JP2021129203A - Communication analysis device, communication analysis program, and communication analysis method - Google Patents

Abstract

To analyze communication abnormalities efficiently and in detail.SOLUTION: The present invention relates to a communication analysis device. The communication analysis device of the present invention includes: encoding processing means for generating a flow code string by acquiring flow data by dividing traffic data to be analyzed according to each flow, discriminating a protocol used for communication, and performing encoding processing of converting each signal of communication indicated in the flow data into a code; label assigning means for assigning a label corresponding to a similar one from multiple pieces of teacher data to the flow code string or a code string based on the flow code string; and output means for performing a predetermined output corresponding to the label for the flow code string or the code string based on the flow code string to which the label is assigned.SELECTED DRAWING: Figure 1

Description

The present invention relates to a communication analysis device, a communication analysis program, and a communication analysis method, and can be applied to, for example, a process of analyzing an abnormality and the type of the abnormality from the communication content.

In general, to identify a communication failure, rely on the experience of engineers based on detailed information such as communication packet dumps and model-dependent knowledge such as vendor expansion and protocol implementation fluctuations. It was often analyzed. On the other hand, in recent years, technological innovations such as matching with events that have occurred in the past by pattern recognition using machine learning devices such as AI are progressing, but in machine learning, completeness of data of events that have occurred in the past is important. Is known to be.

By the way, in a protocol that includes a procedure derived from vendor-dependent implementation fluctuations, machine learning is possible for a typical normal sequence, but when maintaining / confirming a session or notifying an error or warning. In some cases, a message corresponding to the notification may be inserted as appropriate, and it is difficult to perform machine learning in advance. In addition, when an error occurs in actual communication, a sequence of various unexpected patterns occurs, so it is difficult to collect data of all patterns of normal system / abnormal system and perform machine learning in the past. There was a problem that it was.

For example, in the TCP (Transport Control Protocol) sequence, when data is transferred from the first terminal to the second terminal, after successful TCP session generation, the first terminal depends on the amount of data to be transferred. The message "PSH + ACK" from and "ACK" from the second terminal may be repeated, and there is no regulation regarding the number of times. Further, in TCP, since there is an exceptional extension procedure in the communication of the normal system such as Selective ACK (selection acknowledgment), there are many variations in the normal system. Further, in TCP communication, there are many variations of an abnormal system, such as sudden occurrence of RST due to an error such as packet loss, or disconnection by FIN even though data transfer is completed normally.

The same thing exists in other protocols. For example, when considering SIP (Session Initiation Protocol) for VoIP call control, 100 Triing, 180 Ring, 200 OK are continued after receiving INVITE, which is a start message, as in TCP, and ACK is returned for it. There is a typical sequence. Even in this case, depending on the vendor, the normal sequence may be determined to be abnormal due to fluctuations such as the PRACK message being inserted irregularly.

As a conventional technique for solving such a problem, for example, there is a description technique of Patent Document 1.

Patent Document 1 describes a method for determining whether a communication is an attack (scan) or a normal operation based on the header information of a packet. Patent Document 1 mainly uses a discrimination method using a threshold value related to a statistical value, but also discloses a characteristic method of determining a network-like distance using the Levenshtein distance of an IP address. ing.

JP-A-2017-76841

By the way, it is assumed that the method described in Patent Document 1 is used to identify which error type (error cause) is when an error (abnormality) occurs in the communication flow. In this case, in the method described in Patent Document 1, the number of packets is counted based on the change in the counter value in a certain period of time, and secondary information is used for determining whether or not the packet is normal. Therefore, the method described in Patent Document 1 can be applied to determine whether the error is a true error or an error that does not need to be bothered, but there remains a problem that it cannot be used for the purpose of identifying the error type and taking countermeasures. ..

When the conventional technology is used, it is possible to detect that an error (abnormality) has occurred in spite of the above-mentioned problems, but in an actual environment, processing is performed by a typical normal sequence. It is rarely completed, and there are a wide variety of communication sequence patterns regardless of whether they are normal or abnormal. Therefore, even if the conventional technique is used, there is still a problem that it is difficult to investigate the cause by pattern learning using machine learning or the like when a connection problem occurs.

In view of the above problems, a communication analysis device, a communication analysis program, and a communication analysis method capable of efficiently and in detail analyzing communication abnormalities are desired.

In the first communication analysis device of the present invention, (1) the data of the traffic to be analyzed was divided for each flow to acquire the flow data, and each communication signal shown in the flow data was used. The coding processing means for generating a flow code string by performing the coding process for converting to a code according to the protocol, and (2) the flow code string or the code string based on the flow code string are similar from a plurality of teacher data. Labeling means for assigning a label corresponding to the object, and (3) an output means for outputting a predetermined output according to the label with respect to the flow code string or the code string based on the flow code string to which the label is attached. It is characterized by having and.

The second communication analysis program of the present invention acquires flow data by dividing the data of the traffic to be analyzed into (1) for each flow, and obtains the flow data, and obtains each communication signal shown in the flow data. A plurality of teacher data for the coding processing means for generating a flow code string by performing the coding process for converting to a code according to the protocol used, and (2) the flow code string or the code string based on the flow code string. (3) For the flow code string or the code string based on the flow code string to which the label is attached, a predetermined output corresponding to the label is output. It is characterized in that it functions as an output means to be performed.

A third aspect of the present invention is a communication analysis method performed by a communication analysis apparatus, which includes (1) a coding processing means, a labeling means, and an output means, and (2) the coding processing means is a traffic to be analyzed. Data is divided for each flow to acquire flow data, and each communication signal shown in the flow data is coded to be converted into a code according to the protocol used to generate a flow code string. , (3) The labeling means assigns a label corresponding to a plurality of teacher data to the flow code string or a code string based on the flow code string, and (4) the output means said. It is characterized in that a predetermined output corresponding to the label is performed on the flow code string or the code string based on the flow code string to which the label is attached.

According to the present invention, it is possible to provide a communication analysis device, a communication analysis program, and a communication analysis method for efficiently and in detail analyzing communication abnormalities.

It is a block diagram which showed the connection structure of each apparatus which concerns on 1st Embodiment. It is a block diagram which showed the example of the connection structure around the error cause analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the example of the substitution character definition information about TCP held by the error analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the example of the sequence included in the flow of TCP which is the analysis target by the error cause analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the process of character stringizing the TCP flow by the error cause analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the example of the substitution character definition information about SIP held by the error analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the example of the sequence included in the flow of the SIP to be analyzed by the error cause analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the process of character stringizing the SIP flow by the error cause analysis apparatus which concerns on 1st Embodiment. It is a figure which showed the example of the process which detects the repeated character string in the error cause analysis apparatus which concerns on 1st Embodiment. In the error cause analysis device according to the first embodiment, an example of the editing distance between a plurality of teacher character strings (correct answer data) and a plurality of input deleted flow character strings is shown in a table format. be. It is a block diagram which showed the example of the connection structure around the error cause analysis apparatus which concerns on 2nd Embodiment.

(A) First Embodiment Hereinafter, the first embodiment of the communication analysis device, the communication analysis program, and the communication analysis method according to the present invention will be described in detail with reference to the drawings. In this embodiment, an example in which the communication analyzer, the communication analysis program, and the communication analysis method of the present invention are applied to the error cause analysis device and the error cause analysis program will be described.

(A-1) Configuration of First Embodiment FIG. 1 is a block diagram showing a connection configuration of devices related to the first embodiment. The reference numerals in parentheses in FIG. 1 are the reference numerals used in the second embodiment described later.

FIG. 2 is an explanatory diagram showing an example of a connection configuration of the error cause analysis device 10 according to the first embodiment.

The error cause analysis device 10 is a device that monitors the communication status of the network N and performs processing including detection of an error (abnormality) and analysis of the cause of the detected error (hereinafter, referred to as "communication analysis processing").

In the example of the first embodiment, it is assumed that at least the PC terminal 20 and the server 30 are connected to the network N to be analyzed by the error cause analysis device 10.

The PC terminal 20 is, for example, a terminal used by a user (subscriber) connected to the network N.

The server 30 is a device that communicates with the PC terminal 20 to provide a predetermined service. The configuration of the server 30 is not limited, but for example, a server (computer) that provides various services (for example, a Web service, a database service, etc.) to the PC terminal 20 is applicable.

In this embodiment, for the sake of simplicity, the error cause analysis device 10 describes an example of analyzing the communication between the PC terminal 20 and the server 30, but connects to the network N configuration and the network N. Attributes such as the number and types (functions) of terminals and servers are not limited.

Next, the internal configuration of the error cause analysis device 10 will be described with reference to FIG.

The error cause analysis device 10 includes a receiving unit 11, a protocol analysis / character string processing unit 12, a repeating character string deleting unit 13, a labeling processing unit 14, a cause output unit 15, a teacher data holding unit 16, and a repeating character string holding unit. It has a part 17.

The error cause analysis device 10 may be realized, for example, by installing a program (including a communication analysis program according to the embodiment) on a computer having a processor and a memory. Further, in the error cause analysis device 10, some or all of the processing may be realized by hardware (for example, a dedicated semiconductor chip or the like).

The receiving unit 11 has a function of acquiring information (hereinafter, referred to as “flow data”) regarding each flow of traffic flowing through the network N. In the example of this embodiment, it is assumed that the flow data acquired by the receiving unit 11 includes at least the flow data related to the traffic flowing between the PC terminal 20 and the server 30. The configuration in which the receiving unit 11 acquires the flow data is not limited, and various configurations can be applied. For example, flow data may be collected online in real time from a gateway device (for example, a network device such as a router or proxy) arranged on a route between the PC terminal 20 and the server 30 (not shown). The flow data acquired by the gateway (not shown above) may be acquired offline (for example, the data recorded in the storage may be acquired).

The protocol analysis / character string processing unit 12 classifies the flow data received by the receiving unit 11 for each flow, and analyzes the corresponding protocol for each flow. Then, the protocol analysis / character string processing unit 12 converts the communication sequence (string of the signal (communication procedure) for each time series) included in the flow from the flow data of each flow into characters corresponding to the protocol of the flow. Performs a process of converting a column (hereinafter, this character string is referred to as a "flow character string") (hereinafter, referred to as a "character string conversion process"). In other words, the protocol analysis / character string processing unit 12 performs a process of replacing each signal (procedure) constituting the communication sequence with a corresponding character and converting the entire sequence into a character string. The details of the processing performed by the protocol analysis / character string processing unit 12 will be described later. The character system (code system) used in the character string conversion process is not limited, but for example, characters that can be described by codes such as ASCII code and Unicode may be applied. In the present specification, the concept of "character" will be described as including all characters that can be described by various character codes (for example, ASCII code, etc.) such as symbols and numbers.

The repeating character string deletion unit 13 repeatedly occurs (generates redundantly) from the flow character string processed by the protocol analysis / character string processing unit 12 based on the data registered in the repeating character string holding unit 17. Performs a process (hereinafter referred to as "repeated character string deletion process") for deleting a character string (hereinafter referred to as "repeated character string") that occurs cyclically. Further, the repeating character string deleting unit 13 may supply a newly appearing deleteable character string to the repeating character string holding unit 17 to register the character string. In the following, it is assumed that the flow character string deleted by the repeating character string deletion unit 13 is referred to as a “deleted flow character string”. The processing details of the repeating character string deletion unit 13 will be described later.

The repeating character string holding unit 17 has a function of holding a list (list) of repeating character strings used in the repeating character string deleting process and providing the repeating character string deleting unit 13. The repeating character string holding unit 17 may manage the repeating character strings by classifying them according to the protocol.

The label assignment processing unit 14 calculates a parameter indicating the degree of similarity of each deleted flow character string with the teacher character string held by the teacher data holding unit 16 (hereinafter, referred to as “teacher character string”). do. Here, the label assignment processing unit 14 performs a process of calculating the edit distance as a parameter indicating the degree of similarity between the deleted flow character string and the teacher character string (hereinafter, referred to as “edit distance calculation process”). And. The editing distance is a technology that quantifies how many times a character string editing such as insertion / deletion is repeated to obtain the corresponding character string, and is also used for sentence theft detection. In other words, the edit distance is a parameter that indicates the minimum number of steps required to transform one character string into the other character string by inserting, deleting, or replacing one character. That is, it can be said that the editing distance is a numerical value of how many times the character string editing such as insertion / deletion is repeated to obtain the corresponding character string when the original character string is arranged. In the example of this embodiment, the Levenshtein distance is used as the editing distance.

Then, the label assignment processing unit 14 selects a teacher character string that is close to the editing distance and is likely to be, and assigns a label corresponding to the teacher character string to the deleted flow character string (hereinafter, "label assignment"). It is called "processing"). Here, the label is the communication content (for example, normal / abnormal communication) indicated by the character string (deleted flow character string or teacher character string) in the protocol to be analyzed, or abnormal. The cause of communication, etc.) shall be displayed.

For example, the labeling processing unit 14 may select the deleted flow character string and the teacher character string having the shortest editing distance. As for the deleted flow character string, a plurality of teacher character strings are selected for one deleted flow character string, and the labels of the selected plurality of teacher character strings are assigned to the deleted flow character string. It may be given to. For example, if there are a plurality of teacher character strings having the same editing distance as the deleted flow character string, the label assignment processing unit 14 may select all the labels of those teacher character strings. Further, for example, the label assignment processing unit 14 may select all the deleted flow character strings and the teacher character strings whose editing distance is equal to or less than the threshold value. The processing details of the labeling processing unit 14 will be described later.

The teacher data holding unit 16 holds data (hereinafter, referred to as “teacher data”) in which a label (label corresponding to the correct answer) is associated with the teacher character string supplied to the label assigning processing unit 14. .. The teacher data held in the teacher data holding unit 16 is, for example, a deleted flow character string acquired in advance by flow data or the like, and a human being (for example, an operator, a designer, etc.) with respect to the deleted flow character string. ) May be applied to the correct answer data. The teacher data holding unit 16 may hold a plurality of teacher data by classifying each protocol.

The cause output unit 15 refers to the label assigned to each deleted flow character string, and performs output processing according to the referenced label. For example, the cause output unit 15 may add (associate with) a given label to each deleted flow character string and output it. At that time, the cause output unit 15 determines the date and time (time stamp) when the flow related to each deleted flow character string occurs, and the host (for example, terminal name or IP address) of the source and / or destination of the flow. ) Or information such as the protocol of the flow may be added. The details of the processing of the cause output unit 15 will be described later.

(A-2) Operation of First Embodiment Next, the operation of the error cause analysis device 10 of the first embodiment having the above configuration will be described.

When the receiving unit 11 receives the flow data, the receiving unit 11 supplies the flow data to the protocol analysis / character string processing unit 12.

When the flow data is supplied, the protocol analysis / character string processing unit 12 separates (classifies) the flow data for each flow and determines the protocol for each flow. Various separation methods (classification methods) can be applied to the process in which the protocol analysis / character string processing unit 12 separates traffic data for each flow. For example, the protocol analysis / character string processing unit 12 may divide the flow using so-called 5-tuples (a combination of a source address and a port, a destination address and a port, and a protocol number) as a key.

Then, the protocol analysis / character string processing unit 12 determines the protocol for the flow data for each classified flow. The method by which the protocol analysis / character string processing unit 12 determines the protocol of each flow is not limited, and various methods can be applied. The protocol analysis / character string processing unit 12 may, for example, determine the protocol for each flow from the flow data based on the protocol number, port number, or the like of the packets constituting the flow.

Then, the protocol analysis / character string processing unit 12 has what meaning in the protocol for each signal (message) constituting the sequence for each flow (communication sequence included in the flow data). It analyzes whether it exists and performs a character string conversion process that replaces it with a character according to the protocol determined for each flow.

By the way, in a TCP packet, the meaning (processing / function) of the packet is indicated by the control bit of the TCP header. For example, for the control bit of the TCP header, "URG" indicating that the emergency pointer field is valid, "ACK" indicating that the acknowledgment number field is valid, and the data stored in the buffer are output (pushed). Flags (bits) corresponding to each of "PSH" requesting the operation, "RST" requesting the reset of the connection, "SYN" requesting the synchronization of the sequence number, and "FIN" indicating the end of transmission are provided. There is. In a TCP packet, the meaning (processing content and function) of the packet is indicated by the combination of the control bits of the TCP header as described above. In the following, it is assumed that the name (message) corresponding to the flag set in each TCP packet is used. For example, a TCP packet in which the SYN flag is set (set to 1) becomes "SYN".

In other words, when the protocol analysis / stringification processing unit 12 analyzes the TCP protocol flow (sequence), it is a session start (SYNC), a response (ACK), or a data transmission (PSH). Map to the information. Further, the protocol analysis / character string conversion processing unit 12 defines replacement characters for each character for each meaning (defined by a dictionary) as the character string conversion process, and the communication (sequence) characters that occur in time series. Make a line. That is, the protocol analysis / character string conversion processing unit 12 converts a meaningful character string sequence based on the communication flow as the character string conversion process.

Next, as an example, a specific example of the character string conversion process when the protocol determined for a certain flow is TCP will be described with reference to FIGS. 3 to 5.

Here, in the protocol analysis / character string conversion processing unit 12, the character to be replaced for each name (type) of the original signal (message) with respect to the protocol to be processed for character string conversion (hereinafter, also simply referred to as “replacement character”). ) Is defined (hereinafter referred to as "replacement character definition information").

FIG. 3 is a diagram showing an example of substitution character definition information regarding TCP.

As shown in FIG. 3, the replacement character definition information defines (describes) a replacement character for each name (type) of the original signal (message). Specifically, in the TCP replacement character definition information shown in FIG. 3, "S" is used for "SYN", "T" is used for "SYN + ACK", "A" is used for "ACK", and "PSH + ACK" is used for "ACK". "P" for "P", "F" for "FIN", "R" for "RST", "U" for "URG", and so on are defined as replacement characters. And.

FIG. 4 is a sequence diagram showing a series of packets transmitted / received in a TCP sequence between the PC terminal 20 and the server 30. As shown in FIG. 4, in the flow, TCP packets P101 to P105, ... P201 to P204 are flowing between the PC terminal 20 and the server 30. As shown in FIG. 4, the TCP packets of P101 to P105 indicate the messages of "SYN", "SYNC + ACK", "ACK", "PSH + ACK", and "ACK", respectively. Further, as shown in FIG. 4, the TCP packets of P201 to P204 indicate the messages of "FIN", "ACK", "FIN", and "ACK", respectively.

FIG. 5 is a diagram showing a process of character stringizing the flow shown in the sequence of FIG. 4 based on the replacement character definition information shown in FIG.

FIG. 5A is a list in which the messages of each TCP packet in the sequence of FIG. 4 are arranged in chronological order. Then, FIG. 5B shows a flow character string obtained by converting the list of messages shown in FIG. 5A into a character string.

As shown in FIG. 5B, when the TCP packets P101 to P105, ... P201 to P204 are converted into character strings, it becomes "STAPA ... FAFA".

Next, a specific example of the character string conversion process when the protocol determined as an example is SIP will be described with reference to FIGS. 6 to 8.

Normally, a predetermined port number (standard: 5060) of UDP (User Datagram Protocol) is set in the packet in which the SIP message is set. For example, in the protocol analysis / character string processing unit 12, if the port number for SIP used on the network N is registered in advance, the SIP flow can be determined. Further, the protocol analysis / character string processing unit 12 may recognize the message type (name) by referring to the header portion of the SIP message.

FIG. 6 is a diagram showing an example of substitution character definition information regarding SIP.

As shown in FIG. 6, replacement characters are defined (description) for each type (name) of the original message in the replacement character definition information. In the SIP replacement character definition information shown in FIG. 6, "I" is used for "INVITE", "B" is used for "BYE", "A" is used for "ACK", and "P" is used for "PRACK". , "C" for "CANCEL", "J" for "INFO", "M" for "MESSAGE", "E" for "REGISTER", "100 Trying" for "100 Trying" "R" for "T" and "180 Ringing", "O" for "200 OK", ... Are defined as replacement characters, respectively.

FIG. 7 is a sequence diagram showing a flow of a series of SIP messages (packets in which SIP messages are set) transmitted and received between the PC terminal 20 and the server 30. As shown in FIG. 7, in the sequence, SIP message packets P301 to P305, ... P401, P402 are flowing between the PC terminal 20 and the server 30. As shown in FIG. 7, the packets (SIP messages) of P301 to P305 indicate the messages of "INVITE", "100 Trying", "180 Ringing", "200 OK", and "ACK", respectively. Further, as shown in FIG. 7, the packets (SIP messages) of P401 and P402 indicate the messages of "BYE" and "200 OK", respectively.

FIG. 8 is a diagram showing a process of character stringizing the flow shown in the sequence of FIG. 7 based on the replacement character definition information shown in FIG.

FIG. 8A is a list in which each SIP message in the sequence of FIG. 7 is arranged in chronological order. Then, FIG. 8B shows a flow character string obtained by converting the list of SIP messages shown in FIG. 8A into a character string.

As shown in FIG. 8B, when the packets P301 to P305, ... P401, and P402 are converted into character strings, they become "ITROA ... BO".

As described above, the protocol analysis / character string processing unit 12 generates a flow character string obtained by character stringizing the communication sequence for each separated flow.

Next, the repeating character string deletion unit 13 performs a process (repeated character string deletion process) of deleting a redundant portion (repeated character string) from the flow character string.

For example, when a TCP sequence is converted into a character string, the amount of content (data) to be transmitted, such as repeating PSH + ACK (data transmission) and ACK (data reception response) an arbitrary number of times according to the amount of data to be communicated, etc. May contain dependent redundant strings. In addition, when the SIP sequence is processed into a character string, PRACK (provisional response confirmation) may be inserted as appropriate for communication due to factors such as stabilizing the communication flow, and the characters generated by this PRACK may be inserted. Columns may be redundant. The repeating character string deletion unit 13 performs a process of deleting such a redundant character string as a "repeating character string" from the flow character string.

As described above, the repeated character string referred to in the repeated character string deletion process in the repeated character string deletion unit 13 is held (registered) in the repeated character string holding unit 17. The repeating character string to be held by the repeating character string holding unit 17 may be, for example, one created and set in advance by a human being (for example, an operator or a designer). However, since the variation of the repeating character string may increase, the repeating character string deleting unit 13 detects a newly appearing repeating character from the supplied flow character string and registers it in the repeating character string holding unit 17. You may do so.

The method by which the repeating character string deletion unit 13 detects a new repeating character from the supplied flow character string is not limited, but various algorithms for detecting the circulation (repetition) appearing in an arbitrary column are used. Can be done. For example, the repeated character string deletion unit 13 may use the Floyd cycle detection method.

FIG. 9 is a diagram showing an example of performing a repeat character detection process and a repeat character string deletion process on a flow character string in which the repeat character string deletion unit 13 is input.

9.

Here, it is assumed that the repeating character string deletion unit 13 simply detects all the character strings (circulation) that appear a plurality of times (twice or more) by using the Floyd cycle detection method. Then, as shown in FIG. 9, the repeating character string deletion unit 13 will perform "ITRiAIIAaIiAaIiAaIiAaIiAaIiAaIAiABb", "ITSIAIiAIIAIIABb", "ITSiAIIAIIAIIABb", "ITRiAITiAITiABb", "ITRiAITiAITiAJi" Will be detected repeatedly. At this time, the repeating character string deletion unit 13 detects only the character string (circulation) that appears N times (N is an integer of 2 or more) or more, or M characters or more (M is an integer of 2 or more) when detecting the repeating character. Restrictions may be set such that only a character string (circular) of 1 or more characters) is detected, or only a character string of J characters or less (circular) is detected. In the repeating character string deletion unit 13, a plurality of restrictions may be set at the same time. Further, the repeating character string deleting unit 13 may leave only one repeating character string (delete only the redundant part) without deleting all the repeating character strings. The repeating character string deletion part is not limited to the Floyd cycle detection method.

As shown in FIG. 9, when the flow character string "ITRiAIiAaIiAaIiAaIiAaIiAaIiAaIiAiABb" is input, the repeat character string deletion unit 13 deletes all the repeat character strings "iAI" from the flow character string and deletes "ITRiABb". Output the processed flow string. Similarly, the repeat character string deletion unit 13 also performs the repeat character string deletion process for "ITSAAIAIAIAIAIABb", "ITRiAITiAITiABb", and "ITRiAJjJjJjJjBb" using the repeat character strings "iAI", "iAIT", and "Jj", respectively. Then, the deleted flow character strings "ITSiABb", "ITRiABb", and "ITRiABb" are output.

As described above, the repetitive character string deletion unit 13 performs the repetitive character string deletion process for each flow character string.

Next, the labeling processing unit 14 calculates the editing distance of the deleted flow character string from the teacher character string (teacher data) held by the teacher data holding unit 16, and the teacher who is close to the editing distance and is likely to be edited. Select the character string to assign the label of the teacher character string to the deleted flow character string.

As described above, in the example of this embodiment, the labeling processing unit 14 describes that the Levenshtein distance is applied to the editing distance between the deleted flow character string and the teacher character string (teacher data).

FIG. 10 is a table showing the editing distance between the plurality of teacher character strings (correct answer data) and the plurality of input deleted flow processed flow character strings (sample data).

In FIG. 10, the teacher character string is shown by a label in the column direction (“pseudo-net label” in the figure), and the deleted flow character string is shown by the actual type in the row direction (“actual” in the figure). It is illustrated as "net label").

In FIG. 10, as the real network label (deleted flow character string), "normal (early dialog)", "normal", "Busy error", "CANCEL", and "Message, 200OK" in SIP are shown. .. Further, in FIG. 10, as a pseudo network labels (teacher character string), "0", "1", "2", "3", "4", _{"5 1", "5 2",} "6" , "7", _{"8 1", "8 2"} are shown _{"8 3".} Of the pseudo-net labels in FIG. 10, only "0" indicates that it is normal, and the others indicate that it is abnormal (error). Note "5 _1", "5 _2", etc., labels subscript (subscript) is appended is intended the same cause of the pattern of the teacher string in response to but subscript shows different And. The label display format is not limited to the above format, and any format may be used as long as each label is unique. Further, in FIG. 10, in order to simplify the explanation, those normal in pseudo network label is in only one "0" MULTI (e.g., "0 _1", "0 _2", ...・ It is natural that multiple settings may be made.

In the table of FIG. 10, when the distance between each real net label and each pseudo net label that needs to be determined is overlooked, it can be estimated that the editing distance is less than 4 when it can be judged that the distance is relatively short. That is, the label assigning processing unit 14 assigns a pseudo network label having an edit distance of a predetermined threshold value Th or less to each deleted flow character string (real network label) as a possibility of being applicable. It may be configured. In the example of FIG. 10, as described above, it can be estimated that Th = 4 is appropriate. The threshold value Th may be set in advance in the repeating character string deletion unit 13, for example.

For example, looking at the row (real net label) of the table in FIG. 10 from above, in the input "normal (eary dialog)" of the top row, the value with the smallest editing distance is 2 and the label is normal (the label is normal. 0) is attached, and all other pseudo-net labels have a larger editing distance than 4. Further, in the input "normal" of the second line from the top, the value of the smallest edit distance is 4, which is the normal label (0), and all the other pseudo-net labels have a larger edit distance than 4. Further, the third input "Busy error" from the top has a large number of 2 and 3 as a small distance. In such a state, among those with a small distance, there are multiple possibilities that it is close to one of the errors (pseudo-label of abnormality), and the labeling is the one that may be applicable. It is appropriate to give more than one. Next, in the fourth input "CANCEL" from the top, since the value of the smallest distance is only 2, it can be identified as an error (abnormality) of the pseudo network label 6.

Finally, in the fifth input "Message 200OK" from the top, no edit distance is found (for example, threshold TH = 4 or less), and it is not close to any of the pseudo-net labels currently held as teacher data. Can be determined. In this case, the label assignment processing unit 14 supplies the input (fifth input “Message 200OK”) to the cause output unit 15 without assigning any label of the teacher data. As a result, the cause output unit 15 can output that the input is an unknown error because it does not correspond to any teacher data. Further, as the same processing, it is possible to increase the editing distance for the editing of the fourth distance, which may have a significantly different meaning in the deleted flow character string.

As described above, in the label assigning processing unit 14, the real network label (deleted) according to the calculation result of the editing distance between the real network label (deleted flow character string) and each pseudo network label (teacher character string). A pseudo-net label (label of a teacher's character string) is attached to the processed flow character string), and the label is supplied to the cause output unit 15.

Then, the cause output unit 15 refers to the label of the supplied deleted flow character string, and performs output processing according to the content of the label. For example, when a deleted flow character string with an error label is generated, information indicating the error (error) (for example, a character string indicating the code or details corresponding to the label) and the deletion are performed. Output information that identifies the flow corresponding to the processed flow character string (for example, the IP address and protocol name of the source and destination of the flow) (for example, to provide information to the operator and the person who responds to the communication failure). (Output of) may be performed. The format when the cause output unit 15 outputs is not limited, and for example, it is output by communication (for example, e-mail transmission, telegram transmission based on a predetermined protocol, message transmission using a chat application, etc.). Alternatively, the display may be output to a display device (not shown) or the sound may be output from a sound device (speaker).

(A-3) Effect of First Embodiment According to the first embodiment, the following effects can be obtained.

In the error cause analysis device 10 of the first embodiment, the flow data is converted into a character string, labeled with a similar teacher character string, and output. Therefore, the cause when a communication error (error) occurs can be determined. The specified information can be output automatically. As a result, in the first embodiment, although the protocol used for each communication service is different and there are innumerable error variations depending on the vendor and combination, the communication failure is analyzed by a skilled person. The effect of being able to automate what was used is obtained.

Further, in the error cause analysis device 10 of the first embodiment, it is possible to perform a process of assigning only the label (error) of the teacher data whose editing distance is equal to or less than the threshold value. As a result, the error cause analysis device 10 of the first embodiment can output error candidates even if similar errors exist, and when an unknown error occurs (the distance is a threshold abnormality with any teacher data). In the case of), it can be output as an unknown error (results that do not have similar teacher data), so it is possible to manually work on only the parts that really need to be analyzed by humans. That is, the error cause analysis device 10 of the first embodiment can be used as an efficient analysis auxiliary tool.

Further, since the error cause analysis device 10 of the first embodiment evaluates using the flow character string in which the redundant repeated characters are deleted and deleted, the teacher required to improve the accuracy of the error cause analysis. The number of data variations can be reduced. In other words, since the error cause analysis device 10 of the first embodiment evaluates by deleting redundant information from the flow character string, it is possible to ensure completeness with less teacher data.

(B) Second Embodiment Hereinafter, a second embodiment of the communication analysis device, the communication analysis program, and the communication analysis method according to the present invention will be described in detail with reference to the drawings. In this embodiment, an example in which the communication analyzer, the communication analysis program, and the communication analysis method of the present invention are applied to the error cause analysis device and the error cause analysis program will be described.

(B-1) Configuration and operation of the second embodiment The connection configuration of the device related to the second embodiment can also be shown with reference to FIG. The reference numerals in parentheses in FIG. 1 are the reference numerals used in the second embodiment described later.

As shown in FIG. 1, the second embodiment is different from the first embodiment in that the error cause analysis device 10 is replaced with the error cause analysis device 10A.

Further, the error cause analysis device 10A of the second embodiment is different from the first embodiment in that the labeling processing unit 14 and the teacher data holding unit 16 are replaced with the labeling processing unit 14A.

The label assignment processing unit 14 of the first embodiment selects teacher data (teacher character string) according to the editing distance from the deleted flow character string, and assigns a label to the selected teacher data. On the other hand, in the labeling processing unit 14A of the second embodiment, teacher data (for teachers) similar to the deleted flow character string is used by using the classifier 141 to which the learning model learned in advance by machine learning is applied. (Character string) is selected, and the process of assigning the label of the selected teacher data is performed.

The classifier 141 is a means for identifying and outputting the corresponding label (pseudo-net label) when the deleted flow character string is input. The classifier 141 automatically determines which teacher character string the input deleted flow character string is most similar to, based on a preset learning model (learned pattern recognition model). Perform processing.

The classifier 141 is, for example, a discriminating means to which a learning model obtained as a result of machine learning using teacher data including a set of a teacher character string and a label (pseudo-net label as correct answer data) is applied by a learning device (not shown in advance). be. As the teacher data applied to the above-mentioned learner, for example, the teacher data held in the teacher data holding unit 16 in the first embodiment can be applied. The labeling processing unit 14A may be further equipped with a learning device that generates a learning model to be applied to the classifier 141 by machine learning. Since various AI systems can be applied to the method of generating the learning model and the method of performing the identification process based on the learning model in the label assignment processing unit 14A, detailed description thereof will be omitted.

(B-2) Effect of Second Embodiment According to the second embodiment, the following effects can be obtained as compared with the first embodiment.

In the error cause analysis device 10A of the second embodiment, unlike the first embodiment, one known label (teacher data) is given, so that the cause of the error is clear. It has the effect that it is possible to deal with the problem without the intervention of skilled personnel.

(C) Other Embodiments The present invention is not limited to each of the above embodiments, and modified embodiments as illustrated below can also be mentioned.

(C-1) In the first embodiment, the labeling processing unit 14 calculates the Levenshtein distance, but the editing distance calculated by the Levenshtein distance is not weighted, so the meaning is opposite. There is a problem that the editing distance with the character string is short. For example, when the character indicating the start of communication is "S", the character indicating the end of communication is "E", the character indicating the success of processing is "O", and the character indicating the failure of processing is "X", " The editing distance between "SOE" and "SXE" is 2, which is a very short distance, but the meaning will change significantly.

Therefore, when the label assignment processing unit 14 calculates the editing distance from the teacher character string, the weight is applied to the editing in which the meaning of the character string changes (the editing in which the characters before and after the editing correspond to a predetermined pattern). The final calculated editing distance may be increased by increasing the attachment.

For example, the labeling processing unit 14 may register in advance an editing pattern for increasing the weighting. For example, in the case of the TCP flow character string in the format shown in FIGS. 3 to 5 described above, when A (ACK) indicating a normal system is edited into R (RST) or U (URG), it is normal. It may be set so that an editing distance having a weight of about 5 times occurs. For example, "A" even if only the last character is different, such as "STAPA ... FAFA" and "STAPA ... FAFU", in the TCP flow character string in the format shown in FIGS. 3 to 5 described above. Is changed to "U", so that an editing distance of 5 characters (5 times the normal value) of other characters and a large weight may be generated.

Further, in general, in the communication sequence, the position changes as "start-> process 1-> process 2-> ...-> end", so that the position is different between the first and last routine processes and the change in the middle stage. In this case, similarly, in the flow character string, the meanings of the first and last characters and the characters in the middle stage are different. Therefore, when calculating the editing distance, the labeling processing unit 14 makes the weight when the characters at both ends (first character and last character) are edited in the flow character string heavier than the characters in the middle stage. It may be set (for example, a setting that changes the weight of the flow character string in a quadratic curve from the beginning).

As described above, the labeling processing unit 14 may change the weight of the editing distance according to the character pattern before and after editing and the position of the character to be edited.

(C-2) In each of the above embodiments, an example in which the protocol analysis / character string processing unit 12 replaces a flow (sequence) with a character string such as an alphabet when converting the flow (sequence) into a character string has been described. Not limited to columns, it may be converted to a code containing numerical values, symbols, etc. (hereinafter, these are collectively referred to as "code string"), and by appropriately selecting a code that is easy to process, it can be applied to protocols with many variations. You may do so.

10 ... Error cause analysis device, 11 ... Receiver unit, 12 ... Protocol analysis / string conversion processing unit, 13 ... Repeated character string deletion unit, 14 ... Labeling processing unit, 15 ... Cause output unit, 16 ... Teacher data holding unit , 17 ... Repeated character string holding unit.

Claims (9)

The data of the traffic to be analyzed is divided for each flow to acquire the flow data, and each communication signal shown in the flow data is coded to be converted into a code according to the protocol used. Coding processing means for generating a code string and
Labeling means for assigning labels corresponding to similar ones from a plurality of teacher data with respect to the flow code string or a code string based on the flow code string.
A communication analysis apparatus comprising: an output means for outputting a predetermined output according to the label with respect to the flow code string or the code string based on the flow code string to which the label is attached. The coding processing means further includes a repeating code string deleting means that deletes a repeating code string that is repeated a plurality of times from the encoded flow code string to generate a repeatedly deleted code string.
The communication analysis device according to claim 1, wherein the label-imparting means assigns a label corresponding to a similar one from a plurality of teacher data to the repeatedly deleted code string. The communication analysis apparatus according to claim 2, wherein the labeling means selects similar ones from a plurality of teacher data for the repeatedly deleted code string, and assigns a label corresponding to the selected teacher data. .. The communication analysis apparatus according to claim 3, wherein the labeling means selects teacher data having a closer editing distance as teacher data having a high degree of similarity to the repeatedly deleted code string. The communication analysis device according to claim 4, wherein the labeling means changes the weight of the editing distance according to the code pattern before and after editing. The communication analysis device according to claim 4, wherein the labeling means changes the weight of the editing distance according to the position of the code to be edited. The labeling means selects teacher data having a closer editing distance as teacher data having a high degree of similarity to the repeatedly deleted code string by using a classifier to which a learning model machine-learned based on the teacher data is applied in advance. The communication analysis apparatus according to claim 3, wherein the communication analysis apparatus is used. Computer,
The data of the traffic to be analyzed is divided for each flow to acquire the flow data, and each communication signal shown in the flow data is coded to be converted into a code according to the protocol used. Coding processing means for generating a code string and
Labeling means for assigning labels corresponding to similar ones from a plurality of teacher data with respect to the flow code string or a code string based on the flow code string.
A communication analysis program characterized in that the flow code string to which the label is attached or a code string based on the flow code string is made to function as an output means for performing a predetermined output according to the label. In the communication analysis method performed by the communication analysis device,
A coding processing means, a labeling means, and an output means are provided.
The coding processing means divides the data of the traffic to be analyzed for each flow to acquire the flow data, and converts each communication signal shown in the flow data into a code according to the protocol used. The flow code string is generated by performing the coding process to be performed.
The labeling means assigns a label corresponding to a similar one from a plurality of teacher data to the flow code string or a code string based on the flow code string.
The output means is a communication analysis method, characterized in that a predetermined output according to the label is performed on the flow code string or the code string based on the flow code string to which the label is attached.

Images