JP2013243558A - Traffic data monitoring device, traffic data monitoring method, traffic data monitoring program, and traffic database per area characteristic - Google Patents

Abstract

PROBLEM TO BE SOLVED: To improve accuracy of abnormality determination by traffic analysis.SOLUTION: A traffic data monitoring device 10 comprises: a collection function unit 11 which collects traffic information from a probe P and stores it in a traffic database 12; a traffic data classification function unit 14 per area characteristic which classifies the traffic data stored in the traffic database 12 per area characteristic on the basis of an area characteristic classification definition 15 and stores the classified traffic data in a traffic database 13 per area characteristic; and an abnormality determination function unit 16 which performs past time comparison and similar characteristic area comparison determination. The traffic data monitoring device 10 can reduce misdetections by abnormality determination by improving abnormality determination accuracy by traffic analysis by comparing traffic data of an area with traffic data of other areas having similar area characteristics.

Description

  The present invention relates to a traffic data monitoring device, a traffic data monitoring method, a traffic data monitoring program, and a traffic database for each area characteristic, and in particular, a traffic data monitoring device, a traffic data monitoring method, and traffic data for monitoring traffic data that is the amount of data flowing through a network. The present invention relates to a monitoring program and a traffic database for each area characteristic.

  By installing a probe in a network to be monitored, traffic data that is information about data flowing through the network may be acquired. The probe can acquire various types of traffic data such as the amount of data flowing in the installed network depending on the function and performance. By analyzing the traffic information acquired by this probe, it is possible to detect a network abnormality.

For example, Patent Document 1 describes an agent type information collection application that collects traffic data by an agent. Patent Document 1 describes a technique for collecting data of network elements at a predetermined time and cycle.
Here, the analysis logic for detecting a network abnormality generally includes the following.
(1) A method for determining an abnormality when a threshold value is exceeded or below a certain threshold value (hereinafter referred to as simple threshold value determination)
(2) A method of comparing with a time zone that shows a past similar tendency and determining that the difference is large (hereinafter referred to as past comparison determination).

The case of performing the simple threshold determination (1) will be described with reference to FIG. As shown in FIG. 14A, when analyzing the traffic data of the area A to be monitored, which is generated by the probe, the value of the traffic data changes with time. Then, when the value of the traffic data falls below a predetermined threshold value, it is determined that there is an abnormality.
The case where the past comparison determination of (2) is performed will be described with reference to FIG. As shown in FIG. 14B, when the traffic data value of the monitored area B changes with time, and the current traffic data changes differently from the past traffic data change trend, Judged to be abnormal.

JP 2004-274289 A

In the simple threshold determination of (1) above, erroneous detection of an abnormality occurs if the threshold cannot be set in consideration of the traffic characteristics unique to the measurement area. However, when the number of areas to be monitored becomes enormous, it is not realistic to set a threshold value for each area individually.
In the past comparison determination of (2) above, it is possible to reduce false detections by comparing with a time zone showing a past similar tendency in the same monitoring area.

  However, the traffic time trend may change significantly due to environmental changes in the area. For example, it is a case where many users come to gather in the area C where a shopping center was newly built. In such a case, the number of users in area C (hereinafter referred to as the number of visited areas) increases. In this case, as shown in FIG. 15A, since the number of service areas increases and the traffic volume increases, the current traffic data change tendency is different from the past traffic data change tendency. Accordingly, in such a case, the tendency of the traffic to change with time changes greatly, so that correct abnormality detection cannot be performed by simple threshold determination and past comparison determination, although it is normally normal.

Also, as shown in FIG. 15B, when past data does not exist (or when past data cannot be used), such as when monitoring of a new area D is started, it is abnormal although it is abnormal. Cannot be determined.
The present invention has been made to solve the above-described problems of the prior art, and its object is to improve the accuracy of abnormality determination by traffic analysis, a traffic data monitoring device, a traffic data monitoring method, and traffic data monitoring. It is to provide a traffic database for each program and area characteristics.

  A traffic data monitoring apparatus according to an aspect of the present invention classifies characteristics of traffic data, which is information related to data flowing in each of a plurality of areas constituting a network, by a value of an element that affects the traffic data of the area. A traffic data classifying unit for classifying each characteristic based on the area class definition to be defined (for example, corresponding to the area characteristic class definition 15 in FIG. 1) (for example, corresponding to the traffic data classifying function unit for each area characteristic in FIG. 1). And a traffic database for each area characteristic (for example, corresponding to the traffic database for each area characteristic 13 in FIG. 1) classified by the traffic data classification unit for each characteristic, and traffic data of the area to be monitored And traffic data for each area characteristic An extraction unit (for example, corresponding to the abnormality determination function unit 16 in FIG. 1) that extracts traffic data of another area having characteristics similar to the characteristics of the area stored in the source. Features. According to such a configuration, by comparing with traffic data of other areas having similar area characteristics, the accuracy of abnormality determination by traffic analysis can be improved, and erroneous detection of abnormality determination can be reduced.

  By comparing the traffic data of the monitoring target area extracted by the extraction unit with the traffic data of the other area extracted by the extraction unit, the traffic data of the monitoring target area is abnormal. An abnormality determination unit (for example, corresponding to the abnormality determination function unit 16 in FIG. 1) may be further included. According to such a configuration, it is possible to automatically perform abnormality determination by traffic analysis regardless of the worker.

  In addition, a traffic data acquisition unit (for example, corresponding to the collection function unit 11 in FIG. 1) that acquires traffic data that is information regarding data flowing in each of a plurality of areas constituting the network, and the traffic data acquisition unit A traffic database (for example, corresponding to the traffic database 12 of FIG. 1) for storing traffic data, and the traffic data classifying unit for the traffic data stored in the traffic database based on the area classification definition You may classify | categorize for every said characteristic. With this configuration, the apparatus can automatically collect and store traffic data and perform abnormality determination by traffic analysis.

  The abnormality determination unit compares the traffic data of the monitored area with the latest traffic data of another area having characteristics similar to the characteristics of the area, thereby detecting an abnormality in the traffic data of the monitored area. You may make it determine. By doing so, it is possible to correctly determine an abnormality in an area where many users gather, such as when a building such as a shopping center is newly built.

  In addition, when there is no past traffic data in the monitored area, the abnormality determination unit converts the traffic data of the monitored area into the past traffic of another area having characteristics similar to the characteristics of the area. By comparing with data, an abnormality in the traffic data of the monitored area may be determined. By doing so, it is possible to correctly determine the abnormality of the new monitoring target area.

  Furthermore, when there is past traffic data in the monitored area, the abnormality determination unit compares the traffic data of the monitored area with the past traffic data of the area, thereby comparing the monitoring target area. When it is determined that the traffic data of the area is abnormal, and it is determined that the traffic data is abnormal, the traffic data of the monitored area is further changed to the past traffic of other areas having characteristics similar to the characteristics of the area. By comparing with data, an abnormality in the traffic data of the monitored area may be determined. In this way, when an abnormality is detected as a result of the past comparison determination, the similar characteristic area comparison determination can be further performed, and the abnormality determination can be correctly performed for the monitoring target area.

The traffic data monitoring method according to an aspect of the present invention is configured to classify characteristics of traffic data, which is information related to data flowing in each of a plurality of areas constituting a network, by a value of an element that affects the traffic data of the area. A traffic data classification step for classifying each characteristic based on an area classification definition to be defined;
Storing the traffic data classified for each characteristic in the traffic data classification step in a traffic database for each area characteristic;
The traffic data of the monitored area is compared by comparing the traffic data of the monitored area with the traffic data of other areas having characteristics similar to the characteristics of the area stored in the traffic database for each area characteristic. An abnormality determination step for determining data abnormality;
It is characterized by including. According to such a method, by comparing with traffic data of other areas having similar area characteristics, the accuracy of abnormality determination by traffic analysis can be improved, and erroneous detection of abnormality determination can be reduced.

  A traffic data monitoring program according to an aspect of the present invention is characterized in that, for traffic data, which is information related to data flowing in each of a plurality of areas constituting a network, a computer is determined by the value of an element that affects the traffic data of the area. A traffic data classification step for classifying each characteristic on the basis of an area classification definition that defines a classification of the data; a step of storing traffic data classified for each characteristic in the traffic data classification step in a traffic database for each area characteristic; The traffic data of the monitored area is compared with the traffic data of other areas having characteristics similar to the characteristics of the area stored in the traffic database for each area characteristic. , An abnormality determination step of determining an abnormality of the traffic data, characterized in that to the execution. If such a program is executed by a computer, the accuracy of abnormality determination by traffic analysis can be improved by comparing with traffic data of other areas with similar area characteristics, and erroneous detection of abnormality determination can be reduced. .

  A traffic database according to an aspect of the present invention is a traffic database that stores traffic data that is information related to data flowing in each of a plurality of areas constituting a network, and is determined by a value of an element that affects the traffic data of the area. The traffic data classified for each of the characteristics based on the area classification definition that defines the classification of the characteristics to be stored is stored, and the traffic data of other areas having characteristics similar to the characteristics of the monitored area can be extracted It has a structure. By using such a traffic database, the accuracy of abnormality determination by traffic analysis can be improved by comparing with traffic data of other areas with similar area characteristics, and erroneous detection of abnormality determination can be reduced.

  According to the present invention, by comparing with traffic data of other areas with similar area characteristics, the accuracy of abnormality determination by traffic analysis can be improved, and erroneous detection of abnormality determination can be reduced.

It is a figure which shows the structural example of the traffic data monitoring apparatus which concerns on embodiment of this invention. It is a figure which shows the structural example of the network of the monitoring object. It is a flowchart which shows the 1st operation example of a traffic data monitoring apparatus. It is a flowchart which shows the 2nd operation example of a traffic data monitoring apparatus. It is a sequence diagram which shows an example of the data transfer between each part which comprises a traffic data monitoring apparatus. It is a sequence diagram which shows the other example of the data transfer between each part which comprises a traffic data monitoring apparatus. It is a sequence diagram which shows the other example of the data transfer between each part which comprises a traffic data monitoring apparatus. It is a figure which shows the example of the data memorize | stored in the traffic database. (A) is a figure which shows the example of the threshold value for classifying for every area characteristic, (B) is a figure which shows the example at the time of classifying each area. It is a figure which shows the example of an area characteristic classification | category definition, (A) is a figure which shows the example at the time of classifying with the communication frequency characteristic of a user in area, (B) is an example at the time of classifying with the service utilization characteristic of a user in area (C) is a figure which shows the example at the time of classifying by the number of position registration. It is a figure which shows the example of the traffic data for every area characteristic classified based on the area characteristic classification definition. (A) is a figure which shows the example when the change tendency of traffic data differs from the tendency of the past change, (B) is a figure which shows the example compared with the data of the other area where area characteristics are similar. (A) is a figure which shows the example when past data does not exist, (B) is a figure which shows the example compared with the data of the other area where area characteristics are similar. (A) is a figure which shows the example in the case of performing simple threshold value determination, (B) is a case where the change of the present traffic data differs from the tendency of the change of the past traffic data. (A) is a figure which shows the example from which the change tendency of the present traffic data differs from the tendency of the change of the past traffic data, (B) is a figure which shows an example when the past data does not exist.

Hereinafter, embodiments of the present invention will be described with reference to the drawings. In the drawings referred to in the following description, the same parts as those in the other drawings are denoted by the same reference numerals.
(Configuration example of traffic data monitoring device)
FIG. 1 is a block diagram showing a configuration example of a traffic data monitoring apparatus according to an embodiment of the present invention. Referring to the figure, the traffic data monitoring apparatus 10 according to the present embodiment acquires traffic data from the probe P. The probe P is provided in the network to be monitored as will be described later. The probe P generates traffic data that is information regarding the amount of data flowing through the monitored network.

  The traffic data monitoring apparatus 10 of this example collects traffic information from the probe P and accumulates it in the traffic database 12 and the traffic data stored in the traffic database 12 in the area characteristic classification definition 15. Based on the area characteristics, the traffic data classification function section 14 for each area characteristic for storing the classified traffic data in the traffic database 13 for each area characteristic, and the abnormality determination function section for performing past time comparison and similar characteristic area comparison determination 16. For example, the area characteristic classification definition 15 may be stored in an area characteristic classification definition storage unit (not shown).

  The traffic data classification function unit 14 for each area characteristic classifies each characteristic based on the area classification definition that defines the characteristic classification determined by the value of the element that affects the traffic data of each of the plurality of areas constituting the network. . For example, the number of areas in the area, the time fluctuation rate of the number of areas, the communication frequency characteristics of the users in the area, the number of calls for the line connection service, the number of calls for the packet connection service, the number of location registrations, etc. The traffic data classification function unit 14 for each area characteristic classifies the traffic data according to the characteristic determined by the value of the element.

  The abnormality determination function unit 16 determines the abnormality of the traffic data in the monitored area by comparing the traffic data in the monitored area with the traffic data in other areas. When determining an abnormality, even if there is a portion that does not match the values of the data, if the difference is within a predetermined value range, a process may be performed in which the abnormality is not determined.

Regarding the collection function unit 11, the traffic data classification function unit 14 for each area characteristic, and the abnormality determination function unit 16, these function units can be realized by a CPU (not shown) executing a program stored in advance.
The collection function unit 11 and the traffic database 12 may be provided outside the traffic data monitoring apparatus 10.
The traffic data that can be acquired by the probe P is transmitted to the traffic data monitoring device 10. The traffic data output from the probe P is traffic data for each area where the probe is provided.

(probe)
The position where the probe is inserted into the network to be monitored will be described with reference to FIG. FIG. 2 is a diagram illustrating a configuration example of a network to be monitored. Referring to FIG. 2, in the monitoring target network of this example, a probe P is provided at an area boundary or the like. The traffic data monitoring apparatus 10 acquires and analyzes the traffic data generated by the probe P. The area includes not only a geographical area but also a logical network area.

  The network to be monitored in this example includes a radio base station (nodeB) 21 that is a component of a 3G (3rd Generation) mobile communication network, an RNC (Radio Network Controller) 22 that controls the node B21, and an SGSN (Serving GPRS ( General Packet Radio Service (Support Node) 23, and the cover areas 21a, 22a, and 23a are realized. In this example, the probe P is provided in the cover areas 21a, 22a, and 23a, and traffic data can be acquired from the cover areas 21a, 22a, and 23a.

  In addition, the monitoring target network in this example includes a base station (eNB) 31 that is a component of a mobile communication network of LTE (Long Term Evolution), and an MME (Mobility Management Entity) 32 that is a mobile management device that accommodates the eNB 31. And S-GW (Serving-Gateway) 33 which is a packet switch, and the cover areas 31a, 32a and 33a are realized. In this example, the probe P is provided in the cover areas 31a, 32a, and 33a, and traffic data can be acquired from the cover areas 21a, 22a, and 23a.

  In this example, a 3G mobile communication network is connected to another carrier packet switch 40 via a GGSN (Gateway GPRS (General Packet Radio Service) Support Node) 24. In this example, the LTE mobile communication network is connected to another carrier packet switch 40, PDN (Public Data Network) 50, and IMS (IP Multimedia Subsystem) 60 via a P-GW (Packet Data Network-Gateway) 34. It is connected.

The other carrier packet switch 40 is, for example, an international roaming carrier or an MVNO (Mobile Virtual Network Operator) carrier (virtual mobile communication carrier), and is provided at the boundary with the other carrier packet switch 40. The traffic data of the boundary portion can be acquired by the probe P obtained.
The PDN 50 is, for example, an ISP (Internet Services Provider), an MVNO operator, or the like, and the traffic data of this boundary portion can be acquired by a probe P provided at the boundary portion with the PDN 50.

Further, the IMS 60 is connected to an exchange of an interconnection operator that is an operator mutually connected based on an interconnection contract, that is, an exchange 70 of another operator. Traffic data of this boundary portion can be acquired by the probe P provided at the boundary portion between the IMS 60 and the other operator exchange 70.
Note that a probe need not be provided as long as traffic data can be acquired from each device constituting the network.

(Operation example of traffic data monitoring device)
Next, an operation example of the traffic data monitoring apparatus will be described.
FIG. 3 is a flowchart showing a first operation example of the traffic data monitoring apparatus. In this example, only the similar characteristic area determination is performed.
In FIG. 3, the abnormality determination function unit 16 performs similar characteristic area comparison determination (step S101). If an abnormality is detected as a result of the similar characteristic area comparison determination (step S102: YES), the determination result is “abnormal”, and the processing by the traffic data monitoring apparatus ends (steps S103 and S105). On the other hand, if no abnormality is detected as a result of the determination in step S102, the determination result is “normal”, and the processing by the traffic data monitoring apparatus ends (steps S104 and S105).

FIG. 4 is a flowchart showing a second operation example of the traffic data monitoring apparatus. In this example, when there is past comparison data, past comparison determination is performed, and when an abnormality is detected, similar characteristic area determination is performed as in the first operation example.
First, the abnormality determination function unit 16 determines whether there is past comparison data (step S201). When there is past comparison data (step S201: YES), past comparison determination is performed (step S202).

  If an abnormality is detected as a result of the past comparison determination in step S202 (step S203: YES), similar characteristic area comparison determination is performed in the same manner as in step S101 of FIG. 3 (step S204). The same applies to the case where past comparison data does not exist in step S201 (step S201: NO), that is, the determination of an abnormality regarding a new monitoring target area (step S204).

If an abnormality is detected as a result of the similar characteristic area comparison determination (step S205: YES), the determination result is “abnormal”, and the processing by the traffic data monitoring apparatus ends (steps S206 and S208).
As a result of the similar characteristic area comparison determination, when no abnormality is detected (step S205: NO), the determination result is “normal”, and the processing by the traffic data monitoring apparatus is ended (step S208).
If no abnormality is detected as a result of the past comparison determination in step S202 (step S203: NO), the determination result is “normal”, and the processing by the traffic data monitoring apparatus ends (step S208).

(Internal processing example of traffic data monitoring device)
Next, an example of internal processing of the traffic data monitoring apparatus will be described.
FIG. 5 is a sequence diagram showing an example of data exchange between the respective parts constituting the traffic data monitoring apparatus. FIG. 5 is a sequence diagram showing an example of data exchange in the case of the first operation example described with reference to FIG.
In FIG. 5, the probe P is provided in the network to be monitored, and the collection function unit 11 receives the traffic data notified from the probe P, and acquires the traffic data (S11). The collection function unit 11 stores the acquired traffic data in the traffic database 12 (S12). The data acquired from the probe P is recorded in the traffic database 12 as it is.

  Next, the traffic data classification function unit 14 for each area characteristic searches the traffic data stored in the traffic database 12 for each area characteristic (S13). Then, the traffic data classification function unit 14 for each area characteristic stores the search result for each area characteristic in the traffic database 13 for each area characteristic (S14). The traffic data for each area characteristic 13 classified for each area characteristic is recorded in the traffic database for each area characteristic 13.

  When performing abnormality determination, the abnormality determination function unit 16 searches the traffic data stored in the traffic database 12 and extracts data at the latest time in the monitoring target area (S15). Next, the abnormality determination function unit 16 searches the traffic data classified for each area characteristic stored in the traffic database 13 for each area characteristic, and is nearest to another area showing characteristics similar to the monitored area. Time data is extracted (S16). Then, the abnormality determination function unit 16 compares the latest time data of the monitoring target area with the latest time data of another area showing characteristics similar to the area (S17).

  In this way, by performing comparison determination with the data at the latest time in the similar characteristic area, as in the case of FIG. 15A, the abnormality determination is correctly performed even when the number of located areas increases and the traffic amount increases. It can be carried out. In other words, even if the number of service areas increases, the amount of traffic increases, and the change tendency of the current traffic data (latest data) is different from the change tendency of the past traffic data (past data), it shows similar characteristics. Since it is compared with the data of the latest time in other areas, it is possible to correctly determine the abnormality.

Further, by performing comparison determination with data at the latest time in the similar characteristic area, it is possible to correctly perform abnormality determination even when past data does not exist as in the case of FIG. That is, since the past data that does not exist is compared with the data at the latest time in another area that exhibits similar characteristics to the monitored area, it is possible to correctly determine the abnormality.
FIG. 6 is a sequence diagram showing another example of data exchange between the units constituting the traffic data monitoring apparatus. FIG. 6 is a sequence diagram showing an example of data exchange in the case of the second operation example described with reference to FIG.

  In FIG. 6, similarly to the case of FIG. 5, the traffic data monitoring apparatus receives the traffic data notified from the probe P and stores the data acquired from the probe P in the traffic database 12 (S11, S12). Similarly to the case of FIG. 5, the traffic data stored in the traffic database 12 is searched, and the traffic data for each area characteristic classified for each area characteristic is stored in the traffic database 13 for each area characteristic (S13, S14). ).

  When performing abnormality determination, as in the case of FIG. 5, the abnormality determination function unit 16 searches the traffic data stored in the traffic database 12, and obtains the latest time data of the monitored area and the past time of the area. Are extracted (S15, S16 ′). The past time is, for example, the same time on the same day of the week before. Then, the abnormality determination function unit 16 compares the latest time data of the monitoring target area with the past time data of the area (S17 '). As described above with reference to FIG. 4, abnormality determination can be performed by first performing comparison determination with data of the past time in the same area.

By the way, when past data does not exist, such as when monitoring of a new area D is started as in the case of FIG. 15B, or because the traffic characteristics have changed in the same area as in FIG. When past data in the same area cannot be used, the traffic data monitoring apparatus performs processing as shown in FIG.
7, the traffic data monitoring apparatus receives the traffic data notified from the probe P and stores the data acquired from the probe P in the traffic database 12 (S11, S12). ). Similarly to the case of FIG. 5 and FIG. 6, the traffic data stored in the traffic database 12 is searched, and the traffic data for each area characteristic classified for each area characteristic is stored in the traffic database 13 for each area characteristic ( S13, S14).

  When performing abnormality determination, as in the case of FIGS. 5 and 6, the abnormality determination function unit 16 searches the traffic data stored in the traffic database 12, data at the latest time in the monitored area, and the area The past time data is extracted (S15, S16 '). The past time is, for example, the same time on the same day of the week before. Then, the abnormality determination function unit 16 compares the latest time data of the monitoring target area with the past time data of the area (S17 ').

  Here, when past data does not exist (or when past data cannot be used), the abnormality determination function unit 16 searches the traffic data classified by area characteristic stored in the area characteristic traffic database 13. Then, data of the latest time of another area showing characteristics similar to the monitoring target area is extracted (S16). Then, the abnormality determination function unit 16 compares the latest time data of the monitoring target area with the latest time data of another area showing characteristics similar to the area (S17).

  Thus, when past data does not exist, such as when monitoring of a new area D is started, as in the case of FIG. Even when the past data cannot be used, since it is compared with the data of the past time in other areas showing similar characteristics, the abnormality can be correctly determined.

(Example of database structure)
Next, an example of traffic data for each area characteristic obtained by classifying the traffic data stored in the traffic database 12 for each area characteristic will be described.
FIG. 8 is a diagram illustrating an example of data stored in the traffic database 12. FIG. 8 shows an example of traffic data stored in the traffic database 12 in the case where N (N is a natural number, the same applies hereinafter) areas from the area 1 to the area N are monitoring targets. In this example, for each area from area 1 to area N, times t1, t2, and t3, the number of areas in the area at each time (the number of users in the area), and other areas from that area at each time The traffic data transmitted to (or transmitted from the area to the area) is shown.

  Traffic X11 (t1),..., X1n (t1) is a value indicating traffic data in area 1 at time t1. Traffic X11 (t2),..., X1n (t2) is a value indicating traffic data in area 1 at time t2. Traffic X11 (t3),..., X1n (t3) is a value indicating the traffic data in area 1 at time t3.

The traffic data is, for example, a data amount by a packet transmitted from one area to another area. For example, “traffic X12 (t1)” is a data amount of a packet transmitted from area 1 to area 2 at time t1. Further, “traffic X11 (t1)” is a data amount by a packet transmitted to the same area 1 in the area 1 at the time t1.
The traffic data shown is only an example. The traffic data to be processed in the traffic data monitoring apparatus of this example is traffic data acquired by a probe. In other words, what kind of traffic data is to be processed by this apparatus depends on the function and performance of the probe.

(Example of traffic data classification)
FIG. 9 is a diagram illustrating an example of traffic data for each area characteristic obtained by classifying data stored in the traffic database 12 for each area characteristic. First, in this example, as shown in FIG. 9A, the classification based on the number of locations and the classification based on the magnitude of the time variation rate are performed. For the classification in this example, a predetermined threshold is used as follows.
In this example, for the number of located areas, when the total number of located areas at times t1, t2, and t3 is greater than “100”, it is defined as “large number of located areas”, and the existing areas at times t1, t2, and t3. When the total number of service areas is “100” or less, the classification is made so that “the number of service areas is small”.

In this example, regarding the time variation rate, when the time variation rate is greater than “10”, the time variation rate is “large”, and when the time variation rate is “10” or less, the “time variation rate is small”. Perform classification. In this example, the time variation rate is a value obtained by dividing the maximum value of the number of areas out of the number of areas at times t1, t2, and t3 by the minimum value of the number of areas.
The threshold for classification as described above is set to an appropriate value reflecting the result of operating the apparatus.

  FIG. 9B shows an example in which each area of FIG. 8 is classified according to the threshold shown in FIG. In the example of FIG. 9B, area 1 and area 2 have a large number of areas in service and a large time fluctuation. Area 3 and area 4 have a small number of locations and a large time variation. Area 5 and area 6 have a small number of areas and a small time variation. Area 7 and area N have a large number of locations and a small time variation.

(Example of area characteristic classification definition)
FIG. 10 is a diagram illustrating an example of area characteristic classification definition.
When the number of in-service areas and the number of users in communication can be acquired by the probe, the area may be classified according to the communication frequency characteristics of the in-service users as shown in FIG. That is, out of the number of areas (the number of users in the area), the number of users in communication is an element that affects the traffic data of the area. You may classify. For example, the areas may be classified using a value obtained by dividing the total number of users in communication at each of times t1, t2, and t3 by the total value of the number of users at each of times t1, t2, and t3 as a threshold value.

  Further, when the number of CS calls and the number of PS calls can be acquired by the probe, the area may be classified according to the service usage characteristics of the in-zone users as shown in FIG. In other words, services available to users in the area include a circuit connection service (CS; Circuit Switchng) and a packet connection service (PS; Packet Switchng), which are factors that affect the traffic data of the area. is there. For this reason, the areas may be classified according to the number of CS calls and the number of PS calls. For example, the number of CS calls is obtained by dividing the total number of CS calls at each of times t1, t2, and t3 by the sum of the total number of CS calls and the total number of PS calls at each of times t1, t2, and t3. The value obtained by dividing the total number of PS calls at each of times t1, t2, and t3 by the sum of the total number of CS calls and the total number of PS calls at each of times t1, t2, and t3 is PS. The area may be classified using the ratio of the number of calls and the number of CS calls and the number of PS calls as threshold values.

  When the number of position registrations can be acquired by a probe, an area where the number of position registrations exceeds a certain value at an area boundary or the like may be classified as shown in FIG. That is, since the number of mobile terminals that perform location registration increases at the boundary between areas, the number of location registrations is an element that affects the traffic data of the area. For this reason, the areas may be classified according to the number of registered positions. For example, the areas may be classified using the minimum number of registered positions among the number of registered positions at times t1, t2, and t3 as threshold values.

(Example of classified area-specific traffic data)
FIG. 11 is a diagram illustrating an example of traffic data for each area characteristic classified based on the area characteristic classification definition. In this example, the number of locations and time variation are used as area characteristics, and traffic data is classified based on the area characteristics. In this example, the average values of the traffic data at times t1, t2, and t3 are classified according to area characteristics.

  The traffic data for each area characteristic classified as described above is used when determining an abnormality in the monitoring target area as described above. For example, when an abnormality is determined for the area M to be monitored (M is a natural number and M ≦ N), it is as follows. In this example, the number of locations and time variation are used as area characteristics, and the traffic data for each area characteristic is classified according to the area characteristics. For this reason, the characteristics of the area M are determined in the same manner based on the number of locations and the time variation. In this example, the characteristics of the area M are “small” in the number of service areas and “small” in the time variation. When a traffic database for each area characteristic is searched using this area characteristic as a search condition, traffic data in a thick frame portion in the figure is extracted as a comparison target in the classified traffic data for each area characteristic in this example. By comparing the extracted traffic data of the thick frame portion with the traffic data of the area M to be monitored, a similar characteristic area comparison can be realized.

The above is only an example, and the area characteristics of the traffic data of the area to be monitored may be determined based on the area characteristics used when the traffic database for each area characteristic is constructed. Then, the area characteristics of the area to be monitored is determined, the traffic data having the area characteristics is extracted from the traffic database for each area characteristic, and compared with the traffic data of the area to be monitored, a similar characteristic area comparison is realized. it can.
As described above, when there is no data for past comparison by comparing the monitored area with another area having similar characteristics, it is possible to perform abnormality determination. Further, it is possible to prevent erroneous detection of abnormality determination when the traffic time tendency changes by comparing the monitored area with another area having similar characteristics.

(Example of comparison of similar characteristic areas)
FIG. 12A shows a case where many users are gathered in an area C where a building such as a shopping center is newly constructed, as in the case of FIG. 15A. In such a case, since the number of located areas increases and the traffic volume increases, the change tendency of the current traffic data (most recent data) is different from the change tendency of the past traffic data (past data). In this case, as shown in FIG. 12B, the latest data of area C is compared with the traffic data of other area C ′ having similar area characteristics (traffic data acquired by other probes). By doing this, it can be seen that the change in the traffic data is the same behavior, and it can be determined that it is normal.

  That is, when past comparison data exists, the comparison is first made with the data (step S202 in FIG. 4), and if it deviates from the threshold, it is compared with a similar characteristic area as an abnormal candidate (FIG. 4). Step S203: YES, S204). Thus, by determining in two steps, it can prevent erroneously determining that it is abnormal.

  FIG. 13A shows a case where past data does not exist (or past data cannot be used), such as when monitoring of a new area D is started, as in the case of FIG. 15B. In such a case, since there is no past data to compare for the same area, it cannot be determined that the latest data is abnormal although the latest data is abnormal. In this case, as shown in FIG. 13B, the latest data of the area D is compared with traffic data of another area D ′ having similar area characteristics (traffic data of other areas acquired by other probes). . By doing this, it can be seen that the change tendency of the traffic data is different, and it can be determined that it is abnormal.

In any case, when comparing the traffic data, the average value of the traffic data may be calculated and the average values may be compared, or the slope of the straight line of the traffic data change may be calculated to obtain the value of the slope. You may compare each other.
In addition, instead of comparing the traffic data with each other and determining the abnormality by the abnormality determination function unit 16, the traffic data may be extracted and the comparison between the data and the abnormality determination may be performed by an operator. In this case, the traffic data of the monitored area and the traffic data of other areas having characteristics similar to the characteristics of the area stored in the traffic database 13 for each area characteristic are extracted and displayed on the monitor screen or the like. To do. And about the traffic data currently displayed, an operator may perform comparison of data and abnormality determination by visual observation, for example.

(Traffic data monitoring method)
In the traffic data monitoring apparatus described above, the following traffic data monitoring method is realized. That is, for the traffic data that is information related to data flowing in each of a plurality of areas constituting the network, the characteristics based on the area classification definition that defines the classification of characteristics determined by the values of elements that affect the traffic data of the area A traffic data classification step for classifying each of the traffic data, a step of storing the traffic data classified for each of the characteristics in the traffic data classification step in a traffic database for each area characteristic, and traffic data of an area to be monitored for the area characteristics An abnormality determination step for determining an abnormality in the traffic data of the monitored area by comparing with the traffic data of another area having characteristics similar to the characteristics of the area stored in each traffic database; Including Traffic data monitoring method is implemented. According to such a method, by comparing with traffic data of other areas having similar area characteristics, the accuracy of abnormality determination by traffic analysis can be improved, and erroneous detection of abnormality determination can be reduced.

(Traffic data monitoring program)
In the traffic data monitoring apparatus described above, the following traffic data monitoring program is used. That is, based on the area classification definition that defines the classification of characteristics determined by the values of elements that affect the traffic data of the area for traffic data that is information related to data flowing in each of a plurality of areas constituting the network. A traffic data classification step for classifying each characteristic, a step for storing the traffic data classified for each characteristic in the traffic data classification step in a traffic database for each area characteristic, and traffic data for the area to be monitored. An abnormality determination for determining an abnormality in the traffic data of the monitored area by comparing with the traffic data of another area having characteristics similar to the characteristics of the area stored in the traffic database for each area characteristic Traffic data monitoring program to be executed and step, a is used. If such a program is executed by a computer, the accuracy of abnormality determination by traffic analysis can be improved by comparing with traffic data of other areas with similar area characteristics, and erroneous detection of abnormality determination can be reduced. .

(Traffic database for each area characteristic)
In the traffic data monitoring apparatus described above, the following traffic database 13 for each area characteristic is used. That is, a traffic database that stores traffic data that is information relating to data that flows in each of a plurality of areas that constitute a network, and that defines a classification of characteristics determined by values of elements that affect the traffic data of the area The traffic data classified according to the characteristics based on the classification definition is stored, and the traffic data of other areas having characteristics similar to the characteristics of the monitored area can be extracted. A traffic database 13 for each area characteristic is used. By using such a traffic database, the accuracy of abnormality determination by traffic analysis can be improved by comparing with traffic data of other areas with similar area characteristics, and erroneous detection of abnormality determination can be reduced.

(Summary)
As described above, according to the present invention, erroneous detection of abnormality determination can be reduced by comparing with measurement results of other areas (separate probes) having similar area characteristics by the following procedure. That is, first, the areas having the same tendency are grouped (ie, classified) based on the traffic information such as the number of users in communication and the number of visited areas. Then, an average value, an inclination, etc. in an area showing the same tendency are calculated and compared with the traffic information measured in the area. If the same tendency is not shown, it is judged as abnormal. Thus, by comparing with traffic data of other areas with similar area characteristics, the accuracy of abnormality determination by traffic analysis can be improved, and erroneous detection of abnormality determination can be reduced.

  It should be noted that the scope of the present invention is not limited to the illustrated and described exemplary embodiments, but includes all embodiments that provide the same effects as those intended by the present invention. Furthermore, the scope of the invention is not limited to the combinations of features of the invention defined by the claims, but can be defined by any desired combination of particular features among all the disclosed features.

DESCRIPTION OF SYMBOLS 10 Traffic data monitoring apparatus 11 Collection function part 12 Traffic database 13 Traffic database for every area characteristic 14 Traffic data classification function part for every area characteristic 15 Area characteristic classification definition 16 Abnormality judgment function part P Probe

Claims (9)

For traffic data, which is information related to data flowing in each of a plurality of areas constituting a network, for each of the characteristics based on an area classification definition that defines a classification of characteristics determined by values of elements that affect the traffic data of the area A traffic data classification unit for classification;
A traffic database for each area characteristic that stores traffic data classified by the traffic data classification unit for each characteristic;
An extraction unit that extracts the traffic data of the area to be monitored and the traffic data of another area having characteristics similar to the characteristics of the area stored in the traffic database for each area characteristic;
A traffic data monitoring apparatus comprising: In claim 1,
By comparing the traffic data of the monitoring target area extracted by the extraction unit with the traffic data of the other area extracted by the extraction unit, the traffic data of the monitoring target area is abnormal. A traffic data monitoring apparatus further comprising an abnormality determination unit for determining In claim 1 or 2,
A traffic data acquisition unit that acquires traffic data that is information about data flowing in each of a plurality of areas constituting the network; and a traffic database that stores the traffic data acquired by the traffic data acquisition unit,
The traffic data classifying unit classifies the traffic data stored in the traffic database for each of the characteristics based on the area classification definition. In any one of Claim 1 to Claim 3,
The abnormality determination unit compares the traffic data of the monitored area with the latest traffic data of another area having characteristics similar to the characteristics of the area, thereby detecting an abnormality in the traffic data of the monitored area. A traffic data monitoring apparatus characterized by determining. In any one of Claim 1 to Claim 3,
When there is no past traffic data in the monitored area, the abnormality determination unit is configured to change the traffic data of the monitored area to past traffic data of another area having characteristics similar to the characteristics of the area. A traffic data monitoring apparatus characterized by determining an abnormality in traffic data in the monitored area by comparing. In any one of Claim 1 to Claim 3,
When there is past traffic data in the monitoring target area, the abnormality determination unit compares the traffic data of the monitored target area with the past traffic data of the area, thereby comparing the monitoring target area. When it is determined that the traffic data is abnormal, and it is determined that the traffic data is abnormal, the traffic data of the monitored area is further compared with the past traffic data of other areas having characteristics similar to the characteristics of the area. A traffic data monitoring apparatus characterized by determining an abnormality in traffic data in the monitored area by comparing. For traffic data, which is information related to data flowing in each of a plurality of areas constituting a network, for each of the characteristics based on an area classification definition that defines a classification of characteristics determined by values of elements that affect the traffic data of the area A traffic data classification step to classify,
Storing the traffic data classified for each characteristic in the traffic data classifying unit step in a traffic database for each area characteristic;
The traffic data of the monitored area is compared by comparing the traffic data of the monitored area with the traffic data of other areas having characteristics similar to the characteristics of the area stored in the traffic database for each area characteristic. An abnormality determination step for determining data abnormality;
A traffic data monitoring method comprising: On the computer,
For traffic data, which is information related to data flowing in each of a plurality of areas constituting a network, for each of the characteristics based on an area classification definition that defines a classification of characteristics determined by values of elements that affect the traffic data of the area A traffic data classification step to classify,
Storing the traffic data classified for each characteristic in the traffic data classification step in a traffic database for each area characteristic;
The traffic data of the monitored area is compared by comparing the traffic data of the monitored area with the traffic data of other areas having characteristics similar to the characteristics of the area stored in the traffic database for each area characteristic. An abnormality determination step for determining data abnormality;
A traffic data monitoring program characterized in that A traffic database that stores traffic data that is information about data flowing in each of a plurality of areas constituting a network,
Storing traffic data classified for each of the characteristics based on an area classification definition that defines a classification of characteristics determined by the values of elements that affect the traffic data of the area;
A traffic database for each area characteristic having a structure capable of extracting traffic data of another area having characteristics similar to the characteristics of the monitored area.

Images