JP2015186001A - Communication service classification device, method, and program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a communication service classification device, method, and program that identify a provider of a service in a communication network and generate information to learn the use situation of a communication network.SOLUTION: A communication service classification device 10 comprises a DNS map 20 and service classification storage means 21, obtains domain name management information on a domain which a user terminal 50 accesses for a user to use a communication service, has the service classification storage means 21 store information on a communication service provider and a domain name by associating them on the basis of the obtained domain name management information, and thereby classifies the communication service. The communication service classification device 10 classifies a domain name about which a plurality of pieces of information are similar to each other as a domain name related to the same communication service in information stored in the service classification storage means 21 and on the communication service provider.

Description

  The present invention relates to a communication service classification device, method, and program.

Conventionally, in order to manage a communication network and maintain a comfortable environment for the user, usage of the communication network by the user has been investigated.
As a method for this purpose, communication is reconstructed by DPI (Deep Packet Inspection) analysis for all packets and analyzed up to the application layer, and DNS queries / responses are analyzed to determine how the user can configure the communication network. There is a method to investigate what kind of service is used and used. Patent document 1 is known as disclosing such a technique.

  Patent Document 1 discloses an access history information collection system that collects access history information in an IP network. In this access history information collection system, the access history information collection device receives and aggregates records including the source IP address of packets flowing through the IP network from the edge router as flow statistical information, and uses the aggregated flow statistical information Information such as the domain name corresponding to the flow statistical information is obtained from a DNS (Domain Name System) server in the IP network, the application type is determined based on the packet destination port number, and the domain name is included in the flow statistical information. The access history information to which such information is added is accumulated.

JP 2011-215713 A

However, according to the technique of Patent Document 1, information such as the domain name used by the user is accumulated, but it is difficult to specifically know the service used by the user from the accumulated information.
In addition, the DPI analysis for all packets has a heavy analysis processing load. The classification of services used by the user based on the analysis of the DNS query / response is classified as different services even if the services are virtually the same if the domain names accessed by the users are different.
In the above-described method, the domain name in the header cannot be acquired in the case of encrypted communication (for example, SSL (Secure Sockets Layer) encrypted communication or the like) or communication using a unique protocol.

  Accordingly, there is a need for an apparatus that identifies a service provider in a communication network and creates information for grasping the usage status of the communication network.

  It is an object of the present invention to provide a communication service classification apparatus, method, and program for identifying a service provider in a communication network and creating information for grasping the usage status of the communication network.

The present invention uses a domain that a user accesses to use the service.
Even if the domain accessed by the user in order to use the communication service is different from the domain name, if the same service provider manages the domain, there is a high possibility that the domain is related to the same service. That is, if the domain name management information for managing the domain name matches to some extent, the domains can be classified as domains related to the same service.
The domain name management information can be browsed (for example, WHOIS service).
The present invention acquires domain name management information from the domain name of the DNS query (for example, throw it to WHOIS), and classifies the domain names as the same group by matching items in the domain name management information.
Specifically, the following solutions are provided.

  (1) A communication service classification device for classifying communication services used by a user terminal based on communication traffic between the user terminal and a server, and for a DNS query in communication between the user terminal and a DNS server. A response acquisition means for acquiring a DNS response; a domain name that the user terminal makes an inquiry to the DNS server based on the DNS response acquired by the response acquisition means; and an IP address that the DNS server answers Extraction means for extraction, storage control means for associating the domain name extracted by the extraction means with the IP address and storing them in a DNS map, and acquiring communication traffic between the user terminal and the server Traffic acquisition means for performing the traffic acquisition The transmission IP address used for the communication traffic acquired by the stage is extracted from the user terminal to the server, and the domain name associated with the extracted transmission IP address in the DNS map is extracted. Domain name extraction means, management information acquisition means for acquiring domain name management information for managing the domain name using the domain name extracted by the domain name extraction means, and acquisition by the management information acquisition means Communication for classifying the communication service by associating and storing the information on the communication service provider who owns the domain name and the domain name in the service classification storage unit based on the domain name management information A communication service classification device comprising service classification means.

  According to the configuration of (1), the communication service classification device 10 according to (1) acquires a DNS response to a DNS query in communication between a user terminal and a DNS server, and based on the acquired DNS response, the user terminal Extracts the domain name inquired from the DNS server and the IP address answered by the DNS server, associates the extracted domain name with the IP address, stores them in the DNS map, and stores the domain name between the user terminal and the server. The communication traffic is acquired, the transmission IP address used for the acquired communication traffic from the user terminal to the server is extracted, and the domain name associated with the extracted transmission IP address in the DNS map is extracted and extracted. Use the domain name to obtain domain name management information for managing the domain name, and Based on in name management information, and information regarding the communication service provider that owns the domain name, by storing in the service classification storage means in association with the domain name, to classify the communications service.

That is, the communication service classification device acquires domain name management information for a domain that a user terminal accesses in order for a user to use a communication service, and based on the acquired domain name management information, information about a communication service provider and a domain The communication service is classified by associating the name with the name and storing it in the service classification storage means.
Therefore, the communication service classification device according to (1) can identify the service provider in the communication network and create information for grasping the usage status of the communication network.

  (2) The communication service classifying unit relates to the same communication service with the domain names having a plurality of information similar to each other among the information stored in the service class storage unit and related to the communication service provider. The communication service classification device according to (1), which is classified as a domain name.

  Therefore, the communication service classification apparatus according to (2) can identify the service provider in the communication network and create information for grasping in detail the use status of the communication network.

  (3) A management information storage control unit that acquires the domain name management information using the domain name and stores the domain name management information in a domain name management information storage unit that stores the domain name and the domain name management information in association with each other. The management information acquisition means acquires the domain name management information by searching the domain name management information storage means by using the domain name, and the communication service classification means uses the management information acquisition means. The communication service classification device according to (1) or (2), wherein the communication service is classified based on the acquired domain name management information.

  Therefore, the communication service classification device according to (3) can quickly identify the service provider in the communication network and create information for grasping the use status of the communication network in detail.

  (4) A method executed by the communication service classification device according to (1), wherein the response acquisition unit acquires a DNS response to a DNS query in communication between the user terminal and a DNS server; An extraction step in which the extraction means extracts a domain name inquired to the DNS server by the user terminal and an IP address answered by the DNS server, based on the DNS response acquired by the response acquisition step. A storage control step in which the storage control means associates the domain name extracted in the extraction step with the IP address and stores it in a DNS map; and the traffic acquisition means includes the user terminal and the server. Traffic to get communication traffic between And the domain name extracting means extracts a transmission IP address from the user terminal to the server, which is used for the communication traffic acquired by the traffic acquisition step, and adds the extracted transmission IP address to the extracted transmission IP address. A domain name extraction step for extracting the domain name associated in the DNS map, and the management information acquisition means for managing the domain name using the domain name extracted in the domain name extraction step. Management information acquisition step of acquiring the domain name management information, and the communication service classification means relates to a communication service provider that owns the domain name based on the domain name management information acquired by the management information acquisition step Information and the domain name in association with each other A communication service classification step of classifying the communication service by storing it in a service class storage means.

  Therefore, the method according to (4) can create information for identifying the service provider in the communication network and grasping the usage status of the communication network.

  (5) A program for causing a computer to execute each step of the method described in (4).

  Therefore, the program according to (5) can cause the computer to identify the provider of the service in the communication network and create information for grasping the usage status of the communication network.

ADVANTAGE OF THE INVENTION According to this invention, the information for identifying the provider of a communication service and grasping | ascertaining the utilization condition of a communication network can be produced.
ADVANTAGE OF THE INVENTION According to this invention, the information for visualization of the service utilization condition in a communication network can be created and provided.
Furthermore, according to the present invention, it is possible to create and provide information that can be used for future traffic prediction and useful information that can be used for emergency traffic control.

It is a figure for demonstrating the outline | summary of the classification of the communication service by the communication service classification apparatus which concerns on one Embodiment of this invention. It is a figure which shows the structure of the communication service classification | category apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the DNS map by the communication service classification | category apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the DNS response by the communication service classification device which concerns on one Embodiment of this invention. It is a figure which shows the example of the domain name management information storage means by the communication service classification | category apparatus which concerns on one Embodiment of this invention. It is a flowchart which shows the process of the communication service classification apparatus which concerns on one Embodiment of this invention. It is a figure which shows the example of the service classification memory | storage means by the communication service classification apparatus which concerns on one Embodiment of this invention.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. FIG. 1 is a diagram for explaining an outline of communication service classification by the communication service classification apparatus 10 according to an embodiment of the present invention. Although FIG. 1 shows one DNS server 30, server 40, user terminal 50, and domain name management information server 60, the present invention is not limited to this, and is configured by a plurality of DNS servers, servers, and user terminals 50. Also good. The server 40 is a server that provides a service, such as a mail server that provides a mail service, an application server that provides application processing, a content server that provides content (such as text and images), and a Web server. . The domain name management information server 60 is installed by a registrar that manages domain names, and stores domain name management information.

First, in order to perform a communication session with the server 40 via the communication network 70, the user terminal 50 requests the DNS server 30 to make an inquiry for name resolution to check the IP address of the server 40 (DNS query). ). Inquiries include not only queries by domain name, but also queries by host name + domain name.
In response to the inquiry request, the DNS server 30 obtains the IP address of the server 40 and sends a response response to the user terminal 50 (referred to as a DNS response). The communication service classification device 10 extracts the domain name and IP address included in the answer based on the response from the DNS server 30 and stores them as the DNS map 20.

Next, the user terminal 50 requests a service from the server 40. The server 40 returns a response to the service request to the user terminal 50.
The communication service classification device 10 acquires domain name management information using the domain name of the server 40 (for example, using the WHOIS service), and based on the acquired domain name management information (for example, registrar information Grouped by the same communication service provider.
In this way, the communication service classification device 10 can perform communication actually used by the user even when the payload part of the Layer 4 of the OSI reference model is concealed by the concealment technology represented by SSL or the like. Services can be classified.

  FIG. 2 is a diagram showing a configuration of the communication service classification device 10 according to an embodiment of the present invention. The communication service classification device 10 includes a response acquisition unit 11, an extraction unit 12, a storage control unit 13, a traffic acquisition unit 14, a domain name extraction unit 15, a management information acquisition unit 16, a communication service classification unit 17, A DNS map 20 and service classification storage means 21 are provided. Hereinafter, each means will be described in detail.

The response acquisition unit 11 acquires a DNS response to the DNS query in communication between the user terminal 50 and the DNS server 30.
Specifically, the user terminal 50 transmits a DNS query for name resolution to the DNS server 30 in order to communicate with the server 40. The DNS server 30 obtains the IP address of the server 40 and transmits a DNS response to the user terminal 50. The response acquisition unit 11 acquires a DNS response.

Based on the DNS response acquired by the response acquisition unit 11, the extraction unit 12 extracts the domain name that the user terminal 50 has inquired of the DNS server 30 and the IP address that the DNS server 30 has answered.
Specifically, based on the DNS response acquired by the response acquisition unit 11, the extraction unit 12 removes the host name from the FQDN (Fully Qualified Domain Name) included in the DNS response, and extracts the upper level domain and the IP address. And extract.

The storage control means 13 associates the domain name extracted by the extraction means 12 with the IP address and stores them in the DNS map 20.
Specifically, the storage control unit 13 creates the DNS map 20 in which the domain name of the server 40 is associated with the IP address of the server 40. If the correspondence between the domain name and the IP address has an expiration date, and the correspondence is frequently changed, the storage control unit 13 uses the latest information on the correspondence between the domain name and the IP address. The DNS map 20 may be updated.

The traffic acquisition unit 14 acquires communication traffic between the user terminal 50 and the server 40.
The domain name extraction unit 15 extracts a transmission IP address used for the communication traffic acquired by the traffic acquisition unit 14 from the user terminal 50 to the server 40 and associates the extracted transmission IP address with the DNS map 20. Extracted domain name.

The management information acquisition unit 16 acquires domain name management information for managing the domain name using the domain name extracted by the domain name extraction unit 15.
Specifically, the management information acquisition unit 16 uses the domain name (for example, transmits the domain name to the WHOIS service and receives management information regarding the domain name corresponding to the transmitted domain name), and performs domain name management. Get information. The domain name management information includes, for example, an organization name, a name server, a registration date, and the like, and depending on a registrar that manages the domain name, includes a registrant name, an expiration date, an e-mail address of a public contact window, and the like.

Based on the domain name management information acquired by the management information acquisition unit 16, the communication service classification unit 17 associates information related to the communication service provider that owns the domain name with the domain name in the service classification storage unit 21. Classify communication services by storing them.
Specifically, the communication service classification unit 17 uses, for example, an organization name, a registrant name, or a registrar name (hereinafter referred to as a registration name) indicating the owner of the domain name as information about the communication service provider based on the domain name management information. A name server indicating a server name installed in the domain, an e-mail address of the public contact window, and the like are stored in the service classification storage unit 21 in association with the domain name.

Further, the communication service classification unit 17 classifies domain names that are similar to each other among a plurality of pieces of information among the information stored in the service classification storage unit 21 and related to the communication service provider as the same communication service. Specifically, the communication service classification unit 17 calculates a similarity degree obtained by comparing registrant names and the like. For example, when the registrant name is “XXX” and “XXX.COP”, the similarity is expressed in the notation format (Hiragana, Katakana, Roman, English, etc.), excluding the extension “.COP”, “.cop”, etc. It is calculated by evaluating the difference.
In addition, the communication service classification unit 17 evaluates whether the name servers are the same (the same is true when the name servers are different but have the same name), and whether the domain names of the email addresses are the same. An evaluation value including “” is calculated, and when the calculated evaluation value is equal to or greater than a predetermined value, the domain names are classified into the same service.

  Further, the communication service classification unit 17 classifies the mail service, the content distribution service, and the like into different services even if the communication service provider is the same. Specifically, the communication service classifying unit 17 uses a plurality of communications generated by the same user (for example, the same source IP address) and the communication times are close (for example, within a predetermined time), and When service providers are the same, they are grouped as the same service.

  For example, the communication service classification unit 17 sets the domain names having similar registrant names and the like among the information related to the communication service provider as the same service classification (for example, S1). Further, the communication service classification means 17 is a domain name classified into the same service classification (for example, S1), and other information other than the registrant name among the information related to the communication service provider is similar. (For example, when domain names of email addresses are the same or when name servers are the same) Domain names are classified as the same group in the same service classification (for example, S1) (for example, S1-1). Further, the communication service classification means 17 uses the same domain names that have similar registrant names among the information related to the communication service providers and that have similar communication start times by the same user in the traffic statistical information. (See FIG. 7 to be described later).

Furthermore, the communication service classification device 10 may include a management information storage control unit 18 and a domain name management information storage unit 22.
The management information storage control unit 18 acquires domain name management information using the domain name, and stores the domain name management information in association with the domain name management information (for example, a cache memory or a local memory). In the storage device or the like. In this case, the management information acquisition unit 16 acquires domain name management information by searching the domain name management information storage unit 22 using the domain name, and the communication service classification unit 17 uses the management information acquisition unit 16 to The communication services are classified based on the domain name management information acquired from the name management information storage unit 22.
The management information storage control means 18 may store the domain name management information storage means 22 with an expiration date for each domain name. The management information storage control means 18 deletes the domain name management information that has passed the expiration date, and newly acquires and stores the domain name management information. The management information storage control unit 18 may delete the domain name whose search frequency has decreased from the domain name management information storage unit 22. The management information acquisition unit 16 can perform stable processing on domain names that need to be searched frequently.

  FIG. 3 is a diagram showing an example of the DNS map 20 by the communication service classification device 10 according to an embodiment of the present invention. As illustrated in FIG. 3, the DNS map 20 associates the domain name of the server 40, the IP address of the server 40, the DNS response time, and TTL (Time to live) for each IP address of the user terminal 50. Remember.

  FIG. 4 is a diagram illustrating an example of a DNS response by the communication service classification device 10 according to an embodiment of the present invention. The example of FIG. 4 is a diagram illustrating that the user terminal 50 communicates with the server 40 that provides a service based on a DNS answer acquired by making an inquiry to the DNS server 30. In FIG. 4, the user terminal 50 makes a DNS inquiry to the DNS server 30, acquires the IP address of the server 40 that provides the service by the DNS response, and sends the server 40 that provides the service based on the acquired IP address. Connect and receive service from the server 40.

FIG. 5 is a diagram showing an example of the domain name management information storage unit 22 by the communication service classification device 10 according to an embodiment of the present invention. As shown in FIG. 5, the domain name management information storage unit 22 stores the domain name, the domain name management information, and the expiration date in association with each other.
The domain name management information storage unit 22 may be created in advance by the management information storage control unit 18. The domain name management information storage unit 22 may be created as a cache memory by the management information storage control unit 18.

  FIG. 6 is a flowchart showing processing of the communication service classification apparatus 10 according to the embodiment of the present invention. The communication service classification device 10 is configured by hardware included in a computer and its peripheral devices, and software that controls the hardware. The following processing is performed by each control unit (for example, CPU) under a predetermined condition under the OS. This process is executed according to software.

  In step S <b> 101, the CPU (response acquisition unit 11, extraction unit 12, storage control unit 13) performs a DNS analysis and associates the domain name with the IP address and stores them in the DNS map 20. More specifically, the CPU acquires a DNS response to the DNS query, and based on the DNS response, removes the host name from the FQDN included in the DNS response, and extracts and extracts the domain name and the IP address. The domain name and the IP address are associated with each other and stored in the DNS map 20.

  In step S102, the CPU (traffic acquisition means 14, domain name extraction means 15) analyzes communication traffic and extracts an IP address. More specifically, the CPU acquires communication traffic between the user terminal 50 and the server 40, and extracts a transmission IP address from the user terminal 50 to the server 40 that is used for the acquired communication traffic.

  In step S103, the CPU (domain name extraction means 15) acquires a domain name corresponding to the extracted IP address in the DNS map 20. More specifically, the CPU searches the DNS map 20 using the extracted IP address, and acquires the domain name associated with the searched IP address.

  In step S104, the CPU (management information acquisition unit 16) acquires domain name management information of the acquired domain name. More specifically, the CPU makes an inquiry to the domain name management information server 60 using the acquired domain name, and acquires domain name management information corresponding to the inquired domain name.

  In step S105, the CPU (communication service classification means 17) classifies the communication service based on the acquired domain name management information. More specifically, based on the acquired domain name management information, the CPU stores the information related to the communication service provider that owns the domain name and the domain name in the service classification storage unit 21 in association with each other. Classify communication services. Further, the CPU classifies domain names of a plurality of pieces of information that are similar to each other as information about the same communication service among the information about the communication service provider.

  In step S106, the CPU (communication service classification means 17) outputs the classified information. More specifically, the CPU displays the correspondence between the domain name stored in the service classification storage unit 21 and the information related to the communication service provider on the display or outputs it as a file.

FIG. 7 is a diagram showing an example of the service classification storage unit 21 by the communication service classification apparatus 10 according to an embodiment of the present invention. As shown in FIG. 7, in the example of FIG. 7, the communication service classification device 10 classifies the domain names having similar registrant names among the information related to the communication service provider as the service classification S <b> 1. Information other than the registrant name among the information related to the communication service provider is similar (for example, when the domain names of the email addresses are the same, This shows that the domain names are further grouped in the same service classification S1-1, which is classified into S1.
Further, in the example of FIG. 7, the communication service classification device 10 has similar registrant names among the information related to the communication service provider, and the communication start times by the same user in the traffic statistical information are close to each other. It is shown that the domain names that are present are set as another group (for example, content distribution service) in the service classification S1, called service classification S1-2. Similarly, in the example of FIG. 7, the communication service classification device 10 has a service classification S1-3 in which domain names whose registrant names and the like are similar to the service classification S1 in the information related to the communication service provider are called service classification S1-3. This indicates that the group is still another group (for example, a mail service) in the classification S1.

According to the present embodiment, the communication service classification device 10 includes a DNS map 20 and a service classification storage unit 21, and acquires domain name management information for a domain that the user terminal 50 accesses in order for the user to use the communication service. Based on the acquired domain name management information, the communication service provider classifies the communication service by associating the information related to the communication service provider with the domain name and storing them in the service classification storage unit 21. The communication service classification device 10 classifies domain names that are similar to each other among a plurality of pieces of information stored in the service classification storage unit 21 and that are similar to each other as domain names related to the same communication service. .
Furthermore, the communication service classification device 10 includes domain name management information storage means 22 (for example, as a cache) that stores a domain name and domain name management information in association with each other, and uses the domain name to store the domain name management information. The domain name management information is acquired by searching the means 22, and the communication service is classified based on the acquired domain name management information.
Therefore, the communication service classification device 10 can identify the provider of the communication service and create information for grasping the usage status of the communication network.

  As mentioned above, although embodiment of this invention was described, this invention is not restricted to embodiment mentioned above. The effects described in the embodiments of the present invention are only the most preferable effects resulting from the present invention, and the effects of the present invention are limited to those described in the embodiments of the present invention. is not.

DESCRIPTION OF SYMBOLS 10 Communication service classification device 11 Response acquisition means 12 Extraction means 13 Storage control means 14 Traffic acquisition means 15 Domain name extraction means 16 Management information acquisition means 17 Communication service classification means 18 Management information storage control means 20 DNS map 21 Service classification storage means 22 Domain name management information storage means 30 DNS server 40 server 50 user terminal 60 domain name management information server 70 communication network

Claims (5)

A communication service classification device that classifies communication services used by the user terminal based on communication traffic between the user terminal and the server,
In the communication between the user terminal and the DNS server, a response acquisition unit that acquires a DNS response to the DNS query;
Based on the DNS response acquired by the response acquisition means, an extraction means for extracting the domain name that the user terminal has inquired of the DNS server and the IP address that the DNS server has answered,
Storage control means for associating the domain name extracted by the extraction means with the IP address and storing them in a DNS map;
Traffic acquisition means for acquiring communication traffic between the user terminal and the server;
A transmission IP address used for the communication traffic acquired by the traffic acquisition means is extracted from the user terminal to the server, and the domain name associated with the extracted transmission IP address in the DNS map Domain name extraction means for extracting
Management information acquisition means for acquiring domain name management information for managing the domain name using the domain name extracted by the domain name extraction means;
Based on the domain name management information acquired by the management information acquisition unit, information related to a communication service provider who owns the domain name and the domain name are associated with each other and stored in the service classification storage unit, A communication service classification means for classifying the communication service;
A communication service classification apparatus comprising: The communication service classification means is the information stored in the service classification storage means, and among the information related to the communication service provider, the domain name having a plurality of similar information as the domain name related to the same communication service. Classify,
The communication service classification device according to claim 1. Management information storage control means for acquiring the domain name management information using the domain name and storing it in a domain name management information storage means for storing the domain name and the domain name management information in association with each other,
The management information acquisition means acquires the domain name management information by searching the domain name management information storage means using the domain name,
The communication service classification means classifies the communication service based on the domain name management information acquired by the management information acquisition means;
The communication service classification apparatus according to claim 1 or 2. A method performed by the communication service classification device according to claim 1,
A response acquisition step in which the response acquisition means acquires a DNS response to a DNS query in communication between the user terminal and a DNS server;
An extraction step in which the extraction means extracts, based on the DNS response acquired in the response acquisition step, a domain name that the user terminal has inquired of the DNS server and an IP address that the DNS server has answered; ,
A storage control step in which the storage control means associates the domain name extracted in the extraction step with the IP address and stores it in a DNS map;
A traffic acquisition step in which the traffic acquisition means acquires communication traffic between the user terminal and the server;
The domain name extraction unit extracts a transmission IP address from the user terminal to the server, which is used for the communication traffic acquired by the traffic acquisition step, and adds the extracted transmission IP address to the DNS map in the DNS map. A domain name extraction step of extracting the associated domain name;
The management information acquisition means acquires the domain name management information for managing the domain name using the domain name extracted by the domain name extraction step;
Based on the domain name management information acquired by the management information acquisition step, the communication service classification means associates information about the communication service provider that owns the domain name with the domain name, and stores the service classification. A communication service classification step of classifying the communication service by storing in a means;
A method comprising:   The program for making a computer perform each step of the method of Claim 4.

Images