls a plurality of facility devices connected to the lower network via a gateway (for example, Patent Document 1).

  In general, the central monitoring device, the gateway device, and each facility device constituting the building management system are provided from different vendors. Each vendor can fully perform the operation confirmation test of the device itself provided by itself, but it is not easy to perform the operation confirmation test that fully covers the situation after the system is actually constructed. Absent.

  For this reason, there are many cases where unexpected problems occur after the system is constructed and actually operated. It is necessary to collect and analyze the messages flowing through In other words, it is necessary to investigate what kind of events are occurring in the upper network and the lower network, and how the respective causal relationships are.

JP 2006-129283 A

  In this type of conventional technology, messages of a plurality of networks are collected separately. Therefore, there is a problem that the worker needs to perform the work of associating the collected messages of each network, which is very troublesome.

  The present invention has been made to solve the above-described conventional problems, and an object of the present invention is to provide a network analysis support apparatus that collects and correlates messages flowing on a plurality of networks.

In order to achieve the above object, a network analysis support device according to the present invention provides:
A device that supports network analysis in a system including a first device, a gateway device, and a second device,
A first message collection means for collecting messages flowing on the first network connected to the first network to which the first device and the gateway device are connected;
A second message collection means for collecting messages flowing on the second network connected to the second network to which the gateway device and the second device are connected;
A correspondence between a message flowing from the first network to the gateway device and a message flowing from the gateway device to the second network, a message flowing from the second network to the gateway device, and A mapping table in which a correspondence relationship with a message flowing on the first network from the gateway device is defined;
A message association means for referring to the mapping table and associating the messages collected by the first message collection means with the messages collected by the second message collection means;
Display means for displaying a result associated with the message association means.

  According to the present invention, since the messages flowing on a plurality of networks are collected and associated, the efficiency of maintenance work in the equipment management system or the like can be improved.

It is a figure showing the whole equipment management system composition which incorporated a network analysis support device concerning one embodiment of the present invention. It is a block diagram which shows the structure of the network analysis assistance apparatus which concerns on this embodiment. (A) is a block diagram which shows the structure of the 1st message | telegram collection part shown in FIG. 2, (b) is a block diagram which shows the structure of the 2nd message | telegram collection part shown in FIG. FIG. 3 is a block diagram illustrating a configuration of a message association unit illustrated in FIG. 2. It is a figure which shows an example of a mapping table. It is a figure which shows an example of a request-response rule table. It is a flowchart which shows the procedure of the process for matching between networks. It is a block diagram which shows the structure (the 1) of the message | line related part in the network analysis assistance apparatus which concerns on other embodiment. It is a figure which shows an example of an instance corresponding | compatible rule table. In other embodiment, it is a figure for demonstrating the message correlation using an instance corresponding | compatible rule table. It is a figure which shows the other example of a mapping table. It is a figure for demonstrating the message | telegram collection method of the network analysis assistance apparatus which concerns on other embodiment. FIG. 10 is a diagram (No. 1) for describing a method of setting a mapping table, a request-response rule table, and an instance association rule table in the network analysis support device. FIG. 11 is a diagram (No. 2) for describing a method for setting a mapping table, a request-response rule table, and an instance association rule table in the network analysis support apparatus. It is a block diagram which shows the structure (the 2) of the message related part in the network analysis assistance apparatus which concerns on other embodiment. It is FIG. (1) for demonstrating the function of the network analysis assistance apparatus of FIG. It is FIG. (2) for demonstrating the function of the network analysis assistance apparatus of FIG.

  Hereinafter, a network analysis support apparatus according to an embodiment of the present invention will be described in detail with reference to the drawings.

  FIG. 1 is a diagram showing an overall configuration of an equipment management system incorporating a network analysis support apparatus according to the present embodiment. This equipment management system is a system (so-called building management system) that controls and manages equipment such as air conditioners and lighting equipment installed in a building. As shown in FIG. And a central monitoring device 20, a gateway device 30, and a facility equipment system 40.

  The central monitoring device 20 and the gateway device 30 are connected to a first network (facility management system network) 50 that is a higher-level network in accordance with a communication protocol such as BACnet (A Data Communication Protocol for Building Automation and Control Networks). . The gateway device 30 and the equipment device system 40 are connected to a second network 60 (equipment equipment network), which is a lower network in accordance with a vendor-specific communication protocol that is a provider of equipment equipment. The network analysis support device 10 is connected to both the first network 50 and the second network 60.

  Although not shown in the figure, the central monitoring device 20 includes a control device (consisting of a CPU, ROM, RAM, etc.), an external storage device (for example, a readable / writable nonvolatile semiconductor memory, a hard disk drive, etc.). ), Input devices (for example, composed of a keyboard, mouse, keypad, touchpad, touch panel, etc.), display devices (for example, composed of a CRT, a liquid crystal monitor, etc.), a predetermined communication interface, etc. Prepare. The central monitoring device 20 controls each equipment device (for example, an air conditioner, an illuminator, etc.) constituting the equipment device system 40 via the gateway device 30. In the present embodiment, the central monitoring device 20 corresponds to a first device, and each facility device of the facility device system 40 corresponds to a second device.

  Although not shown, the gateway device 30 includes a control device (configured from a CPU, ROM, RAM, etc.) and an external storage device (for example, a readable / writable nonvolatile semiconductor memory, a hard disk drive, etc.). ) And a predetermined communication interface.

  When the central monitoring device 20 performs operation of each facility device in the facility device system 40 and monitoring of the operation state, a predetermined telegram is output from the central monitoring device 20 onto the first network 50. The electronic message is converted into a data format that can be processed by each facility device by the gateway device 30, and then output on the second network 60 and delivered to each facility device. On the other hand, a message from each equipment is converted by the gateway device 30 into a data format that can be processed by the central monitoring device 20, and then output onto the first network 50 and delivered to the central monitoring device 20.

  In this way, the central monitoring device 20 sends a message from the first network 50 to the second network 60 via the gateway device 30, or from the second network 60 to the first network 50. The functions such as various operations and monitoring for each facility device of the facility device system 40 are realized by receiving the electronic message.

  That is, in order to understand the operation status of this equipment management system, it is necessary to grasp the state of message conversion performed through the gateway device 30 and the state of message input / output to / from both of the gateway device 30. There is. The network analysis support device 10 of the present invention collects and analyzes messages from a plurality of networks such as the first network 50 and the second network 60 connected to both ends of the gateway device 30 and associates the messages with each other. And presenting the result to the worker helps the worker to easily understand the operation status of the equipment management system. As a result, when a defect occurs, it becomes easy to identify the defect location and the contents of the defect, thereby improving the efficiency of the maintenance work.

  Although the network analysis support device 10 is not shown in hardware, the network analysis support device 10 includes a control device (consisting of a CPU, ROM, RAM, etc.), an external storage device (for example, a readable / writable nonvolatile semiconductor memory, Comprised of a hard disk drive, etc.), input device (eg, comprised of a keyboard, mouse, keypad, touchpad, touch panel, etc.), display device (eg, comprised of a CRT, liquid crystal monitor, etc.) And a predetermined communication interface. Each process (details will be described later) executed by the network analysis support device 10 is realized by a CPU or the like executing a predetermined program stored in a ROM or an external storage device.

  As shown in FIG. 2, the network analysis support apparatus 10 functionally includes a first message collection unit 101, a second message collection unit 102, a first storage unit 103, and a second storage unit. 104, a message association unit 105, a display unit 106, and a control unit 107 that controls these components.

  As shown in FIG. 3A, the first message collection unit 101 includes a first message reception unit 111 and a first message analysis unit 112. The first telegram receiver 111 is a telegram that flows on the first network 50, that is, a telegram transmitted from the central monitoring device 20 to the gateway device 30 (downward telegram of the first network), and the gateway device. The messages (upstream messages of the first network) transmitted from 30 to the central monitoring device 20 are collected. The first message analysis unit 112 analyzes the message received by the first message reception unit 111, and stores information about the received message (message information) in the first storage unit 103 according to the analysis result. . For example, the first message analysis unit 112 analyzes the direction of the message (up or down), the session identifier, the content of the command, and the like, and stores the results in the first storage unit 103 in time series.

  As shown in FIG. 3B, the second message collection unit 102 includes a second message reception unit 121 and a second message analysis unit 122. The second telegram receiving unit 121 transmits a telegram that flows on the second network 60, that is, a telegram transmitted from the gateway device 30 to the facility device system 40 (downward telegram of the second network), and the facility device. Collects messages transmitted from the system 40 to the gateway device 30 (upstream messages of the second network). The second message analysis unit 122 analyzes the message received by the second message reception unit 121 in the same manner as the first message analysis unit 112, and the result (message information) is stored in the second storage unit in chronological order. It stores in 104.

  Note that the first storage unit 103 and the second storage unit 104 do not need to be configured by physically different semiconductor memories or the like. Furthermore, the first storage unit 103 and the second storage unit 104 may be configured by the same semiconductor memory or the like and may indicate the same memory area. In this case, the identification information indicating which message information is on the first network 50 side or the second network 60 side is sent to each message information by the first message analysis unit 112 and the second message analysis unit 122. To be added.

For example, the first storage unit 103 stores message information conforming to the BACnet described above, and the second storage unit 104 stores message information conforming to a vendor-specific communication protocol. Each message information is, for example,
"Destination address + Source address + Session identifier + Response necessity flag + Command (processing details)
+ Processing target class identifier + processing target instance identifier + processing target property identifier + processing target property value "
The records are collected by the first message collection unit 101 and the second message collection unit 102 in the first storage unit 103 and the second storage unit 104, respectively. There are as many messages as there are.

  The message association unit 105 executes a process of associating the message stored in the first storage unit 103 with the message stored in the second storage unit 104 (message association process). The processing result of the message association unit 105 is displayed on the display unit 106 via the control unit 107.

  FIG. 4 is a block diagram illustrating a configuration of the message association unit 105. As illustrated in FIG. 4, the message association unit 105 includes a relationship analysis unit 151, a mapping table 152, and a request-response rule table 153. The mapping table 152 shows the correspondence between messages flowing from the first network 50 side to the second network 60 side and messages flowing from the second network 60 side to the first network 50 side as one of the components of the message. It is a data table defined using all or part. FIG. 5 shows an example of the mapping table.

  In the example of FIG. 5, “command (WriteProperty etc.) + Processing target class identifier (BO etc.) + Processing target instance identifier (001 etc.)” which is a part of the component of the telegram information on the first network 50 side, A correspondence relationship between “command (operation, etc.) + Process target property identifier (operation / stop, etc.)”, which is a part of the component of the message information on the second network 60 side, is defined.

  The request-response rule table 153 is data that defines a correspondence between a request message and a response message corresponding to the request message in the same network (in this embodiment, the second network 60) using a part or all of the components of the message. It is a table. FIG. 6 shows an example of the request-response rule table 153.

  In the example of FIG. 6, “command + processing target property identifier” (operation + run / stop, etc.) of the request message on the second network 60 and “command + processing target property identifier” (operation monitor response +) of the response message. (Operation / stop, etc.) is defined.

  The association analysis unit 151 refers to these tables and associates the message information stored in the first storage unit 103 with the message information stored in the second storage unit 104.

  Hereinafter, the message association process by the relationship analysis unit 151 will be described. Here, a case where a message for controlling the facility device is transmitted from the central monitoring device 20 to the facility device system 40 and a response message for the message is returned to the central monitoring device 20 will be described as an example. To do.

  First, the association analysis unit 151 uses the mapping table 152 to perform processing for associating a message flowing from the first network 50 to the second network 60. Such processing (inter-network correspondence processing) will be described with reference to the flowchart of FIG. First, the relation analysis unit 151 acquires one record of message information (A) whose content indicates a request from the first storage unit 103 (step S101).

  Next, the association analysis unit 151 determines whether or not the acquired message information (A) includes a session identifier (step S102). If the session identifier is included (step S102; YES), The analysis unit 151 acquires message information (B) having a common session identifier (for example, InvokeID) from the first storage unit 103 and associates it with the message information (A) (step S103).

  In the case where the determination in step S102 is NO or after the processing in step S103, the relation analysis unit 151 refers to the mapping table 152 using the acquired message information (A) as a key, and from the gateway device 30 to the second network 60. The content of the message information (predicted message information) of the message that is predicted to be output to the side is acquired (step S104). In the example of FIG. 5, when the content of the acquired message information is “WriteProperty + BO + 001”, the corresponding prediction message information content (that is, predicted to be output to the second network 60 side) is “ Operation + Run / Stop ".

  The relation analysis unit 151 searches the second storage unit 104 for the message information (C) that is later in time series from the message information (A), matching the contents of the acquired predicted message information (step S105). . Then, the association analysis unit 151 associates the message information (A) with the searched message information (C) (step S106).

  Subsequently, the association analysis unit 151 refers to the request-response rule table 153 and performs a process of associating the downlink message and the uplink message on the second network 60 side. For example, when the content of the message information (C) on the second network 60 side associated in the above-described process is “operation + run / stop” indicating a request, in the example of FIG. The content of the telegram information of the telegram for which a response to the request is predicted is “operation monitor response + run / stop”.

  Therefore, the relation analysis unit 151 has the content “operation monitor response + run / stop” from the second storage unit 104, and the message information (D) that is later in time series than the message information related to the request. Search for. Then, the association analysis unit 151 associates the message information (C) related to the request with the searched message information (D). When session identifiers are set, the session identifiers may be associated with each other.

  Next, the association analysis unit 151 uses the mapping table 152 to perform processing for associating a message flowing from the second network 60 to the first network 50. In the example of FIG. 5, “operation monitor response + run / stop” on the second network 60 side corresponds to “COVNotification + BI + 001” on the first network 50 side. Therefore, the relation analysis unit 151 has the content “COVNotification + BI + 001” from the first storage unit 103, and the message information (D) of the second network 60 indicating the response in time series ( E) Search. Then, the association analysis unit 151 associates the message information (D) of the second network 60 with the message information (E) of the searched first network 50.

  As described above, a message for controlling the facility device is transmitted from the central monitoring device 20 to the facility device system 40, and a series of messages (message information) when a response message to the message is returned to the central monitoring device 20. Association of (A) to (E)) is completed.

  The control unit 107 causes the display unit 106 to display the message group (related message group) associated by the message association unit 105 with another related message group in an identifiable manner, for example, by color coding.

  In the above message association process, the range to be associated can be arbitrarily set. For example, only message information related to a message received within a predetermined time from the reception time of the original message may be set as a target of association. For example, in the process of step S105 in FIG. Of the information, only the message information related to the message closest to the reception time of the original message may be the target of association.

  As described above, according to the network analysis support device 10 according to the present embodiment of the present invention, messages flowing in the first network 50 and the second network 60 can be associated with each other and presented to the operator. When this occurs, it becomes easy to specify the location of the failure, the content of the failure, etc., and to improve the efficiency of the maintenance work.

  In addition, this invention is not limited to the said embodiment, Of course, the various change in the range which does not deviate from the summary of this invention is possible.

  For example, there is no limitation on the execution timing of the above-described message association process executed by the network analysis support device 10, and it can be arbitrarily started by a user such as an operator. For example, the network analysis support device 10 may always execute a message association process during normal operation of the facility management system and output the result to the display unit 106, or only collect messages during normal operation. May be performed. In the latter case, when a problem or the like occurs, the message association process is executed according to the operation by the operator.

  In the above-described embodiment, the mapping table 152 and the request-response rule table 153 have been defined as having a one-to-one correspondence. However, the one-to-many, many-to-one, and many-to-many correspondences, respectively. You may define

  In addition, in a facility management system, for example, by setting a group of facility devices as a process target instance identifier of a message whose processing target class identifier is BO or BI, a plurality of facility devices are controlled by one message. Is also possible. For example, when it is desired to set the group number 1 to the processing target instance identifier “001”, the processing target instance identifier is set to “101”. In this example, if the equipment No. 1 and No. 2 belong to the group number 1, the operation of the No. 1 and No. 2 can be operated / stopped by the message “WriteProperty + BO + 101”.

  Even in such a case, as shown in FIG. 8 and FIG. 9, by providing an instance correspondence rule table 154 indicating the relationship between the group number and the corresponding equipment (No. 1, No. 2, etc.), a message can be obtained. The associating unit 105 can associate a message.

  The association of the electronic message in this case will be described. In the example of FIG. 10, on the first network 50 side, the message 801 is a downlink message with the content “WriteProperty + BO + 101”, the message 802 is an uplink message with the command “SimpleACK”, and the message 807 is , The content is an upward telegram with “COVNotification + BI + 101”.

  On the second network 60 side, the telegram 803 is a downward telegram indicating “operation + run / stop” for the first unit, and the telegram 804 represents “operation + run / stop” for the second unit. The telegram 805 is an upward telegram indicating “operation monitor response + run / stop” from the first machine, and the telegram 806 represents “operation monitor response + run / stop” from the second machine. It is an uplink message.

  In addition, alternate long and short dash lines 808 and 809 indicate correspondence relationships established by combining the mapping table 152 and the instance correspondence rule table 154. Dashed arrows 810, 811, and 812 indicate correspondence relationships obtained by session identifiers (Invoke ID on the first network 50 side and Session ID on the second network 60 side).

  In the above case, first, the message association unit 105 associates a message 801 and a message 802 having a common session identifier (InvokeID) on the first network 50 side. Then, the telegram 803 and the telegram 804 on the second network 60 side are associated with each other with reference to the mapping table 152 and the instance correspondence rule table 154. Next, a message 805 having a common session identifier (SessionID) is associated with the message 803, and similarly, a message 806 having a common session identifier is associated with the message 804. Even in a specification in which a session identifier is not set in a message on the second network 60 side, it is possible to associate a message on the second network 60 side with reference to the request-response rule table 153 and the instance association rule table 154. It is.

  Then, the electronic message association unit 105 refers to the mapping table 152 and the instance correspondence rule table 154, and associates the electronic message 805, the electronic message 806, and the electronic message 807. Thus, a series of electronic message associations in the example of FIG. 10 is completed.

  In the example of the mapping table 152 in FIG. 5, the correspondence relationship is defined at a relatively detailed level. However, as shown in FIG.

  In the above embodiment, the network analysis support apparatus 10 is connected to the first network 50 and the second network 60, and the messages flowing through the networks are transmitted to the first message collection unit 101 and the second message collection unit. The message information is obtained by receiving and analyzing in 102, but is not limited to this configuration. For example, as shown in FIG. 12, the network analysis support device 10 and the gateway device 30 are connected so as to be capable of data communication via a predetermined communication cable 70 (may be wireless communication), and the gateway device 30 is connected to the first network. The message information related to the message received from the 50 side or the second network 60 side or the message information related to the message output to the first network 50 side or the second network 60 side is transmitted to the network analysis support device 10. It may be a specification. Or you may make it the specification which mixed this structure and the structure connected to the 1st network 50 or the 2nd network 60. FIG.

  In addition, a method of setting each table such as the mapping table 152, the request-response rule table 153, and the instance correspondence rule table 154 in the network analysis support apparatus 10 is arbitrary. For example, as shown in FIG. 13, the network analysis support device 10 and the gateway device 30 are connected via a communication cable 80 so that data communication is possible. The network analysis support device 10 is connected to the gateway device 30 by data communication. Each table such as the mapping table 152, the request-response rule table 153, and the instance correspondence rule table 154 may be acquired. In this case, as shown in FIG. 13, the network analysis support device 10 includes a table acquisition unit 108 for acquiring these tables from the gateway device 30, and the gateway device 30 stores these tables in the network analysis support device 10. A table supply unit 300 for supplying a table is provided.

  Alternatively, as shown in FIG. 14, the gateway device 30 outputs a table such as a mapping table 152, a request-response rule table 153, and an instance correspondence rule table 154 to a predetermined computer-readable storage medium 90, These tables may be read from the storage medium 90 and set on the analysis support apparatus 10 side.

  Alternatively, these tables may be input to the network analysis support apparatus 10 from another information processing apparatus or the like via a serial interface, a USB (Universal Serial Bus) interface, or the like. The contents of these tables may be directly input to the network analysis support device 10 by operating.

  Furthermore, information corresponding to the contents of each table such as the mapping table 152, the request-response rule table 153, and the instance correspondence rule table 154 may be created and updated in the network analysis support apparatus 10. In this case, as shown in FIG. 15, the message association unit 105 includes a relation analysis unit 155, a mapping information estimation / learning unit 156, a mapping information accumulation unit 157, a request-response rule estimation / learning unit 158, The request-response rule accumulation unit 159, the instance correspondence rule estimation / learning unit 160, and the instance correspondence rule accumulation unit 161 are configured. The message association unit 105 having such a configuration includes a mapping information estimation / learning unit 156, request-response rule estimation, while the association analysis unit 155 acquires message information from the first storage unit 103 and the second storage unit 104. Using the learning unit 158 and the instance correspondence rule estimation / learning unit 160, the correspondence relationship of the message is estimated / learned, and the results are stored as the mapping information accumulation unit 157, the request-response rule accumulation unit 159, and the instance correspondence rule accumulation, respectively. Stored in the unit 161.

  The mapping information storage unit 157, the request-response rule storage unit 159, and the instance correspondence rule storage unit 161 may be set with simple initial values (for example, level information shown in FIG. 11).

  Hereinafter, a method for estimating mapping information and the like will be briefly described. For example, when a single request message 1201 on the first network 50 side as shown in FIG. 16 and a message 1202 on the second network 60 side flowing at that time are detected, they are related to each other. Since it is natural to think of it as a thing, the mapping information estimation / learning unit 156 and the like perform processing such as reflecting these correspondences in the estimation result of the mapping information. At this time, the tendency of the delay time 1203 until the output to the input may be taken into consideration. In addition, the correspondence relationship of all the components of the message information may be reflected, or a part of the components may be used.

  Whether or not the message is a single message can be determined, for example, by whether or not another message has been detected within a predetermined time before and after the detection of the message. Even when the message is not a single message, for example, when a message of the same quality (for example, a message with a common command and processing target class identifier and different processing target instance identifiers) appears continuously on the first network 50 side, By examining the message group that appears on the second network 60 side at that time, there is a high possibility that a related tendency can be grasped.

  Also, the mapping information estimation / learning unit 156, etc., for example, as shown in FIG. 17, if nine messages 1302 in the downlink direction are detected on the second network 60 side, the commands of those messages are common. If so, it is estimated that three messages on the second network 60 side are associated with each message in the three downlink messages 1301 on the first network 50 side, and the estimation / learning result of the mapping information Can be reflected in

  By proceeding with estimation / learning as described above, mapping information, request-response rules, instance correspondence rules, etc. are estimated / learned, and the mapping table 152, request-response rule table 153 are found in the network analysis support device 10. Information corresponding to the contents of each table such as the instance correspondence rule table 154 can be constructed.

  Further, by applying the program executed by the network analysis support apparatus 10 of the above embodiment to an existing personal computer (PC) or the like, it is possible to cause the PC to function as the network analysis support apparatus according to the present invention. .

  Such a program distribution method is arbitrary, for example, a computer-readable recording medium such as a CD-ROM (Compact Disk Read-Only Memory), a DVD (Digital Versatile Disk), an MO (Magneto Optical Disk), or a memory card. It may be stored and distributed in a network, or distributed via a communication network such as the Internet.

  The present invention can be suitably employed in an equipment management system or the like installed in a building.

DESCRIPTION OF SYMBOLS 10 Network analysis support apparatus 101 1st message collection part 111 1st message receiving part 112 1st message analysis part 102 2nd message collection part 121 2nd message reception part 122 2nd message analysis part 103 1st Storage unit 104 second storage unit 105 message association unit 151, 155 analysis unit 152 mapping table 153 request-response rule table 154 instance correspondence rule table 156 mapping information estimation / learning unit 157 mapping information storage unit 158 request-response Rule estimation / learning unit 159 Request-response rule accumulation unit 160 Instance correspondence rule estimation / learning unit 161 Instance correspondence rule accumulation unit 106 Display unit 107 Control unit 108 Table acquisition unit 20 Central monitoring device 30 Gateway device 300 Table supply unit 40 Equipment System 5 The first of the network (facilities management system network)
60 Second network (equipment network)
70, 80 Communication cable 90 Storage medium

Claims (9)

A device that supports network analysis in a system including a first device, a gateway device, and a second device,
A first message collection means for collecting messages flowing on the first network connected to the first network to which the first device and the gateway device are connected;
A second message collection means for collecting messages flowing on the second network connected to the second network to which the gateway device and the second device are connected;
A correspondence between a message flowing from the first network to the gateway device and a message flowing from the gateway device to the second network, a message flowing from the second network to the gateway device, and A mapping table in which a correspondence relationship with a message flowing on the first network from the gateway device is defined;
A message association means for referring to the mapping table and associating the messages collected by the first message collection means with the messages collected by the second message collection means;
Display means for displaying the result associated by the message association means;
A network analysis support device characterized by that. A first request response table in which a correspondence relationship between a request message transmitted from the first device and a response message received by the first device is further defined in the first network; Prepared,
The message association means associates messages collected by the first message collection means with reference to the first request / response table.
The network analysis support apparatus according to claim 1. A second request response table in which a correspondence relationship between a request message transmitted from the gateway device and a response message received by the gateway device is defined in the second network;
The message association means associates the messages collected by the second message collection means with reference to the second request response table.
The network analysis support device according to claim 1, wherein the network analysis support device is a network analysis support device. An instance correspondence table defining a correspondence relationship between a group number set in a request or response message flowing on the first network and an instance identifier of the second device belonging to the group indicated by the group number; Prepared,
The message association means associates the collected messages with reference to the instance correspondence table.
The network analysis support apparatus according to claim 1, wherein the network analysis support apparatus is a network analysis support apparatus. A device that supports network analysis in a system including a first device, a gateway device, and a second device,
A first message collection means for collecting messages flowing on the first network connected to the first network to which the first device and the gateway device are connected;
A second message collection means for collecting messages flowing on the second network connected to the second network to which the gateway device and the second device are connected;
Estimating means for estimating the correspondence of collected messages based on the collection result of at least one of the first message collecting means or the second message collecting means;
Based on the estimation result by the estimation means, the messages collected by the first message collection means, the messages collected by the second message collection means, or the messages collected by the first message collection means A message association means for associating at least one of the messages collected by the second message collection means;
Display means for displaying the result associated by the message association means;
A network analysis support device characterized by that. A method for supporting network analysis in a system including a first device, a gateway device, and a second device,
A first message collection step for collecting messages flowing on a first network to which the first device and the gateway device are connected;
A second message collection step of collecting messages flowing on a second network to which the gateway device and the second device are connected;
A correspondence between a message flowing from the first network to the gateway device and a message flowing from the gateway device to the second network, a message flowing from the second network to the gateway device, and The telegram collected in the first telegram collection step and the second telegram collection step with reference to a mapping table in which a correspondence relationship between the gateway device and the telegram flowing on the first network is defined. A message association step for associating the messages collected in
A display step of displaying the result associated in the message association step with a display unit,
A network analysis support method characterized by the above. A method for supporting network analysis in a system including a first device, a gateway device, and a second device,
A first message collection step for collecting messages flowing on a first network to which the first device and the gateway device are connected;
A second message collection step of collecting messages flowing on a second network to which the gateway device and the second device are connected;
An estimation step for estimating a correspondence relationship of collected messages based on a collection result in at least one of the first message collection step or the second message collection step;
Based on the estimation result in the estimation step, messages collected in the first message collection step, messages collected in the second message collection step, or collected in the first message collection step A message correlating step for associating the received message with at least one of the messages collected in the second message collecting step;
A display step of displaying the result associated in the message association step with a display unit,
A network analysis support method characterized by the above. A program for supporting network analysis in a system including a first device, a gateway device, and a second device,
On the computer,
A first message collection step for collecting messages flowing on a first network to which the first device and the gateway device are connected;
A second message collection step of collecting messages flowing on a second network to which the gateway device and the second device are connected;
A correspondence between a message flowing from the first network to the gateway device and a message flowing from the gateway device to the second network, a message flowing from the second network to the gateway device, and The telegram collected in the first telegram collection step and the second telegram collection step with reference to a mapping table in which a correspondence relationship between the gateway device and the telegram flowing on the first network is defined. A message association step for associating the messages collected in
A display step of displaying a result associated with the message association step by a display unit;
A program characterized by that. A program for supporting network analysis in a system including a first device, a gateway device, and a second device,
On the computer,
A first message collection step for collecting messages flowing on a first network to which the first device and the gateway device are connected;
A second message collection step of collecting messages flowing on a second network to which the gateway device and the second device are connected;
An estimation step for estimating a correspondence relationship of collected messages based on a collection result in at least one of the first message collection step or the second message collection step;
Based on the estimation result in the estimation step, messages collected in the first message collection step, messages collected in the second message collection step, or collected in the first message collection step A message correlating step for associating the received message with at least one of the messages collected in the second message collecting step;
A display step of displaying a result associated with the message association step by a display unit;
A program characterized by that.

Images