JP2013247417A - Method for detecting change in communication device use condition and communication system - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a radio base station and a network monitoring device which can detect a doubt about robbery even in cases where the location of a radio base station always changes such as for an on-vehicle type installed in an electric train.SOLUTION: A radio base station 12 accumulates information on radio terminals 13 which performed communication with the radio base station 12 and also transmits accumulated information on the radio terminals 13 to a network monitoring device 11. The network monitoring device 11 makes analysis on the basis of the number of radio terminals which communicated with the radio base station 12 in a designated period, the number of times information on each radio terminal 13 was collected, and a percentage in the sum total thereof occupied by the number of times information on the radio terminals 13 was collected, thereby detecting a change in the state of how the radio base station 12 is used. When it is determined as a result of detection that the radio base station 12 which had been used by an unspecified large number of radio terminals 13 became to be used by an unspecified small number of radio terminals 13, a doubt about robbery of the radio base station 12 is reported to the administrator of the network.

Description

  The present invention relates to a method and a communication system for detecting a change in usage status of a communication device.

  Small wireless communication devices, such as small wireless base stations, can be installed anywhere. So far, such as places where wiring is difficult, such as mountainous areas, and places where radio waves are difficult to reach locally. It can be installed in places where communication services are not available due to geographical reasons. Moreover, it is sufficient to install as many as necessary for the communication service required in the area, and wasteful costs can be suppressed.

  Such a small wireless communication device is maintained and monitored from a remote place by a network monitoring device connected by wire or wirelessly. For example, registering a wireless communication device connected to the network, changing or deleting configuration information, or raising an alarm when an abnormality is detected in the wireless communication device, and displaying the alarm on a maintenance terminal connected to the network monitoring device In some cases, the network maintainer is notified of the abnormality.

  As a network monitoring system for monitoring a wireless communication device, Patent Document 1 provides a means for grasping the current position by providing a GPS (Global Positioning System) to the wireless communication device, and provides power supply and a wired line in a normal state. It is described that when the connection state is interrupted, the current position is compared with the installation position using the internal battery, and if it is moved, it is determined that the theft is detected and an alarm is sent to the network monitoring device. Yes.

JP 2006-279854 A

  In Patent Document 1, on the assumption that the GPS is mounted on the wireless communication device, a change in the usage state of the wireless communication device is detected by calculating position information by the GPS.

  However, when the position of the wireless communication device always changes, such as a wireless communication device not equipped with GPS or an in-vehicle type installed on a train, the detection means described in Patent Document 1 can be used. Absent.

  Therefore, the present invention provides a method and a communication system for detecting a change in the usage state of a wireless communication device without using hardware additional components even in a small wireless communication device having no position detection means such as GPS. Is to provide.

  In order to solve the above-described problem, the present invention provides a storage unit that associates and holds identification information for identifying a plurality of communication devices and the number of connections with a relay device to which the plurality of communication devices are connected. The total number of identification information is calculated based on the identification information, the total number of connections is calculated based on the number of connections, and the first sum of the number of connections is calculated based on the number of connections less than the first predetermined value among the number of connections. A first ratio of the first sum to the sum is calculated based on the sum and the first sum, and the relay apparatus performs communication based on the total number of identification information and the first ratio. A communication monitoring device, comprising: a processing unit that determines an environment used by the device.

  According to the present invention, even in a small wireless communication device having no position detection means such as GPS, when the usage of the communication device changes, the change in the usage can be detected. It becomes possible.

It is a system configuration diagram. It is a functional block diagram of a network monitoring apparatus. It is a hardware block diagram of a network monitoring apparatus. It is a functional block diagram of a radio base station. It is a hardware block diagram of a radio base station. It is a wireless terminal access information management table. It is a flowchart of a radio | wireless terminal access information collection process. It is a flowchart of a wireless terminal access information transmission process. It is a terminal access information management table. It is a flowchart of an access information collection process. It is a radio base station management table. It is a flowchart of a theft analysis process. It is an access information history management table. It is a flowchart of the update process of an access information history management table. It is a theft analysis table. It is a flowchart of a theft determination process. It is a sequence diagram which shows the flow of a theft detection. It is the flowchart which showed the process which detects the change of a usage condition. It is the flowchart which showed the determination process whether to implement a theft determination.

  Hereinafter, examples will be described with reference to the drawings. A small-sized network that can be used by an unspecified number of people regardless of time and place, has a network such as the Internet or wireless as a backhaul, and can be used by an unspecified number of wireless terminals regardless of installation location. The embodiment will be described using a radio base station as an example. Also, in this embodiment, description will be given of detecting a suspicion of the theft of a radio base station by determining the usage status of the radio base station and detecting a change in the usage status.

  FIG. 1 is a system configuration diagram of this embodiment. The network monitoring device 11 has a wired connection 16 to the communication network 14, the wireless base station 12 has a wireless connection 17 or a wired connection 18 to the communication network 14, and the network monitoring device 11 remotely connects the wireless base station 12 through the communication network 14. Monitor. Further, the communication network 14 is connected to the Internet network 15, and the wireless terminal 13 is connected to the wireless base station 12 by wireless communication 19, and receives a service from the Internet network 15 beyond that. The radio base station 12 relays communication between the radio terminal 13 and the Internet network 15 via the communication network 14.

  The wireless base station 12 may have various installation forms such as an outdoor type installed in a station platform, an indoor type installed in a store, and a vehicle-mounted type installed in a train or bus. Therefore, the wireless base station 12 may be an in-home micro base station device or a wireless LAN device.

  FIG. 2 shows a functional block diagram of the network monitoring device 11. The network monitoring device 11 includes a transmission / reception unit 40, an access information collection processing unit 41, a theft analysis processing unit 42, and a storage unit 48. The transmission / reception unit 40 transmits / receives signals to / from a lower-level device. The theft analysis processing unit 42 includes a wireless terminal identification information total number comparison processing unit 45, an appearance count total comparison processing unit 46, a use environment determination processing unit 47, an access information history management table update processing unit 43, and a theft determination processing unit 44. It is.

  The storage unit 48 includes a wireless terminal access information management table T200, a wireless base station management table T300, an access information history management table T400, and a theft analysis table T500. The network monitoring apparatus 11 stores management target radio base station information in the radio base station management table T300. Details will be described with reference to FIG. Information transmitted from the wireless base station 12 by the processing of the wireless terminal access information transmission processing unit 32 is collected by the access information collection processing unit 41 and stored in the wireless terminal access information management table T200.

  Based on the management target radio base station information stored in the radio base station management table T300, the network monitoring apparatus 11 periodically executes the theft analysis processing by the theft analysis processing unit 42. Within this processing, the wireless terminal identification information total number comparison processing unit 45, the total number of appearances comparison processing unit 46, the usage environment determination processing unit 47, the access information history management table update processing unit 43, the theft determination processing unit 44, the wireless terminal access information The theft analysis is performed using the management table T200, the radio base station management table T300, the access information history management table T400, and the theft analysis table T500. Details will be described later.

  FIG. 3 is a hardware block diagram of the network monitoring device 11. It has the same hardware configuration as a general information processing apparatus such as a personal computer or a workstation. The network monitoring device 11 includes a central processing unit (CPU) 21, a main storage device (main memory) 26, an input / output unit 23, an auxiliary storage device 27, and the like interconnected by an internal transmission path 28. The The input / output unit 23 includes a network card (NIC: Network Interface Card) 22 connected to the communication network 14 via a cable, an input unit 44 connected to a keyboard and a mouse, and an output unit 25 connected to a monitor. And implements each functional block of FIG. Information such as a program and a table for realizing each function of the network monitoring device 11 can be stored in the main storage device 26 or the auxiliary storage device 27. The central processing unit (CPU) 21 loads a program for realizing each function stored in the auxiliary storage device 27 onto the main storage device (main memory) 26, and executes the loaded program.

  FIG. 4 shows a functional block diagram of the radio base station 12. The radio base station 12 includes a transmission / reception unit 30, a radio terminal access information collection processing unit 31, a radio terminal access information transmission processing unit 32, and a storage unit 33. The transmission / reception unit 30 transmits / receives signals to / from the lower apparatus and the upper apparatus. In addition, you may divide into the transmission / reception part which transmits / receives a signal with a low-order apparatus, and the transmission / reception part which transmits / receives a signal with a high-order apparatus.

  The storage unit 33 includes a wireless terminal access information management table T100. The radio base station 12 periodically executes access information periodic collection processing, which will be described later, in the radio terminal access information collection processing unit 31, acquires information on the radio terminal 13 that is accessing the radio base station 12, and obtains radio terminal access information ( Hereinafter, it may be simply referred to as access information) and stored in the wireless terminal access information management table T100.

  Here, the accessing wireless terminal means that the wireless base station 12 receives the radio wave of the wireless terminal 13 and recognizes that the wireless terminal is in the area of the wireless base station. The access information includes the number of wireless terminals 13 accessing the wireless base station 12, identification information of the wireless terminals 13, access frequency (access time) of the wireless terminals 13, and the number of appearances of the wireless terminals 13 (number of connections). Say. The collected information is periodically transmitted to the network monitoring device 11 by the wireless terminal access information transmission processing unit 32.

  FIG. 5 is a hardware block diagram of the radio base station 12. The wireless base station 12 includes a central processing unit (CPU) 51, a main storage device (main memory) 55, an auxiliary storage device 56, a wired communication unit 52, a wireless communication unit 53, an internal battery, which are interconnected by an internal transmission path 57. 54 or the like. The wired communication unit 52 is connected to and monitored by the network monitoring device 11 via the communication network 14 via a cable. The wireless communication unit 53 transmits and receives wireless radio waves and connects to a wireless terminal. In some cases, not the wired communication unit 52 but the wireless communication unit 53 may connect to the communication network 14 and connect to the network monitoring device 11. Information such as a program and a table for realizing each function of the radio base station 12 can be stored in the main storage device 55 or the auxiliary storage device 56. The central processing unit (CPU) 51 loads a program for realizing each function stored in the auxiliary storage device 56 onto the main storage device (main memory) 55 and executes the loaded program.

  FIG. 6 is a wireless terminal access information management table T100. This table includes wireless terminal identification information T101 such as a mobile device identification number (MEID: Mobile Equipment IDentifiers) and the number of appearances T102. The wireless terminal identification information T101 is identification information for identifying the wireless terminal 13 that is accessing the wireless base station 12. The appearance count T102 represents the frequency with which the wireless base station 12 is used by the wireless terminal 13, and the larger the numerical value, the more frequently the wireless terminal 13 is used, that is, the longer it is used. Represent. Naturally, the wireless terminal identification information T101 is not limited to the portable device identification number (MEID), but may be information identifying the wireless terminal 13.

  FIG. 7 shows a flowchart of a wireless terminal access information collection process (S100), which is a periodic collection process of access information by the wireless terminal access information collection processor 31 of the wireless base station 12. In this process, for example, the identification information of the wireless terminal 13 that the wireless base station 12 is accessing with itself is periodically collected (S102), and the wireless terminal identification information in the wireless terminal access information management table T100 is collected. Data is stored in T101. If the collected access information has already been stored in the wireless terminal access information management table T100 (YES in S103), 1 is added to the appearance count T102 of the wireless terminal 13 (S104). If not stored (NO in S103), the identification information of the wireless terminal 13 is newly stored in the wireless terminal identification information T101, and the appearance count T102 is set to 1 (S105).

  FIG. 8 illustrates a wireless terminal access information transmission process (process for transmitting wireless terminal access information collected by the wireless base station 12 to the network monitoring apparatus 11 by the wireless terminal access information transmission processing unit 32 of the wireless base station 12. It is a flowchart explaining S200). In accordance with this process, the radio base station 12 collects the stored radio terminal access information from the network monitoring apparatus 11 periodically, for example, every three hours, according to the radio terminal access information collection process (S100) described in FIG. Transmit (S202), and after transmission, the information stored in the wireless terminal access information management table T100 is cleared (S203).

  FIG. 9 is a wireless terminal access information management table T200. This table is held for each radio base station 13 managed by the network monitoring apparatus 11. This table includes wireless terminal identification information T201 and appearance count T202. The wireless terminal access information obtained by the wireless terminal access information transmission process (S200) is registered in this table by the access information collection process described below.

  FIG. 10 is a flowchart of the access information collection processing (S300) by the access information collection processing unit 41 of the network monitoring device 11. When the access information stored in the wireless terminal access information management table T100 transmitted by the wireless terminal access information transmission process (S200) is received (S302), the access stored in the received wireless terminal access information management table T100. If the wireless terminal identification information T101 contained in the received access information matches the wireless terminal identification information T201 already registered in the wireless terminal access information management table T200 (YES in S304), the information is referred to (S303). The appearance count T102 stored in the wireless terminal access information management table T100 is added to the appearance count T202 stored in the wireless terminal access information management table T200 (S305). Wireless terminal identification information T102 and its appearance times The number T102 is newly stored in the wireless terminal identification information T201 and the appearance count T202 in the wireless terminal access information management table T200 (S306).

  FIG. 11 is a radio base station management table. This table is composed of radio base station identification information T301, which is identification information for identifying the radio base station 12 to be managed by the network monitoring apparatus 11, its usage environment T302, and usage status determination T303. The usage environment field T302 stores information about the environment in which the wireless base station is used. Undecided indicating undefined is included as an initial state. In the usage environment T302, public is stored when it is determined that the environment is used by an unspecified number of wireless terminals 13 by processing to be described later, and private is stored when it is determined that it is not. The usage status determination T303 stores information for determining whether to execute an update process (S4016) of the access information history management table T400 (described later) (active) or not (negative). In the wireless base station 12 that is determined that the usage environment T302 is public, that is, once used by an unspecified number of wireless terminals 13, the usage status changes at a certain point in time, that is, the private usage method, that is, an unspecified number of When it is determined that the wireless terminal 13 is being used, the access information history management table T400 is updated to information (active) for which it is suspected that the specific number of wireless terminals 13 are biased.

  FIG. 12 is a flowchart showing a theft analysis process (S400) for each radio base station 12 by the theft analysis processing unit 42 of the network monitoring device 11. This process is executed periodically (for example, every day) to detect the wireless base station 12 that is suspected of being stolen. In this embodiment, the wireless base station 12 that is assumed to have been used by an unspecified number of wireless terminals 13 changes suddenly at a certain point in time, that is, is used by an unspecified number of wireless terminals 13. Detect suspicion of becoming. Further, when such a situation continues for a certain period or longer, the network administrator (maintenance person) is notified that the radio base station 12 is suspected of being stolen.

  When the wireless base station 12 that is supposed to be used by an unspecified number of wireless terminals 13 detects a suspicion that the wireless base station 12 is used by an unspecified number of wireless terminals 13, the detection is made to the network administrator. You may be notified. Here, the unspecified majority means a state in which the wireless terminal 13 is used by a large number of wireless terminals 13 and is not used biased to a specific wireless terminal 13.

  The theft analysis processing unit 42 of the network monitoring device 11 selects one of the monitored wireless base stations 12 as a theft analysis processing target (S402), and identifies the wireless base station 12 of the wireless base station 12 in the wireless base station management table T300. The usage status determination T303 corresponding to the information T301 is confirmed.

  If the usage status determination T303 is negative (YES in S403), the wireless terminal identification information total number comparison processing unit 45 is stored in the wireless terminal access information management table T200 of the wireless base station 12 at the time of the current theft analysis processing. The total number that is the number of the wireless terminal identification information T201 is calculated (S404), and it is compared whether the total exceeds a threshold value (for example, 1000) (S405).

  As a result of comparison, when a certain threshold value (for example, 1000) is exceeded (YES in S405), that is, when it is determined that the wireless base station 12 is used by many wireless terminals 13, the total number of appearances The comparison processing unit 46 calculates the sum of the number of appearances T202 (the total number of appearances) and the sum of the number of appearances T202 less than a certain threshold N (for example, 5) (sum of the number of appearances) (S4061). , A comparison is made as to whether the sum of the number of appearances less than N exceeds a certain threshold (for example, 50%) in the total number of appearances (S4062).

  As a result of comparison, when a certain threshold value (for example, 50%) is exceeded (YES in S4062), that is, when it is determined that the wireless base station 12 is used by an unspecified wireless terminal 13, The use environment determination processing unit 47 determines that the radio base station 12 is a public radio base station 12 used by an unspecified number of radio terminals 13, and changes to public if the use environment T302 is undecided (YES in S407). If it is private (NO in S407, YES in S409), it is changed to undecided because there is a possibility that it is used by an unspecified number of wireless terminals 13 (S4012). If there is (NO in S409), it is not changed as it is.

  After execution of the use environment determination processing unit 47, the theft analysis processing unit 42 of the network monitoring device 11 clears the wireless terminal access information management table T200 (S4015). As a result of the comparison by the wireless terminal identification information total number comparison processing unit 45, when the total number of the wireless terminal identification information T201 is equal to or less than the threshold value (NO in S405), or as a result of comparison by the appearance frequency total comparison processing unit 46, N If the sum of the number of appearances less than the ratio of the total number of appearances is equal to or less than a certain threshold (NO in S4062), the usage environment determination processing unit 47 is a private type that is not used by an unspecified number of wireless terminals 13. If it is determined that the wireless base station 12 is used and the usage environment T302 is undecided (YES in S408), it is changed to private (S4013), and if it is private (NO in S408, YES in S4010), it is changed as it is. do not do.

  When the usage environment T302 is public (NO in S4010), the usage environment determination processing unit 47 allows the radio base station 12 that has been used by an unspecified number of radio terminals 13 to be used privately. In other words, the usage status determination T303 is set to active because there is a suspicion of being used by an unspecified number of wireless terminals 13 (S4014).

  When the usage status determination T303 is set to active in S4014, the access information history management table update processing unit 43 of the network monitoring device 11 performs an update process of the access information history management table T400 (S500). When the above process ends for all the radio base stations managed by the radio base station identification information T301 in the radio base station management table T300 (YES in S4017), the theft analysis process (S400) ends (S4018). .

  In addition, when the usage state determination T303 is set to active in S4014, the wireless base station 12 that has been used for an unspecified number of wireless terminals 13 is used for an unspecified number of wireless terminals 13 The network administrator may be notified that this suspicion has been detected. In addition, each threshold value may hold | maintain the same value with respect to each wireless base station 12, even if the network monitoring apparatus 11 hold | maintains a different value for every wireless base station 12. FIG. In the above example, the usage environment determination processing unit 47 determines whether the usage environment T302 of the wireless base station 12 is public or private in the theft analysis process (S400). It is also possible to set a value set in advance for the radio base station 12 by the network administrator.

  FIG. 13 is an access information history management table T400. This table is held for each radio base station 12 to be managed by the network monitoring apparatus 11, and in the above-described theft analysis process (S400), the radio base station management table T300 in which the usage status determination T303 is active. This table is created for the base station 12. Appearance count total history (T401 to T407), which is history information of the summation of appearance count T202, and the average sum of appearance count T202 per theft analysis process calculated from each occurrence count summation history (T401 to T407) Value, which is the total number of appearance times average value (T408). In this embodiment, the theft analysis process (S400) is performed every day, and history information for the past one week is held. The history information represents the degree of use of each radio base station 12.

  FIG. 14 is a flowchart of the update processing (S500) of the access information history management table T400 by the access information history management table update processing unit 43 of the network monitoring apparatus 11. When there is a suspicion that the wireless base station 12 that has been used for an unspecified number of wireless terminals 13 in the past is used by an unspecified number of wireless terminals 13, is it temporary? In order to determine whether it is a long-term one, it collects data on usage status for a certain period (for example, one week), and determines whether or not it has been used by an unspecified number of wireless terminals 13. When it is determined that the wireless base station 12 is used by an unspecified number of wireless terminals 13, the wireless terminal 13 using the wireless base station 12 is specified, and the wireless base station 12 is used by the specified small number of wireless terminals 13. The theft determination process (S600) (described later) for increasing the determination accuracy of the state to be detected is performed.

  Delete the data of 7 days ago (T401), which is the oldest information in the total number of appearances history, store the data of T402 6 days ago in the field of T401 7 days ago, and execute the data one day before T407 by sequentially executing The number of appearances T202 stored in the terminal access information management table (T200) of the wireless base station 12 to be used for the theft analysis process (S400) used in the current theft analysis process (S400). Is calculated and stored in T407 one day before (S503), and the average value of the period from T407 to T7 days before T401 is calculated from the value stored in T407 to T7 days before T401. Stored in the value T408 (S504). Thereafter, if data for 7 days has not been accumulated in the access information history management table (NO in S505), the processing is terminated as it is, and this processing is repeated until data for 7 days is accumulated.

  If data for 7 days is accumulated (YES in S505), if the total number of appearances T408 is larger than a threshold (eg, 1000) (YES in S506), the radio base station 12 is unspecified many The usage environment (T302) is changed to undecided, the usage status determination (T303) is changed to negative, and the information in the access information history management table T400 is cleared (S508). If the appearance count total average value T408 is equal to or less than the threshold value (NO in S506), the wireless base station 12 determines that the wireless base station 12 has been used by an unspecified number of wireless terminals 13, and A theft determination process (S600) described later is executed.

  In S502, when the update process (S500) of the access information history management table T400 is executed, the T401 may be overwritten and stored from the T407 one day before the T407 every time it is executed. Note that when it is determined that the wireless base station 12 is in a state of being used by an unspecified number of wireless terminals 13, a change in the usage status of the wireless base station 12 is detected. ) May be notified to the network administrator without executing the above.

  FIG. 15 is a theft analysis table T500. Wireless terminal identification information T501, a counter T502 indicating the frequency of use by a certain wireless terminal 13 with respect to the wireless base station 12, and a time when the counter T502 is updated as an index of the date and time when the wireless base station 12 was used by the wireless terminal 13 It consists of the last access time T503. This table is used biased to a specific number of radio terminals 13 after it is determined that the radio base stations 12 originally used for an unspecified number of radio terminals 13 are used by an unspecified number of radio terminals 13. Used to determine whether or not

  FIG. 16 is a flowchart of the theft determination processing S600 by the theft determination processing unit 44 of the network monitoring device 11. Analyzing whether or not the radio base station 12 is being used by a specific radio terminal 13 with respect to the radio base station 12 determined to be used by an unspecified number of radio terminals 13, When it is found that the terminal 13 is being used in a biased manner, the network administrator is notified that the wireless base station 12 is suspected of being stolen.

  In the wireless terminal access information management table T200, the sum of the number of appearances T202 of the wireless terminal 13 up to the top Mth (for example, the third) of the number of appearances T202 is calculated (S602). When the sum of the calculated number of appearances T202 occupies N% (for example, 90%) or more of the total number of appearances T202 (YES in S603), it is assumed that there is a suspicion of being used by a specific wireless terminal 13. Proceed to If the top M-th wireless terminal 13 having the appearance count T202 is selected (S604) and the wireless terminal identification information T201 of the selected wireless terminal 13 is already stored in the theft analysis table T500 (S605), the wireless terminal 13 1 is added to the value of the counter T502 (S606). If not stored (NO in S605), the wireless terminal identification information T201 is stored in the theft analysis table T500 as the wireless terminal identification information T501, and the counter T502 is set to 1 (S607).

  Thereafter, the value of the current time is stored in the last access time T503 of the wireless terminal 13 (S608). After performing the above processing for all the wireless terminals 13 up to the top M-th appearance frequency T202 (YES in S609), the value of the counter T502 is examined, and there is a counter T502 that exceeds a threshold value (for example, 5). If this is the case (YES in S6010), the wireless base station 12 is biased toward a specific small number of wireless terminals 13, that is, the network administrator is notified of a theft suspicion that there is a suspicion of theft ( S6011).

  After notifying the theft suspect (S6011), the difference between the last access time T503 stored in the theft analysis table T500 and the current time is taken, and the value of the counter T502 whose difference is equal to or greater than a threshold value (for example, 168 hours) is decremented by 1. (S6012). Then, the information of the wireless terminal 13 in which the value of the counter T502 is 0 is deleted from the theft analysis table T500. When the sum of the number of appearances T202 up to the top M of the number of appearances T202 is less than N% of the total number of appearances T202 (NO in S603), or when there is no counter T502 exceeding the threshold (YES in S6010), The process proceeds to S6012.

  FIG. 17 shows a series of flows from when the wireless base station 12 collects access information of the wireless terminal 13 until the network monitoring device 11 detects a change in the usage status of the wireless base station 12 and notifies the suspected theft. It is a sequence diagram.

  Communication is performed between the wireless terminal 13 and the wireless base station 12 (S1601), and the wireless base station 12 periodically executes wireless terminal access information collection processing (S100). The collected access information is transmitted to the network monitoring apparatus 11 by wireless terminal access information transmission processing (S200), and the wireless terminal access information is cleared after transmission (S203).

  When the network monitoring apparatus 11 receives the access information transmitted from the radio base station 12, the network monitoring apparatus 11 executes access information collection processing and stores the received access information in the radio terminal access information management table T200 (S300). Based on the stored access information, a theft analysis process is periodically executed (S400). When a change in the usage status of the radio base station 12 is detected and it is determined that the theft is suspected, the network administrator is notified of this (S6011).

  In addition, as an operation after the theft suspecting of the wireless base station 12 is notified in the theft determination processing (S600) (S6011), an alarm indicating the theft is displayed on the monitor provided in the network monitoring device 11 or an alarm is given. To prompt the network administrator to confirm something.

  It is also possible to stop the communication function of the radio base station 12 so that the radio base station 12 is not used any more. For example, in the wireless base station 12 having a setting file that defines validity / invalidity of the wireless function, when the suspicion of theft is notified (S6011), the network monitoring device 11 disables the wireless function to the wireless base station 12. There is means for disabling the wireless function and making the wireless base station 12 unusable by transmitting the setting file and changing the wireless function setting of the wireless base station 12 to invalid.

  As described above, a means for determining a change in the usage status of a radio base station from the tendency of the number of radio terminals that have communicated with the radio base station is realized. In this embodiment, since no additional hardware parts are required, the cost can be reduced. In addition, it is possible to notify the network administrator of the suspicion that the wireless base station has been stolen by detecting a change in the usage status of the wireless base station that does not have a means for specifying the position such as GPS. The network administrator can notice theft.

  Hereinafter, Example 2 will be described with reference to the drawings. In the first embodiment, the total number of appearances history for seven days is collected for the radio base station 12 whose usage status determination is active, but the total number of appearances history is used to determine the usage status of the radio base station 12. May be used. That is, for all the radio base stations 12, the access information history management table T400 shown in FIG. 13 is provided, and the total occurrence frequency history is managed by performing the processes shown in S501 to S505 in FIG. A change in the usage status of the radio base station 12 is detected based on the total appearance history.

  FIG. 18 is a flowchart showing a series of flows until a change in the usage status of the radio base station 12 using the average value of the total number of appearances is detected. In this flow, it is assumed that the usage environment of the radio base station 12 has already been determined by the processing shown in FIG. The theft analysis processing unit 42 of the network monitoring device 11 selects one of the monitored wireless base stations 12 as a theft analysis processing target (S1802), and updates the access information management table of the wireless base station 12 (S1803). After the update, an average value of the total number of appearances (appearance total number average value T408) is calculated from the total appearance frequency history of the access information management table (S1804), and the usage environment of the wireless base station 12 is public (YES in S1805). Yes, when the appearance frequency total average value T408 calculated in S1804 is less than a certain threshold (YES in S1806), the usage status determination of the radio base station 12 is set to active (S1807).

  Hereinafter, Example 3 will be described with reference to the drawings. In the first embodiment, after collecting history information for 7 days for the radio base station whose usage status determination is active (YES in S505 in FIG. 14), the total number of appearances T408 is less than or equal to the threshold value. 14 (NO in S506 in FIG. 14), the theft determination processing (S600 in FIG. 14) is performed for the first time. If the usage status determination is active, the theft determination is performed without collecting the history information for 7 days. Processing (S600) may be performed.

  FIG. 19 is a flowchart for explaining the above. The theft analysis processing unit 42 of the network monitoring device 11 selects one of the monitored radio base stations 12 as a theft analysis processing target (S1902), and when the usage status determination of the radio base station 12 is active (in S1903) YES), a theft determination process (S600) of the wireless base station 12 is performed.

  In the first embodiment, “number of wireless terminals” and “number of appearances” are used as means for detecting a change in usage status of the wireless base station 12, but “access frequency (access time)”, “occupation status”, Changes in usage status may be detected from information such as “usage time” and “usage status”.

  Here, “access frequency (access time)” is the frequency and time that the wireless terminal 13 has used the wireless base station 12. That is, by measuring how many times the wireless terminal 13 in a certain period has used one wireless base station 12, a change in usage status is captured. In the radio base station 12 used in a public environment, the access frequency from the same radio terminal 13 is low, and is used only for such a radio terminal 13. On the other hand, in the private wireless base station 12, the access frequency by the same wireless terminal 13 is high. Therefore, a change in the usage status of the radio base station 12 is detected by looking at a change in access frequency.

  “Occupancy status” is the degree of occupation of the band between the radio base station 12 and the radio terminal 13. Since the radio base station 12 used in a public environment can be used by many radio terminals 13, the degree of occupation of the band also increases. On the other hand, since the radio base station 12 used in a private environment is considered to be used only by a small number of radio terminals 13, the degree of band occupation is small. Therefore, a change in usage status is detected by detecting a change in the degree of occupation of the band.

  “Usage time” refers to the amount of time during which the wireless base station 12 has recognized the wireless terminal 13. In the wireless base station 12 used in a public environment, the usage time of a certain wireless terminal 13 is shortened, and in the wireless base station 12 used in a private environment, it is long. Therefore, a change in usage status is detected by looking at a change in usage time.

  In addition, some, or all of the above-described examples 1, 2, and 3 and the above information are managed as “usage status”, and by combining them, the usage status used in the public environment and the private environment are used. A change in usage status may be detected.

DESCRIPTION OF SYMBOLS 11 Network monitoring apparatus 12 Wireless base station 13 Wireless terminal 14 Communication network 31 Wireless terminal access information collection process part 32 Wireless terminal access information transmission process part 41 Access information collection process part 42 Theft analysis process part 43 Access information history management table update process part 44 Theft determination processing unit 45 Total number of wireless terminal identification information comparison processing unit 46 Total number of appearance comparison processing unit 47 Usage environment determination processing unit T100 Wireless terminal access information management table T200 Usage environment management table T300 Wireless base station management table T400 Access information history management Table T500 Theft Analysis Table

Claims (10)

A storage unit that holds the identification information for identifying each of the plurality of communication devices and the number of times of connection with the relay device to which the plurality of communication devices are connected;
Calculate the total number of the identification information based on the identification information,
Calculate the sum of the number of connections based on the number of connections,
Calculating a first sum of the number of connections based on the number of connections less than a first predetermined value among the number of connections;
Calculating a first ratio of the first sum to the sum based on the sum and the first sum;
A processing unit that determines an environment in which the relay device is used by the plurality of communication devices based on the total number of the identification information and the first ratio;
A communication monitoring apparatus comprising: The communication monitoring device according to claim 1,
The processor is
Comparing the calculated total number of the identification information and the first threshold;
When the total number of the identification information is smaller than the first threshold, it is determined that the relay device is in an environment used by the unspecified number of the plurality of communication devices,
When the total number of the identification information is larger than the first threshold, the first ratio is compared with the second threshold, and when the first ratio is smaller than the second threshold, the relay device When it is determined that the environment is being used by an unspecified number of the plurality of communication devices, and the first ratio is greater than the second threshold, the relay device is an unspecified number of the plurality of communication devices. It is determined that the environment is used by the communication monitoring device. The communication monitoring device according to claim 2,
The storage unit
Holding use environment information defining an environment in which the relay device is used by the plurality of communication devices;
The usage environment information is:
When the environment is undefined, it has a first value, and when the environment is an environment used by an unspecified number of the plurality of communication devices, it has a second value, and the environment is unspecified. A third value in the case of an environment utilized by a number of the plurality of communication devices;
The processor is
When the total number of the identification information is smaller than the first threshold, when the usage environment information has the first value, update to the second value,
When the first ratio is larger than the second threshold, when the usage environment information has the first value, it is updated to the third value and has the second value. If it is, the communication monitoring device is updated to the first value. The communication monitoring device according to claim 3,
The processor is
When the total number of the identification information is smaller than the first threshold and the usage environment information has the third value,
The sum of the number of connections is calculated every predetermined period, and the total history is recorded in the storage unit as a value for each predetermined period. When the predetermined number of the total history is recorded, the predetermined number and the predetermined An average value is calculated based on the sum total history for each period, the calculated average value is compared with a third threshold value, and when the average value is smaller than the third threshold value, the relay device A communication monitoring device that performs a change notification for notifying that a change has occurred in an environment used by a plurality of communication devices. The communication monitoring device according to claim 4,
The storage unit
The identification information associated with the number of connections greater than or equal to a second predetermined value among the number of connections and the counter value are stored in association with each other,
The processor is
When the calculated average value is smaller than the third threshold, a second sum of the connection times is calculated based on the connection times equal to or greater than a second predetermined value among the connection times, and the sum and the sum Calculating a second ratio of the second sum to the total sum based on the second sum, comparing the calculated second ratio with a fourth threshold, wherein the second ratio is The counter corresponding to the selected identification information is selected from among the identification information associated with the number of connections greater than or equal to a second predetermined value among the number of connections when the threshold is greater than or equal to a fourth threshold. A communication monitoring device characterized by adding a value, comparing the counter value with a fifth threshold value, and notifying the suspected theft of the relay device when the counter value is larger than the fifth threshold value. . A second device in communication with a plurality of first devices;
A third device for monitoring the second device,
The second device includes:
The identification information for identifying each of the plurality of first devices is acquired from the plurality of first devices, and the number of connections between the plurality of first devices and the own device is counted according to the acquisition of the identification information. ,
The acquired identification information and the counted number of connections are transmitted to the third device,
The third device includes:
Receiving the identification information and the connection count from the second device;
Calculate the total number of the identification information based on the received identification information,
Calculate the total number of connections based on the number of connections received,
Calculating a first sum of the number of connections based on the number of connections less than a first predetermined value among the number of connections;
Calculating a first ratio of the first sum to the sum based on the sum and the first sum;
A communication system, wherein an environment in which the second device is used by the plurality of first devices is determined based on a total number of the identification information and the first ratio. The communication system according to claim 6,
The third device includes:
Comparing the calculated total number of the identification information and the first threshold;
When the total number of the identification information is smaller than the first threshold, it is determined that the second device is in an environment used by the unspecified small number of the first devices,
When the total number of the identification information is greater than the first threshold, the first ratio is compared with a second threshold;
When the first ratio is smaller than the second threshold, it is determined that the second device is in an environment used by the unspecified number of the plurality of first devices;
When the first ratio is larger than the second threshold, it is determined that the second device is in an environment used by an unspecified number of the plurality of first devices. system. A communication system according to claim 7,
The third device includes:
The second device has a first value when an environment used by the plurality of first devices is undefined, and the environment is used by an unspecified number of the plurality of first devices. Holding use environment information having a second value in the case of an environment in which the environment is used and an environment in which the environment is used by an unspecified number of the plurality of first devices,
If the total number of the identification information is smaller than the first threshold,
When the usage environment information has the first value, update to the second value,
If the first ratio is greater than the second threshold, and the usage environment information has the first value, update to the third value,
If the second value is included, the communication system is updated to the first value. A communication system according to claim 8,
The third device includes:
When the total number of the identification information is smaller than the first threshold and the usage environment information has the third value,
Calculating the sum of the number of connections for each predetermined period and recording the sum history as a value for each predetermined period in the storage unit;
When a predetermined number of the total history is recorded, an average value is calculated based on the predetermined number and the total history for each predetermined period,
The calculated average value is compared with a third threshold value,
When the average value is smaller than the third threshold, the second device performs a change notification for notifying that a change has occurred in an environment used by the plurality of first devices. Communication system. The communication system according to claim 9, wherein
The third device includes:
The identification information associated with the number of connections greater than or equal to a second predetermined value among the number of connections and the counter value are stored in association with each other,
When the calculated average value is smaller than the third threshold, a second sum of the connection times is calculated based on the connection times equal to or greater than a second predetermined value among the connection times,
Calculating a second ratio of the second sum to the sum based on the sum and the second sum;
Comparing the calculated second ratio with a fourth threshold;
When the second ratio is equal to or greater than the fourth threshold, one of the number of connections is selected from the identification information associated with the number of connections greater than or equal to a second predetermined value,
Add the counter value corresponding to the selected identification information,
Comparing the counter value with a fifth threshold;
When the counter value is larger than the fifth threshold value, a communication system characterized by notifying a suspicion of theft of the second device.

Images