JP2012175300A - Flow quality degradation identification device and method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To reduce a processing load needed for flow management and also make use of flow information to identify flow quality degradation.SOLUTION: The present invention includes the means of: collecting per-flow byte counts and duration as flow information in a network; calculating a flow rate based on the received flow information; identifying an originating area and a terminating area based on the flow information; calculating an inter-area flow rate based on the flow rate; generating time-series data of the inter-area flow rate, determining the quality of the inter-area flow rate based on a prescribed standard; detecting an area where quality degradation of the inter-area flow rate occurs synchronously; and extracting, based on the information on the inter-area flow rate and detected inter-area flow rates where the quality degradation of the inter-area flow rate occurs, an area where the degradation of the inter-area flow quality common in both areas is synchronous.

Description

  The present invention relates to a flow quality degradation identification device and method, and more particularly to a flow quality degradation identification device and method for identifying a location that causes degradation in order to manage the communication quality state of an IP network.

  As IP networks are widely used, there is an increasing demand for communication quality assurance over IP networks. In the current IP network management, whether or not a certain link is congested is mainly determined from the link usage rate. However, since the relationship between the link usage rate and the quality such as the file transfer time and throughput experienced by the user is unknown, it is difficult to specifically specify the usage rate for determining the congestion state.

Also, the method of measuring the file transfer time and throughput of the flow that passes through the link, and determining that the statistical value such as the average falls below a certain threshold is a congestion state,
1) User quality measurements such as file transfer time and throughput are calculated by capturing all packets passing through the link and assembling the flow, or installing a test packet transmitter / receiver at the front or back of the link or both Thus, it is necessary to actively make quality measurements by sending test packets, which is generally difficult;
2) Even if the link is not a bottleneck, the average throughput varies from network to network depending on the state of the network before and after the flow passing through the link, and a specific threshold setting for file transfer time and throughput is set. Is difficult;
There was a problem.

  On the other hand, in recent years, flow measurement technology has been widely used. A flow is generally defined as a group of packets having the same set of five: {source IP address, destination IP address, source port number, destination port number, protocol}. In the flow measurement, the number of packets, the number of bytes, and the duration for each flow are output as information. However, the flow data generally uses information related to the traffic volume, such as mainly calculating the amount of AC traffic, detecting the concentration of traffic to a specific destination, or specifying a heavy user.

  Usually, in order to ensure scaleability, processing required for flow management is reduced by performing packet sampling (see, for example, Non-Patent Document 1). For example, one out of every N packets is sampled, and the original flow statistical information is estimated from the sampled packets.

  In addition, a method for specifying a flow having a high link bandwidth occupancy rate using packet sampling has been proposed (see, for example, Non-Patent Document 2).

  In addition, a method has been proposed for accurately obtaining statistics of a flow having a large flow size (see, for example, Non-Patent Document 3).

  Furthermore, a method of estimating the total number of unsampled flows and the flow size using the number of sampled SYN packets (one of the TCP flags, meaning communication start) has been proposed (for example, Non-Patent Document 4).

IETF RFC 5474 A Framework for Packet Selection and Reporting http://datatracker.ietf.org/wg/psamp/. T. Mori, T. Takine, J. Pan, R. Kawahara, M. Uchida, and S. Goto, '' Identifying heavy-hitter flows from sampled flow statistics, '' IEICE Trans.Commun., Vol.E90-B , no.11, pp.3061-3072, Nov. 2007. C. Estan and G. Varghese, "New Directions in Traffic Measurement and Accounting," ACM SIGCOMM2002, Aug. 2002. N. Duffield, C. Lund, and M. Thorup, "Properties and Prediction of Flow Statistics from Sampled Packet Streams," ACM SIGCOMM Internet Measurement Conference 2002, Nov. 2002.

  However, the proposed methods of Non-Patent Documents 2 and 3 described above are intended to identify flows that have a large size or a high bandwidth occupancy rate, and quickly identify users that generate excessive flows. It did not make it possible to manage the communication quality of the entire flow on the link.

  In addition, the proposed method of Non-Patent Document 4 also only estimates the original flow statistical information, and does not make it possible to manage the communication quality of the entire flow on a link.

  The present invention has been made in view of the above points. While reducing the processing required for flow management, the flow information is used to grasp the quality of the entire flow, and if flow quality deterioration occurs, It is an object of the present invention to provide a flow quality degradation identification device and method that can detect and identify the degradation factor location.

To solve the above problems, the present invention is a flow quality degradation identification device for managing the communication quality state of an IP network,
As flow information on the network, flow receiving means for collecting the number of bytes and the duration for each flow;
Flow rate calculation means for calculating a flow rate based on the received flow information;
An inter-area flow rate management means that identifies a source area and a destination area based on the flow information, and calculates an inter-area flow rate based on the flow rate;
Generate time-series data of the inter-area flow rate, determine the quality of the inter-area flow rate based on a predetermined criterion, and detect an area in which the quality deterioration of the inter-area flow rate occurs synchronously Flow quality degradation detection means;
Based on the information on the inter-area flow rate and the inter-area flow rate where the quality detected by the flow quality deterioration detecting means is deteriorated, the rate decrease for extracting the area where the deterioration of the common inter-area flow quality is synchronized between the areas. A pair extraction means.

  As described above, according to the present invention, while reducing the processing required for flow management, the flow information is used to grasp the quality of the entire flow, and if a flow quality deterioration occurs, it is detected. As a result, it is possible to specify the flow quality deterioration at the factor location.

It is a system configuration figure in a 1st embodiment of the present invention. It is a block diagram of the flow quality degradation specific apparatus in the 1st Embodiment of this invention. It is a flowchart of the operation | movement in the 1st Embodiment of this invention. It is an example of the time series of the measured flow rate in the 1st Embodiment of this invention. It is a link usage rate of the link line | wire on a common path | route between AS in the 1st Embodiment of this invention. It is a block diagram of the flow quality degradation specific device in the 2nd Embodiment of this invention. It is a flowchart of the operation | movement in the 2nd Embodiment of this invention. It is an example of the user flow management table in the 2nd Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings.

[First Embodiment]
FIG. 1 shows a system configuration according to the first embodiment of the present invention.

  The system shown in FIG. 1 includes a plurality of nodes 10 on the IP network 101 and a flow quality deterioration specifying device 100, and the flow quality deterioration specifying device 100 collects flow information from the node 10.

  FIG. 2 shows the configuration of the flow quality deterioration identifying device according to the first embodiment of the present invention.

  The flow deterioration identifying device 100 shown in the figure includes a flow receiving unit 110 that collects flow information on the network, a flow rate calculating unit 120 that calculates a flow rate based on the received flow information, and an area based on the flow rate. An inter-area flow rate management unit 130 that calculates an inter-area flow rate, a flow quality deterioration detection unit 140 that detects an inter-area flow rate deterioration based on the inter-area flow rate, and an inter-area flow rate and quality deteriorated area It comprises a rate-reduced pair extraction unit 150 that extracts areas in which the deterioration of inter-area flow quality is synchronized based on the inter-flow rate information.

  FIG. 3 is a flowchart of the operation in the first embodiment of the present invention.

  In the flow quality deterioration identifying device 100 having the above-described configuration, the following steps are repeated every certain period t0.

  Step 101) The flow reception unit 110 receives, as flow information, a value obtained by measuring the number of transfer bytes B_i and the duration T_i for each flow i in a node (group) in the IP network, and outputs the flow information to the flow rate calculation unit 120. .

  Step 102) The flow rate calculation unit 120 calculates the flow rate R_i as R_i = B_i / T_i based on the received flow information, and outputs it to the inter-area rate management unit 130.

  Step 103) The inter-area flow rate management unit 130 identifies the source area and destination area of the flow i from the flow information, and calculates the inter-area flow rate F (A_i, A_j) of the flow from the area A_i to A_j. And output to the flow quality deterioration detection unit 140 and the rate reduction pair extraction unit 150.

  Step 104) The flow quality degradation detection unit 140 creates time series data of F (A_i, A_j) for all areas based on each F (A_i, A_j), and uses a certain threshold as a reference between the areas. The quality of the flow rate is determined, and all areas where the quality deterioration of the inter-area flow rate is generated in synchronization are extracted and output to the rate reduction pair extraction unit 150.

  Step 105) The rate reduction pair extraction unit 150 is based on the information received from the inter-area flow rate management unit 130 and the flow quality degradation detection unit 140 (inter-area flow rate, all areas where quality degradation occurs synchronously). In addition, a bottleneck on a common route between areas is specified.

  This will be described in detail below.

  The flow information receiving unit 110 acquires a flow from the node (group) 10 in the IP network 101. The flow rate calculation unit 120 measures the number of transfer bytes B_i and the duration T_i for each flow i, and calculates the flow rate R_i as R_i = B_i / T_i. On the other hand, the inter-area flow rate management unit 130 identifies the source area and destination area of flow i from information such as the source IP address of the packet, checks the flow from area A_i to A_j, Calculated by rate F (A_i, A_j) (for example, average flow rate = ΣR_i / Nf (Nf is the number of flows between the corresponding areas). This is performed every fixed period t0 and stored in a memory (not shown). The flow quality degradation detection unit 140 creates F (A_i, A_j) time-series data, stores it in a memory (not shown), and if the inter-area flow rate falls below a certain threshold, The quality is deteriorated and stored in a memory (not shown).

  The above processing is performed between the areas, and the quality degradation flow extraction unit 150 reads out the flow rate between areas and the area below the threshold value from a memory (not shown), and the decrease in the flow rate between areas is synchronized. Extract between other areas. Thereafter, the plurality of areas extracted as the rate decrease is synchronized are identified as having a bottleneck on a common route between the areas.

  In this embodiment, a TCP (Transmission Control Protocol) flow is targeted. The flow rate defined above means the file transfer speed in TCP. Therefore, a decrease in the flow rate means a deterioration in TCP quality. In addition, in TCP, when the network or server is congested, the transmission rate is autonomously decreased. Therefore, the decrease in the rate means that congestion occurs somewhere on the communication path. That the decrease in the rate is synchronized means that there is a possibility that there is a bottleneck on the shared path between the areas.

  In addition, as a specific example of the threshold value for performing the deterioration determination in the flow quality deterioration detection unit 140, as described later in the fourth method of the present invention, or automatically set based on past data, or For example, a value to be secured as the flow rate (TCP throughput) between the areas is set to a value determined in advance with the NW user by SLA (service level agreement) or the like. For example, if 3 Mbps is guaranteed as the throughput, the threshold is set to 3 Mbps.

  Note that the bottleneck determination in the quality degradation flow extraction unit 150 is specifically described later in the fifth or sixth embodiment, but a pair between areas where the rate is reduced is extracted and the inter-area X is temporarily extracted. If the rate of Y between areas is determined to be synchronized, the route between the areas X (route path in IP) and the route between the areas Y are examined respectively, and the route section common to both is determined as the bottleneck location. to decide.

  FIG. 4 shows a time series of flow rates measured on a certain internet line. Here, the area is AS, and the average of the flow rate for each AS is calculated in a 15-minute cycle. From this, a decrease in the flow rate is observed at two locations from 11:00 to 13:00 and from 17:00 to 17:30 on the time series. Moreover, it can be confirmed that the decrease is synchronized in each time series. Actually, looking at the link usage rate of the link line on the common path between these ASs (FIG. 5), it can be confirmed that the usage rate is very high in the above two time zones. In this way, quality deterioration can be specified by looking at the behavior of the flow rate.

  Here, area = AS, but other areas = area (Tokyo, Osaka, etc.), area = server, etc. can be aggregated according to various definitions. For example, if synchronization of a decrease in the flow rate is detected as a result of aggregation as area = server, it is possible to identify quality degradation as the server being a bottleneck.

[Second Embodiment]
FIG. 6 shows the configuration of the flow quality degradation specifying device in the second exemplary embodiment of the present invention.

  The flow quality degradation specifying device 100B shown in the figure includes a flow information receiving unit 110, a user flow management table 210, a flow rate calculation unit 120, an inter-area flow rate management unit 130, a flow quality degradation detection unit 140, and a quality degradation flow extraction unit. 160.

  FIG. 7 is a flowchart of the operation in the second embodiment of the present invention, and FIG. 8 shows an example of a user flow management table in the second embodiment of the present invention.

  Step 201) The flow receiving unit 110 arbitrarily selects N received packets from packets received from the node (group) 10 in the IP network 101 during a period from the start of measurement until a predetermined time period t0 elapses. And the flow (flow i) to which the packet belongs is detected based on the extracted information of the packet header.

  Step 202) Whether or not the detected flow i is registered in the user flow management table 210 is confirmed. If the flow i is not registered, the process proceeds to step 203. If registered, the process proceeds to step 204.

  Step 203) If the flow i is not registered, the current arrival time (T_first_i) and the last arrival time (T_last_i) of the packet for the flow i are set as the current time, and the sequence of the last arrival packet The sequence number read from the packet header is set as the number (SN_last_i), the sequence number (SN_first_i) of the packet that arrives first is set as {the sequence number-the packet size}, and the flow i is set in the user flow management table 210. sign up.

  Step 204) If the flow i is registered, the last arrival time for the flow i is set as the current time, and the sequence number of the packet that has arrived last is set as the sequence number read from the packet header. The registration information of the flow i in the flow management table 210 is updated.

  Step 205) The above processing is repeated until a time t0 of a predetermined cycle elapses.

  Step 206) When the time t0 has elapsed, the flow rate calculation unit 120 determines whether the time at which the packet of the flow i first arrived is the same as the time at which it last arrived. If the time at which the packet of the flow i arrived last is later than the time at which the packet i arrived first, the processing proceeds to step 208.

  Step 207) The flow i is deleted from the user flow management table 210, and the process proceeds to Step 209.

Step 208) The flow rate of the flow i is
Flow rate R_i = (SN_last_i-SN_first_i) / (T_last_i-T_first_i)
And the flow rate of the flow i registered in the user flow management table 210 is set.

  Subsequent processing is the same as in the first embodiment.

  This will be described in detail below.

In the present embodiment, as a method for obtaining the flow rate R_i, instead of directly measuring the transfer byte number B_i as in the first embodiment, the flow information receiving unit 110 uses the node (group) 10 in the IP network 101. One packet is extracted from N arrival packets from the packet, and the packet header is read to determine which flow the packet belongs to. The flow is prepared in advance as shown in FIG. It is checked whether the entry is made in the table 210. In the user flow management table 210, for each flow,
The time T_first_i when the packet from flow i first arrived
・ Time T_last_i when packet last arrived
-Sequence number SN_first_i of the first packet that arrived
-Sequence number SN_last_i of the last packet that arrived
Is remembered. The user flow management table 210 is assumed to be a storage medium such as a memory or a hard disk in the apparatus.

If the received packet is a packet from a new flow, it is not entered in the user flow management table 210. Therefore, the flow information receiving unit 110 enters the flow in the user flow management table 210, and T_first_i (packet first ), T_last_i (the time when the packet last arrived) is set to the current time, SN_last_i is set to the sequence number read from the packet header,
SN_first_i ← {the sequence number-the packet size}
Set to.

  When the flow corresponds to a user flow i that has already been entered, T_last_i is updated to the current time in the record of the user flow management table 210 corresponding to the flow, and SN_last_i is set to the sequence number read from the packet header. Update.

The above procedure is performed until a predetermined time period t0 elapses after the measurement is started. At the time t0 elapses, if T_last_i = T_first_i, the flow i is excluded from the entry of the user flow management table 210. If T_last_i> T_first_i, the flow rate calculation unit 120 sets the flow rate R_i of the flow i entered in the user flow management table 210.
R_i = (SN_last_i-SN_first_i) / (T_last_i-T_first_i)
And calculate.

  This is a procedure for estimating the flow rate of each flow from information obtained by packet sampling. This procedure is the same as that of the inventors' literature 1 "R. Kawahara, T. Mori, K. Ishibashi, N. Kamiyama, and H. Yoshino," Packet sampling TCP flow rate estimation and performance degradation detection method, " IEICE Trans. Commun., Vol.E91-B, No.5, pp.1309-1319, May 2008. ”

[Third Embodiment]
In the inter-area flow rate management unit 130 in the first embodiment, the average of the flow rates between the areas is used as the inter-area flow rate. However, in this embodiment, the upper X percentile tile is used.

  The inter-area flow rate management unit 130 calculates the inter-area flow rate F (A_i, A_j) of the flow from the area A_i to A_j, or uses the average of the flow rates between areas, or the upper X percentile (X is Select the flow rate between the areas corresponding to (can be set arbitrarily).

The average rate of flow between areas is
Average = ΣR_i / Nf (Nf is the number of flows between corresponding areas)
And the X value is the 50th percentile (ie median) or the 95th percentile (by looking at the 5% value from the top of the rate, the flow rate corresponding to the value of the X percentile is the inter-area flow rate. Will be selected.

  As a result, it is possible to make arbitrary settings such as checking whether deterioration has occurred between areas with high throughput.

[Fourth Embodiment]
In the present embodiment, processing of the flow quality deterioration detection unit 140 will be described.

  The flow quality deterioration detection unit 140 detects the rate decrease (quality deterioration) from the time series of the inter-area flow rate, and sets the inter-area flow rate in the t-th measurement period as F (A_i, A_j, t). Using this as an input, the smoothed flow rate S (A_i, A_j, t) is updated by the following equation.

S (A_i, A_j, t) ← (1−α) S (A_i, A_j, t−1) + αF (A_i, A_j, t)
Also, the flow rate variance V (A_i, A_j, t) is updated by the following equation.

V (A_i, A_j, t) ← (1−β) V (A_i, A_j, t) + β {S (A_i, A_j, t) − F (A_i, A_j, t)} ²
A threshold is calculated from the smoothed flow rate S (A_i, A_j, t) and the variance V (A_i, A_j, t) of the flow rate according to the following equation.

Threshold ← S (A_i, A_j, t-1) -γsqrt (V (A_i, A_j, t−1))
Note that γ is a parameter that determines a threshold value for determining quality degradation, and is set to a value of 1 or more. For example, if γ = 3 is set, the threshold value is “average-3 standard deviation” in the past flow rate data, which is below this threshold value when a normal distribution is assumed. Is a rare event that occurs only with a probability of 0.13%, and exceeding this means that the quality status has changed compared to the past, and it has been judged to be decreasing.

  When the current flow rate F (A_i, A_j, t) falls below the above threshold, it is detected as quality degradation.

  Note that α and β are predetermined smoothing parameters and are set to values between 0 and 1.

Perform the above, and if the current flow rate F (A_i, A_j, t) is the threshold
S (A_i, A_j, t−1) -γsqrt (V (A_i, A_j, t−1))
If it falls below, it is detected as quality degradation. As for how to determine α, β, and γ, a flow rate decrease for various (α, β, γ) parameter sets is detected using flow data for a certain period in the past. When the operator actually confirms the series visually and sets the operator's judgment as the correct answer, a parameter set is selected that can reduce both the ratio that is erroneously determined to be a rate decrease and the ratio that misses the rate decrease.

  Here, as an example of calculating the smoothing rate (baseline) of the time series, the case of using the exponentially weighted moving average (EWMA) as described above is shown, but in addition, a general ARIMA model or The Holt-winters method (Reference 2: “JD Brutlag,“ Aberrant behavior detection in time series for network monitoring, ”14th Systems administration conference (LISA2000), Dec. 2000.)) may be used.

[Fifth Embodiment]
In the present embodiment, a case will be described in which the flow quality deterioration detection unit 140 extracts an area where the flow rate decrease is synchronized.

  When the flow quality deterioration detection unit 140 extracts between areas where the flow rate decrease is synchronized, the measurement period length for detecting synchronization is N slots (the measurement period t0 for calculating the flow rate corresponds to one slot). ), If the flow rate at time point n of area pair i is y_n (i), and a decrease in the flow rate is detected during the period of N slots between areas i, between area i and area j The cross-correlation function Rk (i, j) at lag k is calculated by the following equation.

なお、μはエリア間ｉのフローレートの平均，Cは相互共分散関数を意味し、
k=−L, −(L-1), …, −1, 0, 1, …, (L−1), L（Lは調査するラグの範囲）
となる。

Note that μ is the average of the flow rates between areas i, C is the mutual covariance function,
k = −L, − (L-1),…, −1, 0, 1,…, (L−1), L (L is the range of lag to be investigated)
It becomes.

  Note that L, th, and M are preset values. An example of how to determine the value will be described later.

  If the number of times that R_k (i, j)> th (th is a predetermined threshold) is greater than or equal to M with respect to R_k (i, j), the rate-decreasing pair extraction unit 150 sets the pair {i, j} determines that the rate drop is synchronized and extracts the pair of areas.

[Sixth Embodiment]
In the present embodiment, instead of extracting the rate-decreasing pair {i, j} by comparing the cross-correlation function Rk (i, j) with the threshold as in the fifth embodiment, the following procedure is performed. To extract a pair.

  When the flow quality deterioration detection unit 140 extracts the areas where the flow rate decrease is synchronized, the distance between the pair {i, j} is calculated by the following formula defined in advance. However, R_k (i, j) of the pair {i, j} is described as a (k).

D (R_k (i, j)) = F (a (-L), a (-(L-1), ..., a (-1), a (0), a (1), ..., a (L -1), a (L))
Then, the distance between the pair {i, j} is clustered using a clustering method such as K-means. As a result of clustering, when the pair {i, j} is classified into the same cluster, the rate-reduced pair extraction unit 150 can extract the pair {i, j} as a rate-reduced synchronization pair.

  As an example of the distance function F, F = Σw (i) a (i) (w (i) is a predetermined weighting coefficient) can be used.

  The operation of each component of the flow quality deterioration characteristic apparatus shown in FIGS. 2 and 6 is constructed as a program and installed in a computer used as the flow quality deterioration specifying apparatus, or distributed through a network. It is possible to make it.

  The present invention is not limited to the above-described embodiment, and various modifications and applications can be made within the scope of the claims.

DESCRIPTION OF SYMBOLS 10 Router 100 Flow quality degradation specific apparatus 101 IP network 110 Flow information receiving part 120 Flow rate calculation part 130 Inter-area flow rate management part 140 Flow quality degradation detection part 150 Rate fall pair extraction part 160 Quality degradation flow extraction part 210 User flow management table

Claims (10)

An IP (Internet Protocol) network flow quality degradation identification device that manages the communication quality status of a network,
As flow information on the network, flow receiving means for collecting the number of bytes and the duration for each flow;
Flow rate calculation means for calculating a flow rate based on the received flow information;
An inter-area flow rate management means that identifies a source area and a destination area based on the flow information, and calculates an inter-area flow rate based on the flow rate;
Generate time-series data of the inter-area flow rate, determine the quality of the inter-area flow rate based on a predetermined criterion, and detect an area in which the quality deterioration of the inter-area flow rate occurs synchronously Flow quality degradation detection means;
Based on the information on the inter-area flow rate and the inter-area flow rate where the quality detected by the flow quality deterioration detecting means is deteriorated, the rate decrease for extracting the area where the deterioration of the common inter-area flow quality is synchronized between the areas. A pair extraction means;
A flow quality deterioration identifying device characterized by comprising: The flow receiving means includes
In the period from the start of measurement to the elapse of a predetermined time period t0,
For a packet received from a node (group) in the IP network, one arbitrary packet is extracted from N received packets, and the flow to which the packet belongs based on the extracted information of the packet header (flow i) And confirms whether or not the detected flow i is registered in the user flow management table,
If the flow i is not registered, the time when the packet first arrived (T_first_i) and the last arrival time (T_last_i) for the flow i are set as the current time, and the sequence number ( SN_last_i) is set as the sequence number read from the packet header, the sequence number (SN_first_i) of the first packet arrived is set as {the sequence number-the packet size}, and the flow i is registered in the user flow management table. ,
When the flow i is registered, the user flow management is performed with the last arrival time of the flow i as the current time, and the sequence number of the last arrival packet as the sequence number read from the packet header. Update the registration information of the flow i in the table;
Including means to repeat
The flow rate calculation means includes
At the time t0 elapses,
If the time at which the packet of flow i first arrived is the same as the time at which it last arrived, delete flow i from the user flow management table;
If the last arrival time of the packet of the flow i is later than the first arrival time, the flow rate of the flow i is calculated and the flow rate of the flow i registered in the user flow management table is calculated. 2. The flow quality deterioration identifying device according to claim 1, further comprising means for setting. The inter-area flow rate management means includes:
When calculating the inter-area flow rate,
A method that uses the average of the flow rates between areas,
Or
How to select the flow rate between areas corresponding to the top X percentile (X can be set arbitrarily)
The flow quality deterioration identifying device according to claim 1, wherein: The flow quality deterioration detecting means is
When determining the quality of the inter-area flow rate based on the predetermined criteria,
Update the inter-area flow rate in the t-th measurement period using the smoothed flow rate, calculate a threshold based on the smoothed flow rate and the variance of the flow rate,
The flow quality deterioration specifying device according to claim 1, further comprising means for detecting as a quality deterioration when a current flow rate falls below the threshold. The flow quality deterioration detecting means is
When a decrease in flow rate is detected in a measurement period for detecting synchronization in a certain inter-area i, a cross-correlation function Rk (i, j) at a lag k between the inter-area i and the inter-area j is calculated. If the number of times that the cross-correlation function Rk (i, j) is greater than the threshold value is equal to or greater than a predetermined number, it is determined that the rate reduction of the pair of areas (i between areas and j between areas) is synchronized. The flow quality deterioration specifying device according to claim 4, further comprising means for extracting the pair of areas. The flow quality deterioration means is
6. A means for calculating a distance between the pair of areas, clustering the distance, and extracting the pair of areas as a synchronized pair having a reduced rate when the pairs of areas are classified into the same cluster. The flow quality deterioration identifying device described. A flow quality deterioration identification method for managing communication quality status of an IP (Internet Protocol) network,
A flow receiving means for collecting the number of bytes and the duration of each flow as flow information on the network;
A flow rate calculation step in which a flow rate calculation means calculates a flow rate based on the received flow information;
An inter-area flow rate management means identifies a source area and a destination area based on the flow information, and calculates an inter-area flow rate management step based on the flow rate; and
The flow quality degradation detection means generates time-series data of the inter-area flow rate, determines the quality of the inter-area flow rate based on a predetermined criterion, and the quality degradation of the inter-area flow rate occurs synchronously A flow quality degradation detection step for detecting the area being
Based on information on the inter-area flow rate and the inter-area flow rate where the quality detected by the flow quality deterioration detecting means is deteriorated, the rate-decreasing pair extracting means synchronizes the deterioration of the common inter-area flow quality between the areas. A rate-reducing pair extraction step for extracting areas to be performed;
A flow quality deterioration identifying method characterized by: In the flow receiving step,
In the period from the start of measurement to the elapse of a predetermined time period t0,
For a packet received from a node (group) in the IP network, one arbitrary packet is extracted from N received packets, and the flow to which the packet belongs based on the extracted information of the packet header (flow i) And confirms whether or not the detected flow i is registered in the user flow management table,
If the flow i is not registered, the time when the packet first arrived (T_first_i) and the last arrival time (T_last_i) for the flow i are set as the current time, and the sequence number ( SN_last_i) is set as the sequence number read from the packet header, the sequence number (SN_first_i) of the first packet arrived is set as {the sequence number-the packet size}, and the flow i is registered in the user flow management table. ,
When the flow i is registered, the user flow management is performed with the last arrival time of the flow i as the current time, and the sequence number of the last arrival packet as the sequence number read from the packet header. Update the registration information of the flow i in the table;
Repeat that
In the flow rate calculation step,
At the time t0 elapses,
If the time at which the packet of flow i first arrived is the same as the time at which it last arrived, delete flow i from the user flow management table;
If the last arrival time of the packet of the flow i is later than the first arrival time, the flow rate of the flow i is calculated and the flow rate of the flow i registered in the user flow management table is calculated. The flow quality deterioration specifying method according to claim 7 to be set. In the inter-area flow rate management step,
When calculating the inter-area flow rate,
A method that uses the average of the flow rates between areas,
Or
How to select the flow rate between areas corresponding to the top X percentile (X can be set arbitrarily)
The flow quality deterioration identifying method according to claim 7, wherein: In the flow quality deterioration detection step,
When determining the quality of the inter-area flow rate based on the predetermined criteria,
Update the inter-area flow rate in the t-th measurement period using the smoothed flow rate, calculate a threshold based on the smoothed flow rate and the variance of the flow rate,
The flow quality deterioration specifying method according to claim 7, wherein when the current flow rate falls below the threshold value, it is detected as quality deterioration.

Images