JP2013214814A - Device, system, method and program for equipment identification - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve equipment identification accuracy.SOLUTION: An equipment identification device for acquiring a packet from equipment to identify the equipment according to a feature amount represented by the packet includes: a feature amount storage unit for storing into a storage unit the feature amount represented by the acquired packet; a group classification unit for applying a predefined group distribution condition to the feature amount represented by the acquired packet, and for classifying the equipment to an equipment group having common information related to a network; and when the feature amount of a predefined essential item to identify a group is stored in the storage unit, a determination unit for determining that the feature amount of the equipment is stored.

Description

  The present invention relates to a device identification device, a device identification system, a device identification method, and a device identification program.

  Conventionally, it has been proposed that a device identification device receives a response packet or a passive packet transmitted by a home appliance, and accumulates necessary information from the received response packet and passive packet as features. Here, the response packet is a packet in which a command is transmitted to the home appliance connected to the network and the home appliance responds in response to the command. The device identification apparatus estimates the closest device information as the device information of the home appliance from the device information dictionary of the feature group to which the device information is mapped in advance.

  For example, Non-Patent Document 1 discloses a device name estimation method using features extracted from exchanged protocols by a machine learning technique in order to identify a wide variety of devices.

Sawako Sato, Ryuji Yanada, Hiroyuki Maedo, “Examination of Device Identification Method in Home Network”, IEICE Technical Report, ICM, Information and Communication Management: IEICE technical report 110 (466), 87-92, 2011-03 -03

  In the conventional feature extraction, there is no means for judging whether or not the features are sufficiently accumulated because the feature amounts that can be collected differ depending on the model for which dictionary registration or device identification is to be executed. Therefore, when dictionary registration or device identification is executed in a state where the features are not sufficiently accumulated, there is a problem that the identification accuracy is lowered due to the small number of features that are distinguished from other models.

  Therefore, the present invention has been made in view of the above problems, and it is an object to provide a device identification apparatus, a device identification system, a device identification method, and a device identification program that can improve the identification accuracy of a device. To do.

  (1) The present invention has been made in view of the above circumstances, and one aspect of the present invention is a device identification apparatus that acquires a packet from a device and identifies the device according to a feature amount represented by the packet. A feature amount accumulating unit for accumulating the feature amount represented by the acquired packet in a storage unit, and applying a predetermined group distribution condition to the feature amount represented by the acquired packet, thereby connecting the device to the network A group classification unit that classifies information into a group of devices with common information, and a feature amount of an essential item determined in advance for each group is stored in the storage unit, it is determined that the feature amount of the device is accumulated A device identification device.

  (2) In the device identification apparatus described above, according to one aspect of the present invention, the packet includes a response packet transmitted from the device in response to a command transmitted from the device to the device, and the device. A passive packet that is transmitted to another device, and an active measurement unit that extracts a feature amount based on the response packet, and a protocol feature analysis unit that extracts a feature amount based on the passive packet. The distribution condition to the group is determined by at least one of the feature quantity extracted by the active measurement unit or the feature quantity extracted by the protocol feature analysis unit.

  (3) In the device identification apparatus described above, one aspect of the present invention includes a feature number counting unit that counts the number of feature amounts accumulated in the storage unit, and the determination unit includes the feature at a certain time. It is determined whether or not the feature amount of the device is accumulated based on a comparison between the number of features counted by the number counting unit and the number of features counted by the feature number counting unit at a time before the certain time. And

  (4) In the device identification apparatus described above, according to one aspect of the present invention, a monitoring end time for ending monitoring of the accumulation of the feature amount is determined for each group of the devices, and the determination unit includes: Based on the comparison between the number of features counted by the feature number counting unit at a certain time and the number of features counted by the feature number counting unit at a time before the certain time, and the comparison between the current time and the monitoring end time Then, it is determined whether or not the feature amount of the device is accumulated.

  (5) One aspect of the present invention is a device identification system that acquires a packet from a device and identifies the device according to a feature amount represented by the packet, and stores a feature amount represented by the acquired packet A group for classifying the device into a group of devices having common information on the network by applying a predetermined group distribution condition to the feature amount storage unit stored in the network and the feature amount represented by the acquired packet The system includes: a classification unit; and a determination unit that determines that the feature amount of the device is accumulated when the feature amount of an essential item determined in advance for each group is stored in the storage unit.

  (6) One aspect of the present invention is a device identification method for acquiring a packet from a device and identifying the device according to a feature amount represented by the packet, wherein the feature amount storage unit stores the acquired packet The procedure for accumulating the feature quantity to be stored in the storage unit and the group classification unit apply a predetermined group distribution condition to the feature quantity represented by the acquired packet, so that the information regarding the network of the devices is shared. A procedure for classifying the device into a group, and a procedure for the determination unit to determine that the feature value of the device has been accumulated when the feature value of an essential item predetermined for each group is stored in the storage unit And a device identification method.

  (7) In one embodiment of the present invention, a packet is acquired from a device, and the feature amount represented by the obtained packet is stored in a storage unit in a device identification device that identifies the device according to the feature amount represented by the packet. And a group classification unit that classifies the devices into a group of devices having common network information by applying a predetermined group distribution condition to the feature amount represented by the acquired packet. And a determination step of determining that the feature amount of the device is accumulated when the feature amount of the essential item predetermined for each group is stored in the storage unit, and a device identification program for executing is there.

  According to the present invention, the accuracy of device identification can be improved.

It is a figure which shows the structure of the apparatus identification system in 1st Embodiment. It is a schematic block diagram of the apparatus identification apparatus in 1st Embodiment. It is a figure which shows an example of the structure of the feature storage table T1 which feature storage DB hold | maintains. It is an example of the feature value of NetBIOS. It is an example of the characteristic value of a TCP packet. It is an example of other feature values. It is a figure which shows an example of a structure of the model number table T2 and the detail table T3 which apparatus information DB hold | maintains. It is a figure which shows an example of a structure of terminal information table T4 and estimation information table T5 which terminal information DB hold | maintains. It is an example of an apparatus list screen. It is an example of a dictionary registration screen. It is an example of the transition diagram of an apparatus list screen and a dictionary registration screen. It is a flowchart which shows an example of the flow of a process of the apparatus identification device in 1st Embodiment. It is a flowchart which shows an example of the flow of the active feature extraction process of step S101 of FIG. It is a flowchart which shows an example of the flow of the passive feature extraction process of step S102 of FIG. It is a flowchart which shows an example of the flow of the characteristic accumulation determination process of step S103 of FIG. An example of a set of feature extraction categories and implementation contents executed by the device identification apparatus is shown. It is a flowchart which shows an example of the flow of the group determination process of step S407 of FIG. It is an example of distribution conditions, essential items, and timeout conditions for each group. It is an example of a timeout list and a monitoring list held by the feature accumulation determination unit. It is a flowchart which shows an example of the flow of the group process of step S408 of FIG. It is a continuation of the flowchart of FIG. It is a flowchart which shows an example of the flow of the dictionary creation process of the apparatus identification device in 1st Embodiment. It is a flowchart which shows an example of the flow of the apparatus identification process of the apparatus identification apparatus in 1st Embodiment. It is a figure which shows the structure of the apparatus identification system in 2nd Embodiment. It is a schematic block diagram of the apparatus identification device in 2nd Embodiment. It is a schematic block diagram of the apparatus information dictionary server apparatus in 2nd Embodiment.

<First Embodiment>
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a diagram illustrating a configuration of a device identification system according to the first embodiment. The device identification system 1 includes network devices (hereinafter also referred to as devices) 11 to 15 and a device identification device 100. Here, the network devices 11 to 15 are electronic devices (for example, a television, a game device, a recorder, a router, a network HUB, etc.) having a communication function connected to the network. The device identification apparatus 100 is connected to each of the network devices 11 to 15 via the LAN 16. In the first embodiment, as an example, it is assumed that the device identification system 1 is constructed on a home network of one house.

  The device identification apparatus 100 according to the first embodiment receives a response packet and a passive packet from each of the network devices 11 to 15. Here, the response packet is a packet transmitted from each network device in response to a command transmitted to each network device. A passive packet is a packet transmitted by each network device. Then, the device identification device 100 extracts necessary information from the received response packet and passive packet as a feature amount of the home appliance, and accumulates the extracted feature. Then, the device identification apparatus 100 identifies each of the network devices 11 to 15 based on the accumulated feature amount.

  At this time, the device identification apparatus 100 determines whether or not the packet features are sufficiently accumulated for each of the network devices 11 to 15 having different numbers of feature amounts (hereinafter referred to as feature numbers). If the feature accumulation is sufficient, the device identification apparatus 100 notifies the dictionary registration or device identification execution permission. This prohibits dictionary registration or device identification when the feature accumulation is insufficient, and if the feature accumulation is sufficient, it notifies the dictionary registration or device identification execution permission. Can be notified. When the device identification apparatus 100 receives the notification and executes the identification process of the network devices 11 to 15 by the user's operation, the network devices 11 to 15 can be identified with high accuracy.

  FIG. 2 is a schematic block diagram of the device identification apparatus 100 according to the first embodiment. The device identification apparatus 100 includes a storage unit 110, a capture unit 120, a protocol feature analysis unit 130, an active measurement unit 140, a DB (Data Base) access unit 150, a device identification unit 160, a Web UI unit 170, A feature accumulation determination unit 180 and an input unit 190 are provided. Here, the protocol feature analysis unit 130 includes protocol feature analysis units 131 to 133. The active measurement unit 140 includes active measurement units 141 to 142.

  The storage unit 110 includes a feature accumulation DB 111, a device information DB 112, and a terminal information DB 113. The feature storage DB holds a table T1 that stores the features of the received response packet and passive packet. The device information DB 112 holds a model number table T2 in which data such as model numbers of the network devices 11 to 15 are stored. The device information DB 112 holds a detailed table T3 in which the feature name and the feature value of the packet are associated with each other. The terminal information DB 113 holds a terminal information table T4 in which the accumulation state of the feature amount represented by the packet for each network device 11 to 15 is stored. Here, the terminal information table T4 manages the status of devices existing in the same network. Further, the terminal information DB 113 holds an estimated information table T5 in which the network devices 11 to 15 store the degree of difference from their respective dictionary registration models.

  The capture unit 120 captures packets transmitted by the network devices 11 to 15 connected to the same network, that is, passive packets. Then, the capture unit 120 identifies the corresponding protocol from the captured passive packet. Then, the capture unit 120 outputs the captured passive packet information to the protocol feature analysis unit that analyzes the identified protocol.

  Each protocol feature analysis unit 13i (i is an integer from 1 to 3) performs analysis for each protocol on the information input from the capture unit 120, and extracts a feature quantity necessary for device identification. That is, each protocol feature analysis unit 13i extracts a feature amount represented by the passive packet. Examples of protocols to be analyzed include TCP analysis, SSL analysis, and WOL analysis. Each protocol feature analysis unit 13 i outputs the extracted feature amount to the DB access unit 150.

Each active measurement unit 14j (j is 1 or 2) transmits a command to the network devices 11 to 15 connected to the same network, and a packet transmitted from the network devices 11 to 15 in response to the command, that is, a response packet is transmitted. get. Then, each active measurement unit 14j extracts a feature amount represented by the acquired response packet.
Specifically, for example, each active measurement unit 14j transmits an arping command to the network devices 11 to 15 and acquires a response packet corresponding to the command. Here, the arping command is a command for sending an ARP (Address Resolution Protocol) request, and is a command for checking the network connection status with the other party at the IP level and acquiring the MAC address. Each active measurement unit 14j extracts the TCP port opening / closing status of the corresponding model as an example of the feature amount from the information included in the acquired response packet. Then, each active measurement unit 14j outputs the extracted feature amount to the DB access unit 150.
The detection of the network device may be triggered by a response to the arping command, or may be when other features are first acquired.

The DB access unit 150 registers information input from other units in a specified table of a specified DB. Specifically, the DB access unit 150 adds the feature amount input from each protocol feature analysis unit 13i to the feature storage table T1 of the feature storage DB 111. In addition, the DB access unit 150 adds the feature amount input from each active measurement unit 14j to the feature accumulation table T1 of the feature accumulation DB 111. That is, the DB access unit 150 functions as a feature amount storage unit that stores the feature amount represented by the acquired packet in the storage unit 110.
In addition, the DB access unit 150 extracts data from any DB in the storage unit 110 under specified conditions in response to a request from each functional unit, and outputs the extracted data to the functional unit that transmitted the request. .

  The device identification unit 160 compares the feature group of one model input from the Web UI unit 170 with the feature amount registered in the device information DB 112, and extracts model information having the closest feature. Here, the feature group is a set of feature amounts. The model information is information (for example, device name) regarding the model of the network device. Then, the device identification unit 160 returns the extracted model information to the Web UI unit 170.

  The Web UI unit 170 functions as a Web server, creates a device list screen or a dictionary registration screen, and displays the created screen on a network device that requests display. Here, the device list screen is a screen for outputting device information for each MAC address. The Web UI unit 170 may extract device information from the feature storage DB, and may manage a detected device by providing a device information table.

  On the device list screen, a dictionary registration button and a device identification button are displayed for each MAC address. When the dictionary registration button displayed on the device list screen is pressed, the Web UI unit 170 displays a device information registration screen. On the other hand, when the device identification button displayed on the device list screen is pressed, the Web UI unit 170 extracts a feature amount having the corresponding MAC address from the feature storage table T1 of the feature storage DB 111. Then, the Web UI unit 170 outputs the extracted feature amount to the device identification unit 160. The Web UI unit 170 acquires model information corresponding to the output feature amount from the device identification unit 160, and displays the acquired model information on a network device that requests display.

  The dictionary registration screen is a screen for registering model information (for example, category, manufacturer name, product name, model number, etc.). The Web UI unit 170 extracts a feature having the corresponding MAC address from the feature storage DB. The Web UI unit 170 displays the extracted feature group on the network device that requests display.

Further, the Web UI unit 170 displays an input area of model information (for example, category, manufacturer name, device name, model number, etc.), a registration button, and a cancel button for a model having the corresponding MAC address on the dictionary registration screen.
When the registration button is pressed, the Web UI unit 170 registers the feature group and model information in the model number table T2 and the detail table T3 of the device information DB 112. This registration is called dictionary registration.
Note that the Web UI unit 170 does not have to display the extracted feature group on the screen of the network device.

  The input unit 190 accepts selection of an accumulation mode for each group of network devices, and outputs mode selection information indicating the accepted selection to the feature accumulation determination unit 180 via the Web UI unit 170. Here, a group is a group of devices that share information related to the network. Groups are divided according to predetermined group distribution conditions. Here, the accumulation mode includes two accumulation modes of feature amounts, one is a normal mode, and the other is a monitoring mode. These accumulation modes are selected for each group of network devices.

  In the normal mode, the feature quantities of devices belonging to the same group are within a predetermined range, and the types of feature quantities (hereinafter also referred to as essential items) that are essential for maintaining the accuracy of device identification can be specified in advance. Set when The essential items are predetermined in order to specify the group. The “normal mode” has “accumulating” and “completed” as feature accumulation states. “Accumulating” means that all the essential features for the group are not accumulated (there are missing features), and “Completed” means that all the essential features for the group are accumulated. This means a state in which there is no insufficient feature amount, or a state in which the feature accumulation time has timed out.

  On the other hand, the monitoring mode is a mode in which the feature quantity increase state is monitored for a certain period of time, and accumulation is completed when the feature quantity increases. In the monitoring mode, an item for which the feature amount is required to be stored may be defined. “Monitoring mode” includes “monitoring”, “update”, and “completed” as feature accumulation states. “Update” means a state when the number of features has increased compared to the first time or the previous time. “Completed” means that the monitoring mode times out and there are no more updates. “Monitoring” is set when a function unit other than the feature accumulation determination unit 180 uses the determination result, and waits for feature accumulation in the monitoring mode. “Monitoring” is set when “update” is detected and some operation is performed, and is provided to distinguish whether or not any operation state has been performed after “update”.

  This monitoring mode is effective when the number of features of models belonging to the same group varies and it is difficult to define the number of features. Although the device identification accuracy improves as the number of features increases, there are models that do not increase the number of features even after waiting for a long time. Therefore, by setting the monitoring mode, the feature accumulation determination unit 180 can execute device identification at an early stage and perform device identification with higher accuracy at that timing even when the number of features increases. Become.

The feature accumulation determination unit 180 periodically monitors the feature extraction status that has been detected, and determines whether or not a feature amount sufficient to execute dictionary registration and device identification is accumulated in the feature accumulation DB 111.
The feature accumulation determination unit 180 functions as a group classification unit that classifies devices into groups that are classified based on the feature accumulation order pattern reference based on the feature amount represented by the acquired packet. Specifically, the feature accumulation determining unit 180 classifies devices into groups by applying the group distribution condition held by the feature accumulation determining unit 180 to the feature amount represented by the acquired packet.

  Then, the feature accumulation determination unit 180 determines whether to permit identification of devices classified into groups based on the mode selection information for each group input from the input unit 190 via the Web UI unit 170. Specifically, when the mode selection information is the normal mode, the feature accumulation determination unit 180, when the feature quantity of the essential items determined in advance for specifying the group is stored in the storage unit 110, It functions as a determination unit that determines that the feature amount has been accumulated. On the other hand, the feature accumulation determination unit 180 as the determination unit does not store the feature amount of the device when the feature amount of the essential item determined in advance for specifying the group is not stored in the storage unit 110. judge.

  On the other hand, when the mode selection information is the monitoring mode, the feature accumulation determination unit 180 functions as a feature number counting unit that counts the number of feature amounts accumulated in the storage unit 110. The feature accumulation determination unit 180 accumulates the feature amount of the device based on the comparison between the feature number counted by the feature number counting unit at a certain time and the feature number counted by the feature number counting unit at a time before the certain time. It functions as a determination unit that determines whether or not.

  More specifically, the monitoring end time for ending the monitoring of feature amount accumulation is determined for each group of devices, and the feature accumulation determining unit 180 has a certain number of features counted by the feature number counting unit at a certain time. As a determination unit that determines whether or not the feature amount of the device has been accumulated based on the comparison with the feature number counted by the feature number counting unit at an earlier time and the comparison between the current time and the monitoring end time Function. Specifically, for example, when the number of features counted is larger than the number of features held by the storage unit 110 and the current time has passed the monitoring end time, the feature accumulation determination unit 180 It is determined that the feature amount of the device has been accumulated.

  FIG. 3 is a diagram illustrating an example of the configuration of the feature storage table T1 held by the feature storage DB. The feature accumulation table T1 is a table that stores the feature amounts extracted by the protocol feature analysis units 131 to 133. The feature accumulation table T1 holds the MAC address, IP address, feature name, feature value, and recording date and time of the network devices 11 to 15 in association with each other. Here, the feature name is a parameter name of the feature amount extracted by the protocol feature analysis units 131 to 133. The feature value is a feature value extracted by the protocol feature analysis units 131 to 133.

  FIG. 4 is an example of a feature value of NetBIOS. Here, NetBIOS (Network Basic Input Output System) is a communication interface used in Windows (registered trademark) communication. In the figure, a combination of a NetBIOS feature name and a feature value is shown. For example, when the feature name is “NetBIOS_Host_Name”, the feature value is “BRW0022585EBD2”.

  Here, an example of analysis of the NetBIOS packet will be described. The protocol feature analysis unit 13i analyzes the Mailslot name of the SMB protocol #Trans Request unit. Then, the protocol feature analysis unit 13i continues the analysis if “0x01” (Host Announcement), and excludes it from the analysis target otherwise. Next, the protocol feature analysis unit 13i analyzes the operation code of the BROWSE protocol. Next, the protocol feature analysis unit 13i analyzes the Host Name and converts the byte sequence into SJIS. Next, the protocol feature analysis unit 13i analyzes the ServerType, analyzes the Host Comment, and converts the byte sequence into SJIS. This is the end of the description of the example of analyzing the NetBIOS packet.

  FIG. 5 is an example of a characteristic value of a TCP packet. In the figure, a set of feature names and feature values of a TCP packet is shown. For example, when the feature name is “TCP_OPT_2”, it is indicated that the feature value is “05b4”.

  FIG. 6 is an example of other feature values. In the figure, a set of other feature names, feature values, and outlines of the feature values is shown. For example, when the feature name is “TCP_PORT_139”, the feature value is “OPEN”, indicating that TCP port 139 is open. As described above, the protocol feature analysis unit 13i analyzes the open / close state for each TCP port.

  In the example shown in the figure, the active measurement unit 14j transmits an SNMP (Simple Network Management Protocol) command and acquires a value from the response content. Moreover, in the example of the same figure, the active measurement part 14j analyzes an ARP packet and acquires a request or a response.

  Also, in the example of the figure, the protocol feature analysis unit 13i analyzes a DHCP (Dynamic Host Configuration Protocol) packet, and extracts a DHCP option Tag (option number) and a value corresponding to the DHCP option Tag. Moreover, in the example of the figure, the protocol feature analysis unit 13i analyzes a Membership Report of an IGMP (Internet Group Management Protocol) packet and extracts a corresponding value value.

  Further, in the example of the figure, the protocol feature analysis unit 13i analyzes a WOL (Wake-on-LAN) packet and extracts a corresponding value value. Moreover, in the example of the figure, the protocol feature analysis unit 13i analyzes an SSL (Secure Socket Layer) packet and extracts the value of the corresponding value as SSL_CLIENT.

  Moreover, in the example of the figure, the protocol feature analysis unit 13i analyzes an IPv4 (Internet Protocol Version 4) packet (with options), and extracts IPv4 option information. Moreover, in the example of the figure, the protocol feature analysis unit 13i analyzes an IPv6 (Internet Protocol Version 6) packet and extracts a destination IP address as IPv6_DSTADR.

FIG. 7 is a diagram illustrating an example of the configuration of the model number table T2 and the detail table T3 stored in the device information DB 112. The model number table T2 and the detail table T3 are linked by a set of dictionary creation device ID and model number.
The model number table T2 is a table that stores model number information of the network devices 11-15. The model number table T2 holds a dictionary creation device ID, a learning ID, a category, a manufacturer name, a device name, a model number, a comment, and a learning date and time in association with each other. Here, the dictionary creation device ID is identification information unique to the device identification device 100. In this embodiment, since it is assumed that one device identification device 100 is installed for each home as an example, the dictionary creation device ID is identification information unique to each home as an example.

The learning ID is a sequence number in which dictionary registration is executed for each device identification device 100. Here, learning means performing dictionary registration and associating model number information with feature data.
The category is a category of the network devices 11 to 15 (for example, AV, PC peripheral device, etc.). The manufacturer name is the name of the manufacturer of the network devices 11-15. The device name is the name of the network device 11-15. The model number is the model number of the network devices 11-15. The comment is a memo written by the registrant at the time of dictionary registration (for example, a memo regarding partial modification after purchase, a memo for fixed IP settings, a memo for DHCP settings, etc.)
The learning date / time is the date / time when dictionary registration was performed.

  The detailed table T3 is a table that stores the feature amounts of the network devices 11 to 15. The detailed table T3 holds a dictionary creation device ID, a learning ID, a feature name, and a feature value in association with each other. The feature name and the feature value are a feature name and a characteristic value held in the feature accumulation table T1 stored in the feature accumulation DB 111, respectively.

  FIG. 8 is a diagram illustrating an example of the configuration of the terminal information table T4 and the estimated information table T5 held in the terminal information DB 113. The terminal information table T4 and the estimated information table T5 are linked by a terminal ID. Here, the terminal ID is identification information for identifying each network device. The terminal information table T4 is associated with one or more estimation information tables.

  The terminal information table T4 holds a terminal ID, a MAC address, an IP address, a connection state, a storage mode, and storage information in association with each other. The MAC address is the MAC address of the network device identified by the terminal ID. The IP address is the IP address of the network device identified by the terminal ID. The connection state is a network connection state of the network device identified by the terminal ID, and takes a value of ON or OFF, for example. For example, ON is registered when there is a response to the ARP command transmission by the active measurement unit 14j, and OFF is registered when there is no response (that is, when a timeout occurs). The accumulation mode is the accumulation mode of the network device identified by the terminal ID. The accumulation state is a feature amount accumulation state for the network device identified by the terminal ID. The accumulation mode and accumulation state are set by the feature accumulation determination unit 180.

  The estimation information table T5 holds terminal IDs, points (also referred to as specific points), categories, manufacturer names, model names, model numbers, and comments in association with each other. The point is the degree of difference between the corresponding device and each dictionary registered model, which is calculated when device identification is executed. The category is a category registered in the model number table T2 extracted as a result of device identification. The manufacturer name is the name of the manufacturer registered in the model number table T2 extracted as a result of device identification. The model name is a device name registered in the model number table T2 extracted as a result of device identification. The model number is a model number registered in the model number table T2 extracted as a result of device identification. In the comment, a comment registered in the model number table T2 extracted as a result of device identification is registered together with the model number information.

  FIG. 9 is an example of a device list screen. In the device list screen G91 of the same figure, as a detected device list, a set of detected network device MAC address, IP address, specific point, category, manufacturer, device name, model number, comment, details, and device identification is shown. Yes. A specific point or the like is shown for each model with respect to the MAC address or the IP address.

  Here, as an example, the larger the specific point, the more similar to the corresponding device and each dictionary registered model. For example, in the network device whose IP address in the first line is “192.168.11.3”, the device name “HDD & DVD video recorder” whose specific point is “0.333” is most similar. In this example, the network device having the IP address “192.168.11.3” is identified by the device identification unit 160 as the device name “HDD & DVD video recorder”.

In the details column, a link to the dictionary registration screen is provided under the name “details”. In the device identification column, a link is made to the name “device identification”. When this link is clicked, the device identification unit 160 performs device identification.
Information extracted from the terminal information table T4 and the estimated information table T5 by the Web UI unit 170 is displayed on the device list screen.

  FIG. 10 is an example of a dictionary registration screen. In the dictionary registration screen G92 of the same figure, a set of KEY and VALUE is shown. Here, KEY is a feature name, and VALUE is a feature value. That is, a set of feature names and feature values acquired from a certain network device is shown.

  In addition, fields for inputting the category, manufacturer, device name, model number, and comment of the network device are shown. A registration button is shown at the bottom of the dictionary registration screen G92. When the registration button is pressed, the Web UI unit 170 generates a learning ID. Then, the Web UI unit 170 stores the input category, manufacturer, device name, model number, comment, and learning date and time in the model number table T2 of the device information DB 112 in association with the learning ID and the dictionary creation device ID. Here, the learning date and time is the date and time when the registration button is pressed. At the same time, the Web UI unit 170 associates the learning ID and the dictionary creation device ID with the KEY and VALUE displayed on the dictionary registration screen G92 as the feature name and feature value, respectively, and the detailed table T3 of the device information DB 112. To store.

  FIG. 11 is an example of a transition diagram between the device list screen and the dictionary registration screen. In the figure, a device list screen G91 and a dictionary registration screen G92 are shown. When the “device identification” link is pressed on the device list screen G91, the device identification unit 160 identifies the device, and then the device list screen G91 is displayed again. When the “details” link is pressed on the device list screen G91, a dictionary registration screen G92 is displayed. When the “Register” button is pressed on the dictionary registration screen G92, the input device information is added to the model number table T2 and the detail table T3 of the device information DB 112, and the device list screen G91 is displayed.

FIG. 12 is a flowchart illustrating an example of a process flow of the device identification apparatus 1 according to the first embodiment.
First, in step S101, the active measurement units 141 to 142 execute active feature extraction processing. Next, in step S102, the protocol feature analysis units 131 to 133 execute passive feature extraction processing.

  Next, in step S103, the feature accumulation determination unit 180 executes feature accumulation determination processing. Next, in step S104, the feature accumulation determination unit 180 refers to the accumulation information of the first terminal ID from the terminal information table T4 of the terminal information DB 113. Next, in step S105, the feature accumulation determination unit 180 determines whether or not the referenced accumulation state is complete.

  When the stored state referred to is complete (step S105 YES), the feature storage determination unit 180 displays the “device identification” link or the “execute” button at the time of dictionary registration in a controllable state (step S106). The process proceeds to step S108. The device identification apparatus 100 may detect a network device in which the estimation information is not registered and the accumulation state is complete, and perform device identification automatically.

  On the other hand, if the referenced storage state is not complete (NO in step S105), the feature storage determination unit 180 displays the “device identification” link or the “execute” button for dictionary registration in an uncontrollable state (step S107). The process proceeds to step S108. The feature accumulation determination unit 180 may output an error message when the user presses a link for device identification or an “execute” button for dictionary registration.

  Next, in step S108, it is determined whether or not the accumulated information of all terminal IDs has been referenced from the terminal information table T4 of the terminal information DB 113. When the accumulated information of all terminal IDs is not referred to (NO in step S108), the feature accumulation determining unit 180 refers to the accumulated information of the next terminal ID from the terminal information table T4 (step S109), and the process of step S105 Return to. On the other hand, when the accumulated information of all terminal IDs is referred to (YES in step S108), the device identification device 1 ends the process of this flowchart.

According to the processing in FIG. 12, the feature accumulation determination unit 180 of the device identification apparatus 1 permits dictionary registration or device identification only when the accumulation state indicates completion. As a result, the device identification apparatus 1 performs device identification only on the network device in which the feature amount is sufficiently accumulated, so that the accuracy of device identification can be improved.
In addition, since the device identification apparatus 1 performs dictionary registration only for network devices in which feature amounts are sufficiently accumulated, it is possible to improve the accuracy of information on registered devices. Thereby, since the accuracy of the information of the device referred when performing device identification is improved, the device identification device 1 can also improve the accuracy of device identification.

  FIG. 13 is a flowchart showing an example of the flow of the active feature extraction process in step S101 of FIG. First, in step S201, the active measurement unit 14j acquires a MAC address and an IP address registered in the feature accumulation table T1 of the feature accumulation DB 111. Next, in step S202, the active measurement unit 14j transmits a request packet to the network device that has acquired the IP address. Here, the request packet is a packet for requesting a response. Next, in step S203, the active measurement unit 14j receives a response packet from the network device.

  Next, in step S204, the active measurement unit 14j analyzes the received response packet. Next, in step S205, the active measurement unit 14j extracts a feature amount from the response packet. Next, in step S206, the active measurement unit 14j registers in the feature accumulation table T1 of the feature accumulation DB 111 via the DB access unit 150.

  Next, in step S207, the active measurement unit 14j determines whether or not a predetermined time (for example, 1 hour) determined in advance has elapsed since the transmission of the request packet in step S202. When the active measurement unit 14j determines that the predetermined time has elapsed (step S207 YES), the process returns to step S201. Thereafter, the active measurement unit 14j transmits the request packet again to the network device. In this way, the active measuring unit 14j periodically transmits a request packet.

  On the other hand, when the active measurement unit 14j determines that the predetermined time has not elapsed (NO in step S207), the device identification apparatus 100 determines whether or not a processing end request has been input from the outside by a user operation or an interrupt process. (Step S208). When the device identification apparatus 100 determines that a processing end request has not been input from the outside (NO in step S208), the process returns to step S207. On the other hand, when the device identification apparatus 100 determines that a processing end request has been input from the outside (YES in step S208), the device identification apparatus 100 ends the active feature extraction process. Above, the process of this flowchart is complete | finished.

  FIG. 14 is a flowchart illustrating an example of the flow of the passive feature extraction process in step S102 of FIG. First, in step S301, the capture unit 120 captures packets transmitted from the network devices 11-15. Next, in step S302, the active feature analysis unit 14j analyzes the captured packet based on a predetermined protocol. Next, in step S303, the active feature analysis unit 14j extracts a feature amount from the analyzed packet. Next, in step S304, the extracted feature amount is registered in the feature accumulation table T1 held in the feature accumulation DB 111.

  Next, in step S <b> 305, the device identification apparatus 100 determines whether or not a processing end request is input from the outside by a user operation or an interrupt process. If the device identification apparatus 100 determines that a processing end request has not been input from the outside (NO in step S305), the process returns to step S305. On the other hand, when the device identification apparatus 100 determines that a processing end request is input from the outside (YES in step S305), the device identification apparatus 100 ends the passive feature extraction process. Above, the process of this flowchart is complete | finished. By the active feature extraction process and the passive feature extraction process, the feature amount of the network device is accumulated in the feature accumulation table T1 of the feature accumulation DB 111.

  FIG. 15 is a flowchart showing an exemplary flow of the feature accumulation determination process in step S103 of FIG. First, in step S <b> 401, the feature accumulation determination unit 180 reads a setting file held in the internal memory of the feature accumulation determination unit 180. Next, in step S402, the feature accumulation determination unit 180 determines whether or not the accumulated data read cycle has been reached. Here, the read cycle of the accumulated data is determined in advance. If the feature accumulation determination unit 180 determines that the accumulated data read cycle has not been reached (NO in step S402), the feature accumulation determination unit 180 stands by as it is.

  On the other hand, when it is determined that the feature accumulation determination unit 180 has reached the stored data read cycle (YES in step S402), the feature accumulation determination unit 180 displays a list of MAC addresses of in-home NW (network) connected devices in the terminal information DB 112. Obtained from the terminal information table T4. Next, in step S404, the feature accumulation determination unit 180 creates a network device list (hereinafter referred to as a terminal list) whose accumulation state is other than completion.

  Next, in step S405, the feature accumulation determination unit 180 executes the processes of steps S406 to S408 each time the terminal list is sequentially read. Next, in step S406, the feature accumulation determination unit 180 reads from the feature accumulation table T1 of the feature accumulation DB 111 of the feature accumulation DB 111 via the DB access unit 150.

  Next, in step S407, the feature accumulation determination unit 180 executes group determination processing. Next, in step S408, the feature accumulation determination unit 180 executes group processing. Next, in step S409, the device identification apparatus 100 determines whether a processing end request has been input from the outside by a user operation, an interrupt process, or the like. If the device identification apparatus 100 determines that a processing end request has not been input from the outside (NO in step S409), the process returns to step S402. On the other hand, when the device identification apparatus 100 determines that a process end request is input from the outside (YES in step S409), the device identification apparatus 100 ends the feature accumulation determination process. Above, the process of this flowchart is complete | finished.

  FIG. 16 shows an example of a set of feature extraction categories and implementation contents executed by the device identification apparatus 100. In the figure, it is shown that the features analyzed by the protocol feature analysis unit 13i are SSL, IPv6, NetBIOS, and TCP (Transmission Control Protocol) options. Here, the TCP option is information for specifying a special setting related to the TCP connection. In addition, it is shown that the features analyzed by the active measurement unit 14j are port check and SNMP. Hereinafter, as an example, the description will be made on the assumption that the protocol feature analysis unit 13i and the active measurement unit 14j use the above features as analysis targets.

  FIG. 17 is a flowchart illustrating an example of the flow of the group determination process in step S407 of FIG. First, in step S501, the feature accumulation determination unit 180 determines whether the port check is completed. When the feature accumulation determination unit 180 determines that the port check has not been completed (NO in step S501), the feature accumulation determination unit 180 ends the group determination process. On the other hand, when the feature accumulation determining unit 180 determines that the port check has been completed (YES in step S501), the feature accumulation determining unit 180 determines whether the port 9100/631 is Open (step S502). .

If the feature accumulation determination unit 180 determines that Port 9100/631 is Open (YES in step S502), the feature accumulation determination unit 180 determines that the network device is group A (step S503), and performs group determination processing. finish.
On the other hand, when the feature accumulation determining unit 180 determines that the Port 9100/631 is not Open (NO in Step S502), the feature accumulation determining unit 180 determines whether the Port 139 is Open (Step S504).

When the feature accumulation determining unit 180 determines that the Port 139 is Open (YES in step S504), the feature accumulation determining unit 180 determines that the network device is group B (step S505), and ends the group determination process.
On the other hand, when the feature accumulation determining unit 180 determines that the Port 139 is not Open (NO in Step S504), the feature accumulation determining unit 180 determines whether the Port 80 or 8080 is Open or whether there is a feature value of SSL_CLIENT (Step S504). S506).

If the feature accumulation determination unit 180 determines that Port 80 or 8080 is Open or has a feature value of SSL_CLIENT (YES in step S506), the feature accumulation determination unit 180 determines that the network device is group C (step S507). The group determination process ends.
On the other hand, when the feature accumulation determining unit 180 determines that neither Port 80 nor 8080 is Open and there is no SSL_CLIENT feature value (NO in step S506), the feature accumulation determining unit 180 determines whether there is an IPv6_DSTADR feature value. (Step S508).

  When the feature accumulation determination unit 180 determines that there is an IPv6_DSTADR feature value (YES in step S508), the feature accumulation determination unit 180 determines that the network device is group D (step S509), and ends the group determination process. . On the other hand, if the feature accumulation determination unit 180 determines that there is no Pv6 DstAdr (NO in step S508), the feature accumulation determination unit 180 determines that the network device is “other” (step S509), and ends the group determination process. . Above, the process of this flowchart is complete | finished.

By this group determination process, the group of each network device is determined.
Note that the branch of the group determination described above may be described in a setting file, or the determination logic may be fixed in advance. Alternatively, the feature accumulation may be periodically analyzed and the determination logic may be automatically generated and applied.

FIG. 18 is an example of a distribution condition, essential items, and timeout condition for each group. In the figure, a set of a group name, a distribution condition, an essential item, and a timeout condition is shown. In the case of the group D and the “others” group, the timeout condition indicates a condition that is applied when the accumulation mode is the monitoring mode.
As an example, the distribution condition to the group is determined by the open / close state of TCP_PORT obtained for active feature extraction, presence / absence of SSL_CLIENT feature value obtained for passive feature extraction, or presence / absence of IPv6_DSTADR feature value obtained for passive feature extraction. ing.
In other words, in the present embodiment, the conditions for allocating to groups are determined by, for example, the feature amount obtained by active feature extraction and the feature amount obtained by passive feature extraction.

  In the present embodiment, the distribution condition to the group is determined by the feature amount obtained by active feature extraction and the feature amount obtained by passive feature extraction as an example. It may be determined only by the feature amount obtained by active feature extraction such as port check. In this embodiment, an example of the group determination process when the TCP port check has been completed has been described. However, the present invention is not limited to this, and the condition for determining whether the TCP port check has been completed is eliminated. The distribution condition may be determined only by the feature amount obtained by passive feature extraction. In other words, the condition for allocating to the group may be determined by at least one of the feature quantity extracted by the active measurement unit 14j or the feature quantity extracted by the protocol feature analysis unit 13i. Thereby, the feature accumulation determination unit 180 can classify each device into an appropriate group.

  In FIG. 18, Group A corresponds to the case where TCP ports 631 (Internet Printing Protocol) and 9100 (PDL DataStream) are opened by active feature extraction, and often has a printer function. Since the printer is equipped with the NetBIOS protocol as a shared service of Windows (registered trademark) machines, the features of NetBIOS are set as essential features. In the existing technology, a plurality of features are extracted from the protocol analysis of NetBIOS. However, since the timing for acquiring the features related to NetBIOS is often acquired at the same time, it is sufficient that at least one feature related to NetBIOS can be acquired.

  Similarly, because there are many printers that use the TCP option, the TCP option is set as an essential item of the feature. However, since the TCP option also collects a plurality of features at the same time, even one feature related to the TCP option can be acquired. That's fine. Since there are many printers equipped with SNMP, SYS_NAME of SNMP (Management Information Base) information is set as an essential item. Here, MIB is management information referred to by SNMP, and SYS_NAME is a variable in which the name of the device is entered. SNMP information acquisition is not limited to SYS_NAME, but may be used when other items are acquired.

The timeout condition for group A is set to 20 minutes as an example because there are many devices with a NetBIOS transmission period of about 15 minutes.
In addition, the feature accumulation determination unit 180 holds a determination order as to which group belongs as a group distribution condition. The judgment order is, for example, a method that explicitly specifies the order (for example, a method that defines the processing order of groups in the definition file) and a condition that includes all the same conditions without omitting the conditions. There is a method of setting rules for determining in ascending order. In the latter method, for example, when there is a group A with TCP_PORT_9100 = OPEN and TCP_PORT_631 = OPEN and a group B with TCP_PORT_9100 = OPEN and TCP_PORT_631 = OPEN and TCP_PORT_139 = OPEN, the group A with less conditions is given priority.

FIG. 19 is an example of a timeout list and a monitoring list held by the feature accumulation determination unit 180. In the timeout list T191 in the figure, the MAC address and the feature accumulation monitoring end time are associated with each other. That is, the feature accumulation monitoring end time is determined for each network device.
In addition, in the monitoring list T192 in the figure, the MAC address, the feature accumulation monitoring end time, and the previous feature number are associated with each other. Here, the previous feature number is the number of feature amounts counted (hereinafter referred to as count) by the feature accumulation determination unit 180 last time. In other words, the feature accumulation monitoring end time and the previous feature amount are determined for each network device.

The flow of group processing performed by the feature accumulation determination unit 180 will be described with reference to FIGS. FIG. 20 is a flowchart illustrating an example of the flow of group processing in step S408 of FIG. FIG. 21 is a continuation of the flowchart of FIG.
First, in step S601, the feature accumulation determination unit 180 acquires the current time. Next, in step S602, the feature accumulation determination unit 180 determines whether or not the accumulation mode of the group into which the target network device (hereinafter referred to as the target device) is classified is the monitoring mode.

  When the group accumulation mode is not the monitoring mode (NO in step S602), the feature accumulation determining unit 180 confirms the essential items of the group into which the target device is classified (step S603). At this time, when all the feature amounts of the essential items have been acquired, the feature accumulation determination unit 180 turns on the flags of all the essential items. Here, the feature accumulation determination unit 180 holds flags of all essential items. When even one feature of the essential item has not been acquired, the feature accumulation determining unit 180 turns off the flag of the essential item for which no feature is acquired, and turns on the flag of the essential item for which the feature has been acquired. In the case of the monitoring mode, the above flag and all the mandatory items are turned off.

  Next, in step S604, the feature accumulation determination unit 180 determines whether or not the feature amounts of all essential items set in the group into which the target device is classified are stored in the feature accumulation DB 111. If the feature amounts of all the essential items are stored in the feature accumulation DB 111 (YES in step S604), the feature accumulation determination unit 180 checks the timeout list (step S605). Next, in step S606, the feature accumulation determination unit 180 determines whether or not the MAC address of the target device is registered in the timeout list. When registered in the timeout list (YES in step S606), the feature accumulation determining unit 180 deletes the record of the target device from the timeout list (step S607), and proceeds to step S608. On the other hand, if not registered in the timeout list (NO in step S606), the feature accumulation determining unit 180 proceeds to step S608.

Next, in step S608, the feature accumulation determination unit 180 sets the accumulation mode of the record having the terminal ID of the target device to “normal” and sets the accumulation state of the record to “completed” in the terminal information table T4 of the terminal information DB 113. Set to. As a result, the device identification apparatus 100 can permit the device identification or dictionary registration to the user since the accumulation of the feature amount of the target device is completed.
Note that the device identification unit 160 may automatically perform device identification without a user instruction after the setting in step S608.

  Returning to step S604, if the feature amounts of all essential items are not stored in the feature accumulation DB 111 (NO in step S604), the feature accumulation determination unit 180 checks the timeout list (step S609). Next, in step S610, the feature accumulation determination unit 180 determines whether the MAC address of the target device is registered in the timeout list.

  When the MAC address of the target device is registered in the timeout list (YES in step S610), the feature accumulation determination unit 180 compares the current time with the monitoring end time associated with the MAC address of the target device in the timeout list. To do. If the current time has passed the monitoring end time (YES in step S611), the feature accumulation determining unit 180 deletes the record of the target device from the timeout list (step S612), and the process proceeds to step S608. On the other hand, if the current time has not passed the monitoring end time (NO in step S611), the feature accumulation determining unit 180 proceeds to step S615.

  Next, returning to step S610, if the MAC address of the target device is not registered in the timeout list (NO in step S610), the feature accumulation determination unit 180 sets the time obtained by adding the timeout time to the current time as the monitoring end time. Calculate (step S613). Next, in step S614, the feature accumulation determination unit 180 registers the MAC address of the target device and the calculated monitoring end time in association with the timeout list, and proceeds to step S615.

  Next, in step S615, the feature accumulation determination unit 180 sets the accumulation mode of the record having the terminal ID of the target device to “normal” and sets the accumulation state of the record to “accumulating” in the terminal information table T4 of the terminal information DB 113. To "". Thereby, when the feature amounts of all the essential items are not prepared and when the monitoring end time has not passed, the device identification device 100 can continuously accumulate the feature amounts. Even when a new network device is connected to the LAN 16 and is not registered in the timeout list, the device identification apparatus 100 can accumulate feature quantities.

Next, returning to step S602, if the group accumulation mode is the monitoring mode (YES in step S602), the process proceeds to step S616 in FIG.
Next, in step S616, the feature accumulation determination unit 180 determines whether or not an essential item is set in the group into which the target device is classified. When the essential items are set in the group into which the target devices are classified, that is, in the case of groups A, B, C, and D (see FIG. 18), the feature accumulation determination unit 180 proceeds to step S617. On the other hand, when the essential item is not set in the group into which the target device is classified, that is, in the case of the “other” group (see FIG. 18), the feature accumulation determination unit 180 proceeds to step S622.

  Next, in step S617, the feature accumulation determination unit 180 confirms the essential items of the group into which the target device is classified (step S617). At this time, when all the feature amounts of the essential items have been acquired, the feature accumulation determination unit 180 turns on the flags of all the essential items. When even one feature of the essential item has not been acquired, the feature accumulation determining unit 180 turns off the flag of the essential item for which no feature is acquired, and turns on the flag of the essential item for which the feature has been acquired.

  Next, in step S618, the feature accumulation determination unit 180 determines whether or not the feature amounts of all essential items set in the group into which the target device is classified are stored in the feature accumulation DB 111. If the feature amounts of all the essential items are stored in the feature accumulation DB 111 (YES in step S618), the feature accumulation determination unit 180 proceeds to step S619. On the other hand, when the feature amounts of all the essential items are not stored in the feature accumulation DB 111 (NO in step S618), the feature accumulation determination unit 180 proceeds to step S622.

  Next, in step S619, the feature accumulation determination unit 180 determines whether or not the MAC address of the target device is registered in the monitoring list (step S619). If the MAC address of the target device is registered in the monitoring list (YES in step S619), the target device record is deleted from the monitoring list (step S620), and the feature accumulation determining unit 180 proceeds to step S621. On the other hand, if the MAC address of the target device is not registered in the monitoring list (NO in step S619), the feature accumulation determining unit 180 proceeds to step S621.

  Next, in step S621, the feature accumulation determination unit 180 sets the accumulation state of the record to be completed by monitoring the accumulation mode of the record having the terminal ID of the target device in the terminal information table T4 of the terminal information DB 113.

  Next, in step S622, the feature accumulation determination unit 180 determines whether the MAC address of the target device is registered in the monitoring list. When the MAC address of the target device is registered in the monitoring list (YES in step S622), the feature accumulation determining unit 180 counts the number of features and obtains the current number of features (step S623). Next, in step S624, the feature accumulation determination unit 180 determines whether or not the acquired current feature number is greater than the previous feature number registered in association with the MAC address of the target device in the monitoring list.

  If the current feature number is equal to or less than the previous feature number (NO in step S624), the feature accumulation determination unit 180 ends the group process. On the other hand, when the current feature number is larger than the previous feature number (step S624 YES), the feature accumulation determination unit 180 determines whether or not the current time has passed the monitoring end time (step S625). When the current time has passed the monitoring end time (step S625 YES), the feature accumulation determination unit 180 deletes the data of the corresponding MAC address from the monitoring list (step S626). Then, the feature accumulation determining unit 180 sets the accumulation mode of the record having the terminal ID of the target device to “monitoring” and the accumulation state of the record to “completed” in the terminal information table T4 of the terminal information DB 113. As a result, the device identification apparatus 100 can notify the user of device identification or dictionary registration permission because the accumulation of the feature amount of the target device has been completed.

  Returning to step S625, if the current time has not passed the monitoring end time (step S625 NO), the feature accumulation determination unit 180 sets the current feature to the previous feature number associated with the MAC address of the target device in the monitoring list. A number is set (step S628). Then, the feature accumulation determination unit 180 sets the accumulation mode of the record having the terminal ID of the target device to “monitoring” and the accumulation state of the record to “update” in the terminal information table T4 of the terminal information DB 113 (step S4). S629), the feature accumulation determination unit 180 ends the group process. Accordingly, the Web UI unit 170 of the device identification apparatus 100 displays the device identification link in a state where it can be executed. Then, the device identification unit 160 executes device identification when the device identification link is pressed. After the Web UI unit 170 displays the device list screen updated after device identification, the storage mode is changed from “updated” to “monitoring”.

  Returning to step S622, if the MAC address of the target device has not been registered in the monitoring list (for example, if the target device has just been connected to the LAN 16 and has not been registered in the monitoring list) (step S622 NO), feature accumulation determination The unit 180 calculates a monitoring end time by adding a timeout time (for example, 10 minutes) set to a group to which the target device belongs (for example, “other” group) at the current time. The feature accumulation determination unit 180 associates and registers the MAC address of the target device, the calculated monitoring end time, and the previous feature number (for example, 20) in the monitoring list (step S631).

  Then, the feature accumulation determination unit 180 sets the accumulation mode of the record having the terminal ID of the target device to “monitoring” and the accumulation state of the record to “update” in the terminal information table T4 of the terminal information DB 113 (step S4). S632), the feature accumulation determination unit 180 ends the group process. Above, the process of this flowchart is complete | finished.

  Since “update” means that the number of features has increased in the monitoring mode, the device identification apparatus 100 may automatically execute device identification processing on the target device after the processing in step S629 or step S632. . Alternatively, the device identification apparatus 100 may display that a feature has been added when performing screen display after the process of step S629 or step S632.

  Further, when the device identification device 100 refers to the terminal information table T4 and notifies the user of the device identification execution timing, the following processing may be performed after the device identification is performed on the target device. That is, the device identification device 100 is a process of changing the storage state of the record having the terminal ID of the target device to “monitoring” in the terminal information table T4 of the terminal information DB 113. As a result, the device identification apparatus 100 can distinguish whether or not device identification has been executed after “updating” the previous feature number.

  In addition, when the accumulation state is “completed” in the monitoring mode, it means that the monitoring mode has timed out. Therefore, the device identification apparatus 100 determines the model information when performing screen display after the processing in step S621 or step S627. May be displayed.

  As described above, the feature accumulation determination unit 180 sets the accumulation state of the feature amount for each target device by the group processing in FIGS. 20 and 21. Specifically, the feature accumulation determination unit 180 completes the accumulation state and permits device identification or dictionary registration when all the essential items set in the group into which the target device is classified are available. Also, the feature accumulation determination unit 180 completes the accumulation state and permits device identification or dictionary registration in the normal mode and when the timeout time has elapsed. In addition, in the monitoring mode, the feature accumulation determination unit 180 permits the device identification or dictionary registration by setting the accumulation state to be accumulating when the current feature number exceeds the previous feature number and the timeout time has elapsed. .

  Accordingly, the feature accumulation determination unit 180 can improve the accuracy of device identification when all the essential items set in the group into which the target device is classified are available. The feature accumulation determination unit 180 permits device identification when the current feature number exceeds the previous feature number and the timeout time has elapsed, so the accuracy of device identification is improved by the amount of feature increase. be able to.

Further, the feature accumulation determination unit 180 permits dictionary registration when all the essential items are prepared, or when the current feature number exceeds the previous feature number and the timeout time has elapsed. Thereby, the feature amount of the information of the network device is sufficiently registered in the storage unit 110. As a result, since there are sufficient registered feature amounts to be compared when device identification is performed, the device identification unit 160 can improve the accuracy of device identification.
Similarly, the feature accumulation determination unit 180 permits dictionary registration when the current feature number exceeds the previous feature number and the timeout time has elapsed. As a result, a large amount of information about the network device information is registered in the storage unit 110. As a result, since there are sufficient registered feature amounts to be compared when device identification is performed, the device identification unit 160 can improve the accuracy of device identification.

  Also, in the normal mode, the feature accumulation determination unit 180 sets the accumulation state to the accumulation state and prohibits device identification or dictionary registration when the timeout time has not elapsed. Also, in the normal mode, the feature accumulation determination unit 180 sets the accumulation state to be accumulating and prohibits device identification or dictionary registration when the MAC address of the target device is not registered in the timeout list. Thus, the feature accumulation determination unit 180 can obtain high identification accuracy by suppressing dictionary registration or device identification in a state where feature accumulation of network devices is insufficient.

  In addition, in the monitoring mode, the feature accumulation determination unit 180 updates the accumulation state and executes device identification when the current feature number exceeds the previous feature number but the timeout period has not elapsed. , Change the accumulation status during monitoring. As a result, the device identification apparatus 100 sequentially executes device identification and reflects the identification result such as the specific point on the device list screen, so that the user predicts the device name of the device from the reflected specific point. Can do.

  FIG. 22 is a flowchart illustrating an example of a dictionary creation process performed by the device identification apparatus according to the first embodiment. First, in step S701, the Web UI unit 170 acquires feature data from the feature storage table T1 of the feature storage DB 111 using the MAC address as a key. Next, in step S702, the Web UI unit 170 displays the acquired feature data and model number information input screen on a display unit included in the corresponding network device.

  In step S703, the Web UI unit 170 receives input of model number information via the network device. Next, in step S704, the Web UI unit 170 assigns the same learning ID to the received model number information and the acquired feature data, and registers the model number information in the model number table T2 of the device information DB 112 in association with the learning ID. Further, the Web UI unit 170 registers the feature data acquired in association with the learning ID in the detail table T3 of the device information DB 112. Next, in step S <b> 705, the Web UI unit 170 creates a list of feature names that can be acquired by the device identification apparatus 100 (hereinafter referred to as a feature name list).

Next, in step S706, the Web UI unit 170 performs the settings in steps S707 to S709 for each feature name in the feature name list.
Next, the Web UI unit 170 determines whether there is a feature name corresponding to the feature data acquired from the feature accumulation table T1. If there is a feature name corresponding to the feature data acquired from the feature storage table T1 (YES in step S707), the Web UI unit 170 generates a learning ID and associates the feature name and feature value of the feature data with the generated learning ID. Register in the detail table T3 (step S708).

  On the other hand, if there is no feature name corresponding to the feature data acquired from the feature storage table T1 (NO in step S707), the Web UI unit 170 generates a learning ID, and uses the “no information” as a feature value to generate the learning ID, The feature name of the feature data and “no information” as the feature value are associated and registered in the detail table T3 (step S709). Above, the process of this flowchart is complete | finished.

  FIG. 23 is a flowchart illustrating an example of a flow of device identification processing of the device identification apparatus according to the first embodiment. First, in step S801, the device identification unit 160 acquires the feature data of the MAC address of a network device (hereinafter referred to as an identification target device) that is a device identification target from the feature accumulation table T1 of the feature accumulation DB 111. Next, in step S802, the device identification unit 160 reads all model numbers from the model number table T2 of the device information DB 112, and creates a model number list including all the read model numbers.

  In step S803, the device identification unit 160 reads all feature names from the detailed table T3 of the device information DB 112 and creates a feature name list including all feature names. Next, in step S804, the device identification unit 160 executes the processes of steps S805 to S807 for each model number in the model number list. Next, in step S805, the device identification unit 160 executes the process in step S806 for each feature name in the feature name list.

  Next, in step S806, the device identification unit 160 calculates the distance from the comparative model number model. Specifically, the device identification unit 160 first initializes the distance for each feature name to zero. And as a 1st process, the apparatus identification part 160 compares the characteristic data of an identification object apparatus with the characteristic data of a corresponding comparison model number model about a certain characteristic name. Then, as a second process, if there is a difference as a result of the comparison, the device identification unit 160 adds the weight determined for each feature name to the distance from the comparative model number model. The device identification unit 160 performs the first process and the second process on all feature names included in the feature data of the identification target device.

Next, in step S807, the device identification unit 160 calculates 1 / (distance + 1) and sets the obtained value as a point (also referred to as a score). Thereby, when the distance is 0, that is, when all the feature values match, the point becomes 1 of the highest score.
Next, in step S807, the device identification unit 160 outputs the device name having the highest point as the identified device. Above, the process of this flowchart is complete | finished.

<Effect of the first embodiment>
The feature accumulation determination unit 180 of the device identification apparatus 100 according to the first embodiment classifies devices into groups based on the feature values extracted by the active measurement unit 14j and the feature values extracted by the protocol feature analysis unit 13i. . Then, the feature accumulation determination unit 180 determines whether or not the storage unit 110 stores a feature regarding essential items that are essential for each classified group. Then, the feature accumulation determination unit 180 determines that the feature amount of the device is accumulated when the feature related to the essential item is stored. On the other hand, when the feature regarding the essential item is not stored, the feature accumulation determining unit 180 determines that the feature amount of the device is not accumulated.

  As a result, the feature accumulation determination unit 180 prohibits device identification in a state where feature accumulation of devices connected to the home network is insufficient, and device identification is performed when the feature accumulation of the device becomes sufficient. Therefore, since a sufficient amount of feature quantities can be compared between the device and the comparative model number model, high identification accuracy can be realized.

  Further, the feature accumulation determining unit 180 prohibits dictionary registration when the feature accumulation of the device connected to the home network is insufficient, and performs dictionary registration when the feature accumulation is sufficient. Sufficient features can be registered in the dictionary. As a result, since there are many feature quantities of the comparative model number model, sufficient types of feature quantities can be compared between the device and the comparative model number model, so that high identification accuracy can be realized.

The existing technology is premised on starting up as a system resident on a network in advance, extracting features for a certain period of time, and using them. However, when an initial setting inquiry is performed by a remote support service or the like, it is also assumed that an inquiry is made in a short time after the device is connected. Thus, depending on the usage scene, it may be necessary to execute dictionary registration or device identification in as short a time as possible.
In such a case, in the conventional method, when the time until feature extraction is set to 15 minutes, for example, when there is a model in which features cannot be sufficiently accumulated in 15 minutes, high identification accuracy cannot be maintained. was there. If the time to feature extraction is set to 15 minutes, for example, and there is a model that completes feature accumulation within 1 minute, the remote support operator or user has a wasteful waiting time of 14 minutes. It has occurred.

  On the other hand, if the feature accumulation determination unit 180 in this embodiment determines that the feature amount of the device has been accumulated, the device identification apparatus 100 can control the “execution identification” link or the “execute” button at the time of dictionary registration. Display in the correct state. Thereby, since the user can recognize the feature accumulation status of the device connected to the home network, it is possible to reduce a wasteful waiting time for feature accumulation.

  Further, in the present embodiment, as an example, the distribution condition to the group is determined by the feature amount extracted by the active measurement unit and the feature amount extracted by the protocol feature analysis unit. Thereby, the device identification apparatus 100 can classify each device into an appropriate group. Here, since an essential item is set for each group, an essential feature amount for identifying each device is selected for each device. As a result, the feature accumulation determination unit 180 determines that the feature amount of the device has been accumulated at the time when all the feature amounts essential for identifying each device have been prepared, and permits device identification. The waiting time can be reduced.

  In addition, a monitoring end time for ending the monitoring of the feature amount is determined for each group, and the feature storage determination unit 180 determines whether the feature amount of the device is based on a comparison between the current time and the monitoring end time. It is determined whether or not it has been accumulated. Thereby, since the monitoring end time is set for each group, the monitoring end time at which a sufficient feature amount for identifying each device is stored is selected for each device. As a result, the feature accumulation determination unit 180 determines that the feature amount of the device has been accumulated at the monitoring end time when the feature amount sufficient to identify each device is accumulated, and permits device identification. Accuracy can be improved.

  When the feature accumulation determination unit 180 determines that the feature amount of the device has been accumulated, the feature accumulation determination unit 180 sets the accumulation state of the device to be completed. As a result, it becomes clear that the device identification apparatus 100 has sufficiently accumulated the characteristics of the devices connected to the home network. Therefore, the device identification apparatus 100 automatically selects and selects the devices for which feature accumulation has been completed. Device identification can be performed.

In addition, the feature accumulation determination unit 180 is configured so that the feature accumulation determination unit 180 determines that the counted number of features is larger than the number of features held by the storage unit 110 and the current time has passed the monitoring end time. Then, it is determined that the feature amount of the device has been accumulated.
As a result, when the feature amount of the device connected to the home network is increased, device identification is performed, so a large amount of feature amount can be compared between the device and the comparison model number. Identification accuracy can be realized.

In the present embodiment, the feature accumulation determination unit 180 determines that if the counted number of features is greater than the number of features held by the storage unit 110 and if the current time has passed the monitoring end time, Although it is determined that the feature amount of the device has been accumulated, the present invention is not limited to this. The feature accumulation determination unit 180 may function as a determination unit that determines that the feature amount of the device has been accumulated based on a comparison between the counted number of features and the number of features stored in the storage unit 110. Specifically, for example, the feature accumulation determining unit 180 may determine that the feature amount of the device has been accumulated when the counted number of features is larger than the number of features held by the storage unit 110. On the other hand, when the counted feature number is equal to or less than the feature number held by the storage unit 110, the feature accumulation determination unit 180 may determine that the feature amount of the device is not accumulated.
As a result, device identification is performed when the feature amount of the device connected to the home network increases, so a large number of feature amounts can be compared between the device and the comparative model number. Accuracy can be achieved.

  In addition, when the feature accumulation determination unit 180 in this embodiment determines that the feature amount of the device has been accumulated, the device identification apparatus 100 can control the “device identification” link or the “execute” button at the time of dictionary registration. Although displayed in a state, the present invention is not limited thereto, and the user may be notified that the feature amount of the device has been accumulated in some form of notification (for example, light, sound, vibration, etc.).

<Second Embodiment>
Next, the second embodiment will be described. FIG. 24 is a diagram illustrating a configuration of a device identification system 1b according to the second embodiment. The device identification system 1b includes network devices 11 to 15, a device identification device 100b, a WAN (Wide Area Network) 200, and a device information dictionary server device 300. Here, the network devices 11 to 15 are electronic devices having a communication function connected to a network. The device identification device 100b is connected to each of the network devices 11 to 15 via the LAN 16. The device identification device 100 b is connected to the device information dictionary server device 300 via the WAN 200.

  In the first embodiment, the device identification apparatus 100 performs device identification processing. The present embodiment is different in that the device information dictionary server device 300 performs device identification processing instead of the device identification device 100b.

FIG. 25 is a schematic block diagram of the device identification apparatus 100b according to the second embodiment. Elements common to those in FIG. 2 are denoted by the same reference numerals, and detailed description thereof is omitted. 25 is different from the configuration of the device identification device 100 in FIG. 2 in that the device identification unit 160 is deleted, the storage unit 110 is changed to the storage unit 110b, and the Web UI unit 170 is changed to the Web UI unit 170b. The communication unit 195 is added. In contrast to the configuration of the storage unit 110b in FIG. 25, the device information DB 112 is deleted from the configuration of the storage unit 110 in FIG.
The communication unit 195 manages the connection with the device information dictionary server device 300. Further, the communication unit 195 transmits data input from each unit to the device information dictionary server device 300. In addition, the communication unit 195 receives data transmitted from the device information dictionary server device 300.

When the device identification button displayed on the device list screen is pressed, the Web UI unit 170b extracts a feature amount having the corresponding MAC address from the feature storage table T1 of the feature storage DB 111. The Web UI unit 170b has the same function as the Web UI unit 170 of the first embodiment, but differs in the following points.
In the second embodiment, since the device identification function is in the device information dictionary server device 300, the Web UI unit 170b transmits the extracted corresponding MAC address group to the device information dictionary server device 300. Then, the Web UI unit 170b receives the device identification result from the device information dictionary server device 300 via the communication unit 195.

  In addition, when the registration button is pressed on the dictionary registration screen, the Web UI unit 170b transmits the feature group and the model information from the communication unit 195 to the device information dictionary server apparatus 300. Here, the feature group is a set of feature names and feature values. The model information is information including the category of the corresponding device, the manufacturer name, the device name, the model number, and the comment. Thereby, the device information dictionary server apparatus 300 holds the feature group transmitted from the Web UI unit 170b and the model information in association with each other.

FIG. 26 is a schematic block diagram of the device information dictionary server 300 according to the second embodiment. The device information dictionary server device 300 includes a device information DB 112, a DB access unit 150b, a device identification unit 160b, a communication unit 310, and a dictionary registration unit 320.
It is assumed that device information is stored in the device information DB 112 also by other device identification devices (not shown) installed in other houses.

The communication unit 310 receives information transmitted from the device identification apparatus 100b via the WAN 200, and outputs the received information to the DB access unit 150b.
When the feature group and model information received by the communication unit 310 are input, the dictionary registration unit 320 receives a learning ID that is different from the dictionary creation device ID for identifying the device identification device 100b and other learning IDs. It is given to information. Then, the dictionary registration unit 320 associates the dictionary creation device ID and learning ID with the model information and stores them in the model number table T2 of the device information DB 112. Further, the dictionary registration unit 320 associates the dictionary creation device ID and the learning ID with the feature group and stores them in the detailed table T3 of the device information DB 112. Thereby, the device information dictionary server apparatus 300 can specify the model information of each device with the dictionary creation device ID and the learning ID.

  The device identification unit 160b has the same function as the device identification unit 160 of the first embodiment, but differs in the following points. The device identification unit 160b identifies a device having the MAC address via the DB access unit 150b based on the MAC address group transmitted from the device identification device 100b. And the apparatus identification part 160b transmits the apparatus identification result which shows the identified apparatus to the apparatus identification apparatus 100b from the communication part 310 via DB access part 150b.

As described above, the device identification system 1b according to the second embodiment has the following effects in addition to the effects of the first embodiment. In the first embodiment, after connecting a network device in the home network and the feature amount of the network device is sufficiently accumulated, the device information of the network device has to be registered in the device information DB 112.
On the other hand, in the second embodiment, device information is accumulated in the device information DB 112 of the device information dictionary server device 300 by another device identification device (not shown) installed in another house. As a result, when the device information of a network device is registered in the device information DB 112 in advance, it is not necessary to register the device information of the network device in the device information DB 112, so that the user's trouble can be reduced. .

  In the second embodiment, the device information DB 112 of the device information dictionary server device 300 sequentially stores device information by other device identification devices (not shown) installed in other houses. Many types of feature quantities are registered for one comparative model number model. As a result, the device identification unit 160 can compare many types of feature quantities between a certain network device and a comparative model number model, thereby realizing high identification accuracy.

Note that a system including a plurality of devices is a device identification device (100, 100b) of the present embodiment.
) May be distributed and processed by the plurality of apparatuses.
Moreover, the program for performing each process of the apparatus identification apparatus (100, 100b) or the apparatus information dictionary server apparatus 300 of this embodiment is recorded on a computer-readable recording medium, and the program recorded on the recording medium May be performed by causing the computer system to read and execute the above-described various processes related to the device identification device (100, 100b) or the device information dictionary server device 300. For example, the processing of the device identification device (100, 100b) or the device information dictionary server device 300 may be operated on an OSGi (Open Services Gateway initiative) FW (framework).

  Here, the “computer system” may include an OS and hardware such as peripheral devices. Further, the “computer system” includes a homepage providing environment (or display environment) if a WWW system is used. The “computer-readable recording medium” means a flexible disk, a magneto-optical disk, a ROM, a writable nonvolatile memory such as a flash memory, a portable medium such as a CD-ROM, a hard disk built in a computer system, etc. This is a storage device.

  Further, the “computer-readable recording medium” refers to a volatile memory (for example, DRAM (Dynamic) in a computer system serving as a server or a client when a program is transmitted via a network such as the Internet or a communication line such as a telephone line. Random Access Memory)) that holds a program for a certain period of time is also included. The program may be transmitted from a computer system storing the program in a storage device or the like to another computer system via a transmission medium or by a transmission wave in the transmission medium. Here, the “transmission medium” for transmitting the program refers to a medium having a function of transmitting information, such as a network (communication network) such as the Internet or a communication line (communication line) such as a telephone line. The program may be for realizing a part of the functions described above. Furthermore, what can implement | achieve the function mentioned above in combination with the program already recorded on the computer system, what is called a difference file (difference program) may be sufficient.

  As mentioned above, although embodiment of this invention was explained in full detail with reference to drawings, the concrete structure is not restricted to this embodiment, The design etc. of the range which does not deviate from the summary of this invention are included.

1, 1b Device identification system 11, 12, 13, 14, 15 Network device (device)
16 LAN
100, 100b Device identification device 110, 110b Storage unit 111 Feature accumulation DB
112 Device information DB
113 terminal information DB
DESCRIPTION OF SYMBOLS 120 Capture part 130 Protocol feature analysis unit 131,132,133 Protocol feature analysis part 140 Active measurement unit 141,142 Active measurement part 150,150b DB access part 160 Device identification part 170 WebUI part 180 Feature accumulation determination part 190 Input part 195 Communication Department 200 WAN
300 device information dictionary server device 310 communication unit 320 dictionary registration unit

Claims (7)

A device identification device that acquires a packet from a device and identifies the device according to a feature amount represented by the packet,
A feature amount storage unit that stores in the storage unit the feature amount represented by the acquired packet;
A group classification unit that classifies the device into a group of devices having common information on the network by applying a predetermined group distribution condition to the feature amount represented by the acquired packet;
A determination unit that determines that the feature amount of the device is accumulated when a feature amount of an essential item determined in advance for specifying the group is stored in the storage unit;
An apparatus identification apparatus comprising: The packet includes a response packet transmitted from the device in response to a command transmitted from the device to the device, and a passive packet transmitted from the device to another device,
Based on the response packet, an active measurement unit that extracts a feature amount;
A protocol feature analysis unit for extracting a feature amount based on the passive packet;
With
The device identification apparatus according to claim 1, wherein the group distribution condition is determined by at least one of the feature quantity extracted by the active measurement unit or the feature quantity extracted by the protocol feature analysis unit. For each group, a monitoring end time for ending monitoring of the accumulation of the feature value is determined,
The device identification apparatus according to claim 1, wherein the determination unit determines whether or not the feature amount of the device is accumulated based on a comparison between a current time and a monitoring end time. A feature number counting unit that counts the number of feature amounts accumulated in the storage unit;
Based on a comparison between the number of features counted by the feature number counting unit at a certain time and the number of features counted by the feature number counting unit at a time before the certain time, the determining unit determines the feature amount of the device. The device identification apparatus according to any one of claims 1 to 3, wherein it is determined whether or not it has been accumulated. A device identification system that acquires a packet from a device and identifies the device according to a feature amount represented by the packet,
A feature amount storage unit that stores in the storage unit the feature amount represented by the acquired packet;
A group classification unit that classifies the device into a group of devices having common information on the network by applying a predetermined group distribution condition to the feature amount represented by the acquired packet;
A determination unit that determines that the feature amount of the device is accumulated when a feature amount of an essential item determined in advance for specifying the group is stored in the storage unit;
A device identification system comprising: A device identification method for acquiring a packet from a device and identifying the device according to a feature amount represented by the packet,
A feature amount storage unit for storing the feature amount represented by the acquired packet in a storage unit;
A procedure for classifying the device into a group of devices having common information on the network by applying a predetermined group distribution condition to the feature amount represented by the acquired packet by the group classification unit;
A procedure for determining that the feature value of the device is accumulated when the determination unit stores a feature value of an essential item determined in advance in order to identify the group;
A device identification method comprising: In a device identification device that acquires a packet from a device and identifies the device according to a feature amount represented by the packet,
A feature amount accumulating step for accumulating the feature amount represented by the acquired packet in a storage unit;
A group classification step of classifying the device into a group of devices having common information on the network by applying a predetermined group distribution condition to the feature amount represented by the acquired packet;
A determination step of determining that the feature amount of the device is accumulated when the feature amount of an essential item determined in advance for specifying the group is stored in the storage unit;
Device identification program for executing

Images