JP5155284B2 - P2P traffic amount estimation method, apparatus and program - Google Patents

Description

  The present invention relates to a technique for grasping and managing communication traffic of an IP (Internet Protocol) network, and in particular, for efficiently calculating the amount of traffic by a P2P (peer-to-peer) application installed in a computer device. It relates to a suitable technique.

  As IP networks are widely used, the usage forms have also diversified. Accordingly, it is becoming important to measure the traffic flowing through the network and grasp the current communication traffic situation.

  In particular, it has recently been pointed out that traffic from P2P applications occupies network bandwidth.

  There are several conventional techniques for measuring P2P traffic. For example, Patent Document 1 describes a technique for accumulating the traffic volume between monitored nodes identified by an IP address and a port number, and selecting a P2P connection to be monitored that exceeds a predetermined reference traffic volume. Yes. In this technique, the traffic amount is obtained on the table by obtaining the data amount of the packet flowing through the P2P connection.

  In addition, the Cisco (registered trademark) SCE (Service Control Engine) product described in Non-Patent Document 1 uses a technology called deep packet inspection (DPI) to analyze the payload, thereby enabling application-level operations. Analyze and identify P2P traffic.

  Non-Patent Documents 2 and 3 describe techniques for identifying a P2P flow by starting a P2P application on a terminal and collecting the IP addresses of users who are performing P2P communication. By matching the identified flow information and the traffic volume (number of bytes or number of packets) of each flow observed in the network, it becomes possible to grasp the traffic volume of the entire P2P flow.

  Flow refers to five attributes {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), destination port number (dstPort), protocol (Protocol)}. The same packet group can be measured by using a flow measurement technique such as “NetFlow” (registered trademark) described in Non-Patent Document 4 and “sFlow” (registered trademark) described in Non-Patent Document 5.

  By using these technologies, it is possible to grasp how much P2P traffic is currently flowing.

  However, depending on the network (ISP: Internet Service Provider), there are cases where P2P regulation and bandwidth control are performed, so the traffic volume measured in the prior art becomes P2P traffic after control, and future network architecture and network It is impossible to grasp the actual demand for P2P traffic necessary for designing.

JP 2005-202589 A

"NetOneSystems: Product Information: Network: Bandwidth Control: Service Control Engine (SCE) Series", [online], [October 16, 2009 Search], Internet <URL: http: //www.netone. co.jp/product/cat_network/band-control/tfa9q10000002m6s3.html> Satoshi Ohzahata, Yoichi Hagiwara, Matsuaki Terada and Konosuke Kawashima, "A Traffic Identification Method and Evaluations for a Pure P2P Application," Proc. Of the 2005 Passive and Active Measurement (PAM'05) workshop. Kamei et al., “Estimation of P2P File Sharing Application Using Partial Measurements in Multiple Layers”, Journal of the Japanese Society for Science and Technology Vol.J88-B No.11 pp.2171-2180. NetFlow, [online], [October 16, 2009 search], Internet <URL: http://en.wikipedia.org/wiki/Netflow>. InMon sFlow Probe, [online], [October 16, 2009 search], Internet <URL: http://www.inmon.com/products/probes.php>.

  The problem to be solved is that in the conventional technology, there are cases where P2P regulation and bandwidth control are performed in the network, and it is necessary to consider the original P2P traffic demand that is necessary for considering the future network architecture and network design. It is a point that cannot be grasped.

  An object of the present invention is to solve these problems of the prior art and to appropriately perform network architecture and network design.

In order to achieve the above object, the present invention is characterized in that from the actually measured P2P traffic measurement data, it is estimated how much P2P traffic is distributed if bandwidth control is not performed. For example, first, the flow information flowing through the monitoring points in the target network (NW) is counted using a measurement technology such as NetFlow or sFlow, or the flow information is collected after collecting the packets using a packet capture device. Next, identify the P2P flow based on the aggregated flow information, determine whether the identified P2P flow is a flow that passes through the network (or ISP) that performs bandwidth control, and perform bandwidth control. P2P flows that pass through a network are classified as control P2P flows, non-control P2P flows are classified as non-control P2P flows, flows are collected for a certain period, and the flow size (number of bytes or packets sent per flow) is aggregated Obtain the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow, and By replacing the control P2P flow size distribution, if control P2P flow calculates whether P2P traffic increases much when as it becomes uncontrolled P2P flow. For example, the control P2P flow size distribution is P [control P2P flow size = x] = SPc (x), the non-control P2P flow size distribution is P [non-control P2P flow size = x] = SPu (x), and When the observed number of control P2P flows and the number of non-control P2P flows are NPc and NPu, respectively, the amount of P2P traffic when the control P2P flow becomes a non-control P2P flow is expressed as “NPu × Σ _x SPu (x) × x + NPc × Σ _x SPu (x) × x ”. Incidentally, P2P traffic amount when control P2P flow is directly controlled P2P flow is _{"NPu × Σ x SPu (x)} × x + NPc × Σ x SPc (x) × x ", minus the latter from the former Is calculated as an increase in the amount of P2P traffic when non-control is assumed.

  According to the present invention, it is possible to estimate how much the amount of P2P traffic will increase when non-control in the network is assumed, and it is possible to more accurately grasp the demand for original P2P traffic, Network architecture and network design can be performed more appropriately.

It is explanatory drawing which shows the example of flow information used with the P2P traffic amount estimation apparatus which concerns on this invention. It is explanatory drawing which shows the example of flow size distribution used with the P2P traffic amount estimation apparatus which concerns on this invention. It is explanatory drawing which shows the example of the flow condition which flows into the attention network which provides the P2P traffic amount estimation apparatus which concerns on this invention. It is explanatory drawing which shows the example of an attribute of the flow which flows into the attention network which provides the P2P traffic amount estimation apparatus which concerns on this invention. It is a block diagram which shows the 1st installation structural example of the P2P traffic amount estimation apparatus which concerns on this invention. It is a block diagram which shows the 2nd installation structural example of the P2P traffic amount estimation apparatus which concerns on this invention. It is a block diagram which shows the example of an internal structure of the P2P traffic amount estimation apparatus which concerns on this invention. It is explanatory drawing which shows the structural example of the flow management table used in the P2P traffic amount estimation apparatus which concerns on this invention of FIG. It is explanatory drawing which shows the example of flow attribute information used in the P2P traffic amount estimation apparatus which concerns on this invention of FIG. It is explanatory drawing which shows the example of statistical information used in the P2P traffic amount estimation apparatus which concerns on this invention of FIG. It is a flowchart which shows the processing operation example by the P2P traffic amount estimation method of the P2P traffic amount estimation apparatus which concerns on this invention of FIG.

  Hereinafter, embodiments for carrying out the present invention will be described with reference to the drawings. The P2P traffic amount estimation device 1 according to the present invention shown in FIG. 7 has a computer configuration including a CPU (Central Processing Unit), a main memory, a display device, an input device, an external storage device, etc. After the program and data recorded in a storage medium such as a CD-ROM are installed in the external storage device, the function of each processing unit is executed by reading the program and data from the external storage device into the main memory and processing them by the CPU.

  That is, the P2P traffic amount estimation apparatus 1 of this example has a packet header analysis unit 2, a flow management unit 3, a flow information analysis unit 4, a flow statistics calculation unit 5, and a P2P traffic amount as means for executing programmed computer processing. An estimation unit 6 is included.

  The P2P traffic volume estimation device 1 having such a configuration is used in a form of being inserted into a link between nodes 502 and 503 (routers and switches) in the network, as shown as the P2P traffic volume estimation device 501 in FIG. Alternatively, in the nodes 502 and 503, the packet may be mirrored to a port, and a P2P traffic amount estimation device may be installed at the end of the port.

  Alternatively, as shown as the P2P traffic amount estimation apparatus 601 in FIG. 6, flow information such as NetFlow and sFlow may be exported from each router 603 a to g in the network 602 and collected.

  Hereinafter, the P2P traffic amount estimation technique 1 according to the present invention by the P2P traffic amount estimation apparatus 1 having the configuration shown in FIG. 7 will be described by taking <first to eighth estimation techniques> as an example.

  First, the <first trial calculation technique> will be described.

  The P2P traffic amount estimation apparatus 1 having the configuration shown in FIG. 7 calculates from the actually measured P2P traffic measurement data how much P2P traffic is distributed if bandwidth control is not performed.

  That is, the flow information flowing through the monitoring points in the target network (NW) is totaled using a measurement technique such as NetFlow or sFlow. Alternatively, the flow information is aggregated after collecting the packets using the packet capture device. Then, P2P flows are identified based on the aggregated flow information, and it is determined whether or not the identified P2P flows are flows that pass through the network (or ISP) that is performing bandwidth control, and bandwidth control is performed. P2P flows that pass through the network are classified as control P2P flows, and other P2P flows are classified as non-control P2P flows.

  Furthermore, the flow is collected for a certain period, the flow size (number of bytes or packets sent per flow) is totaled, the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow are obtained, and the control P2P flow By replacing the size distribution with the non-control P2P flow size distribution, it is calculated how much the P2P traffic increases when the control P2P flow becomes a non-control P2P flow.

For example, the control P2P flow size distribution is P [control P2P flow size = x] = SPc (x), the non-control P2P flow size distribution is P [non-control P2P flow size = x] = SPu (x), and When the observed number of control P2P flows and the number of non-control P2P flows are NPc and NPu, respectively, the amount of P2P traffic when the control P2P flow becomes a non-control P2P flow is NPu × Σ _x SPu (x) × x + NPc × Σ _x SPu (x) × x.

Incidentally, P2P traffic amount when control P2P flow is directly controlled P2P flow is _{NPu × Σ x SPu (x)} × x + NPc × Σ x SPc (x) × x, non is minus the latter from the former Calculated as the amount of increase in P2P traffic when control is assumed.

  The flow information used in the P2P traffic amount estimation apparatus 1 of this example is represented by a flow ID {srcIP, dstIP, srcPort, dstPort, protocol} as shown as a flow information table (described as “flow information” in the figure) 101 in FIG. This refers to the number of bytes and the number of packets.

  In the P2P traffic amount estimation apparatus 1, the techniques described in Non-Patent Documents 1 to 3 described above are used as techniques for determining which is a P2P flow.

  Furthermore, when determining whether these P2P flows are flows that pass through the network (or ISP) that controls the bandwidth, whether the srcIP or dstIP address is from the network that controls the bandwidth or to the network It is determined by checking whether or not. Here, the P2P flow that passes through the bandwidth control NW is classified as a control P2P flow, and the other P2P flows are classified as non-control P2P flows.

  The P2P traffic amount estimation device 1 collects flows for a certain period, totals the flow sizes (the number of transmitted bytes or packets per flow), and the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow. Ask for.

  This flow size distribution will be described with reference to FIG.

  In FIG. 2, the x-axis is the flow size x [byte], and the Y-axis P [flow size> x] means the ratio of the number of flows whose flow size exceeds x [byte].

  In the example of FIG. 2, for the non-control P2P flow, this means that 0.1, that is, 10% of the flow exceeds the flow size of 100 Mbytes. On the other hand, in the control P2P flow, 10% of the flow exceeds 10 Mbytes.

  From the Internet traffic measurement data, it is generally known that the flow size is a straight line (in the case of a logarithmic axis) as shown by the uncontrolled P2P flow in FIG. That is, it is known to follow a distribution with a long tail (Pareto distribution etc.) (for example, “N.Duffield, C.Lund, and M.Thorup,” Estimating Flow Distributions from Sampled Flow Statistics, ”ACM SIGCOMM, pp. 325-336, 2003. "," T.Mori, M.Uchida, R.Kawahara, J.Pan, and S.Goto, "Identifying elephant flows through periodically sampled packets," ACM SIGCOMM Internet Measurement Conference, 2004. " ).

  On the other hand, when the bandwidth control is performed, a flow with a large number of bytes is controlled, so that the shape of the distribution is a shape in which the tail is cut off as shown by the control P2P flow in FIG.

  In this example, by replacing such a control P2P flow size distribution with a non-control P2P flow size distribution, if the control P2P flow becomes a non-control P2P flow, how much the P2P traffic increases. Estimate.

  A specific calculation technique of <first trial calculation technique> will be described in <second to eighth trial calculation techniques>.

  First, in <Second trial calculation technique>, the control P2P flow size distribution is P [control P2P flow size = x] = SPc (x), and the non-control P2P flow size distribution is P [non-control P2P flow size. = x] = SPu (x).

  In addition, the number of controlled P2P flows observed is NPc, and the number of non-controlled P2P flows observed is NPu.

In this case, the P2P traffic when the control P2P flow becomes uncontrolled P2P flow, the equation (1) the _{"NPu × Σ x SPu (x)} × x + NPc × Σ x SPu (x) × x " presume.

Incidentally, P2P traffic amount when control P2P flow is directly controlled P2P flow, _{"NPu × Σ x SPu (x)} × x + NPc × Σ x SPc (x) × x " Equation (2) next to the formula (1 The value obtained by subtracting the value of equation (2) from the value of) is estimated as the increase in the P2P traffic amount when deregulation is assumed.

  Next, <Third trial calculation technique> will be described.

  In the second trial calculation technique described above, the amount of traffic passing through the monitoring points (302, 402) is estimated to increase when deregulation is assumed. In the trial calculation technique, the P2P traffic amount of the entire NW of interest (a monitoring point exists in this) is estimated.

  Specifically, as shown in FIG. 3, if the flow measurement is performed only at the monitoring point 302 in the black circle in the entire network of interest 301 (described as “NW of interest” in the figure) 301, Although (1) and flow (2) are observed, flow (3) and flow (4) are not observed.

  In the third trial calculation technique, in order to estimate the P2P traffic volume including these unobserved areas, the following procedure is used for analysis.

  Of the flows that flow through the monitoring points, the direction from the user to the Internet is defined as the up direction, and the reverse direction is defined as the down direction, and the flows are aggregated by direction. Specifically, a flag y is attached to the flow information, and if y = up, it is up, and if dn, it is down.

  Further, a flag z for distinguishing whether or not the flow passing through the monitoring point in the upward (downward) direction is the flow toward (transmitted from) the user in the network of interest (NW) is attached. If z = in, this is the case, and if z = out, the communication flow is outside the network of interest. That is, as shown in FIG. 4, the flow passing through the monitoring point 402 in the network of interest (denoted “NW of interest” in the figure) 401 is represented by “up, out”, “dn, out”, “up, in”. ”And“ dn, in ”.

  In addition, a flag of X is also introduced, and if X = c, it is classified as a control flow, and if X = u, it is classified as a non-control flow.

By performing these classifications, each statistical information (N (t) _{X, y} , Nf (t) _{X, y} , b (t) _{X, y} , rp (t) _{X, y, z} , FP (t) _{X, y, z} , NP (t) _{X, y, in} , NP (t) _{X, y, out} , NP (t) _{X, y} ) are collected.

  It is assumed that flow statistics are collected at regular intervals, and among the pieces of statistical information shown in FIG. 10, those with a subscript “t” represent values aggregated in the t-th cycle.

In FIG. 10, the average flow size (FP (t) _{X, y, z} ) is calculated from the flow size distribution. Specifically, if the P2P flow size distribution of the measurement interval t, type X, direction y, and NW internal / external flag z is SP (t) {X, y, z} (x), “FP (t) _{X, y calculates z = Σ x SP (t)} {X, y, z} and (x) × x ".

  Further, the traffic amount in the entire NW is Ntot, and the proportion of the flow that passes through the bandwidth control network out of the flows that flow through the entire NW is the control flow ratio c.

  These are predetermined parameters. Note that the traffic amount Ntot in the entire NW may be calculated from measured traffic values flowing through each link in the NW. The control flow ratio c is shaken within an assumed range or determined in advance from an external condition.

  The reason for introducing parameter c (the control flow ratio as the ratio of the flow that flows through the bandwidth control network out of the flows that flow through the entire network) is the ratio of the number of control flows that pass through the monitoring point and the number of non-control flows However, this is not necessarily the same as that of the whole NW.

  Based on the above preparation, using the calculation formulas shown in Equations 1 and 2 below, each statistical information on “output” shown in FIG. 10 (P2P traffic amount Npout exchanged outside NW, P2P traffic in NW) The amount Npin) is estimated (calculated).

First, α and β are determined so that the traffic of type X = c (with bandwidth control) and the traffic of X = u (without bandwidth control) are multiplied by α and β, respectively, to coincide with Ntot. Here, assuming that the non-P2P traffic amount is proportional to the control flow ratio without depending on the influence of the band control, α and β satisfying the expression shown in Equation 1 are calculated. Note that AVG [A (t)] = Σ _t A (t) / T (t = 1, 2,..., T: T is the number of measurement intervals).

  Next, using the α and β calculated in this way, the amount of P2P traffic (Npout, Npin) when the control P2P flow is controlled as it is is estimated using the following equation (2) (calculate.

  Npin (intra-NW P2P traffic amount) means the amount of P2P traffic (that is, the upstream direction) that flows from the user of the target NW (toward the same NW user), and at the same time (from the target NW user) This means the amount of P2P traffic that flows out to the user (that is, the downlink direction).

  At the monitoring point, the amount of P2P traffic for up and in may not necessarily match that of dn and in, but in terms of the entire NW, the in traffic that flows in must match the in traffic that flows out. Yes, so that it is estimated by Equation (4) in Equation 2 above.

  In addition, for Npout (P2P traffic volume exchanged outside the NW), the sum of the first term and the second term in Equation (3) shown in Equation 2 above represents the P2P traffic volume that flows out of the NW. The third and fourth terms correspond to the amount of P2P traffic flowing from outside the network.

  Next, the <fourth trial calculation technique> will be described.

  In the third trial calculation technique described above, the control P2P flow is controlled as it is. In the fourth trial calculation technique of this example, the P2P traffic amount when the control P2P flow is uncontrolled is calculated. As shown in Equation (7) in Equation 3 below, trial calculation is performed using Equation 3 by replacing the control P2P flow size with the non-control P2P flow size.

  Next, <Fifth trial calculation technique> will be described.

  In the fifth trial calculation technique, as in the first trial calculation technique described above, a set of five flows {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), incoming call Instead of being defined by destination port number (dstPort) and protocol (Protocol)}, it is defined by a pair {source IP address (srcIP), destination IP address (dstIP)}.

  Next, <Sixth trial calculation technique> will be described.

  In the sixth trial calculation technique, the flow is defined as a set of a source IP address (srcIP) for the upstream direction and a destination IP address (dstIP) for the downstream direction.

  Depending on how the bandwidth is controlled, this is not a control in units of five flows, but may be controlled in units of two or one unit, so it corresponds to these conditions. Because.

  Next, <Seventh trial calculation technique> will be described.

In the seventh trial techniques, as in the third trial techniques or fourth estimation techniques described above, the average of the P2P flow size _{FP (t) X, y,} z = Σ x SP (t) {X, Instead of calculating y, z} (x) × x, only a flow having a size equal to or larger than a predetermined threshold th among the P2P flows is redefined as a P2P flow, and the P2P flow size distribution SP ′ {t at this time , X, y, z} (x) to “SP '{t, X, y, z} (x) = SP (t) {X, y, z} / [1- _{Σx =} 1 to _th SP ( t) {X, y, z}] ”and the average P2P flow size FP (t) _{X, y, z} is expressed as“ FP (t) _{X, y, z} = Σ _x SP ′ {t, X, y , z} (x) × x ”, and the P2P flow ratio rp ′ (t) _{X, y, z} is also“ rp ′ (t) _{X, y, z} = rp (t) _{X, y, z} × [1- _{Σx =} 1 to _th SP ′ {t, X, y, z} (x)] ”and applied to the calculation formulas (Equations 1 to 3) in the third trial calculation technique or the fourth trial calculation technique To do.

  In the seventh trial calculation technique, a flow with a small size is not a flow that is actually transferring data, but is a flow that sends only control packets. By excluding it, it is possible to estimate the amount of P2P traffic due to actual data transfer.

  In addition, since a small-sized flow may include traffic other than actual traffic caused by abnormal traffic such as scan traffic, the abnormal traffic is removed by removing the traffic below the threshold.

  Next, the <eighth trial calculation technique> will be described.

In the eighth trial technique, instead of assuming that when the control P2P flow size distribution becomes uncontrolled, as in the fourth trial technique, the control P2P flow size distribution becomes the non-control P2P flow size distribution, Assuming that the flow is sent according to the non-control P2P flow size distribution at the rate of γ, the P2P flow size distribution SP '' {t, after the non-control, measurement interval t, type X, direction y, NW inside / outside flag z c, y, z} (x) to “SP '' {t, c, y, z} (x) = (1-γ) SP (t) {c, y, z} + γSP (t) {u , y, and z} ", the average flow size FP '(t) c, y , and z' FP '(t) c, y , z = Σ x SP''{t, c, y, z} (x ) × x ”, and this average flow size FP ′ (t) c, y, z is used instead of Equation (7) in Equation 3 shown in the fourth trial calculation technique.

  Hereinafter, the processing operation (corresponding to the above-mentioned <third estimation technique>) of each processing unit constituting the P2P traffic amount estimation apparatus 1 shown in FIG. 7 will be described.

  When a packet arrives from the preceding node, the P2P traffic amount estimation device 1 shown in FIG. 7 determines whether the packet is in the packet direction from the node A to the node B or from the node B to the node A in the packet header analysis unit 2. . Here, description will be given assuming that the direction from node A to node B is the uplink direction from the user, and the direction from node B to node A is the downlink direction.

  The packet header analysis unit 2 then sends the packet flow ID = {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), destination port number (dstPort), protocol (Protocol )} And notifies the flow management unit 3 of header information including these pieces of information.

  The flow management unit 3 holds a flow management table 801 shown in FIG. In the flow management table 801 shown in FIG. 8, the number of packets, the number of bytes, and the direction are managed for each flow ID.

  When the packet header arrives, the flow management unit 3 checks whether the packet is a packet from a flow already entered in the flow management table 801. If the packet has already been entered, the flow management table 801 The number of packets of the corresponding flow ID is counted up by one, and the number of bytes is counted up by the packet size.

  If the packet is from a new flow, the flow management unit 3 newly enters the flow ID in the flow management table 801, sets the number of packets to 1, and sets the number of bytes to the packet size.

  Then, after a predetermined period of time has elapsed, the flow management unit 3 notifies the flow information analysis unit 4 of information in the flow management table 801.

  When the flow information analysis unit 4 receives the flow information from the flow management unit 3, each flow is shown as shown in a flow attribute information table (described as “flow attribute information” in FIG. 9) 901 in FIG. 9 as follows. To each attribute.

  First, the flow information analysis unit 4 identifies whether it is a P2P flow. This identification is performed using, for example, any of the existing techniques of Non-Patent Documents 1 to 3 described above.

  Next, the flow information analysis unit 4 assigns an attribute X that determines whether or not the flow passes through a network (or ISP) that performs bandwidth control. This determination is made by checking whether the srcIP address or the dstIP address is a flow from or to the network that controls the bandwidth, and the flow that passes through the bandwidth control NW is the control flow. Classify as uncontrolled flow. X = c for control flow, X = u for non-control flow.

  Furthermore, the flow information analysis unit 4 defines the communication direction as an up direction and the reverse direction as a down direction, and aggregates the flows by direction. Specifically, a flag y is attached to the flow information, and if y = up, it is up, and if dn, it is down.

  Then, the flow information analysis unit 4 is a flag for distinguishing whether the flow passes through (or is transmitted to) the user in the network of interest (NW) among the flows passing through the monitoring point in the upward (downward) direction. Add z. If z = in, this is the case, and if z = out, the communication flow is outside the network of interest.

  For example, if this is an upstream flow, the dstIP is viewed. If dstIP is included in the network address in the target NW, it is set to in, otherwise it is set to out. When the above processing is completed, the flow information analysis unit 4 notifies the flow statistics calculation unit 5 of the result.

The flow statistic calculation unit 5 uses the information in the flow attribute information table 901 in FIG. 9 notified from the flow information analysis unit 4 to display each statistic (N (t) _{X, y} , Nf (t) _{X, y} , b (t) _{X, y} , rp (t) _{X, y, z} , FP (t) _{X, y, z} , NP (t) _{X, y, in} , NP (t ) _{X, y, out} and NP (t) _{X, y} ) are calculated. Note that the subscript t in each statistic represents a value aggregated in the t-th cycle.

Here, the average flow size (FP (t) _{X, y, z} ) is calculated from the flow size distribution. Specifically, if the P2P flow size distribution of the measurement section t, type X, direction y, and NW inside / outside flag z is SP (t) {X, y, z} (x), “FP (t) _{X, y calculates z = Σ x SP (t)} {X, y, z} and (x) × x ".

  After the above calculation, the flow statistics calculation unit 5 notifies the P2P traffic amount estimation unit 6 of the calculated flow statistics.

  The P2P traffic amount estimation unit 6 accumulates the flow statistical information from the flow statistical calculation unit 5 that is calculated and notified at regular intervals in a storage device (not shown), and accumulates data from the measurement interval t = 1 to T. Then, the P2P traffic volume is estimated by the following procedure.

  Specifically, the P2P traffic amount estimation unit 6 estimates (calculates) the P2P traffic amount Npout exchanged outside the NW and the intra-NW P2P traffic amount Npin indicated by “output” in FIG.

  At this time, the traffic amount in the entire NW is Ntot, and the proportion of the flow that passes through the bandwidth control network in the flow that flows through the entire NW is the control flow ratio c. These are predetermined parameters. Note that Ntot (traffic volume in the entire NW) may be calculated from measured traffic values flowing through each link in the NW. c (control flow ratio: the ratio of the flow passing through the bandwidth control network) is set within an assumed range or determined in advance from an external condition.

  The calculation formula is as shown in the above formulas 1 and 2. Note that traffic of type X = c (with bandwidth control) and traffic of X = u (without bandwidth control) are multiplied by α and β, respectively, so that Ntot (traffic amount of the entire NW) matches α. And β.

Here, assuming that the non-P2P traffic amount is proportional to the control flow ratio without depending on the influence of the band control, α and β satisfying the above-described Expression 1 are calculated. Note that AVG [A (t)] = Σ _t A (t) / T (t = 1, 2,..., T: T is the number of measurement intervals).

  Then, the P2P traffic amount estimation unit 6 uses the α and β calculated in this way, and the P2P traffic amount (P2P traffic amount Npout exchanged outside the NW) when the control P2P flow is controlled as it is. The intra-NW P2P traffic amount Npin) is estimated (calculated) using the above equation (2).

  Further, the P2P traffic amount estimation unit 6 replaces the control P2P flow size with the non-control P2P flow size in the P2P traffic amount when the control P2P flow is uncontrolled as shown in the above equation (3). To calculate.

  Note that the value obtained by subtracting the value of Npin in Equation (4) in Equation (2) from Equation (6) in Equation (3) corresponds to the amount of P2P traffic (within NW) that is expected to increase due to non-control. The value obtained by subtracting Npout in Equation (3) in Equation (2) from Equation (5) in Equation (3) corresponds to the P2P traffic amount (outside NW) that is assumed to increase due to non-control.

  In the above example (corresponding to <Third trial calculation technology>), the P2P traffic volume of the entire network other than the monitoring point was estimated. However, of the traffic passing through the monitoring point, how much the P2P traffic volume is uncontrolled In order to calculate whether or not to increase when the precondition is made, the above-mentioned <second trial calculation technique> is used.

  That is, the control P2P flow size distribution is P [control P2P flow size = x] = SPc (x), and the non-control P2P flow size distribution is P [non-control P2P flow size = x] = SPu (x). In addition, the number of control P2P flows and the number of non-control P2P flows observed are NPc and NPu, respectively.

At this time, the control P2P flow is estimated by _{NPu × Σ x SPu (x)} × x + NPc × Σ x SPu (x) × x the P2P traffic volume when it is uncontrolled P2P flow. In addition, when the control P2P flow is the control P2P flow as it is, the amount of P2P traffic is NPu x Σ _x SPu (x) x x + NPc x Σ _x SPc (x) x x, with the latter minus the latter Estimated as an increase in P2P traffic when control is assumed.

  In the above example (corresponding to <Third trial calculation technique>), a set of five flows {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), destination The port number (dstPort) and protocol (Protocol)} are defined, but as described in <Fifth trial calculation technique> above, the flow is divided into two sets {source IP address (srcIP), destination IP address (dstIP)} may be defined.

  Alternatively, as described in <Sixth trial calculation technique> above, the flow is defined as a set of a source IP address (srcIP) for the upstream direction and a destination IP address (dstIP) for the downstream direction. May be.

Furthermore, the above example the (corresponding to <Third estimated techniques>), the average of the P2P flow size _{FP (t) X, y,} z = Σ x SP (t) {X, y, z} (x) × x, but instead, as explained in <Seventh Trial Calculation Technology> above, only P2P flows with a size greater than or equal to the predetermined threshold th are redefined as P2P flows Then, the P2P flow size distribution SP ′ {t, X, y, z} (x) at this time is expressed as “SP ′ {t, X, y, z} (x) = SP (t) {X, y, z } / [1- _{Σx =} 1 _{~ th} SP (t) {X, y, z}] ”, the average P2P flow size FP (t) _{X, y, z} is calculated as“ FP (t) _{X, y, z} = Σ _x SP ′ {t, X, y, z} (x) × x ”, and the P2P flow ratio rp ′ (t) _{X, y, z} is also“ rp ′ (t) _{X, y , z} = rp (t) _{X, y, z} × [1- _{Σx = 1˜th} SP ′ {t, X, y, z} (x)] ” It may be applied to.

In the above example (corresponding to <third trial calculation technique>), it is assumed that when the control P2P flow size distribution becomes uncontrolled, it becomes a non-control P2P flow size distribution. As described in <Eighth Trial Calculation Technology> above, assuming that the flow is sent according to the non-control P2P flow size distribution at the rate of γ in the control P2P flow, the measurement interval t after the non-control, P2P flow size distribution SP '' {t, c, y, z} (x) of type X, direction y, NW inside / outside flag z is changed to “SP '' {t, c, y, z} (x) = (1 -γ) SP (t) {c, y, z} + γSP (t) {u, y, z} ”and the average flow size FP ′ (t) c, y, z is“ FP ′ (t) c , y, z = 'and {t, c, y, z} and (x) × x ", the FP instead of formula _{(7)' Σ x SP '} (t) c, y, or by using a z .

  As described above with reference to the respective drawings, in this example, it is estimated from the actually measured P2P traffic measurement data how much P2P traffic is distributed when bandwidth control is not performed.

  For example, first, the flow information flowing through the monitoring points in the target network (NW) is counted using a measurement technology such as NetFlow or sFlow, or the flow information is collected after collecting the packets using a packet capture device. Next, identify the P2P flow based on the aggregated flow information, determine whether the identified P2P flow is a flow that passes through the network (or ISP) that performs bandwidth control, and perform bandwidth control. A P2P flow passing through a network is classified as a control P2P flow, and a P2P flow that is not is classified as a non-control P2P flow.

  Then, the flow is collected for a certain period, the flow size (number of bytes or packets sent per flow) is totaled, the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow are obtained, and the control P2P flow By replacing the size distribution with the non-control P2P flow size distribution, it is calculated how much the P2P traffic increases when the control P2P flow becomes a non-control P2P flow.

For example, the control P2P flow size distribution is P [control P2P flow size = x] = SPc (x), the non-control P2P flow size distribution is P [non-control P2P flow size = x] = SPu (x), and When the observed number of control P2P flows and the number of non-control P2P flows are NPc and NPu, respectively, the amount of P2P traffic when the control P2P flow becomes a non-control P2P flow is expressed as “NPu × Σ _x SPu (x) × x + NPc × Σ _x SPu (x) × x ”. P2P traffic amount when control P2P flow is directly controlled P2P flow is _{"NPu × Σ x SPu (x)} × x + NPc × Σ x SPc (x) × x ", is minus the latter from the former, It is obtained as an increase in P2P traffic when assuming non-control.

  More specifically, the P2P traffic volume estimation apparatus 1 having the configuration shown in FIG. 7 calculates the P2P traffic volume flowing in the communication network according to the procedure shown in FIG.

  First, in the packet header analysis unit 2, five attributes in the header information of the arrived packet {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), destination port number (dstPort) ), A packet group having the same protocol (Protocol)} is specified as the same flow (step S1101), and the flow management unit 3 adds up the flow size of the flow for each flow specified by the packet header analysis unit 2. The flow management table 801 shown in FIG. 8 is generated and registered in the storage device (step S1102).

  Next, the flow information analysis unit 4 discriminates the P2P flow from each flow registered in the flow management table 801, and controls each P2P flow with the control P2P flow passing through the network performing the bandwidth control and the bandwidth control. A non-controlled P2P flow that passes through a network that has not been performed is classified (step S1103).

  Then, in the flow statistics calculation unit 5, the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow are obtained by referring to the flow management table 801 aggregated for a predetermined period by the flow management unit 3 ( In step S1104), the P2P traffic amount estimation unit 6 replaces the flow size distribution of the control P2P flow obtained by the flow statistic calculation unit 5 with the flow size distribution of the non-control P2P flow, so that the control P2P flow becomes a non-control P2P flow. It is calculated how much the traffic by the P2P application increases when it becomes (step S1105).

  Note that the packet header analysis unit 2 may identify a group of packets having the same two attributes {source IP address (srcIP), destination IP address (dstIP)} in the header information of the arrived packet as the same flow. Well, for the incoming packet in the upstream direction, specify the same group of packets having the same source IP address (srcIP) as an attribute in the header information of the packet, and for the incoming packet in the downstream direction, Packet groups having the same destination IP address (dstIP) that is an attribute in the header information of the packet may be specified as the same flow.

The P2P traffic amount estimation unit 6 sets the flow size distribution of the control P2P flow to P [control P2P flow size = x] = SPc (x), and sets the flow size distribution of the non-control P2P flow to P [non-control P2P flow size = x] = SPu (x), the number of control P2P flows and the number of non-control P2P flows aggregated in the flow management table 801 are NPc and NPu, respectively, and the P2P traffic when the control P2P flow becomes a non-control P2P flow The amount is calculated by "NPu x Σ _x SPu (x) x x + NPc x Σ _x SPu (x) x x" and the calculated P2P traffic volume (NPu x Σ _x SPu (x) x x + NPc x Σ _x from SPu (x) × x), by subtracting the P2P traffic amount when control P2P flow remains controlled P2P flow _{(NPu × Σ x SPu (x} ) × x + NPc × Σ x SPc (x) × x) , Calculate the increase in traffic volume by the P2P application when the control P2P flow passing through the monitoring point becomes a non-control P2P flow Put out.

Further, the flow information analysis unit 4 discriminates a non-P2P flow together with a P2P flow from each flow registered in the flow management table 801, and for each P2P flow and a non-P2P flow, the flow is either a control flow or a non-control flow. Flag X (control flow is X = c, non-control flow is X = u) and flag y (upward direction is y = up, the downward direction is y = dn), and a flag z indicating whether the flow is directed to a user in the communication network or a flow directed to a user outside the communication network (the flow toward the user in the communication network is The flow attribute information table 901 shown in FIG. 9 with z = in and the flow toward the user outside the communication network added is generated and stored in the storage device. For each t, the flow attribute generated by the flow information analysis unit 4 Using the information in the information table 901, type X (= c or u), the direction y (= Stay up-or dn) of traffic N (t) _{X, y} and, type X, direction y flow speed Nf of (t) _The ratio of the number of flows outside the target NW of _{X, y} and the type X, direction y b (t) _{X, y} (Of the total number of flows, the number of flows to the outside of the communication network or from the outside of the communication network Ratio) and the ratio of the number of P2P flows of type X, direction y, z (= in or out) rp (t) _{X, y, z} (the ratio of the number of P2P flows out of the number of flows inside or outside the communication network) ) And P2P flow size distribution SP (t) {X, y, z} (x) of measurement interval t, type X, direction y, and NW inside / outside flag z “FP (t) _{X, y, z} = Σ _x SP (t) {X, y, z} (x) × x ", the average flow size FP (t) _{X, y, z} of the P2P flow of type X, direction y, z _, and flow Number Nf (t) _{X, y} and flow rate ratio b (t) _{X, y,} and P2P flow number ratio rp (t) _{X, y, z} and average flow size FP (t) _{X, y,} equation and using a _{z "NP (t) X, y,} in = FP (t) X, y, in × (1-b (t) X, y) × rp (t ) _{X, y, in} × Nf (t) _{X, y} ”, P2P traffic amount NP (t) _{X, y, in in} NW of type X and direction _y, and number of flows Nf (t) _{X, y} And the flow rate ratio b (t) _{X, y} and the P2P flow number ratio rp (t) _{X, y, z} and the average flow size FP (t) _{X, y, z} ) _{X, y, out} = FP (t) _{X, y, out} × b (t) _{X, y} × rp (t) _{X, y, out} × Nf (t) _{X, y} P2P traffic volume NP (t) _{X, y, out} outside NW in direction y, P2P traffic volume NP (t) _{X, y, in} and NW outside P2P traffic volume NP (t) _{X, y, out} P2P traffic amount NP (t) _{X, of} type X and direction y, which is obtained by the equation “NP (t) _{X, y} = NP (t) _{X, y, in} + NP (t) _{X, y, out} ” calculating a _y, P2P traffic amount estimation unit 6, a traffic amount Ntot in the entire communication network is predetermined respectively, the band control network of flow through the entire network Control flow ratio c is a proportion of the flow through, as well as traffic volume N (t) _X, the average _{AVG [N (t) X,} y] of _{y = Σ t N (t)} X, y / T ( Traffic of type X = c (with bandwidth control) using Equation (1) and Equation (2) shown in Equation 1 above, including t = 1,2, ..., T: T is the number of measurement intervals) And traffic of type X = u (no bandwidth control) is multiplied by α and β, respectively, to obtain α and β so that they match the traffic amount Ntot in the entire communication network, and the obtained α and β and flow statistics calculation Using the calculation result of the unit 5, the P2P traffic amount Npout exchanged outside the NW and the P2P traffic amount in the NW when the control P2P flow is controlled as it is from the calculation formula shown in the above equation 2 Calculate Npin.

  Further, the P2P traffic amount estimation unit 6 performs control by substituting the control P2P flow size classified by the flow information analysis unit 4 with the non-control P2P flow size according to the equations (5) to (7) shown in Equation 3 above. The amount of P2P traffic when the P2P flow is uncontrolled is calculated.

In addition, the P2P traffic amount estimation unit 6 assumes that the flow is transmitted according to the non-control P2P flow size distribution at the rate of γ among the control P2P flows classified by the flow information analysis unit 4, and performs the measurement after the non-control. The P2P flow size distribution SP ″ {t, c, y, z} (x) of the section t, the type X, the direction y, and the NW inside / outside flag z is expressed by the expression “SP ″ {t, c, y, z} ( x) = (1-γ) SP (t) {c, y, z} + γSP (t) {u, y, z} ”and the average flow size FP ′ (t) c, y, z , wherein "FP '(t) c, y , z = Σ x SP''{t, c, y, z} (x) × x " determined by, obtained FP' (t) c, y , z ( = Σ _x SP ″ (t) {X, y, z} (x) × x ″) is used instead of FP ′ (t) c, y, z in Equation (7) in Equation 3 above The P2P traffic amount when the control P2P flow is uncontrolled is calculated by the equations (5) to (6) shown in equation (3).

  That is, the P2P traffic amount estimation unit 6 performs control by substituting the control P2P flow size classified by the flow information analysis unit 4 with the non-control P2P flow size according to the following equations (8) to (10). The amount of P2P traffic when the P2P flow is uncontrolled is calculated.

In addition, the flow statistics calculation unit 5 sets the average flow size FP (t) _{X, y, z} of the P2P flow of type X, direction y, z to P2P of the measurement interval t, type X, direction y, NW inside / outside flag z. Formula “FP (t) _{X, y, z} = Σ _x SP (t) {X, y, z} (x) × x using flow size distribution SP (t) {X, y, z} (x) ].

Alternatively, the flow statistics calculation unit 5 extracts only flows having a size equal to or larger than a predetermined threshold th from the P2P flows as the specific P2P flow, and the flow size distribution SP ′ {t, X, y, z} (x) is _transformed into the expression “SP ′ {t, X, y, z} (x) = SP (t) {X, y, z} / [1- _{Σx = 1˜th} SP (t) { X, y, z}] and the average flow size FP (t) _{X, y, z} of the P2P flow of type X, direction y, z is expressed by the formula “FP (t) _{X, y, z} = Σ _x SP '{t, X, y, z} (x) × x' and the P2P flow ratio rp '(t) _{X, y, z} is converted to the expression' rp '(t) _{X, y, z} = rp (T) _{X, y, z} × [1- _{Σx =} 1 to _th SP ′ {t, X, y, z} (x)] ”.

  In this way, in this example, it is possible to estimate how much the amount of P2P traffic will increase when non-control in the network is assumed, and it is possible to more accurately grasp the demand for original P2P traffic, Future network architecture and network design can be performed more appropriately.

  In addition, this invention is not limited to the example demonstrated using each figure, In the range which does not deviate from the summary, various changes are possible. For example, in FIG. 7, each processing unit (packet header analysis unit 2, flow management unit 3, flow information analysis unit 4, flow statistics calculation unit) of the P2P traffic amount estimation device 1 according to the present invention is included in one computer device. 5, the P2P traffic amount estimation unit 6) is provided. However, the function of each processing unit may be appropriately distributed in a plurality of computer devices.

  The computer configuration of this example may be a computer configuration without a keyboard or optical disk drive. In this example, an optical disk is used as a recording medium. However, an FD (Flexible Disk) or the like may be used as a recording medium. As for the program installation, the program may be downloaded and installed via a network via a communication device.

  1: P2P traffic amount estimation device, 2: packet header analysis unit, 3: flow management unit, 4: flow information analysis unit, 5: flow statistics calculation unit, 6: P2P traffic amount estimation unit, 101: flow information table, 301 401: Network, 501: P2P traffic amount estimation device, 502: Node A, 503: Node B, 601: P2P traffic amount estimation device, 602: Network, 603a to 603g: Router, 801: Flow management table, 901: Flow Attribute information table.

Claims (11)

A P2P traffic amount estimation method for calculating a traffic amount by a P2P application flowing in a communication network by a computer device,
The computer apparatus includes, as means for executing programmed computer processing, packet header analysis means, flow management means, flow information analysis means, flow statistics calculation means, and P2P traffic amount estimation means,
The packet header analysis means includes
The same five attributes {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), destination port number (dstPort), protocol (Protocol)} in the header information of the arrived packet Specify the same packet group as the same flow,
The flow management means is
For each flow identified by the packet header analysis means, the flow size of the flow is aggregated and registered in the storage device as a flow management table,
The flow information analyzing means is
While determining the P2P flow from each flow registered in the flow management table,
Each P2P flow is classified into a control P2P flow that passes through a network that performs bandwidth control and a non-control P2P flow that passes through a network that does not perform bandwidth control.
The flow statistics calculation means is
Referring to the flow management table compiled by the flow management means for a predetermined period,
Obtain the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow,
The P2P traffic amount estimation means is:
The P2P application when the control P2P flow becomes the non-control P2P flow by replacing the flow size distribution of the control P2P flow obtained by the flow statistics calculation means with the flow size distribution of the non-control P2P flow A P2P traffic amount estimation method, characterized in that it calculates how much traffic is increased by the. A P2P traffic amount estimation method for calculating a traffic amount by a P2P application flowing in a communication network by a computer device,
The computer apparatus includes, as means for executing programmed computer processing, packet header analysis means, flow management means, flow information analysis means, flow statistics calculation means, and P2P traffic amount estimation means,
The packet header analysis means includes
Identify the same group of packets that have the same two attributes {source IP address (srcIP), destination IP address (dstIP)} in the header information of the arrived packet,
The flow management means is
For each flow identified by the packet header analysis means, the flow size of the flow is aggregated and registered in the storage device as a flow management table,
The flow information analyzing means is
While determining the P2P flow from each flow registered in the flow management table,
Each P2P flow is classified into a control P2P flow that passes through a network that performs bandwidth control and a non-control P2P flow that passes through a network that does not perform bandwidth control.
The flow statistics calculation means is
Referring to the flow management table compiled by the flow management means for a predetermined period,
Obtain the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow,
The P2P traffic amount estimation means is:
The P2P application when the control P2P flow becomes the non-control P2P flow by replacing the flow size distribution of the control P2P flow obtained by the flow statistics calculation means with the flow size distribution of the non-control P2P flow A P2P traffic amount estimation method, characterized in that it calculates how much traffic is increased by the. A P2P traffic amount estimation method for calculating a traffic amount by a P2P application flowing in a communication network by a computer device,
The computer apparatus includes, as means for executing programmed computer processing, packet header analysis means, flow management means, flow information analysis means, flow statistics calculation means, and P2P traffic amount estimation means,
The packet header analysis means includes
For the upstream packet that arrived, the same flow group is specified as a packet group having the same source IP address (srcIP) as an attribute in the header information of the packet,
For incoming downstream packets, specify the same flow as a packet group having the same destination IP address (dstIP) as an attribute in the header information of the packet,
The flow management means is
For each flow identified by the packet header analysis means, the flow size of the flow is aggregated and registered in the storage device as a flow management table,
The flow information analyzing means is
While determining the P2P flow from each flow registered in the flow management table,
Each P2P flow is classified into a control P2P flow that passes through a network that performs bandwidth control and a non-control P2P flow that passes through a network that does not perform bandwidth control.
The flow statistics calculation means is
Referring to the flow management table compiled by the flow management means for a predetermined period,
Obtain the flow size distribution of the control P2P flow and the flow size distribution of the non-control P2P flow,
The P2P traffic amount estimation means is:
The P2P application when the control P2P flow becomes the non-control P2P flow by replacing the flow size distribution of the control P2P flow obtained by the flow statistics calculation means with the flow size distribution of the non-control P2P flow A P2P traffic amount estimation method, characterized in that it calculates how much traffic is increased by the. A method for estimating a P2P traffic amount according to any one of claims 1 to 3,
The P2P traffic amount estimation means is:
The flow size distribution of the control P2P flow is P [control P2P flow size = x] = SPc (x), the flow size distribution of the non-control P2P flow is P [non-control P2P flow size = x] = SPu (x), The number of the control P2P flows and the number of the non-control P2P flows aggregated in the flow management table are NPc and NPu, respectively.
The P2P traffic amount when the control P2P flow becomes the uncontrolled P2P flow calculated by the _{"NPu × Σ x SPu (x)} × x + NPc × Σ x SPu (x) × x "
The calculated P2P traffic volume out of the _{(NPu × Σ x SPu (x} ) × x + NPc × Σ x SPu (x) × x), P2P traffic amount when the control P2P flow remains controlled P2P flow (NPU X Σ _x SPu (x) x x + NPc x Σ _x SPc (x) x x)
A method for estimating a P2P traffic amount, comprising: calculating an increase in traffic amount by the P2P application when the control P2P flow passing through the computer device becomes the non-control P2P flow. A method for estimating a P2P traffic amount according to any one of claims 1 to 3,
The flow information analyzing means is
The non-P2P flow is determined together with the P2P flow from each flow registered in the flow management table,
For each P2P flow and non-P2P flow,
A flag X indicating whether the flow is a control flow or a non-control flow (control flow is X = c, non-control flow is X = u);
A flag y indicating whether the flow is in the up or down direction (y = up for the up direction and y = dn for the down direction);
A flag z indicating whether the flow is directed to a user in the communication network or a flow directed to a user outside the communication network (the flow toward the user in the communication network is z = in, and is directed to the user outside the communication network) Create a flow attribute information table with the flow z = out) and store it in the storage device.
The flow statistics calculation means is
Every fixed period t
Using the information in the flow attribute information table generated by the flow information analysis means,
Traffic amount N (t) _{X, y of} type X (= c or u), direction y (= up or dn),
Type X, number of flows in direction y Nf (t) _{X, y}
Number of flows outside the target NW of type X and direction y b (t) _{X, y} (percentage of the number of flows out of or above the communication network out of the total number of flows) ,
P2P flow number ratio rp (t) _{X, y, z} (ratio of the number of P2P flows in or out of the above communication network) of type X, direction y, z (= in or out),
Average flow size FP (t) _{X, y, z} of P2P flows of type X, direction y, z,
The flow number Nf (t) _{X, y} and the non-NW flow number ratio b (t) _{X, y, the} P2P flow number ratio rp (t) _{X, y, z} and the average flow size FP (t) _{X , y, z} and the formula “NP (t) _{X, y, in} = FP (t) _{X, y, in} × (1-b (t) _{X, y} ) × rp (t) _{X, y, in} × Nf (t) _{X, y} ”, PW traffic amount NP (t) _{X, y, in in} NW of type X and direction y,
The flow number Nf (t) _{X, y} and the non-NW flow number ratio b (t) _{X, y, the} P2P flow number ratio rp (t) _{X, y, z} and the average flow size FP (t) _{X , y, z} and the formula NP (t) _{X, y, out} = FP (t) _{X, y, out} × b (t) _{X, y} × rp (t) _{X, y, out} × Nf ( t) _{X, y} ” _{, the} P2P traffic amount NP (t) _{X, y, out} outside NW of type X and direction y,
The expression “NP (t) _{X, y} = NP (t) _X using the intra-NW P2P traffic amount NP (t) _{X, y, in} and the non-NW P2P traffic amount NP (t) _{X, y, out , y, in} + NP (t) _{X, y, out} ”, P2P traffic amount NP (t) _{X, y of} type X and direction y is calculated,
The P2P traffic amount estimation means is:
The traffic amount Ntot in the entire communication network determined in advance, the control flow ratio c that is the proportion of the flow that passes through the bandwidth control network out of the flows that flow through the entire communication network, and the traffic amount N (t) _{X , y} average AVG [N (t) _{X, y} ] = Σ _t N (t) _{X, y} / T (t = 1,2 _, ... _, T: T is the number of measurement intervals) Using Equation (1) and Equation (2) shown in FIG.
Α and β so that the traffic of type X = c (with bandwidth control) and the traffic of type X = u (without bandwidth control) are multiplied by α and β, respectively, to match the traffic amount Ntot of the entire communication network. Seeking
Using the calculated α and β and the calculation result by the flow statistical calculation means, using the equations (3) and (4) shown in the following equation 2,
A P2P traffic estimation method characterized by calculating a P2P traffic amount Npout exchanged outside the NW and an intra-NW P2P traffic amount Npin when the control P2P flow is controlled as it is.

The P2P traffic amount estimation method according to claim 5,
The P2P traffic amount estimation means is:
By the formulas (5) to (7) shown in the following formula 3,
By replacing the control P2P flow size classified by the flow information analysis means with a non-control P2P flow size,
A P2P traffic amount estimation method, characterized in that a P2P traffic amount when a control P2P flow is uncontrolled is calculated.

The P2P traffic amount estimation method according to claim 5,
The P2P traffic amount estimation means is:
Assuming that the flow is analyzed according to the non-control P2P flow size distribution at the rate of γ among the control P2P flows classified by the flow information analysis means,
The P2P flow size distribution SP '' {t, c, y, z} (x) of the measurement interval t, type X, direction y, and NW inside / outside flag z after de-control is expressed by the expression "SP '' {t, c, y, z} (x) = (1-γ) SP (t) {c, y, z} + γSP (t) {u, y, z} ”
Calculate the average flow size FP '(t) c, y, z using the formula "FP' (t) c, y, z = Σ _x SP '' {t, c, y, z} (x) xx" ,
A P2P traffic amount estimation method characterized by calculating a P2P traffic amount when the control P2P flow is uncontrolled by the following formulas (8) to (10) shown in Equation 4.

A method for estimating a P2P traffic amount according to any one of claims 5 to 7,
The flow statistics calculation means is
The average flow size FP (t) _{X, y, z} of the P2P flow of type X, direction y, z is
Formula “FP (t) _{X, y, z} = Σ _x using P2P flow size distribution SP (t) {X, y, z} (x) of measurement section t, type X, direction y, NW inside / outside flag z SP (t) {X, y, z} (x) × x ”. A method for estimating a P2P traffic amount according to any one of claims 5 to 7,
The flow statistics calculation means is
Of the above P2P flows, only flows with a size equal to or greater than a predetermined threshold th are extracted as specific P2P flows,
The flow size distribution SP ′ {t, X, y, z} (x) of the specific P2P flow is expressed by the expression “SP ′ {t, X, y, z} (x) = SP (t) {X, y, z} / [1- _{Σx =} 1 to _th SP (t) {X, y, z}]
The average flow size FP (t) _X, y, z of the P2P flow of type X and direction y, z is expressed by the formula “FP (t) _{X, y, z} = Σ _x SP ′ {t, X, y, z } (X) x x "
The P2P flow ratio rp ′ (t) _{X, y, z} is expressed by the equation “rp ′ (t) _{X, y, z} = rp (t) _{X, y, z} × [1- _{Σx = 1˜th} SP ′ {t, X, y, z} (x)] ". A P2P traffic amount estimation device for calculating the amount of traffic by a P2P application flowing in a communication network by computer processing,
As means for executing programmed computer processing, packet header analysis means, flow management means, flow information analysis means, flow statistics calculation means in the P2P traffic amount estimation method according to any one of claims 1 to 9, A P2P traffic amount estimation device comprising a P2P traffic amount estimation means.   Each process by the packet header analysis means, the flow management means, the flow information analysis means, the flow statistics calculation means, and the P2P traffic amount estimation means in the P2P traffic amount estimation method according to any one of claims 1 to 9 A program for running

Images