JP5511562B2 - Traffic fluctuation amount estimation device, traffic management device, traffic distribution device, and method - Google Patents

Description

  The present invention relates to a technique for managing traffic in an IP network.

  As IP networks become more widely used, traffic needs to be measured and reflected in appropriate network design and operation. For example, when designing a network bandwidth, it is important to grasp not only the average traffic volume but also the fluctuation amount (for example, 95% of the traffic volume).

  It may also be necessary to estimate the number of flows that flow through the network. Here, a flow is a packet having the same set of five elements: a source IP address (srcIP), a destination IP address (dstIP), a source port number (srcPort), a destination port number (dstPort), and a protocol (protocol). Refers to a group. For example, technologies such as NetFlow and sFlow that measure traffic flowing on the network at the flow level are implemented in the router, and flow information observed by the router is exported to a monitoring device called a collector and analyzed by the collector. , Grasp the state of the network. At this time, it is necessary to estimate how many flows arrive at the collector. At that time, it is necessary to grasp not only the average but also the fluctuation amount and prepare a collector having an appropriate processing capacity. Alternatively, when communication is controlled in units of sessions (flows) such as SIP, it is necessary to grasp the number of sessions on the SIP server.

  Furthermore, in recent years, abnormal traffic such as DDoS (Distributed Denial of Service) and scanning has increased rapidly, and the need to detect such abnormal traffic through measurement is also increasing. At this time, in order to find abnormal traffic, a method of accurately estimating the degree of fluctuation in normal traffic and assuming that abnormal traffic occurs when traffic rapidly increases beyond the range of the fluctuation (for example, non-traffic) Since Patent Document 1) is also considered, it is important to appropriately grasp the traffic fluctuation amount in this respect as well.

  On the other hand, in recent years, a technique for measuring and analyzing traffic through packet sampling has been attracting attention in order to perform measurement that can cope with an increase in line speed (Non-patent Document 2). For example, it is a technique of collecting and analyzing flow information (how many packets have been sampled from which flow) by periodically referencing one packet per N packets. Aggregate such sample flow information and create time series data on the number of packets, bytes, and flows generated in a monitoring unit (for each link, for each router, or for each ground) at a certain period (for example, 5 minutes). However, it is considered to analyze (Non-patent Document 3).

Harada Toshiaki, Kawahara Ryoichi, Mori Tatsuya, Kamiyama Noriaki, Hirokawa Hiroshi, Yamamoto Kimihiro, "Abnormal Traffic Occurrence Detection and Termination Judgment Technique," IEICE Technical Report, vol. 106, no. 420, IN2006-133, pp. 115 -120, December 2006. [PSAMP] RFC 5474 on A Framework for Packet Selection and Reporting http://www.faqs.org/rfcs/rfc5474.html Okura et al., Shingaku Sodai, B-7-70, 2006 T. MORI, T. TAKINE, J. PAN, R. KAWAHARA, M. UCHIDA, and S. GOTO, "Identifying Heavy-Hitter Flows from Sampled Flow Statistics," IEICE TRANSACTIONS on Communications, Vol.E90-B, No. 11, pp.3061-3072, Nov 2007. C. Estan and G. Varghese, "New Directions in Traffic Measurement and Accounting," ACM SIGCOMM2002, Aug. 2002. N. Duffield, C. Lund, and M. Thorup, "Properties and Prediction of Flow Statistics from Sampled Packet Streams," ACM SIGCOMM Internet Measurement Conference 2002, Nov. 2002. N. Duffield, C. Lund, and M. Thorup, `` Estimating Flow Distributions from Sampled Flow Statistics, '' In Proceedings of ACM SIGCOMM, pp. 325-336, Aug. 2003. R. Kawahara, T. Mori, N. Kamiyama, S. Harada, and S. Asano, "A study on detecting network anomalies using sampled flow statistics," SAINT 2007 Workshop on Internet measurement technology and its applications to building next generation Internet, Jan . 2007.

  However, in the technique of measuring and analyzing traffic through packet sampling as described above, since packet sampling is performed, necessary information may be lost, and it is necessary to estimate the original flow statistics . Non-Patent Document 4 proposes a method of identifying a flow with a high link bandwidth occupancy rate using packet sampling. Non-Patent Document 5 proposes a method for accurately obtaining statistics of a flow having a large flow size. In Non-Patent Documents 6 and 7, using the number of sampled SYN packets (one of the TCP flags, meaning the start of communication), the total number of unsampled flows, the average of the flow sizes, A method for estimating the distribution is proposed.

  However, these proposed techniques have not made it possible to estimate the amount of traffic time series fluctuation.

  The present invention has been made in view of the above-described problems, and provides a technique that makes it possible to estimate the amount of traffic fluctuation that is difficult to observe from observable data, and the estimated traffic. An object is to provide a technique for realizing traffic management using the fluctuation amount.

により算出することを特徴とするトラヒック変動量推定装置として構成することができる。
In order to solve the above-described problems, the present invention receives sample flow information collected by packet sampling at a sampling rate p in a communication network, and estimates traffic fluctuation amount from the sample flow information. A time-series data generating means for generating time-series data of the number of flows as a traffic amount based on the sample flow information, an expected value y of a sample variance relating to the traffic amount, and an expected value x of a sample average The parameters α (p) and β (p) in the approximate expression y = α (p) x ² + β (p) x indicating the relationship between the time series flow numbers generated by the time series data generation means Using the approximate expression y = α (p) x ² + β (p) x having the parameters α (p) and β (p) calculated by the approximate expression calculating means, and calculating the approximate expression calculating means, A tiger that estimates the amount of traffic fluctuation Tsu a traffic variation amount estimation device Ru and a click estimating means, the traffic fluctuation amount estimation device, by using the source IP address of flow in the sample flow information as a key, the flow M (M is a natural number ) comprising a flow classification means for dividing the number of groups, the flow classification unit, the flow, _one and M ₂ pieces M (M ₁ and M ₂ are classified into two types of each natural number), the approximate equation The calculating means calculates the sample mean X ^(m) (p) and the sample variance Vx ^(m) (p ⁾ from the number of time series flows for each group m (m = 1 to M) generated by the time series data generating means. ) And calculate the expected value of the sample mean for the entire group as S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (summed from m = 1 to M ), expected value of sample variance the performed for two different _{^{S V (M) (p)}} = 1 / M ΣVx (m) (p) = M a process of calculating the (m sums in = 1 to M) M ₁ and M ₂ M = M _i (i = 1, 2), the set of S _E ^(Mi) (p) and S _V ^(Mi) (p) is (x _i , y _i ), and the parameters α (p) and β (p) are

It is possible to configure as a traffic fluctuation amount estimation device characterized by the above calculation .

In addition, the present invention is a traffic management apparatus that receives sample flow information collected by packet sampling at a sampling rate p in a communication network and determines a flow division number suitable for abnormal traffic monitoring from the sample flow information. Based on the sample flow information, the time-series data generating means for generating the time-series data of the number of flows as the traffic amount, the time-series flow number from the time-series data generating means, Approximate expression y = α (p ) The parameters α (p) and β (p) in x ² + β (p) x are calculated from the number of normal time series flows that are not determined to be abnormal by the abnormality detection means. (Average, variance) when the number of abnormal flows is added to the number of normal flows and (x + m_d, α (p) x ² + β (p) x + v_d) In the probability distribution Fx (u) with the average and variance of the number of flows when the number of abnormal flows with the average of m_d and variance of v_d is added to the number, the abnormality judgment threshold is set to th, and the predetermined abnormality miss rate is ε Calculate the normal average number of flows x * satisfying Fx (th) <ε, and obtain the sample average X ^(j) (p) of the number of flows in group j when the flow is divided by the number of divisions of M. The overall sample mean S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (m = 1 to M is summed) and x * are compared, and x * / S _E ^{(M ) When} (p) is smaller than a predetermined threshold value, it is provided with a division number determining means for determining a flow division number suitable for abnormal traffic monitoring by performing a process of increasing the division number to be larger than M. As a traffic management device Made.

Further, the present invention is a traffic distribution device that is connected to L (L is a natural number) servers via a communication network and distributes traffic flows to the L servers. (L is a natural number) When classifying as a traffic amount, a flow classification means for transferring a flow to each server for each group, and time-series data of the number of flows of each group classified by the flow classification means The parameter α () in the approximate expression y = α (p) x ² + β (p) x indicating the relationship between the series data generation means and the expected value y of the sample variance regarding the traffic volume and the expected value x of the sample mean p) and β (p) are approximate expression calculating means for calculating from the number of time-series flows generated by the time-series data generating means, and a distribution destination for determining whether or not to change the flow distribution destination server A server determination means, Specimens in the case where the flow is distributed to over server j (j = 1~L) and flow of group j, the approximate expression calculation means, the flow speed of the sample mean X of the group ^{j (j) (p)} and The variance Vx ^(j) (p) is calculated, and the set (X ^(j) (p), Vx ^(j) (p)) is (x _j , y _j ), and the approximate expression y = α (p) x By fitting to ² + β (p) x, the parameters α (p) and β (p) are obtained,
The distribution destination server determining means uses the approximate expression, so that the number of flows follows a predetermined distribution having parameters of average x and variance α (p) x ² + β (p) x. Calculate the number of flows in the percentile, and the number of flows in the upper X percentile is the processing capacity B _k × a of server k Calculate the average x_target_k such that (a is a coefficient less than ¹⁾ , and X ⁽¹⁾ (p) + X ⁽²⁾ (p) +… + X ^(J) (p) <= x_target_k As long as all the remaining groups are accommodated in one of the servers, the calculation process of accommodating the flows of groups 1, 2, ..., J to the server k is repeated for each server as long as it is satisfied. If there is a server that is no longer needed, it can be configured as a traffic distribution device that determines to change the flow distribution destination server.

  In addition, the present invention can be configured as a method invention corresponding to the processing method of each of the above apparatuses.

  According to the present invention, it is possible to provide a technique that makes it possible to estimate a traffic fluctuation amount that is difficult to observe from observable data, and determine the number of flow divisions using the estimated traffic fluctuation amount. In addition, it is possible to provide a technology that realizes traffic management such as changing the flow distribution destination.

It is a figure explaining the relationship between an abnormal traffic detection threshold value, a false detection rate, and a miss rate. It is a figure which shows the system configuration | structure in Example 1 of this invention. It is a block diagram which shows the structural example of the traffic fluctuation amount estimation apparatus 10 in Example 1 of this invention. It is a flowchart which shows the operation | movement procedure of the traffic fluctuation amount estimation apparatus 10 in Example 1 of this invention. It is a block diagram which shows the structural example of the traffic management apparatus 30 in Example 3 of this invention. It is a flowchart which shows the operation | movement procedure of the traffic management apparatus 30 in Example 3 of this invention. It is a figure which shows the system configuration | structure in Example 4 of this invention. It is a block diagram which shows the structural example of the traffic distribution apparatus 40 in Example 4 of this invention. It is a flowchart which shows the operation | movement procedure of the traffic distribution apparatus 40 in Example 4 of this invention. It is a graph which shows the result of having experimented the effectiveness of the approximate expression in the technique which concerns on this invention.

  First, the 1st-7th method used as a processing method which the apparatus in each Example of this invention performs is demonstrated.

(First method)
In the first method, in a communication network, a flow is made up of a source IP address (srcIP), a destination IP address (dstIP), a source port number (srcPort), a destination port number (dstPort), and a protocol number (Protocol). By defining the five packet groups as the same packet group, collecting traffic data related to the flow by packet sampling at the sampling rate p, and estimating the traffic fluctuation amount that is difficult to observe from the data obtained by observation Is the law.

In this first method, the time series data of the number of sample flows (number of flows in which at least one packet is sampled) observed every fixed period as the traffic amount is handled, and the sample average relating to the time series of the traffic amount and For the sample variance, the relational expression between the expected value y of the sample variance and the expected value x of the sample mean is approximated by y = α (p) x ² + β (p) x, and the parameter α ( p) and β (p) are estimated from the observed data.

  As a result, when an area that is difficult to observe, that is, when the average traffic volume is assumed to be larger or smaller than the observed area, the variance at that time can be estimated using the above approximate expression.

  Here, a method for deriving this approximate expression will be described below.

<Derivation method of approximate expression>
(1) Problem setting
During K unit time, random sampling is performed using random packet sampling, and the aggregated flow index (for example, source IP address) of the sampled packet is applied to a hash function to classify into M groups. In the following, sampling is performed at time intervals (0, K), and the time interval (k−1, k) (k = 1, 2,..., K) is referred to as interval k. The rate is expressed as p.

Let F be the total number of flows in the population, and F _A be the number of aggregated flow index differences. Also, the number of flows classified into the mth (m = 1,2, ... M) group is F ^(m), and the aggregated flow index is classified into the mth (m = 1,2, ... M) group. Let F _A ^(m) be the number of differences. From definition

である。

It is.

Indicator function J _{Aj (m)} for the event that the j-th (j = 1,2,3, ...., F _A ) aggregated flow index is classified into the mth (m = 1,2, ... M) group Is defined by the following equation.

また、j番目(j=1,2,3,…,F_A)の集約フロー指標をもつフローの総数をF_jで表す。よって、m番目のグループに分類される集約フロー指標の総数F_A ^(m)ならびにm番目のグループに分類されるフローの総数F^(m)は

Further, the total number of flows having the j-th (j = 1, 2, 3,..., F _A ) aggregated flow index is represented by F _j . Therefore, the total number F _A ^{(m) of} aggregated flow indicators classified into the mth group and the total number F ^(m) of flows classified into the mth group are

で与えられる。以下では、各グループに属するフローに番号を振り、個々のフローを区別する。

Given in. In the following, numbers are assigned to flows belonging to each group to distinguish individual flows.

To the i-th (i = 1,2,3, ..., F ^(m) ) flow (hereinafter referred to as flow (m, i)) belonging to the m-th (m = 1,2, ..., M) group An instruction function Y _i ^(m) (k | p) (k = 1, 2,..., K) for an event that at least one included packet is extracted in the interval k is defined by the following equation.

さらに、グループmにおいて区間kで少なくとも一つのパケットが抽出されるフローの数X^(m)(k)を定義する。

Further, the number of flows X ^(m) (k) from which at least one packet is extracted in the interval k in the group m is defined.

このとき、標本抽出実験の結果得られる、K個の単位区間に渡って得られるX ^(m)(k|p)の標本平均

At this time, the sample average of X ^(m) (k | p) obtained over K unit intervals obtained as a result of the sampling experiment

ならびに標本分散

And sample variance

は次式で与えられる。

Is given by:

定義より、これらの期待値は、

By definition, these expected values are

で与えられる。以下では、

Given in. Below,

と

When

の関係を議論する。
（２）モデル
この節では、以下の仮定を置く。

Discuss the relationship.
(2) Model This section makes the following assumptions.

Assumption 1: Indication function J _Aj for the event that the j-th (j = 1, 2, 3,..., F _A ) aggregated flow index is classified into the m-th (m = 1, 2,..., M) group (m) is independent of other events and its expected value is

で与えられる。

Given in.

Assumption 2: The total number F _j of flows having the j-th (j = 1, 2, 3,..., F _A ) aggregated flow index independently follows the same distribution.
Different number of aggregated flow indicators in the population F _A is treated as an (unknown) definite value

であり、式（１）、式（２）、仮定１、仮定２より、F^(m)の平均と分散はそれぞれ次式で与えられる。

From Equation (1), Equation (2), Assumption 1, and Assumption 2, the mean and variance of F ^(m) are given by the following equations, respectively.

ただし、Cは

Where C is

である。

It is.

Assumption 3: An indicator function for an event that at least one packet of flow (m, i) (m = 1, 2,..., M, i = 1, 2,..., F ^(m) ) is extracted in interval k. The set {Y _i ^(m) (k | p); k = 1, 2,..., K} has the same connection distribution regardless of the values of m and i.

From Assumption 3, a set of random variables {Y (k | p) that follows the same joint distribution as {Y _i ^(m) (k | p); k = 1,2, ..., K} for an arbitrary flow (m, i) ); k = 1,2, ..., K} can be defined. Using this, the mean E [X ^(m) (p)] and variance Var [X ^(m) (p ^{) of the} number of flows X ^(m) (p) in the time interval randomly selected within the observation period in group m )] Is given by:

式（９）に現れる鍵括弧内の項は、凸関数に対するJensenの不等式より

The term in square brackets that appears in equation (9) is from Jensen's inequality for convex functions

であり、等号はE[Y(k|p)]がkに依らず一定の場合のみ成立することに注意する。

Note that the equal sign holds only if E [Y (k | p)] is constant regardless of k.

  From equation (8)

が得られ、これと式（６）より

From this and equation (6)

が成立する。これらを式（９）へ代入し、整理すると

Is established. Substituting these into equation (9) and rearranging

を得る。ただし、A(p), B(p)は任意のフローを特徴付ける確率変数{Y(k|p);k=1,2,…,K}のみで定まる値であり、

Get. However, A (p) and B (p) are values determined only by a random variable {Y (k | p); k = 1,2, ..., K} characterizing an arbitrary flow,

で与えられる。

Given in.

Equation (10) shows that the variance Var [X ^(m) (p)] of the number of flows classified into the mth group is given by a quadratic function of the average E [X ^(m) (p)]. ing. That is, the mean dispersion curve is a quadratic curve with unknown constants α (p), β (p)
y = α (p) x ² + β (p) x (12)
It becomes.

Where the sample mean of data X ^(m) (k | p) for M

と標本分散

And sample variance

が既知であるとする。まず、それぞれの分類におけるE[X^(m)(p)]とVar[X^(m)(p)] (m = 1, 2, …, M)に対応する標本平均S_E ^(M)(p)、標本分散S_V ^(M)(p)を次式により算出する。

Is known. First, the sample mean S _E ^(M) (p ⁾ corresponding to E [X ^(m) (p)] and Var [X ^(m) (p)] (m = 1, 2,…, M) in each classification ), Sample variance S _V ^(M) (p) is calculated by the following equation.

式（３）と式（８）より、

From Equation (3) and Equation (8),

が成立するため、S_E ^(M)(p)は平均E[X^(m)(p)]の不偏推定量である。一方、式（４）から、

Therefore, S _E ^(M) (p) is an unbiased estimator of the average E [X ^(m) (p)]. On the other hand, from equation (4)

にはK個の時間区間内での共分散を含む項が含まれており、偏りがある。今後、以下を仮定する。

Contains a term that includes covariance within K time intervals and is biased. From now on, we will assume the following.

  Assumption 4:

における共分散を含む項は無視できる。すなわち、

Terms with covariance in can be ignored. That is,

が成立する。

Is established.

  Therefore, the relational expression of the quadratic function of Expression (12) is established between the expected value of the sample mean and the expected value of the sample variance.

(Second method)
Next, the second method will be described. In the second method, in the first method, the srcIP of the observed flow is input to a hash function prepared in advance as a key, and divided into M groups based on the hash value.

For example, flows having the same remainder when the hash value is divided by M are classified into the same group. The sample mean X ^(m) (p) and sample variance Vx ^(m) (p) are calculated for the flow number time series belonging to the mth group (m = 1 to M) at this time, and the samples of the entire group are calculated. The average expected value is S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (m = 1 to M is summed), and the expected sample variance is S _V ^(M) (p) = 1 / M Estimate by ΣVx ^(m) (p) (m = 1 to M and sum). This is performed for M = M ₁ and M ₂ , and S _E ^(Mi) (p) and S _V ^(Mi) (p) when M = M _i (i = 1, 2). Is set to (x _i , y _i ), and parameters α (p) and β (p) in the first method are estimated by the following equations.

（第３の方法）
次に、第３の方法について説明する。第３の方法では、第２の方法において、srcIPをキーとしてグループに分けていた代わりに、dstIPをキーにするか、または｛発信元IPアドレス(srcIP)、着信先IPアドレス(dstIP)、発信元ポート番号(srcPort)、着信先ポート番号(dstPort)、プロトコル番号(Protocol)｝の５つ組みのうちのいくつかの組み合わせでキーを定義してグループに分類することとしている。

(Third method)
Next, the third method will be described. In the third method, instead of using srcIP as a key and dividing into groups in the second method, dstIP is used as a key, or {source IP address (srcIP), destination IP address (dstIP), outgoing Keys are defined and classified into groups of several combinations among five combinations of an original port number (srcPort), a destination port number (dstPort), and a protocol number (Protocol)}.

  How to define and group keys can be set according to the purpose at that time. For example, the sixth method, which will be described later, aims to monitor abnormal traffic. In that case, for example, by classifying srcIP into a group, it is suitable for finding anomalies such as scanning where traffic is distributed from a specific srcIP to many dstIPs and dstPorts. This is because such abnormal traffic is all collected in the same group when group classification is performed using srcIP as a key, so that it is easy to detect abnormal traffic (Non-patent Document 8). .

(Fourth method)
Next, the fourth method will be described. In the fourth method, using the parameters obtained by the second method, the relational expression y = α (p) x ² + β (p) x between the expected value y of the sample variance and the expected value x of the sample mean is Derived and the variance when assuming that the future average traffic amount is x_est is estimated by y_est = α (p) (x_est) ² + β (p) (x_est).

  On the other hand, assuming that traffic follows a predetermined distribution (normal distribution, etc.) with mean x_est and variance y_est as parameters, the top X percentile is derived, and the necessary equipment is designed by regarding it as the amount of traffic added at the future time point. To do.

(Fifth method)
Subsequently, the fifth method will be described. In the fifth method, it is assumed that traffic added to the network is divided into M groups and monitored, and flows classified into each group are further divided into M ′ pieces using a hash function, By classifying M ₁ and M ₂ into two groups in the second method, and estimating the parameters α (p) and β (p) of the first method in the procedure of the second method Yes.

(Sixth method)
Next, the sixth method will be described. In the sixth method, the flow is divided into M groups, the flow number time series of each group m (m = 1 to M) is observed, and a sudden change in the flow number is monitored to detect abnormalities. Assume that traffic is detected. At this time, if it is determined that there is no abnormal traffic in the current traffic, the parameters α (p) and β (p) are estimated by the fifth method, and the expectation of the sample variance of the number of normal flows A relational expression y = α (p) x ² + β (p) x between the value y and the sample average expectation value x is derived in advance.

On the other hand, the number of flows follows a predetermined distribution (normal distribution or the like) having an average x and a variance y as parameters. Here, (m_d, v_d) is defined as abnormal traffic to be detected (average number of flows, variance of number of flows). These are predetermined values. Then, if the abnormal traffic is applied, an appropriate division number M * is determined below so that detection is possible at a predetermined abnormality miss rate ε or less.
The (average, variance) when the abnormal flow number is added to the normal flow number is (x + m_d, α (p) x ² + β (p) x + v_d), and the normal flow number + abnormal flow number is this Consider a probability distribution Fx (u) with mean and variance. Here, Fx (u) means the probability that the random variable U of normal flow number + abnormal flow number is less than or equal to u when the average number of normal flows is x. That is, Fx (u) = P [U = <u]. X * satisfying Fx (th) <ε in the probability distribution is calculated. Note that th is a threshold value for determining an abnormality, and th = x + γ√ {α (p) x ² + β (p) x} using a predetermined parameter γ (for example, γ = 3).

Then, the sample average S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (summed from m = 1 to M) and x * when divided into the current M groups In comparison, if x * / S _E ^(M) (p) is smaller than a predetermined threshold, the number of divisions is made larger than M. Specifically, the number of divisions is updated to INT [S _E ^(M) (p) / x * × M] (INT [a] is rounded up to a whole number by rounding off the decimal point of a).

  The basic concept of the above method will be described below.

  When traffic is observed in the backbone, the amount of traffic is large, so that it is difficult to find even if abnormal traffic is mixed. Therefore, it is conceivable to perform abnormal traffic detection by dividing the monitoring traffic into an appropriate number of groups and monitoring the traffic for each group. If the amount of normal traffic in a group becomes small and only abnormal traffic can be aggregated into a specific group, it becomes easy to detect abnormal traffic.

  In general, abnormal traffic is detected by monitoring the time series of traffic and determining that abnormal traffic has occurred when the traffic volume exceeds a threshold value (when it rapidly increases). In such a determination, it is necessary to reduce the probability of exceeding the threshold value during normal operation (false detection rate) as much as possible, and at the same time, to reduce the oversight rate as much as possible when an abnormality occurs.

FIG. 1 is a diagram showing the relationship between the number of normal flows and the distribution of the number of normal flows + the number of abnormal flows and the false detection rate / missing rate. In general, the threshold th is set to “average x + γ√ (variance)”. For example, in the case of a normal distribution, when γ = 3 is set, the probability of exceeding the threshold, that is, the false detection rate is suppressed to about 0.13%. On the other hand, the number of flows at the time of abnormal mixing follows a probability distribution Fx (u) in which (x + m_d, α (p) x ² + β (p) x + v_d) is (average, variance). Here, Fx (u) means the probability that the random variable U of normal flow number + abnormal flow number is less than u when the average number of normal flows is x (that is, Fx (u) = P [U = <u]). At this time, when the abnormality occurs, the probability of falling below the threshold (that is, the miss rate) is Fx (th) in the probability distribution.

Therefore, if the number of divisions is set so as to satisfy Fx (th) <ε (that is, if the average of the normal traffic amount can satisfy this inequality), Fx (th) <ε is satisfied. Average normal traffic x * is calculated and sample average S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (sum of m = 1 to ^M) when divided into current M groups And x * is compared, and if x * / S _E ^(M) (p) is smaller than a predetermined threshold, the number of divisions is made larger than M. Specifically, the number of divisions is updated to INT [S _E ^(M) (p) / x * × M] (INT [a] is rounded up to a whole number by rounding off the decimal point of a).

(Seventh method)
Next, the seventh method will be described. In the seventh method, it is assumed that there are L servers that process flows, and the processing capability of the server j is B _j [flow / s]. Also, assuming that there is a device that distributes flows to these servers, the flow that is currently allocated to server j is called the flow of group j, and the sample average X ^(j) (p) of the number of flows of group j is Compute the sample variance Vx ^(j) (p). The set (X ^(j) (p), Vx ^(j) (p)) (j = 1 to L) is (x _j , y _j ), and y = α (p) x ² + β (p) The parameters α (p) and β (p) are obtained by fitting to x. In the seventh method, using this relational expression, whether to change the flow distribution destination server is determined by the following procedure.

Traffic is derived according to a predetermined distribution (normal distribution, etc.) with mean x and variance α (p) x ² + β (p) x as parameters, and the upper X percentile is the processing capacity of server k. B _k × a The average x_target_k is calculated such that (a is a coefficient set to less than 1). The server k receives the flows of groups 1, 2,…, J within a range that satisfies X ⁽¹⁾ (p) + X ⁽²⁾ (p) +… + X ^(J) (p) <= x_target_k. Assume that server k is replaced. Repeat this procedure until all the remaining groups are accommodated in any server. As a result, if there is a server that is no longer needed, put the server in sleep state and actually change the accommodation of the flow. To do. After that, in the active server j, when the value of the upper X percentile determined by the distribution of the number of flows to the server j exceeds a × B _j , the server that is in the sleep state is made active and the server Part of the flow accommodated by server j is transferred to the sleep server.

  In the above method, assuming that the load is distributed among multiple servers, if the traffic is reduced and traffic can be processed without having to activate all the servers, part of the traffic The power consumption is reduced by putting the remaining servers in a sleep state and putting the remaining servers in the sleep state.

  Embodiments implementing the above-described method according to the present invention will be described below with reference to the drawings.

  First, Example 1 will be described. FIG. 2 is a configuration diagram illustrating an example of a basic configuration of the system according to the first embodiment. As shown in FIG. 2, this system includes a plurality of routers 2 constituting the IP network 1 and a traffic fluctuation amount estimation device 10.

  In this system, as shown in FIG. 2, the traffic fluctuation amount estimation device 10 collects the sample flow information measured at each packet 2 at the packet sampling rate p. Here, the above sample flow information is a set of flow ID and statistical information. As flow ID, it has source IP address, destination IP address, source port number, destination port number, protocol number, and statistical information. As the number of sample packets and the total number of bytes of the sample packets.

  The traffic fluctuation amount estimation device 10 is a device that performs traffic fluctuation amount estimation using the first to fourth methods. FIG. 3 shows a functional configuration diagram of the traffic fluctuation amount estimation apparatus 10. As illustrated in FIG. 3, the traffic fluctuation amount estimation device 10 includes a flow classification unit 11, a time series data generation unit 12, an approximate expression calculation unit 13, and a traffic prediction unit 14. The operation of the traffic fluctuation amount estimation apparatus 10 having this configuration will be described along the processing procedure shown in FIG.

  Step 101) The flow classification unit 11 receives the sample flow information arriving from each router, reads out the (source IP address, destination IP address, source port number, destination port number, protocol number) of the flow, With reference to a rule registered in advance in a memory or the like in the flow ID collating means, the flows are classified into a plurality of groups according to the rule.

As an example, the flow classification unit 11 inputs srcIP as a key into a hash function, and looks at the first 8 bits of the hash value to classify into M = 2 ^ 8 groups. In this example, srcIP is used as a key, but instead of srcIP, dstIP or {source IP address (srcIP), destination IP address (dstIP), source port number (srcPort), destination port number ( dstPort) and protocol number (Protocol)} may be defined in some combinations of five. Here, the flow classification unit 11 performs classification into M groups for M = M ₁ and M ₂ . For example, set M ₁ = 2 and M ₂ = 4.

After classification, set the flow information and the group numbers m ₁ and m ₂ to which the flows are mapped (the former is M = M ₁ and the latter is the group number when M = M ₂ ) as a set. Notify the series data generation unit 12.

  Step 102) The time-series data generation unit 12 counts the number of flows in each group m every predetermined period (for example, every minute). This is performed for a predetermined measurement period (for example, 1 minute × 180 times), and the time-series data of the number of flows is transferred to the approximate expression calculation unit 13 at the end of the measurement period.

Step 103) The approximate expression calculation unit 13 calculates the sample mean X ^(m) (p) and sample variance Vx ^(m) (p) of each group number m, and calculates the expected value of the sample mean for the entire group as S _E ^{( M)} (p) = 1 / M ΣX ^(m) (p) (m = 1 to M is summed), and the expected sample variance is S _V ^(M) (p) = 1 / M ΣVx ^(m) (p) Estimate by (summing from m = 1 to M). This is performed for M = M ₁ and M ₂ , and S _E ^(Mi) (p) and S _V ^(Mi) (p) when M = M _i (i = 1, 2). The parameters α (p) and β (p) are calculated using the following equations, where (x _i , y _i ) is a set of

パラメータを決定したら、当該パラメータを、トラヒック予測部１４へ通知する。

When the parameter is determined, the parameter is notified to the traffic prediction unit 14.

Step 104) The traffic prediction unit 14 uses the parameter determined by the approximate expression calculation unit 13, and the relational expression y = α (p) x ² + β () between the expected value y of the sample variance and the expected value x of the sample mean. p) x is derived, and the variance when the future average traffic amount is assumed to be x_est is estimated by y_est = α (p) (x_est) ² + β (p) (x_est). On the other hand, assuming that the traffic follows a predetermined distribution (normal distribution or the like) having an average x_est and a variance y_est as parameters, an upper X percentile is derived and output as a predicted value of the traffic amount to be added at the future time point.

  The traffic volume predicted by the traffic prediction unit 14 is output to an operator's terminal, for example. Further, the traffic prediction unit 14 may output the variance estimated as described above, and may predict the traffic amount by other means.

  The traffic fluctuation amount estimation device 10 can be realized, for example, by causing a general computer including a CPU, a memory, a hard disk, and the like to execute a program corresponding to each functional unit. The program may be distributed by being recorded on a computer-readable recording medium such as a portable memory, or may be downloaded from a server on the network. As described above, when the traffic fluctuation amount estimation device 10 is configured by a computer and a program, the CPU advances the processing by reading / writing the processing data such as the number of flows to / from the memory in accordance with the instructions of the program. Each functional unit in the variation estimation device 10 is realized.

  It is also possible to implement the traffic fluctuation amount estimation device 10 using a hardware logic circuit in which the processing functions of the functional units are embedded.

  The points that can be realized by a computer and a program or a hardware logic circuit as described above are the same for devices in other embodiments.

  The apparatus configuration in the second embodiment is the same as that in the first embodiment. In the second embodiment, the following grouping is performed instead of performing two types of preset group classification like the flow classification unit 11 of the first embodiment.

Here, it is assumed that the traffic flowing through the network is classified into M groups. For example, as in Example 3 described later, for the purpose of monitoring abnormal traffic, it is assumed that the traffic is monitored by being divided into M groups (this is M ₁ ). Then, the flow classification unit 11 further divides the flow classified into each group into M ′ pieces using a hash function, thereby realizing M ₂ grouping as a whole, and the M described in the first embodiment. ₁ and M ₂ are classified into two groups, and the traffic fluctuation amount is estimated by the same procedure as in the first embodiment.

  Next, Example 3 will be described. FIG. 5 is a functional configuration diagram of the traffic management device 30 in the present embodiment. This traffic management device 30 is assumed to be provided and operated in place of the traffic fluctuation amount estimation device 10 in the system shown in FIG. Alternatively, the traffic fluctuation amount estimation device 10 may additionally include a functional unit necessary for realizing the function as the traffic management device 30.

  As shown in FIG. 5, the traffic management device 30 includes a flow classification unit 31, a time series data generation unit 32, an abnormality detection unit 33, an approximate expression calculation unit 34, and a group number determination unit 35. The operation of the traffic management device 30 having this configuration will be described along the processing procedure shown in FIG.

  In step 301, the flow classification unit 31 classifies the flows into M groups, and in step 302, the time-series data generation unit 32 generates the number of flows for each group. The processing so far is the same processing as Step 101 and Step 102 in the first embodiment.

  Step 303) The time series data generation unit 32 transfers the data to the abnormality detection unit 33 each time time series data is added at regular intervals.

  Step 304) The anomaly detection unit 33 calculates the average and variance of the number of flows of each group m from the past time series data, sets the anomaly detection threshold to “average + γ × √ (dispersion)”, and If the number of flows exceeds this threshold, it is determined that an abnormality has occurred. If it is determined that there is an abnormality, the fact is notified to the approximate expression calculation unit 34.

Step 305) In the approximate expression calculation unit 34, when it is determined by the abnormality detection unit 33 that there is no abnormal traffic in the current traffic, the parameters α (p) and β (p) are determined by the method of the second embodiment. , And the relational expression y = α (p) x ² + β (p) x between the expected value y of the sample variance of the number of normal flows and the expected value x of the sample mean is derived in advance. Then, the result is notified to the group number determination unit 35.

  Step 306) The group number determination unit 35 determines the number of groups (number of divisions) suitable for monitoring abnormal traffic according to the following procedure.

  First, it is assumed that the number of flows follows a predetermined distribution (normal distribution or the like) having an average x and a variance y as parameters. Here, (m_d, v_d) is the abnormal traffic to be detected (average number of flows, variance of number of flows). The abnormal traffic (average number of flows, variance of number of flows) is a predetermined value. Then, if the abnormal traffic is applied, an appropriate division number M * is determined as follows so as to be equal to or less than a predetermined abnormality miss rate ε.

The (average, variance) when the abnormal flow number is added to the normal flow number is (x + m_d, α (p) x ² + β (p) x + v_d), and the normal flow number + abnormal flow number is this Consider a probability distribution Fx (u) with mean and variance. Here, Fx (u) means the probability that the random variable U of normal flow number + abnormal flow number is less than or equal to u when the average number of normal flows is x. That is, Fx (u) = P [U = <u]. X * satisfying Fx (th) <ε in the probability distribution is calculated. Note that th is a threshold value for determining an abnormality, and th = x + γ√ {α (p) x ² + β (p) x} using a predetermined parameter γ (for example, γ = 3). Compare the sample average S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (summed from m = 1 to M) and x * when divided into the current M groups Thus, if x * / S _E ^(M) (p) is smaller than a predetermined threshold, the number of divisions is made larger than M. Specifically, the number of divisions is updated by updating the number of divisions to INT [S _E ^(M) (p) / x * × M] (INT [a] rounds up the decimal point of a to an integer). To decide.

  Next, Example 4 will be described. As shown in FIG. 7, the system in this embodiment has a configuration in which a traffic distribution device 40 and L servers (50) are connected via a network.

In the configuration of FIG. 7, the traffic distribution device 40 distributes the flow to L servers. Note that the processing capacity of the server j is B _j [flow / s]. The flow currently distributed to the server j will be referred to as a group j flow.

  FIG. 8 shows a functional configuration diagram of the traffic distribution device 40 in the present embodiment. As shown in FIG. 8, the traffic distribution device 40 includes a flow classification unit 41, a time series data generation unit 42, an approximate expression calculation unit 43, and a distribution destination server determination unit 44. The operation of the traffic distribution device 40 having this configuration will be described along the processing procedure shown in FIG.

  Step 401) The flow classification unit 41 classifies the flows into L groups and transfers the flows to the server of the corresponding group number. At the same time, the time-series data generation unit 42 is notified of information on the number of sample flows in each group and which flow is assigned to which group number.

  Step 402) The time-series data generation unit 42 generates a flow time-series for each group. This procedure is the same as step 102 in the first embodiment. In other words, the time-series data generation unit 42 counts the number of flows of the group m every fixed period (for example, every minute). This is performed for a predetermined measurement period (for example, 1 minute × 180 times), and the time-series data is transferred to the approximate expression calculation unit 43 at the end of the measurement period.

Step 403) The approximate expression calculation unit 43 calculates the sample average X ^(j) (p) and the sample variance Vx ^(j) (p) of the number of flows in group j. The set (X ^(j) (p), Vx ^(j) (p)) (j = 1 to L) is (x _j , y _j ), and the approximate expression y = α (p) x ² + β (p) The parameters α (p) and β (p) are obtained by fitting to x. The result is notified to the distribution destination server determination unit 44.

  Step 404) The distribution destination server determination unit 44 determines whether to change the flow distribution destination server by the following procedure using the above approximate expression.

Here, the upper X percentile is derived assuming that the traffic follows a predetermined distribution (normal distribution, etc.) having parameters of average x and variance α (p) x ² + β (p) x, and the upper X percentile is server k. Processing capacity B _k × a The average x_target_k is calculated such that (a is a coefficient set to less than 1). X ⁽¹⁾ (p) + X ⁽²⁾ (p) +… + X ^(J) (p) <= The flow of group 1, 2,…, J is accommodated in server k within the range satisfying x_target_k. Perform the calculation process to be replaced. This procedure is repeated until all the remaining groups are accommodated in any server. As a result, if there is a server that is no longer needed, the server is put into the sleep state, and the actual processing is performed according to the result of the above calculation process. The flow will be changed. On the other hand, in the active server j, when the value of the upper X percentile determined by the distribution of the number of flows to the server j exceeds a × B _j , the server that is in sleep is set active and the server Part of the flow accommodated by server j is transferred to the sleep server.
(Effect of embodiment)
As described above, according to the technology according to the present invention described using each embodiment, it is possible to estimate the traffic fluctuation amount that is difficult to observe directly from the observed sample data, and to calculate the fluctuation amount. By using it, it becomes possible to realize traffic management such as determination of the number of divisions and accommodation change control of the distribution destination server.

  Here, it is shown using actual data that the approximate expression proposed in the present invention correctly estimates the actual traffic fluctuation. The following experiment was performed using packet capture data (171 minutes) measured on the Internet backbone.

  First, packets are sampled at a sampling rate p = 1/1024, and at least one packet is sampled for the number of groups M = 1, 2, 4, 8, 16, 32, 64, 128, 256, 512, 1024. Classification was made with 11 patterns, and a time series of the number of sample flows in each group was created at a cycle of 1 minute. Then, (sample average, sample variance) of each group is calculated, and the result of plotting them is shown in FIG. The X axis is the mean and the Y axis is the variance.

At the same time, an approximate expression y = α (p) x ² + β (p) x was calculated using the results when M = 1 and M = 2. At this time, α = 0.002910 and β = 0.626320. The approximate curve is also shown in FIG. From this, it can be confirmed that the region of M = 4 or more can be approximated by using the technique of the present invention.

  The present invention can be applied to a technology for managing traffic including estimating traffic fluctuation in an IP network.

  The present invention is not limited to the above-described embodiments, and various modifications and applications are possible within the scope of the claims.

DESCRIPTION OF SYMBOLS 1 IP network 2 Router 10 Traffic fluctuation amount estimation apparatus 11, 31, 41 Flow classification part 12, 32, 42 Time series data generation part 13, 34, 43 Approximation formula calculation part 14 Traffic prediction part 30 Traffic management apparatus 33 Abnormality detection part 35 Group number determination unit 40 Traffic distribution device 44 Distribution destination server determination unit 50 Server

Claims (9)

A traffic fluctuation amount estimation apparatus that receives sample flow information collected by packet sampling at a sampling rate p in a communication network and estimates a traffic fluctuation quantity from the sample flow information,
Based on the sample flow information, time-series data generating means for generating time-series data of the number of flows as a traffic amount;
The parameters α (p) and β (p in the approximate expression y = α (p) x ² + β (p) x, which shows the relationship between the sample variance expectation y for the traffic volume and the sample mean expectation x ) Is calculated from the number of time-series flows generated by the time-series data generating means,
Traffic that estimates traffic fluctuation amount using the approximate expression y = α (p) x ² + β (p) x having the parameters α (p) and β (p) calculated by the approximate expression calculation means Ru and a estimation unit is traffic fluctuation amount estimation device,
The traffic fluctuation amount estimation device includes a flow classification unit that divides the flow into M (M is a natural number) groups by using a flow source IP address in the sample flow information as a key.
The flow classification unit, the flow, _one and M ₂ pieces M (M ₁ and M ₂ are each a natural number) are classified into two types of
The approximate expression calculating means calculates the sample mean X ^(m) (p) and the sample variance Vx ^(m from the number of time series flows for each group m (m = 1 to M) generated by the time series data generating means. ⁾ (p) is calculated, and the expected value of the sample mean for the entire group is S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (m = 1 to M is summed), sample variance The process of calculating the expected value of S _V ^(M) (p) = 1 / M ΣVx ^(m) (p) (summing from m = ₁ to M) in two ways: M = M ₁ and M ₂ The above parameters are set as (x _i , y _i ) with a set of S _E ^(Mi) (p) and S _V ^(Mi) (p) when M = M _i (i = 1, 2). α (p) and β (p)

A traffic fluctuation amount estimation device characterized by calculating by the following . The flow classification means uses the destination IP address as a key instead of using the source IP address as a key, or the source IP address, destination IP address, source port number, destination port number, and by using some combination of five of the protocol number as a key, a traffic variation quantity estimation apparatus according to claim 1, characterized in that classifying the flow to the group. The traffic estimation means uses the approximate expression y_est = α (p) (x_est) ² + β (p) (x_est) with the variance y_est assuming that the future average traffic amount becomes x_est as the traffic fluctuation amount traffic change amount estimating apparatus according to claim 1 or 2, characterized in that estimation. The flow classification means further divides each of the flows classified into M ₁ groups into M ′ pieces, and performs M ₂ classifications as a whole, so that _two types of M ₁ and M ₂ are obtained. The traffic fluctuation amount estimation apparatus according to claim 1 , wherein the traffic fluctuation amount estimation apparatus performs classification of A traffic management device that receives sample flow information collected by packet sampling at a sampling rate p in a communication network, and determines a flow division number suitable for abnormal traffic monitoring from the sample flow information,
Based on the sample flow information, time-series data generating means for generating time-series data of the number of flows as a traffic amount;
An abnormality detection unit that receives the number of time-series flows from the time-series data generation unit and determines that it is abnormal when the number of flows exceeds a predetermined abnormality detection threshold;
The parameters α (p) and β (p in the approximate expression y = α (p) x ² + β (p) x, which shows the relationship between the sample variance expectation y for the traffic volume and the sample mean expectation x ) Is calculated from the number of normal time series flows not determined to be abnormal by the abnormality detection means,
When the number of abnormal flows is added to the number of normal flows, the (average, variance) is (x + m_d, α (p) x ² + β (p) x + v_d), and the average is distributed to the number of normal flows with m_d In the probability distribution Fx (u) having the average and variance of the number of flows when the number of abnormal flows with v_d is added, the abnormality determination threshold is set to th, and the predetermined abnormality miss rate is set to ε, Fx (th) < The number of normal average flows x * satisfying ε is calculated, the sample average X ^(j) (p) of the number of flows in group j when the flow is divided by the number of divisions of M is obtained, and the sample average S _E ^{( M)} (p) = 1 / M ΣX ^(m) (p) (m = 1 to M is summed) and x * are compared, and x * / S _E ^(M) (p) is determined in advance. A traffic management device comprising: a division number determination means for determining a flow division number suitable for abnormal traffic monitoring by performing a process of making the division number larger than M if the threshold value is smaller than the threshold value. A traffic distribution device that is connected to L (L is a natural number) servers via a communication network and distributes traffic flows to the L servers.
Classifying the flows into L groups (L is a natural number), and a flow classification means for transferring the flows to each server for each group;
Time-series data generation means for generating time-series data of the number of flows of each group classified by the flow classification means as a traffic amount;
The parameters α (p) and β (p in the approximate expression y = α (p) x ² + β (p) x, which shows the relationship between the sample variance expectation y for the traffic volume and the sample mean expectation x ) Is calculated from the number of time-series flows generated by the time-series data generating means,
A distribution destination server determining means for determining whether or not to change a flow distribution destination server,
When the flow distributed to the server j (j = 1 to L) is a group j flow, the approximate expression calculation means calculates the sample mean X ^(j) (p) of the number of flows in the group j and the sample variance. Vx ^(j) (p) is calculated, and the set (X ^(j) (p), Vx ^(j) (p)) is (x _j , y _j ), and the approximate expression y = α (p) x ² By fitting to + β (p) x, the parameters α (p) and β (p) are obtained,
The distribution destination server determining means uses the approximate expression, so that the number of flows follows a predetermined distribution having parameters of average x and variance α (p) x ² + β (p) x. Calculate the number of flows in the percentile, and the number of flows in the upper X percentile is the processing capacity B _k × a of server k Calculate the average x_target_k such that (a is a coefficient less than ¹⁾ , and X ⁽¹⁾ (p) + X ⁽²⁾ (p) +… + X ^(J) (p) <= x_target_k As long as all the remaining groups are accommodated in one of the servers, the calculation process of accommodating the flows of groups 1, 2, ..., J to the server k is repeated for each server as long as it is satisfied. If there is a server that is no longer needed, it is decided to change the flow distribution destination server. A traffic fluctuation amount estimation method executed by a traffic fluctuation amount estimation device that receives sample flow information collected by packet sampling at a sampling rate p in a communication network and estimates a traffic fluctuation quantity from the sample flow information,
Based on the sample flow information, a time-series data generation step for generating time-series data of the number of flows as a traffic amount;
The parameters α (p) and β (p in the approximate expression y = α (p) x ² + β (p) x, which shows the relationship between the sample variance expectation y for the traffic volume and the sample mean expectation x ), An approximate expression calculating step for calculating from the number of time-series flows generated by the time-series data generating step,
Traffic for estimating traffic fluctuation amount using the approximate expression y = α (p) x ² + β (p) x having parameters α (p) and β (p) calculated in the approximate expression calculating step a traffic variation estimation method Ru and a estimation step,
The traffic fluctuation amount estimation method includes a flow classification step of dividing the flow into M (M is a natural number) groups by using a flow source IP address in the sample flow information as a key,
In the flow classification step, the traffic change amount estimating apparatus, the flow, _one and M ₂ pieces M (M ₁ and M ₂ are each a natural number) are classified into two types of
In the approximate expression calculating step, the traffic fluctuation amount estimating device calculates a sample average X ^(m) ( from the number of time-series flows for each group m (m = 1 to M) generated by the time-series data generating step. p) and the sample variance Vx ^(m) (p), and calculate the expected value of the sample mean for the entire group as S _E ^(M) (p) = 1 / M ΣX ^(m) (p) (m = 1 to M M = M for the calculation to calculate the expected value of sample variance as S _V ^(M) (p) = 1 / M ΣVx ^(m) (p) (m = 1 to M is summed ⁾ ₁ and M ₂ are performed, and a set of S _E ^(Mi) (p) and S _V ^(Mi) (p) when M = M _i (i = 1, 2) is ^expressed as (x _i , Y _i ), the parameters α (p) and β (p)

The traffic fluctuation amount estimation method characterized by calculating by the following . A flow division number determination method executed by a traffic management device that receives sample flow information collected by packet sampling at a sampling rate p in a communication network and determines a flow division number suitable for abnormal traffic monitoring from the sample flow information Because
Based on the sample flow information, a time-series data generation step for generating time-series data of the number of flows as a traffic amount;
An abnormality detection step that receives the number of time-series flows generated in the time-series data generation step and determines that it is abnormal when the number of flows exceeds a predetermined abnormality detection threshold;
The parameters α (p) and β (p in the approximate expression y = α (p) x ² + β (p) x, which shows the relationship between the sample variance expectation y for the traffic volume and the sample mean expectation x ) Is calculated from the number of normal time series flows that are not determined to be abnormal by the abnormality detection step,
When the number of abnormal flows is added to the number of normal flows, the (average, variance) is (x + m_d, α (p) x ² + β (p) x + v_d), and the average is distributed to the number of normal flows with m_d In the probability distribution Fx (u) having the average and variance of the number of flows when the number of abnormal flows with v_d is added, the abnormality determination threshold is set to th, and the predetermined abnormality miss rate is set to ε, Fx (th) < The number of normal average flows x * satisfying ε is calculated, the sample average X ^(j) (p) of the number of flows in group j when the flow is divided by the number of divisions of M is obtained, and the sample average S _E ^{( M)} (p) = 1 / M ΣX ^(m) (p) (m = 1 to M is summed) and x * are compared, and x * / S _E ^(M) (p) is determined in advance. A division number determination step for determining a flow division number suitable for abnormal traffic monitoring by performing a process for making the division number greater than M if the threshold value is smaller than the threshold value. . A distribution destination server determination method executed by a traffic distribution device that is connected to L (L is a natural number) servers via a communication network and distributes traffic flows to the L servers.
Classifying the flows into L groups (L is a natural number), and a flow classification step of transferring the flows to each server for each group;
A time-series data generation step for generating time-series data of the number of flows of each group classified in the flow classification step as a traffic amount;
The parameters α (p) and β (p in the approximate expression y = α (p) x ² + β (p) x, which shows the relationship between the sample variance expectation y for the traffic volume and the sample mean expectation x ), An approximate expression calculating step for calculating from the number of time-series flows generated by the time-series data generating step,
A distribution destination server determination step for determining whether or not to change a flow distribution destination server,
In the approximate expression calculation step, when the flow distributed to the server j (j = 1 to L) is the flow of the group j, the sample average X ^(j) (p) of the number of flows of the group j and the sample variance Vx ^(j) (p) is calculated, and the set (X ^(j) (p), Vx ^(j) (p)) is (x _j , y _j ), and the approximate expression y = α (p) x ² By fitting to + β (p) x, the parameters α (p) and β (p) are obtained,
In the allocation destination server determination step, by using the approximate expression, the upper X is assumed to follow a predetermined distribution with the number of flows as an average x and variance α (p) x ² + β (p) x as parameters. Calculate the number of flows in the percentile, and the number of flows in the upper X percentile is the processing capacity B _k × a of server k Calculate the average x_target_k such that (a is a coefficient less than ¹⁾ , and X ⁽¹⁾ (p) + X ⁽²⁾ (p) +… + X ^(J) (p) <= x_target_k As long as all the remaining groups are accommodated in one of the servers, the calculation process of accommodating the flows of groups 1, 2, ..., J to the server k is repeated for each server as long as it is satisfied. A method of determining a distribution destination server, characterized in that if there is a server that is no longer needed, it is determined to change the flow distribution destination server.

Images