JP2018133688A - Service restoration device and service restoration method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To realize automatic restoration of services provided on a network.SOLUTION: A service restoration device 1 that monitors a service by using flow data collected from a plurality of network devices and restores the service if there is service abnormality includes a storage unit 30 for storing a network setting change for restoring the service, a service quality determination unit 13 for determining abnormality of the service by obtaining a degree of departure from continuity obtained from the collected flow data, a measure plan deriving unit 15 for deriving a measure plan obtained by combining one or a plurality of network setting changes contributing to the restoration of the service from the storage unit 30, a measure plan application unit 16 that applies the measure plan derived from the measure plan deriving unit 15 to the network in which the network devices are arranged.SELECTED DRAWING: Figure 2

Description

  The present invention relates to a service restoration apparatus and a service restoration method.

  In network operation management, it is very important to monitor currently provided services, and various abnormality detection methods for detecting abnormalities in services provided on the network have been known. For example, Patent Document 1 states that “a service monitoring apparatus that monitors a service using flow data collected from a plurality of network devices, and requests traffic and response traffic for the service are collected from the collected flow data. An extracting unit for extracting; a continuity calculating unit for calculating continuity between the request traffic and the response traffic based on the extracted request traffic and response traffic; and the request traffic within a specific period. And a determination unit that determines the quality of the service according to how much the relationship between the response traffic and the response traffic deviates from the calculated continuity ” Is disclosed.

JP 2006-144153 A

  However, according to Patent Document 1, when a service abnormality is detected, it is necessary for the maintenance person to perform operations such as analysis of the cause of the abnormality, examination of a countermeasure plan, and implementation in order to restore the service. For this reason, it takes a lot of time to restore the service.

  The present invention has been made in view of such a background, and an object of the present invention is to realize automatic restoration of services provided on a network.

  In order to solve the above-mentioned problem, the invention according to claim 1 is a service restoration device that monitors a service using flow data collected from a plurality of network devices and restores if there is an abnormality in the service, A storage unit that stores a network setting change for restoring the service; a determination unit that determines abnormality of the service by obtaining a deviation degree from continuity obtained from the collected flow data; and the storage unit The countermeasure plan derivation unit for deriving a countermeasure plan combining one or more network setting changes that contribute to the restoration of the service, and the countermeasure plan derived by the countermeasure plan derivation unit are transferred to the network in which the network device is arranged. And a countermeasure plan application unit to be applied.

  The invention according to claim 3 is a service restoration method in a service restoration device that monitors a service using flow data collected from a plurality of network devices and restores if there is an abnormality in the service, the service restoration method comprising: The storage unit of the restoration device stores a network setting change for restoring the service, and the service restoration device obtains the degree of deviation from continuity obtained from the collected flow data, thereby A determination step for determining an abnormality of the network, a countermeasure plan derivation step for deriving a countermeasure plan combining one or more network setting changes that contribute to the restoration of the service from the storage unit, and a countermeasure derived in the countermeasure plan derivation step Apply countermeasure plan to apply the plan to the network where the network device is located And step, is executed, characterized in that.

According to the first and third aspects of the present invention, it is possible to sequentially apply measures proposed by combining various network setting changes prepared in advance to the network in response to a service abnormality that has occurred.
Therefore, automatic restoration of services provided on the network can be realized.

  Further, the invention according to claim 2 is the service restoration apparatus according to claim 1, wherein the network setting change stored in the storage unit when the countermeasure is applied and the service is restored. A measure plan evaluation unit is provided for increasing or decreasing the evaluation value according to the contribution of restoration of the service.

  The invention according to claim 4 is the service restoration method according to claim 3, wherein the service restoration device stores in the storage unit when the countermeasure is applied and the service is restored. A measure proposal evaluation step is executed to increase or decrease the evaluation value of the network setting change being made according to the contribution of the restoration of the service.

  ADVANTAGE OF THE INVENTION According to this invention, the automatic recovery of the service provided on the network is realizable.

1 is an overall configuration diagram of a network. It is a functional lineblock diagram of the service restoration device of this embodiment. It is a data structure figure of a setting change candidate list. It is a data structure figure of an executed setting change list. It is a data structure figure of a setting change queue. It is a flowchart which shows the process of the service recovery apparatus of this embodiment. It is a flowchart which shows the detail of the countermeasure plan derivation | leading-out process of FIG.

<Concept>
Cloud services represented by SDN (Software Defined Network), SDWAN (Software-Defined Wide Area Networking), and AWS (Amazon Web Services; “Amazon” is a registered trademark) are provided in the form of Software Defined. In this case, device replacement, package replacement, physical wiring replacement, and physical operation taken are not taken, but only software operation is required, and control necessary for recovery from service abnormality, for example, NW configuration change or setting change Etc. can be realized. For this reason, in order to recover the service from the abnormal state, it is not always necessary for the maintenance person to examine and implement the countermeasure plan. In the present invention, until a recovery from an abnormal state of a service is performed, a countermeasure proposal is derived and applied using a preset candidate for NW setting change, and the service is recovered. The NW setting change may be simply referred to as “setting change” or “network setting change”.

<Configuration>
As shown in FIG. 1, the service restoration apparatus 1 according to the present embodiment collects flow data from each of the network apparatuses 2 in the network apparatus group G, and provides the collected data to the terminal 4 from the server 3 using the collected flow data. Service (represented by arrows with signs X and Y in FIG. 1). Further, the service recovery device 1 recovers when a service abnormality is detected as a result of monitoring. The flow data collection method is a well-known method such as NetFlow, sFlow, etc. (for example, Reference 1: B. Claise, “Cisco Systems NetFlow Services Export Version 9,” IETF RFC3954, October 2004. http: //www.ietf .org / rfc / rfc3954 and Reference 2: P. Phaal, S. Panchen, and N. McKee, "InMon Corporation's sFlow: A Method for Monitoring Traffic in Switched and Routed Networks," IETF RFC3176, September 2001. http: //www.ietf.org/rfc/rfc3176, etc.)

  Flow data includes information such as the source IP address, destination IP address (or destination IP address), source port number, destination port number (or destination port number), protocol type, number of packets, number of bytes, etc. Part or all of Flow data is collected in predetermined time units, and the collection time can be included in the flow data. By specifying the source port number or destination port number of the flow data, it is possible to specify the service being provided for which the service quality is to be determined.

The service restoration apparatus 1 of the present embodiment functions as, for example, an IPFIX (Internet Protocol Flow Information Export) flow collector and can collect flow data from each of the network apparatuses 2.
The network device 2 is, for example, a router, a bridge, a repeater, or a gateway. The network device 2 functions as, for example, an IPFIX flow exporter. The network device group G may include a network device 2 that does not function as a flow exporter. Such a traffic state in the network device 2 can be indirectly specified by analyzing the flow data provided by the network device 2 functioning as a flow exporter by a known method.

The server 3 is, for example, a DNS (Domain Name System) server 3a, a Web server 3b, and a DB server 3c, and provides a predetermined service to the terminal 4. Note that the server 3 may have a flow exporter function.
The terminal 4 is a device that a user operates to use a service. Note that the terminal 4 may have a flow exporter function.
The HMI device 5 is a management console for the operator to control the service recovery device 1. The service restoration device 1 outputs an abnormality notification, a restoration notification, and the like to the HMI device 5 as necessary based on the flow data collected from the network device 2.

  As shown in FIG. 2, the service restoration apparatus 1 according to the present embodiment includes a processing unit 10, an input / output unit 20, and a storage unit 30. In the service restoration device 1, the CPU as a specific example of the processing unit 10 causes the various functional units to operate by executing a program read on the memory as a specific example of the storage unit 30.

The processing unit 10 manages the processing of the service restoration device 1. The processing unit 10 includes a traffic extraction unit 11, a continuity calculation unit 12, a service quality determination unit 13 (determination unit), a countermeasure plan evaluation unit 14, a countermeasure plan derivation unit 15, a countermeasure plan application unit 16, and a result output unit 17. Are provided. These functional units will be described later.
The input / output unit 20 constitutes an input / output interface of the service restoration device 1. The input / output unit 20 includes an input unit 21 and an output unit 22. The input unit 21 acquires input from the HMI device 5 and flow data from the network device 2. The output unit 22 outputs the processing result by the processing unit 10 as a file f or the like.
The storage unit 30 stores predetermined data in a predetermined format. The storage unit 30 includes functional units such as a flow data storage unit 31, a continuity data storage unit 32, a service quality degradation state storage unit 33, a setting change candidate list 34, and an executed setting change list 35. These functional units will be described later.

  The traffic extraction unit 11 extracts request traffic and response traffic for a predetermined service being provided from the flow data collected from the network device 2.

  The “request traffic” is information necessary for service realization directed from the terminal 4 that uses the service to the server 3 that provides the service. The terminal 4 that transmits the requested traffic can be identified from the source IP address of the flow data. The server 3 that receives the requested traffic can be identified from the destination IP address of the flow data.

  The “response traffic” is information necessary for realizing the service directed from the server 3 that provides the service to the terminal 4 that uses the service. The server 3 that transmits the response traffic can be identified from the source IP address of the flow data. The terminal 4 that receives the response traffic can be identified from the destination IP address of the flow data.

The stationarity calculation unit 12 calculates stationarity between the request traffic and the response traffic based on the request traffic and the response traffic extracted by the traffic extraction unit 11. When the service is normally provided from the server 3 to the terminal 4, it is considered that a certain tendency occurs between the request traffic and the response traffic, and a predetermined steady state is formed. The stationarity calculated by the stationarity calculation unit 12 is a quantitative expression of this steady state. If the server 3 cannot provide a service due to a DoS (Denial of Service attack) attack or the like, it can be said that the response traffic is extremely small with respect to the request traffic and the continuity is broken.
The continuity calculation by the continuity calculation unit 12 is performed every predetermined unit time. Moreover, although there are various methods for calculating continuity, details are described in Patent Document 1 and description thereof is omitted. In the present embodiment, the calculation method of continuity is assumed to be the one described in Patent Document 1, but is not limited to this.

  The service quality determination unit 13 determines the quality of service according to how much the relationship between request traffic and response traffic within a specific period deviates from the continuity calculated by the continuity calculation unit 12. The “specific period” can be, for example, a period later than the period targeted when the continuity calculation unit 12 calculates the continuity. The “relationship between request traffic and response traffic” is expressed by the same physical quantity as the stationarity calculated by the stationarity calculation unit 12. It is assumed that the quality of service decreases as the degree of deviation between the relationship used by the service quality determination unit 13 and the continuity calculated by the continuity calculation unit 12 increases. For example, when a DoS attack or the like has occurred, the relationship used by the service quality determination unit 13 deviates more than the continuity calculated by the continuity calculation unit 12, so that the quality of the target service decreases. Can be determined.

The measure plan evaluation unit 14 is applied when the measure plan application unit 16 determines that the service in the abnormal state is normal (recovered) (by the service quality determination unit 13) by applying the measure plan. Evaluate the proposed countermeasures.
The countermeasure plan deriving unit 15 refers to the setting change candidate list 34 and derives a countermeasure plan for restoring the service in the abnormal state.
The countermeasure plan application unit 16 applies the countermeasure plan derived by the countermeasure plan deriving unit 15 to the network in which the network device 2 is arranged.

  The result output unit 17 outputs detailed data related to the countermeasure plan executed for recovery from the service abnormality. The detailed data includes various information such as the host name of the server 3 that provides the target service, the number of terminals 4 that use the service, the location where the abnormality is detected, and the content of the executed NW setting change. Contains data. The HMI device 5 can acquire the detailed data desired by the operator by controlling the service restoration device 1. Further, the output unit 22 outputs the acquired detailed data as a processing result by the processing unit 10 in a file f or the like.

The flow data storage unit 31 stores the flow data collected by the service restoration device 1 in a predetermined format. The traffic extraction unit 11 accesses the flow data storage unit 31 and extracts request traffic and response traffic.
The stationarity data storage unit 32 stores the stationarity calculated by the stationarity calculation unit 12 in a predetermined format.
For example, the service quality degradation state storage unit 33 stores, in a predetermined format, detailed data (including data representing a service quality degradation state) related to a service for which the service quality determination unit 13 determines that the service quality has deteriorated. To do.

  The setting change candidate list 34 stores a list of setting changes of NWs that are candidates for eliminating the abnormal state of the service. Each setting change stored in the setting change candidate list 34 is a constituent element of the countermeasure plan derived by the countermeasure proposal deriving unit 15. Each setting change stored in the setting change candidate list 34 can be defined in advance by, for example, a maintenance person, or can be corrected and updated as appropriate during operation.

As shown in FIG. 3, the setting change candidate list 34 includes “item number”, “change contents”, “change method”, “restrictions”, “maintenance decision flag”, “evaluation value (priority)”. And an entry is created for each type of setting change.
In the “item number” column, a number for identifying each setting change is registered.
A description of the corresponding setting change is registered in the “change contents” column.
In the “change method” column, software operations for executing the corresponding change contents are registered.

In the “Restrictions” column, restrictions for executing the corresponding setting change are registered.
In the “maintenance personnel determination wait flag” column, a value “1: confirmation required” indicating that the maintenance operator needs to make a corresponding setting change, or a value indicating that the maintenance operator does not need to be determined. “0: Confirmation unnecessary” is registered.
In the “evaluation value (priority)” column, the evaluation value assigned to the corresponding setting change is registered. The measure evaluation unit 14 determines the evaluation value to be registered. The evaluation value takes a value of 0 to 1, for example.

  The executed setting change list 35 stores a list of NW setting changes executed to recover a service in an abnormal state. Specifically, the setting changes constituting the countermeasure plan applied by the countermeasure plan application unit 16 are stored in the executed setting change list 35. There may be one or more setting changes constituting the countermeasure plan.

As shown in FIG. 4, the executed setting change list 35 has columns such as “item number”, “date / time”, and “setting change content”, and is configured so that an entry is created for each setting change content. Can do.
In the “item number” column, a symbol for identifying the corresponding setting change content is registered.
In the “date and time” column, the year, month, day, hour, minute and second (JST: Japan Standard Time) in which the corresponding setting change contents are executed are registered.
In the “setting change content” column, the item numbers of the setting changes (item numbers shown in the setting change candidate list 34 in FIG. 4) constituting the countermeasure proposal applied by the countermeasure proposal applying unit 16 are registered.
The entries registered in the executed setting change list 35 are sequentially registered in the lower part of FIG. 4 every time they are executed. However, the order of the setting change contents to be executed is one example shown in FIG. Not limited to this.

  The countermeasure plan deriving unit 15 can hold the setting change queue 15a when deriving a countermeasure plan. The setting change queue 15a is a queue that collects information related to execution or cancellation of setting changes. “Cancellation of setting change” means to return the changed setting to the state before the change.

As illustrated in FIG. 5, the setting change queue 15 a includes one or a plurality of sets of item numbers (item numbers in the setting change candidate list 34) and corresponding setting change handling (execution and cancellation). For example, the “item number 3: execution” queue in FIG. 5 is a queue for instructing the setting change (configuration switching) of item number 3. The older the data input to the setting change queue 15a, the lower the position in FIG. The countermeasure plan deriving unit 15 transmits the setting change queue 15a to the countermeasure plan applying unit 16, and the countermeasure plan applying unit 16 refers to the setting change queue 15a, so that the corresponding setting changes are sequentially executed from the oldest one.
The queue added to the setting change queue 15a is added to the upper part in FIG. 5 in accordance with the setting change candidate list 34. However, the example shown in FIG. 5 is an example, and the present invention is not limited to this.

<Processing>
As shown in FIG. 6, the service recovery device 1 of the present embodiment has the following processing (overall processing) of the service recovery device 1 of the present embodiment. This process starts from step S1.

  In step S1, the traffic extraction unit 11 extracts request traffic and response traffic from the collected flow data. After step S1, the process proceeds to step S2.

  In step S2, the stationarity calculation unit 12 calculates the stationarity between the extracted request traffic and response traffic. After step S2, the process proceeds to step S3.

In step S3, the service quality determination unit 13 determines whether the relationship between the request traffic and the response traffic within the specific period deviates from the continuity calculated by the continuity calculation unit 12. Determine the quality of the. The service quality determination unit 13 determines the quality of the service using an allowable error that is a threshold value regarding the degree of deviation between the relationship used by the service quality determination unit 13 and the continuity calculated by the continuity calculation unit 12. Can do. The allowable error is described in Patent Document 1 and will not be described. After step S3, the process proceeds to step S4.
Proceed to

  In step S4, when there is an abnormality that causes a decrease in service quality (Yes), the process proceeds to step S5. On the other hand, if there is no abnormality that causes a decrease in the quality of the service (No), it means that the service is normal (the service is normally normal or has recovered from the abnormal state), and the process proceeds to step S6.

  In step S5, the countermeasure plan derivation unit 15 and the countermeasure plan application unit 16 execute a countermeasure plan execution process. Details of the countermeasure plan execution process will be described later. As a result, a setting change that constitutes a countermeasure plan is executed for the network. After step S5, the process returns to step S2.

  In step S6, the measure plan evaluation unit 14 evaluates the setting change stored in the setting change candidate list 34 for service restoration. The measure plan evaluation unit 14 can refer to the detailed data stored by the service quality degradation state storage unit 33 during the evaluation. Details of the detailed data storage and setting change evaluation will be described later. As a result, the value registered in the “evaluation value (priority)” column of each setting change stored in the setting change candidate list 34 is changed. After step S6, this process ends.

  According to the process shown in FIG. 6, even when an abnormality is discovered by monitoring a service, automatic recovery can be performed.

[Details of countermeasure plan execution processing]
As shown in FIG. 7, the details of the countermeasure plan execution process (step S5 in FIG. 6) are as follows. This process starts from step A1.

In step A1, the countermeasure plan deriving unit 15 performs an end determination that is a determination as to whether or not all the countermeasure plans have been executed. Specifically, the number of entries (measures proposed consisting of combinations of NW setting changes) that have been registered in the executed setting change list 35 throughout the entire process (FIG. 6) is the setting change candidate list 34. It determines greater or not than the number of countermeasures that can be created by combining the configuration changes that have been registered _{(4 C 1 + 4 C 2} -1+ 3 C 3 × 2 = 11) on. If there are many, the countermeasure plan deriving unit 15 transmits a message indicating that “derivation of an appropriate countermeasure plan is impossible” to the result output unit 17, notifies the maintenance person, and ends the process. If not, the process proceeds to step A2.

  In step A2, the countermeasure plan deriving unit 15 collects detailed data about the network device 2 whose service quality is fluctuating more than an allowable error as information on the location where the quality degradation has occurred, and the service quality degradation status Save in the storage unit 33. After step A2, the process proceeds to step A3.

  In step A3, the countermeasure plan deriving unit 15 performs a setting change reset process. Specifically, a setting change cancel operation corresponding to the entry registered in the executed setting change list 35 (a queue indicated by “item number X: cancel” (see FIG. 5)) is added to the setting change queue 15a. With the process of step A3, when another countermeasure plan is executed, the influence of the previously executed setting change can be eliminated. After step A3, the process proceeds to step A4.

  In step A <b> 4, the countermeasure plan deriving unit 15 acquires N setting changes from the setting change candidate list 34. N is a natural number, and the initial value is 1. According to FIG. 3, since there are four setting change entries, N takes a value of 1-4.

For example, the measure proposal deriving unit 15 obtains N setting changes (combinations) from the setting change candidate list 34 (FIG. 3), assuming that N = 1. In the present embodiment, as a setting change acquisition order, for example, a policy of preferentially acquiring the “evaluation value (priority)” (FIG. 3) can be set, but the present invention is not limited to this. Not. After acquiring all the setting changes for each N, if there is still no countermeasure that can be recovered from the abnormality, the process of step A4 is performed again with N = N + 1. When N is 2 or more, the evaluation value of the acquired combination of setting changes can be the total value of the “evaluation values (priority)” (FIG. 3) of the corresponding setting changes, but is not limited thereto. Absent.
After step A4, the process proceeds to step A5.

  In step A5, the measure proposal deriving unit 15 determines whether or not the acquired N setting changes (combinations) have been registered in the executed setting change list 35 throughout the entire process (FIG. 6). judge. This determination can be made by a known technique of tracing the registration history of the executed setting change list 35. If it has been registered (step A5 / Yes), the corresponding N setting changes have already been executed. Therefore, in order to avoid duplicate execution, the process returns to step A4, and the countermeasure plan deriving unit 15 acquires new N setting changes. On the other hand, when it has not been registered (step A5 / No), the countermeasure plan deriving unit 15 determines that the setting change has not been executed, and proceeds to step A6.

  In step A6, the countermeasure plan deriving unit 15 adds the corresponding setting change execution operation to the setting change queue 15a. Specifically, the countermeasure plan deriving unit 15 causes the setting change queue 15a to execute the setting change determined to be unexecuted in step A5 (example: “item ○, ○: execution” (see FIG. 5)). Add After step A6, the process proceeds to step A7.

  In step A7, the measure plan deriving unit 15 executes a maintenance person's implementation propriety confirmation process. Specifically, the countermeasure plan deriving unit 15 includes setting changes in which the value of the “maintenance personnel determination waiting flag” in the setting change candidate list 34 is “1: confirmation required” for the target N setting changes. If it is, the execution of N target setting changes is suspended until an instruction from the maintenance person is given. The instruction from the maintenance person can be realized by input from the HMI device 5, for example. After an instruction from the maintenance person, the process proceeds to step A8.

  In step A8, the measure plan deriving unit 15 transmits the setting change queue 15a to the measure plan applying unit 16. After step A8, the process proceeds to step A9.

  In step A9, the measure plan applying unit 16 refers to the setting change queue 15a received from the measure plan deriving unit 15 and executes the corresponding setting change. After step A9, the process proceeds to step A10.

In step A10, the measure proposal applying unit 16 registers the executed setting change in the executed setting change list 35 (FIG. 4). Specifically, “item number”, “date / time”, and “setting change content” are registered for the executed change content.
After step A10, this process ends, and the process returns to step S2 (FIG. 6).

  According to the processing shown in FIG. 7, it is possible to try all possible countermeasures for recovering from a service abnormality.

<Details of setting change evaluation>
In step S6, when the measure plan evaluation unit 14 evaluates the setting change stored in the setting change candidate list 34, for example, for the setting change content that contributes to the restoration of the service, the evaluation value can be increased. . Further, for example, the evaluation value can be reduced for the setting change contents that have not contributed to the restoration of the service. Also, the evaluation value can be increased or decreased according to the abnormality detection location of the service.

[Evaluation method 1: Increase / decrease fixed value]
For example, the evaluation value is increased or decreased according to the following rules.
Rule 1: If the combination of N setting changes constituting the countermeasure proposal does not contribute to the restoration of the service, 0.1 / N ² is subtracted from the setting value of each setting change. However, when the evaluation value is less than 0, it is set to 0.
Rule 2: When a combination of N setting changes constituting the countermeasure proposal contributes to the restoration of the service, 0.3 / N is added to the setting value of each setting change. However, when the evaluation value exceeds 1, it is 1.

It is assumed that the example of the trial result of the countermeasure plan tried before the service restoration and the increase / decrease of the corresponding evaluation value according to the setting change candidate list 34 shown in FIG. 3 are as follows.

No recovery after trial of countermeasure for item 1 only → -0.1 / 1 ² = -0.1
No recovery by trial of measure 3 only → -0.1 / 1 ² = -0.1
No recovery by trial of countermeasures for item 4 only → -0.1 / 1 ² = -0.1
No recovery by trial of countermeasures for item 2 only → -0.1 / 1 ² = -0.1
No recovery by trial of countermeasures consisting of item numbers 1 and 3 → -0.1 / 2 ² = -0.025
No recovery by trial of countermeasures consisting of items 1 and 4 → -0.1 / 2 ² = -0.025
Recovered by trial of measures consisting of item numbers 3 and 4 → + 0.3 / 2 = +0.15

At this time, the increase / decrease value of the evaluation value of each setting change (item numbers 1 to 4) is as follows.

Increase / decrease value of setting change of No.1: -0.1 -0.025 -0.025 = -0.15
Increase / decrease value of setting change of No. 2: -0.1
Increase / decrease value of setting change of No.3: -0.1 -0.025 +0.15 = +0.025
Increase / decrease value of setting change of No.4: -0.1 -0.025 +0.15 = +0.025

[Evaluation method 2: Increase / decrease corresponding to the abnormal location that occurred]
The increase / decrease value of the evaluation value can be changed according to the information of the location where the service abnormality has occurred. For example, the final increase / decrease value of the evaluation value can be multiplied by a coefficient according to the number of end users accommodated in the network device 2 in which an abnormality has occurred.

Assume that the number of accommodated users at the abnormality detection location is M, and the number of users of the entire service is M_max.
When the combination of N setting changes constituting the countermeasure proposal does not contribute to the restoration of the service, (0.1 / N ² ) × (M / M_max) is subtracted from the setting value of each setting change. However, when the evaluation value is less than 0, it is set to 0.
On the other hand, when a combination of N setting changes constituting the countermeasure proposal contributes to the restoration of the service, (0.3 / N) × (M / M_max) is added to the setting value of each setting change. However, when the evaluation value exceeds 1, it is 1.

  As described above, the countermeasure plan evaluation unit 14 can quantitatively determine the contribution rate of the setting change that contributes to the recovery from the service abnormality by updating the evaluation value for each setting change.

<Summary>
According to the present embodiment, it is possible to sequentially apply measures proposed by various combinations of prepared network setting changes to a network in response to a service abnormality that has occurred.
Therefore, automatic restoration of services provided on the network can be realized.

  In addition, by setting an evaluation value for each network setting change, it is possible to quantitatively determine the contribution rate of the network setting change that contributes to recovery from service abnormality.

≪Others≫
(1): With respect to the setting changes registered in the setting change candidate list 34 (FIG. 3), even if the setting changes are the same, different entries may be created according to the location where the service abnormality occurs. Specifically, for the setting change candidate list 34, “item number”, “change contents”, “change method”, “restrictions”, “maintenance decision flag”, “evaluation value (priority)”, etc. In addition to the column, a “service abnormality detection location” column may be prepared. Thereby, an evaluation value can be set for each abnormality detection location of the service, and the contribution rate of the setting change that contributes to recovery from the abnormality of the service can be determined more quantitatively.

In addition, it is possible to realize a technique in which various techniques described in this embodiment are appropriately combined.
Further, the software described in the present embodiment can be realized as hardware, and the hardware can also be realized as software.
In addition, hardware, software, flowcharts, and the like can be changed as appropriate without departing from the spirit of the present invention.

DESCRIPTION OF SYMBOLS 1 Service restoration apparatus 2 Network apparatus 3 Server 4 Terminal 5 HMI apparatus 10 Processing part 11 Traffic extraction part 12 Stationarity calculation part 13 Service quality determination part (determination part)
DESCRIPTION OF SYMBOLS 14 Countermeasure plan evaluation part 15 Countermeasure plan derivation | leading-out part 15a Setting change queue 16 Countermeasure plan application part 17 Result output part 20 Input / output part 21 Input part 22 Output part 30 Storage part 31 Flow data storage part 32 Stationary data storage part 33 Service quality Decrease status storage unit 34 Setting change candidate list 35 Executed setting change list

Claims (4)

A service recovery device that monitors services using flow data collected from a plurality of network devices and recovers if there is an abnormality in the service,
A storage unit for storing a network setting change for restoring the service;
A determination unit that determines abnormality of the service by obtaining a deviation degree from the continuity obtained from the collected flow data;
A countermeasure plan derivation unit for deriving a countermeasure plan that combines one or more network setting changes that contribute to the restoration of the service from the storage unit;
A countermeasure proposal application section that applies the countermeasure proposal derived by the countermeasure proposal derivation section to a network in which the network device is arranged,
A service recovery device characterized by that. When the countermeasure proposal is applied and the service is restored, the countermeasure proposal evaluation section that increases or decreases the evaluation value of the network setting change stored in the storage section according to the contribution of restoration of the service,
The service restoration apparatus according to claim 1. A service recovery method in a service recovery device that monitors services using flow data collected from a plurality of network devices and recovers if there is an abnormality in the service,
The storage unit of the service restoration device stores a network setting change for restoring the service,
The service restoration device
A determination step of determining an abnormality of the service by obtaining a degree of deviation from continuity obtained from the collected flow data;
A countermeasure plan derivation step for deriving a countermeasure plan combining one or a plurality of network setting changes that contribute to the restoration of the service from the storage unit;
Executing a countermeasure proposal application step of applying the countermeasure proposal derived in the countermeasure proposal derivation step to a network in which the network device is arranged;
A service recovery method characterized by the above. The service restoration device
When the countermeasure plan is applied and the service is restored, a countermeasure plan evaluation step is executed to increase or decrease the evaluation value of the network setting change stored in the storage unit according to the contribution of restoration of the service. ,
The service restoration method according to claim 3.

Images