JP5003566B2 - Network performance prediction system, network performance prediction method and program - Google Patents

Description

  The present invention relates to a network performance prediction system, a network performance prediction method, and a program for predicting communication performance of a network.

  Conventionally, a regression analysis method is used to predict the future from time-series data having a time axis on the horizontal axis. In this regression analysis, a regression equation that approximates time-series data is obtained, and a prediction value is obtained by extrapolating the regression equation toward the future. In addition, interval prediction is performed in which prediction is performed with a value having a width called a confidence interval corresponding to a statistical error (see, for example, Non-Patent Document 1).

  Further, Patent Document 1 predicts future observation values from past observation values using time series analysis, and compares them with actual observation values to detect anomalies that can cope with traffic changes due to temporal changes. It is described that is possible. Since the observed value determined to be abnormal in the analysis is not an original normal value, there is a possibility that normal prediction cannot be performed if prediction is performed based on that value. Therefore, the subsequent prediction is performed except for the observation value determined to be abnormal. In addition, when an abnormality is detected once, it is not used for subsequent prediction, and when an abnormality is detected continuously, it is considered as a change in tendency and is treated as a normal value.

JP 2006-238043 A Yoshiyuki Sakurai, "Regression Analysis Understandable by Illustration", Nihon Jitsugyo Publishing Co., Ltd. June 20, 2002 (116-119, 168-174)

  When regression analysis as disclosed in Non-Patent Document 1 is used for network performance prediction, for example, when a line failure occurs, a value that is significantly different from normal, a so-called “outlier” is temporarily detected. If outliers are not removed from the time-series data, there is a possibility that a predicted value different from the actual value or a confidence interval larger than the actual value is shown. However, in the conventional outlier removal method described in Patent Document 1, for example, it is difficult to determine only a single abnormality that overlaps with a continuous abnormality as an outlier. However, there is a problem that it may not be performed with high accuracy.

  The present invention has been made to solve the above-described problems, and an object thereof is to allow outliers to be accurately removed in a network performance prediction system.

The network performance prediction system according to the present invention includes a measurement value acquisition unit that acquires time-series data in which measurement value information indicating network communication performance and time information indicating measurement time are paired, and acquired by the measurement value acquisition unit Of the analysis data created by the analysis data creation unit that processes the time-series data and creates analysis data, and outlier information as information that is not used in the regression analysis among the analysis data created by the analysis data creation unit, An outlier removal unit that removes the calculated outlier information from the analysis data, and a regression analysis unit that obtains a predicted value by regression analysis based on the analysis data from which the outlier information has been removed by the outlier removal unit; A report creation unit that creates a report indicating a regression analysis result by the regression analysis unit, and the outlier removal unit divides the analysis data into a plurality of periods, and the division It was determined outliers information in each period, based on the analysis data excluding the outlier information, and requests outlier information over the entire period.

  According to the present invention, in a network performance prediction system, outliers can be accurately removed and network performance prediction can be performed by regression analysis.

Embodiment 1 FIG.
The network performance prediction system according to the first embodiment of the present invention is such that a prediction value is obtained by regression analysis based on analysis data from which outliers have been removed by the “section division multi-stage SG (Smirnov-Grubbs) method”. is there. As a result, outliers can be accurately removed and network performance can be predicted by regression analysis.

  FIG. 1 is a block diagram showing a network performance prediction system according to Embodiment 1 of the present invention. In each figure, the same numerals indicate the same or corresponding parts. In FIG. 1, 1 is a network performance prediction system, and 21 is a network performance measurement system.

  The network performance measurement system 21 shown in FIG. 1 can measure various network performance values at predetermined intervals, report a measurement value at each time, and diagnose the presence or absence of an abnormality. Further, the network performance measurement system 21 has a database function capable of periodically measuring and storing and retrieving the measurement results. Note that any performance value or abnormality diagnosis method may be used. For example, the network communication performance measured and predicted includes the traffic amount and bandwidth usage rate in the communication line, the packet response time, the CPU (Central Processing Unit) usage rate and the memory usage rate in the network device.

  In the network performance prediction system 1 shown in FIG. 1, reference numeral 2 denotes a measurement value acquisition unit that acquires time series data and threshold data of measurement results from the network performance measurement system 21. Reference numeral 3 denotes an analysis data creation unit that creates analysis data from the measurement values obtained by the measurement value acquisition unit 2. Reference numeral 4 denotes an outlier removal unit that removes outliers from the analysis data obtained by the analysis data creation unit 3. The segmentation multistage SG (Smirnov−) performs an operation based on the “section division multistage SG method” described later. (Grubbs) having a test unit 4a. Reference numeral 5 denotes a regression analysis unit that performs regression analysis using analysis data after outlier removal. Reference numeral 6 denotes a report creation unit that creates a report by a graph or a table using the result of the regression analysis in the regression analysis unit 5.

  Next, the operation will be described. The measured values of network performance are measured and accumulated from time to time, and the network performance prediction system 1 according to the first embodiment is also periodically predicted to obtain updated prediction results. Or you may make it obtain a prediction result at any time by designation | designated. In any case, a Unix cron system or the like can be applied as a method of executing a predetermined function periodically or at a specified time.

  First, the measurement value acquisition unit 2 acquires, from the network performance measurement system 21, time-series data in which measurement value information and measurement time information are paired as a measurement result for a predetermined period. When the prediction is performed periodically, for example, only the difference may be acquired as from the previous prediction execution date to today. As a data acquisition method, for example, SQL (Structured Query Language) often used in a database system is applicable, and any method supported by the network performance measurement system 21 may be used.

  Next, using the time-series data acquired by the measurement value acquisition unit 2, the analysis data generation unit 3 generates analysis data that is data for regression analysis. However, the analysis data creation unit 3 is an optional component. The regression analysis may be performed by the regression analysis unit 5 using the measurement value obtained by the measurement value acquisition unit 2 as it is. However, network performance is often measured frequently, for example, at intervals of several minutes. In addition, it can be considered that there are a large number of devices to be measured and MIB (Management Information Base) values. For this reason, there is a concern that the amount of calculation increases if the measured value is subjected to regression analysis as it is. Therefore, the analysis data creation unit 3 calculates, for example, an average value of measured values every day, and uses this average value as data for regression analysis, thereby reducing the amount of data used for regression analysis and reducing the amount of calculation. Like to do. The created analysis data is accumulated so that analysis data calculated in the past can be used. In the above example, the daily average is used, but the present invention is not limited to this. For example, an average for every hour or an average for every week may be used.

  Next, an outlier is detected from the analysis data and removed from the analysis target by the section division multi-stage SG test unit 4a of the outlier removal unit 4 which is a feature of the first embodiment. This process is based on the “section division multistage SG method” described later. In the first embodiment, an example in which the test is performed in two stages is shown in FIG. 2, but the test may be performed in a larger number of stages.

  Using the analysis data from which outliers are removed in this way, the regression analysis unit 5 performs a single variable regression analysis. In this regression analysis, various functions such as a linear function, a quadratic function, an exponential function, and a logarithmic function can be applied. As an analysis method according to each function, for example, in the case of linear regression, Non-Patent Document 1 Can be applied. In the case of this linear regression, values of A and B which are parameters in the regression function Y = Ax + B are obtained.

  Next, the report creation unit 6 creates a report using the results of the processing so far. The report is basically a graph showing a prediction line based on a regression function as shown in FIG. In addition, points indicating actual measurement values and analysis data values may be plotted, and threshold lines and excess times exceeding them may be plotted. Alternatively, a 95% confidence interval (a range in which the measured values are distributed with a probability of 95%) related to the predicted value may be displayed. The report may be a table instead of a graph. As a reference method, reference may be made with a WEB browser, or a predetermined user may be notified by e-mail.

  Finally, the operation in the segmented multistage SG test unit 4a of the outlier removal unit 4 by the “segmented multistage SG method” will be described with reference to FIG. This method is an improvement of the SG (Smirnov-Grubbs) test (Smirnov-Grubbs test) so that outliers can be detected in consideration of variations over time. The SG test calculates the average value Xave and standard deviation σ of the population in advance and calculates | Xi-Xave | / σ for each measured value Xi. The values are excluded from the population, and the average value and the standard deviation are obtained again, and the above process is repeated until no outliers appear.

  First, in FIG. 2A, analysis data is divided in units of sections (periods) in a time such as one hour or one day, and an average value and a standard deviation are obtained in each section. The above SG test is applied to each section, and outliers are removed for each section. Thereby, instantaneous abnormal values can be accurately determined as outliers and removed. In the example of FIG. 2A, the data at times t0 and t1 are determined to be outliers and removed, but the data at time t2 is almost the same value as the data at time t1, but is not determined to be an outlier. You can Next, in FIG. 2B, an average value and a standard deviation over the entire section of the analysis data are obtained, and an SG test is performed by regarding the average value of each section as data. Thus, when there are many abnormal values due to congestion of the communication line through the specific section, all values in the corresponding section can be determined as outliers and removed. As described above, according to the “section division multi-stage SG method”, the SG test is performed by dividing each section, and further, the SG test is performed through all sections, so that instantaneous outliers can be detected continuously. Outlier detection can be performed with high accuracy.

  As described above, in the network performance prediction system according to the first embodiment of the present invention, the predicted value is obtained by the regression analysis based on the analytical data from which the outlier is removed by the above-described “section division multistage SG method”. ing. Thereby, instantaneous outlier detection and continuous outlier detection are possible, and outliers can be accurately removed and network performance prediction can be performed by regression analysis.

Embodiment 2. FIG.
The network performance prediction system according to the second embodiment of the present invention is such that a predicted value is obtained by regression analysis based on analytical data from which outliers have been removed by the “neighbor value comparison method”. As a result, outliers can be accurately removed and network performance can be predicted by regression analysis.

  4 is a block diagram showing a network performance prediction system according to Embodiment 2 of the present invention. In each figure, the same numerals indicate the same or corresponding parts. 4 except that the outlier removal unit 4 is configured to include a neighborhood value comparison unit 4b that performs an operation based on a “neighboring value comparison method” described later, instead of the section division multi-stage SG test unit 4a. 1 is the same configuration as the network performance prediction system according to the first embodiment shown in FIG.

  Next, the operation will be described. The operation of each unit is the same as that of the first embodiment except for the operation in the neighborhood value comparison unit 4b of the outlier removal unit 4. Therefore, the operation in the neighborhood value comparison unit 4b by the “neighbor value comparison method” will be described with reference to FIG. In this method, first, an average value and a standard deviation of all measured values are calculated, and a difference between each measured value and a measured value at the next time is calculated. For example, as shown in FIG. 5, Δ1 = measured value t2−measured value t1 (subtract the measured value at the time from the measured value at the next time), and Δ1> average value of all measured values + n × standard deviation (n Is an integer greater than or equal to 0), the difference between the measured values is calculated with the measured value t2 as a reference, for example, Δ2 = measured value t2−measured value t5 after the measured value t2. If Δ2> average value of all measured values + n × standard deviation, the measured value t2 to the measured value t4 are regarded as outliers. After the measurement value t5, similarly to Δ1, the measurement value at the time is subtracted from the measurement value at the next time, and this process is repeated. According to this method, it is possible to remove a measurement value or a sequence of measurement values that are significantly different from the surrounding values as outliers, and obtain an accurate prediction value in the subsequent regression analysis.

  In the description according to FIG. 5 in the second embodiment of the present invention, the “neighbor value comparison method” is described in one stage. However, similarly to the “section division multi-stage SG method” in the first embodiment, the section You may make it perform division and multistage.

  As described above, in the network performance prediction system according to the second embodiment of the present invention, the predicted value is obtained by the regression analysis based on the analysis data from which the outlier is removed by the above-mentioned “neighbor value comparison method”. Yes. As a result, it is possible to perform a network performance prediction by regression analysis by accurately removing an array of measurement values that are significantly different from neighboring values as outliers.

Embodiment 3 FIG.
In the network performance prediction system according to the third embodiment of the present invention, a predicted value is obtained by regression analysis based on analytical data from which outliers have been removed by the “external data reference method”. As a result, outliers can be accurately removed and network performance can be predicted by regression analysis.

  FIG. 6 is a block diagram showing a network performance prediction system according to Embodiment 3 of the present invention. In each figure, the same numerals indicate the same or corresponding parts. In FIG. 6, the outlier removal unit 4 has an external data reference unit 4c that performs an operation based on the “external data reference method” described later, instead of the section division multi-stage SG test unit 4a, and is an external database alarm. The configuration is the same as that of the network performance prediction system according to the first embodiment shown in FIG. 1 except that the information 22 and the calendar information 23 are referred to.

  In FIG. 6, alarm information 22 is a database that holds data indicating abnormality and information on the time of occurrence thereof. The data indicating the abnormality may be data indicating a period in which an abnormality such as an interface down or a device stop is occurring, or an MIB (Management Information Base) indicating error occurrence information such as packet loss may be used. . The calendar information 23 is a database that stores day information such as weekends and holidays, information on business hours (for example, 9:00 to 17:00), and the like.

  Next, the operation will be described. In FIG. 6, the operation of each unit is the same as that of the first embodiment except for the operation in the external data reference unit 4c of the outlier removal unit 4. The operation in the external data reference unit 4c by the “external data reference method” will be described. The external data reference unit 4c compares each time of the analysis data with the contents held in the alarm information 22 and the calendar information 23 (external data). If it is a holiday or outside business hours, remove it as an outlier. As a result, it is possible to remove analysis data in a situation different from the normal time, such as when an alarm occurs, a holiday, or outside business hours, and obtain a highly accurate predicted value in the subsequent regression analysis.

  In the third embodiment, it has been described that both alarm information and calendar information are used. However, only one of them may be used. In addition, as external data, any information can be expected as long as it is information related to outliers.

  As described above, in the network performance prediction system according to the third embodiment of the present invention, the predicted value is obtained by the regression analysis based on the analytical data from which the outlier has been removed by the above-mentioned “external data reference method”. Yes. As a result, it is possible to accurately analyze data for analysis in situations different from normal times, such as when an alarm occurs, on holidays, or outside business hours, and perform network performance prediction by regression analysis.

Embodiment 4 FIG.
The network performance prediction system according to the fourth embodiment of the present invention obtains a predicted value by regression analysis based on analytical data from which outliers have been removed by the combined use of the “external data reference method” and the “section division multistage SG method”. It is a thing. As a result, outliers can be removed with higher accuracy and network performance can be predicted by regression analysis.

  FIG. 7 is a block diagram showing a network performance prediction system according to Embodiment 4 of the present invention. In each figure, the same numerals indicate the same or corresponding parts. In FIG. 7, the outlier removal unit 4 performs an operation based on the above-described “external data reference method” in addition to the interval-division multi-stage SG test unit 4 a that performs an operation based on the above-described “section division multi-stage SG method”. Except for having a data reference unit 4c and referring to alarm information 22 and calendar information 23 which are external databases, the first embodiment shown in FIG. 1 and the third embodiment shown in FIG. 6 are used. The configuration is the same as that of the network performance prediction system.

  Next, the operation will be described. In FIG. 7, the operation of each unit is the same as the operation in the first embodiment and the operation in the third embodiment except for the operation in the outlier removal unit 4. In the outlier removal unit 4, the external data reference unit 4 c performs outlier removal based on the above-described “external data reference method”, and the section division multi-stage SG test unit 4 a performs outlier based on the above-described “section division multi-stage SG method”. Perform value removal. As a result, outlier removal by both the “external data reference method” and the “section division multistage SG method” can be performed, so that a better predicted value can be obtained.

  As described above, in the network performance prediction system according to the fourth embodiment of the present invention, regression analysis based on analytical data from which outliers have been removed by the combined use of the “external data reference method” and the “section division multi-stage SG method” Thus, the predicted value is obtained. This makes it possible to accurately remove analysis data in situations that differ from normal times, such as when an alarm occurs, holidays, or outside business hours, as an outlier, and to detect instantaneous outliers continuously. Detection is also possible, and outliers can be removed more accurately and network performance can be predicted by regression analysis.

Embodiment 5 FIG.
The network performance prediction system according to the fifth embodiment of the present invention obtains a predicted value by regression analysis based on analytical data from which outliers have been removed by the combined use of the “external data reference method” and the “neighbor value comparison method”. It is a thing. As a result, outliers can be removed with higher accuracy and network performance can be predicted by regression analysis.

  FIG. 8 is a block diagram showing a network performance prediction system according to Embodiment 5 of the present invention. In each figure, the same numerals indicate the same or corresponding parts. In FIG. 8, the outlier removal unit 4 performs an operation based on the above-described “external data reference method” in addition to the neighborhood value comparison unit 4 b that performs an operation based on the above-described “neighbor value comparison method”. 4c, except that the alarm information 22 and calendar information 23, which are external databases, are referred to, in the first embodiment shown in FIG. 1, the second embodiment shown in FIG. 4, and the FIG. The configuration is the same as that of the network performance prediction system according to the third embodiment shown.

  Next, the operation will be described. In FIG. 8, the operation of each unit is the same as the operation in the first embodiment, the operation in the second embodiment, and the operation in the third embodiment except for the operation in the outlier removal unit 4. In the outlier removal unit 4, the external data reference unit 4 c performs outlier removal based on the “external data reference method” described above, and the neighborhood value comparison unit 4 b performs outlier removal based on the above “neighbor value comparison method”. Do. As a result, outliers can be removed by both the “external data reference method” and the “neighboring value comparison method”, so that a better predicted value can be obtained.

  As described above, in the network performance prediction system according to the fifth embodiment of the present invention, the regression analysis based on the analysis data from which the outlier is removed by the combined use of the “external data reference method” and the “neighboring value comparison method”. The predicted value is obtained. This makes it possible to accurately remove analysis data in situations different from normal times, such as when an alarm occurs, on holidays, or outside business hours, as an outlier, and to remove the measurement values that are significantly different from nearby values as outliers. Further, outliers can be removed with higher accuracy and network performance can be predicted by regression analysis.

  The network performance prediction method corresponding to the network performance prediction system according to the first to fifth embodiments described above may be realized by software processing using a program executed by a microcomputer or the like.

Configuration diagram showing a network performance prediction system according to Embodiment 1 of the present invention Explanatory drawing for demonstrating the network performance prediction system by Embodiment 1 of this invention Explanatory drawing for demonstrating the network performance prediction system by Embodiment 1 of this invention The block diagram which shows the network performance prediction system by Embodiment 2 of this invention Explanatory drawing for demonstrating the network performance prediction system by Embodiment 2 of this invention The block diagram which shows the network performance prediction system by Embodiment 3 of this invention The block diagram which shows the network performance prediction system by Embodiment 4 of this invention The block diagram which shows the network performance prediction system by Embodiment 5 of this invention

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Network performance prediction system 2 Measured value acquisition part 3 Analysis data creation part 4 Outlier removal part 5 Regression analysis part 6 Report creation part

Claims (6)

A measurement value acquisition unit that acquires time-series data in which measurement value information indicating network communication performance and time information indicating measurement time are paired;
An analysis data creation unit that creates analysis data by processing the time series data obtained by the measurement value obtaining unit;
Out of the analysis data created by the analysis data creation unit, outlier information as information not used for regression analysis is obtained, and the outlier removal unit that removes the obtained outlier information from the analysis data;
A regression analysis unit that obtains a predicted value by regression analysis based on analysis data from which outlier information has been removed by the outlier removal unit;
A report creation unit for creating a report indicating a regression analysis result by the regression analysis unit,
The outlier removal unit divides the analysis data into a plurality of periods, obtains outlier information for each divided period, and based on the analysis data excluding the outlier information , over the entire period. A network performance prediction system characterized by obtaining outlier information.   The network performance prediction system according to claim 1, wherein the outlier removal unit obtains outlier information by a Smirnov-Grubbs test.   The network performance prediction system according to claim 1, wherein the outlier removal unit obtains outlier information based on a comparison between analysis data corresponding to adjacent time information.   The network performance prediction system according to claim 1, wherein the outlier removal unit obtains outlier information with reference to external data. A measurement value acquisition step of acquiring time series data in which measurement value information indicating network communication performance and time information indicating measurement time are paired;
An analysis data creation step for creating analysis data by processing the time series data acquired in the measurement value acquisition step;
Of the analytical data created in the analytical data creation step, outlier information as information not used for regression analysis is obtained, and the obtained outlier information is removed from the analytical data outlier removal step;
A regression analysis step of obtaining a predicted value by a regression analysis based on the analytical data from which the outlier information has been removed in the outlier removal step;
A report creation step for creating a report indicating the regression analysis result of the regression analysis step,
The outlier removal step divides the analysis data into a plurality of periods, obtains outlier information for each divided period, and based on the analysis data excluding the outlier information , over the entire period. A network performance prediction method characterized by obtaining outlier information.   A program for causing an electronic computer to execute the network performance prediction method according to claim 5.

Images