JP6127888B2 - Process determination apparatus, process determination program, and process determination method - Google Patents

Description

  The present invention relates to a process determination device, a process determination program, and a process determination method.

  Conventionally, as one of services, when execution is instructed by a client terminal, a server terminal provides a selected process among a plurality of processes. Taking document management as an example of such a service, the above processing includes document storage and document deletion. As a charge for providing such a service, the charge processing device charges a fixed amount such as, for example, X yen per month to the client terminal regardless of what process is selected. However, it is desired to charge according to the selected process in the service, instead of such a fixed charge. Therefore, it is necessary to know what processing the client terminal has caused the server terminal to execute.

By the way, when the client terminal transmits data indicating what kind of processing is to be executed by the server terminal, the data to be transmitted is divided into a plurality of packet data and transmitted. Then, the number of packet data (data communication amount) per predetermined time gradually increases, and decreases after a peak. The amount of peak data communication varies depending on the selected process. For example, as shown in FIG. 33, when the client terminal instructs the server terminal to install the client application for instructing the above, the peak data communication amount is large. Further, in the case of parameter setting, the peak traffic is relatively small like the peak value C. Further, in the case of data communication, the peak communication volume is relatively large like the peak value B. As described above, the peak traffic when transmitting data indicating what processing is to be executed from the client terminal to the server terminal differs depending on the selected processing. This is because the amount of data transmitted from the client terminal to the server terminal differs for each of the selected processes. For the same reason, the total communication amount of data transmitted from the client terminal to the server terminal also differs depending on the selected process.
Therefore, it is considered that the selected process can be determined by measuring the data communication amount and the total communication amount at the peak time.

JP 2001-189760

  However, as shown in FIG. 34A, even when the selected process (hereinafter referred to as an event) is different, the peak traffic may be similar. That is, as shown in FIG. 35A, the peak traffic corresponding to the instructions of different events A and B are similar, so these events A and B cannot be determined by the traffic. Further, as shown in FIG. 35 (B), since the total communication amounts Sa and Sb corresponding to instructions of different events A and B are similar, the events A and B cannot be determined.

  Incidentally, there are cases where a plurality of processing instructions are given from a client terminal to a server terminal within a certain period. In this case, as shown in FIG. 34 (B), communication of data for each instruction overlaps, and the peak communication amount of the overlapped communication is larger than the peak communication amount corresponding to each event. There is.

  Furthermore, the transmission speed when the client terminal transmits data to the server terminal may be limited to a constant value due to network settings or the like. For this reason, as shown in FIG. 34C, the amount of data transmitted as a whole is equal to the total communication amount corresponding to the event, but the peak communication amount is equal to the peak communication amount corresponding to the event. May be different.

  As described above, there is a case where the event cannot be accurately determined based on the peak communication amount or the total communication amount.

  The processing that the client terminal has caused the server terminal to execute can be understood by looking at the contents of the packet in the data transmitted from the client terminal to the server terminal for the above instruction. However, when the client terminal and the server terminal are connected by a virtual private network server (VPN server) and the data to be transmitted is encapsulated (encrypted), the billing processing device looks at the contents of the packet. I can't. Therefore, the billing processing device does not know what processing is executed from the client terminal to the server terminal.

  An object of the present invention is to make it possible to understand what processing is instructed from a client terminal to a server terminal.

  In one embodiment, the server apparatus executes a designated process among a plurality of processes of different types. The client device transmits data to instruct execution of processing to the server device. The storage unit stores, in correspondence with each process, a distribution of communication amount over a predetermined time of data transmitted from the client apparatus to the server apparatus in order to instruct execution of each of the plurality of processes.

  The first determination unit determines which of the plurality of processes is the first process that the client apparatus has instructed the server apparatus to execute. The subtracting unit subtracts the second traffic volume distribution from the first traffic volume distribution. The distribution of the first communication amount is a distribution of the communication amount of data transmitted from the client device to the server device within a certain period including a predetermined time when the first process is instructed. The second traffic amount distribution is a communication amount distribution over a predetermined time stored in the storage unit corresponding to the process determined for the first process by the first determination unit.

  The second determination unit instructs the client device to the server device within the predetermined period based on the remaining portion of the first traffic distribution obtained by subtracting the second traffic distribution by the subtractor, and It is determined which of the plurality of processes is the remaining second process.

  As one aspect, there is an effect of knowing what processing is instructed from the client terminal to the server terminal.

It is a figure which shows a service provision system. 2 is a block diagram of a VPN server 10. FIG. 2 is a functional block diagram of a VPN server 10. FIG. It is a figure which shows the process of the VPN server. It is a figure which shows each time communication amount memory | storage table. It is a figure which shows the time differential value storage table. It is a figure which shows the peak time traffic storage table. It is a figure which shows each event peak hour communication amount storage table. It is a figure which shows the determination content storage table. It is a figure which shows the event content storage table. It is a figure which shows the undetermined generation | occurrence | production event storage table. 4 is a flowchart illustrating an example of a setting process for performing initial settings for providing a service from a server terminal 16 to a client terminal 12. It is a flowchart which shows an example of the process which preserve | saves the traffic on the VPN server 10 which the VPN server 10 performs. It is a flowchart which shows an example of the event determination process which the VPN server 10 performs when the predetermined charging period passes. It is a flowchart which shows an example of the process of step 112 of FIG. (A) shows that the distribution of the traffic volume of packet data from the client terminal 12 to the VPN server 10 is distributed in a saw-like manner, and (B) shows an approximate curve for the traffic volume distribution of (A). A state of normalization is shown, and (C) is a diagram showing a distribution of normalized traffic. It is a flowchart which shows an example of the process of step 116 of FIG. It is a flowchart which shows an example of the process in step 142 of FIG. (A)-(C) is a figure which shows the table of the distribution of the traffic at each time of each event corresponding to the event E1-event E3, respectively. (A) shows the traffic distribution stored in each time traffic storage table 72, and (B) shows that the indication of the event having the peak at time t2 in (A) is the indication of event E1. (C) is a figure which shows a mode that the distribution of the traffic corresponding to the event E1 was calculated from the traffic distribution stored in each time traffic data storage table 72. FIG. It is a flowchart which shows an example of a process of step 144 of FIG. It is a figure which shows the event which generate | occur | produces regularly, (A) shows that a peak position corresponds at 12:34 every day in distribution of the communication amount of the data transmitted when execution of event E5 is instruct | indicated. (B) is a figure which shows that a peak generate | occur | produces between 12:00 to 14:00 every day in distribution of the communication amount of the data transmitted when execution of the event E3 is instruct | indicated. It is a figure which shows the event which a peak repeatedly occurs in data communication when execution is instruct | indicated, (A) is the peak position of the distribution of the communication amount of the data transmitted when execution of event E2 is instruct | indicated. FIG. 5B is a diagram illustrating a state where the peak position of the distribution of the amount of data transmitted in the field is repeated three times when execution of the event E6 is instructed. (A) indicates that if there is an instruction to execute event E2, there is a high probability that there is an instruction to execute event E4, and (B) indicates that there is an instruction to execute event E4. It is a figure which shows that an event has only the case of event E2. It is a flowchart which shows an example of a process of step 146 of FIG. It is a figure explaining the calculation method of event generation period T. FIG. (A) indicates that the events A and B cannot be distinguished by the peak traffic (peak value), (B) indicates that the events A and B cannot be distinguished by the total traffic, and (C) It is a figure which shows that event B cannot be determined even if event A is determined. (A) indicates that the events A and B cannot be distinguished by the peak traffic (peak value), (B) indicates that the event A can be determined by the attribute, and (C) indicates the total traffic. It is a figure which shows that the event B can be determined by. The flowchart which shows an example of the process of step 148 of FIG. It is a figure explaining that event E1 and event E2 are judged corresponding to the traffic of one peak. It is a figure which shows the correlation probability with each instruction | indication of event E1 and E2 next when there exists an instruction | indication of the event E3. It is a state that an event is determined for each peak by each process of the present embodiment. It is the figure which showed a mode that the traffic amount at the time of peak differed for every different process (event). (A) shows that even during different events, the peak traffic may be similar, (B) shows that data communications for indication of two events overlap within a certain period, It is a figure which shows that the traffic amount at the time of a peak becomes larger than the traffic amount at the time of a peak according to each event, (C) is a transmission rate at the time of transmitting data from a client terminal to a server terminal. It is a figure which shows that the traffic amount at the peak time becomes lower than the traffic amount at the peak time according to the event when it is limited to. (A) shows that the traffic volume at the peak time of different events A and B is the same, and these events A and B cannot be determined by the traffic volume, and (B) shows different events A and B. FIG. 11 is a diagram illustrating that events A and B cannot be determined because the total communication amounts Sa and Sb are similar to each other.

Hereinafter, an example of an embodiment of the disclosed technology will be described in detail with reference to the drawings.
FIG. 1 is a diagram illustrating a service providing system. As shown in FIG. 1, in the service providing system, a private network server (VPN (Virtual Private Network) server) 10 and a billing processing device 18 are connected between a plurality of client terminals 12 and 14 and a server terminal 16. ing. The plurality of client terminals 12 and 14 are connected to the VPN server 10 and the accounting processing device 18, and the VPN server 10 and the accounting processing device 18 are connected to the server terminal 16. The VPN server 10 and the billing processing device 18 are connected to each other. Since the client terminals 12 and 14, the server terminal 16, the charging processing device 18, and the VPN server 10 have the same configuration, the configuration of the VPN server 10 will be described below, and the description of the configuration of other devices will be omitted.

  FIG. 2 shows a block diagram of the VPN server 10. As shown in FIG. 2, the VPN server 10 includes a CPU (Central Processing Unit) 22, a ROM (Read Only Memory) 24, and a memory 26. The VPN server 10 also includes a display device 34, an input device 36, and a communication control unit 38 via a log database 28, a table database 30, and a display control unit 32. The CPU 22, ROM 24, memory 26, log database 28, table database 30, display control unit 32, display device 34 connected to the display control unit 32, input device 36, and communication control unit 38 are mutually connected via a bus 40. It is connected to the. The table database 30 is provided with various tables (72 to 84 (FIGS. 5 to 11) and FIG. 19) described later. The communication control unit 38 is connected to the client terminals 12 and 14, the accounting processing device 18, and the communication control unit 38 of the server terminal 16.

  The client terminals 12 and 14, the server terminal 16, and the VPN server 10 are examples of a client device, a server device, and a process determination device according to the technology of the present disclosure. The table database 30 is an example of a storage unit according to the technique of the present disclosure.

  FIG. 3 shows a functional block diagram of the VPN server 10. As illustrated in FIG. 3, the VPN server 10 includes a communication amount storage unit 52, a waveform normalization unit 54, a table update unit 56, an event determination unit 58, and an event transmission unit 60. The communication volume storage unit 52 is connected to the log database 28 and the table database 30. The waveform normalization unit 54, the table update unit 56, the event determination unit 58, and the event transmission unit 60 are connected to the table database 30.

  The ROM 24 stores an event determination processing program. The CPU 20 reads the event determination processing program from the ROM 24 and develops it in the memory 26, and executes the event determination processing process included in the event determination processing program.

  As shown in FIG. 4, the event determination processing process includes a communication amount storage process 62, a waveform normalization process 64, a table update process 66, an event determination process 68, and an event transmission process 70.

  The CPU 22 operates as the units 52 to 60 in FIG. 3 by executing the processes 62 to 70, respectively.

  FIG. 5 shows each time communication volume storage table 72. Each time communication amount storage table 72 is provided for each of the plurality of client terminals 12 and 14. Each time communication volume storage table 72 corresponds to times t1, t2, t3,... At predetermined times from the start of a billing period, which will be described later, from the client terminal 12 to the server terminal 16 within the predetermined period. The communication amount a1, a2, a3... Of the transmitted data is stored correspondingly.

  FIG. 6 shows a time differential value storage table 74 provided according to the client terminals 12 and 14. In the time differential value storage table 74, the time differential value of the communication amount for each predetermined time is stored corresponding to the predetermined time. For example, the predetermined time T1 is time t2−time t1, and the time differential value d1 is (communication amount a2−communication amount a1) / T1. Similarly, the predetermined time T2 is time t3−time t2, and the time differential value d2 is (communication amount a3−communication amount a2) / T2.

  FIG. 7 shows a peak traffic storage table 76 provided for the client terminals 12 and 14. In the peak traffic volume storage table 76, for example, the peak traffic volume corresponding to the peak times pt1, pt2, and pt3 at the time of data communication from the client terminal 12 to the server terminal 16 is the peak traffic volume. Pa1, pa2, and pa3 are stored correspondingly.

  FIG. 8 shows a communication volume storage table 78 for each event peak. Each event peak traffic data storage table 78 corresponds to events E1, E2, E3... Which are identification information of each event, and peak traffic data (threshold values) TS1, TS2, TS3 which are peak traffic volumes. Are stored correspondingly. Note that data communication, for example, ping is performed from the client terminals 12 and 14 to the server terminal 16 regardless of the event. In the present embodiment, each event peak traffic data storage table 78 stores a peak traffic TS100 corresponding to E100 which is identification information of data communication that occurs regardless of the event. ing.

  FIG. 9 shows a determination content storage table 80. In the determination content storage table 80, peak time, peak traffic, peak traffic (threshold), and event identification information are stored correspondingly.

  FIG. 10 shows an event content storage table 82. The event content storage table 82 includes an event occurrence time zone, an occurrence order, a dependent event, a repetition count, a total communication amount, a correlation value with each event, an average occurrence count per day, and an occurrence probability per day. Is remembered. The event occurrence time zone, occurrence order, dependent event, repetition count, total communication amount, correlation value with each event, average occurrence count per day, and occurrence probability per day for each event are events E1, E2,. .. stored in correspondence with each of

  The event content storage table 82 further stores the total communication amount S100 corresponding to the identification information E100 of data communication from the client terminals 12 and 14 to the server terminal 16 that occurs regardless of the event. .

  FIG. 11 shows an undetermined occurrence event storage table 84. The undetermined occurrence event storage table 84 stores a peak time, a peak traffic, a candidate event, and a correlation probability of each event.

  By the way, for example, when the client terminal 12 transmits data indicating what kind of processing (event) is to be executed to the server terminal 16, the data to be transmitted is divided into a plurality of packet data. Then, the number of packet data (data communication amount) per predetermined time gradually increases, and decreases after a peak. The amount of communication at the peak time differs depending on the process (event) selected by the client terminal 12. This is because the amount of data transmitted from the client terminal to the server terminal differs for each event. For the same reason, the total communication amount of data transmitted from the client terminal to the server terminal also varies depending on the event.

  In FIGS. 19A to 19C, the three events E1 to E3 are taken as an example, and the amount of communication of data transmitted by the client terminal 12 to indicate each of the three events E1 to E3 Distribution is shown. As shown in FIGS. 19 (A) to 19 (C), the amount of communication per predetermined time for each predetermined time of data transmitted to indicate each of the three events E1 to E3 is determined in advance. Yes. In the table database 30, a distribution of data traffic per predetermined time for each predetermined time determined corresponding to each event is stored as a table.

  Next, the operation of this embodiment will be described. The event determination process executed by the VPN server 10 for the event instructed to be executed from each of the client terminals 12 and 14 to the server terminal 16 is the same as each other. Therefore, only the event determination process executed by the VPN server 10 when the execution is instructed from the client terminal 12 to the server terminal 16 will be described below.

  FIG. 12 is a flowchart illustrating an example of a setting process for performing an initial setting for providing a service from the server terminal 16 to, for example, the client terminal 12. In step 102, the client terminal 12 purchases a service from the charging processing device 18. As a result, the client application (Client Application (Client App)) 1 for providing the service is downloaded from the accounting processing device 18 to the client terminal 12. FIG. 1 shows that another client application (Client App) 2 has been downloaded from the accounting processing device 18 to the client terminal 12. For example, the service provided by Client App1 includes document management, and the service provided by another Client App2 includes transmission / reception of electronic mail. Since the event determination process is the same for the services that are instructed to be provided by the client apps 1 and 2, the service that is instructed to be provided by the client app 1 will be described below.

  In step 104, the accounting processing device 18 creates an environment (instance) for executing the virtual server SV <b> 1 for providing a service with the client app 12 downloaded to the client terminal 12 in the server terminal 16. In addition, the accounting processing device 18 sets a VPN connection between the Client App1 downloaded to the client terminal 12 and the virtual server SV1 set to the server terminal 16. Thus, the client application 1 is connected to the virtual server SV1 via the VPN server 10. When the client terminal 12 transmits data indicating what kind of processing (event) is to be executed by the server terminal 16, the data is encrypted and transmitted.

  In step 106, the client terminal 12 uses the service from the virtual server SV1 via the Client App1 and the VPN server 10.

  FIG. 13 shows a flowchart of an example of processing for saving the traffic on the VPN server 10 executed by the VPN server 10. In step 108, the traffic volume storage unit 52 counts the traffic volume of data transmitted from the Client App1 to the virtual server SV1 via the VPN server 10, and stores it in each time traffic volume storage table 72 (FIG. 5). In other words, the traffic volume storage unit 52 of the VPN server 10 counts the number of packet data transmitted from the Client App 1 every predetermined time. The communication amount storage unit 52 calculates a multiplication value of the number of packet data received within a predetermined time and the communication amount of data per packet. The communication amount storage unit 52 stores the multiplication value as the communication amount for a predetermined time in each time communication amount storage table 72. For example, the communication amount storage unit 52 stores a communication amount a1 obtained by multiplying the number of packet data received by the time t1 when a predetermined time elapses from the start of charging, by the communication amount per packet, corresponding to the time t1. . The communication volume storage unit 52 performs the above processing every predetermined time from the start of the charging period to the end of the next charging period. The communication volume storage unit 52 also stores the same data as the contents of each time communication volume storage table 72 in the log database 28.

  In the present embodiment, the billing processing device 18 sends to the client terminal 12 billing information for billing according to a predetermined billing period, for example, the number of events aggregated for each of a plurality of types of events per month. Send.

  FIG. 14 is a flowchart showing an example of event determination processing executed by the VPN server 10 when a predetermined charging period has elapsed. The event determination process starts when the charging period has elapsed since the end of the previous charging period. In step 112, an event determination process is executed based on the traffic and the threshold. An example of specific contents of the processing (step 112) is shown as a flowchart in FIG.

  In step 122 of FIG. 15, the table updating unit 56 calculates a time differential value from the time and traffic stored in each time communication volume storage table 72 (FIG. 5), and a time differential value storage table 74 (FIG. 6). Save to. That is, as described above, the table update unit 56 calculates, for example, time t2−time t1 and substitutes it for the predetermined time T1. The table updating unit 56 saves the value obtained by subtracting the communication amount a1 at time t1 from the communication amount a2 at time t2 by T1 as the time differential value d1 in the time differential value storage table 74. The table updating unit 56 calculates time differential values for the communication volumes at all times stored in each time communication volume storage table 72 and stores them in the time differential value storage table 74 (FIG. 6).

  In step 124, the waveform normalization unit 54 normalizes the waveform of the communication amount of packet data. That is, first, the waveform of the distribution of the traffic amount of packet data from the client terminal 12 to the VPN server 10 is, for example, a sawtooth shape as shown in FIG. If the communication amount of packet data is used in the form of a saw, the calculation amount increases. Therefore, the waveform normalization unit 54 uses a known algorithm for obtaining an approximate curve, and obtains an approximate curve from the amount of communication distributed in a saw-tooth shape, for example, as shown in FIG. Normalize the traffic distribution. The waveform normalization unit 54 calculates the peak time of the traffic volume from the normalized distribution of traffic volume. For example, as shown in FIG. 16C, the time differential value before the time tx takes a positive value, while the time differential value takes a negative value after the time tx. Thus, the inflection point at which the time differential value changes from a positive value to a negative value corresponds to the peak time (peak time). Therefore, the table update unit 56 calculates the peak time (peak time) based on the value of the time differential value stored in the time differential value storage table 74 (FIG. 6). The table updating unit 56 refers to each time communication amount storage table 72 (FIG. 5) to obtain the communication amount at the peak time (peak time) tx. The table update unit 56 stores the calculated peak time (peak time) tx in correspondence with the communication amount at the peak time (peak time) tx in the peak communication amount storage table 76 (FIG. 7).

  In step 126, the table updating unit 56 determines the peak traffic volume (threshold value) of each event stored in each event peak traffic volume storage table 78 (FIG. 8) and the peak traffic volume storage table 76 (FIG. The peak traffic stored in 7) is compared. That is, the table updating unit 56 sets each of the peak communication volumes pa1, pa2, pa3... (Hereinafter referred to as “pa” as a representative) at each peak in the peak communication volume storage table 76 (FIG. 7). Take out one by one. The table updating unit 56 determines the peak traffic volume (threshold values) TS1, TS2, TS3,... For each event in each event peak traffic volume storage table 78 (FIG. 8) (hereinafter referred to as TS for each). Take out one of each. The table updating unit 56 compares each peak communication amount pa with each peak communication amount (threshold) TS. Thereby, it is determined which peak of each event corresponds to each peak in the peak traffic data storage table 76 (FIG. 7). That is, it is determined which event the instruction of the event corresponding to each peak in the peak traffic storage table 76 (FIG. 7) indicates.

  In step 128, the event determination unit 58 determines whether there is a peak communication amount (threshold) TS that falls within a range of ± 5% of the peak communication amount pa at each peak time. That is, the event determination unit 58 first calculates a range of ± 5% of the peak communication amount pa, and then determines whether each peak communication amount (threshold) TS of each event falls within the range. To do. If the determination result in step 128 is affirmative, the event determination process proceeds to step 130, and if the determination result in step 128 is negative, the event determination process proceeds to step 132.

  When the determination result in step 128 is affirmative, there is an event in which the peak communication amount (threshold value) TS enters the range of peak communication amount pa ± 5%. That is, there is a possibility that an instruction for an event whose peak traffic is the peak traffic pa is an indication of an event whose peak traffic (threshold) is the peak traffic (threshold) TS. Therefore, in step 130, the event determination unit 58 determines the peak time, the peak communication volume pa, and the identification information of the event whose peak communication volume (threshold) is the peak communication volume (threshold) TS. Save to 80 (FIG. 9). On the other hand, in step 132, the event determination unit 58 stores only the peak time of the event and the peak communication amount pa in the determination content storage table 80 (FIG. 9).

  In step 134, it is determined whether or not the above processing (steps 128 to 132) has been performed on all peak times pt1, pt2, pt3,... (FIG. 7). If the determination in step 134 is negative, in step 136, the event determination unit 58 determines the peak traffic of each event in the event peak traffic storage table 78 for the traffic at the uncompared peak time. Compare with (threshold). After the process of step 136, the event determination process proceeds to step 128.

  When the above processing (FIG. 15) is executed, the specific content of the determination content storage table 80 becomes, for example, the content shown in FIG. For example, events E1 and E2 (event identification information) are stored in association with the event of peak traffic pa1 at peak time pt1. The peak traffic (threshold values) TS1 and TS2 of the events E1 and E2 are also stored correspondingly. Thus, the technical meaning of storing the identification information of a plurality of events corresponding to one peak time is as follows. For example, as shown in FIG. 30, the peak traffic volume (threshold) TS1 of the event E1 and the peak traffic volume of the event E2 are within a range of ± 5% of the peak traffic volume pa1 of the event whose peak time is pt1. (Threshold) TS2 is entered. That is, there is a possibility that an instruction for an event with a peak time of pt1 is an instruction for either event E1 or E2.

  On the other hand, event E3 is stored corresponding to peak time pt3 in FIG. This is because there is a possibility that the instruction of the event having the peak time pt3 is the instruction of the event E3. If step 128 is negative, in step 132, only the peak time and peak traffic are stored in the determination content storage table 80. In this case, event identification information and peak traffic (threshold) are not stored in correspondence with peak time and peak traffic.

  Thus, it can be determined that the peak time at which the event identification information and the peak traffic (threshold) are stored corresponding to the peak time and the peak traffic is corresponding to the event identified by the event identification information. . However, it can be determined that an event has not been determined at a peak time that is not stored in correspondence with the peak time and peak traffic.

  The processing of steps 122 to 134 in FIG. 15 is an example of determination performed by the first determination unit in the technology of the present disclosure.

  When the process shown in FIG. 15 is completed, the event determination process proceeds to step 114 in FIG. In step 114, the event determination unit 58 determines whether there is an undetermined event or whether there are a plurality of very close thresholds. That is, if the event determination unit 58 refers to the determination content storage table 80 (FIG. 9) and determines that the event identification information and the threshold value are not stored corresponding to the peak time and peak traffic, it is not determined. Determine that the event exists. The event determination process proceeds to step 116.

  Further, when the event determination unit 58 refers to the determination content storage table 80 (FIG. 9) and determines that a plurality of event identification information and threshold values are stored corresponding to the peak time and the peak traffic. Is determined to have a plurality of very close thresholds. The event determination process proceeds to step 116.

  If step 114 is negative, that is, if one event is determined for events corresponding to all peak times, the event determination process proceeds to step 118.

  FIG. 17 is a flowchart showing an example of the process in step 116 of FIG. In step 142 of FIG. 17, processing for determining an event that occurred in the same time period is performed by subtracting the distribution of the communication amount of the event for which only one peak has been determined from the communication amount (FIG. 5). . FIG. 18 is a flowchart showing an example of the process in step 142 of FIG.

  In step 152 of FIG. 18, the event determination unit 58 uses the determination content storage table 80 (FIG. 9) to determine an event for which only one peak has been determined in the process of step 112 of FIG. 14 (see FIG. 15). Search for. That is, as described above, the peak time at which the identification information of only one event and the peak traffic (threshold) are stored corresponding to the peak time and peak traffic is identified by the event identification information. It can be judged that it corresponds only to the event. However, it can be determined that an event has not been determined at a peak time when only one peak traffic (threshold) is not stored corresponding to the peak time and peak traffic. Therefore, the event determination unit 58 searches for the determined event from the event identification information stored in each event column of the determination content storage table 80 (FIG. 9). In step 154, the event determination unit 58 reads the communication amount at each time of the event for which only one is determined for one peak. That is, in this embodiment, as shown in FIGS. 19A to 19C, the distribution of the traffic at each time of each event is stored as a table corresponding to the events E1 to E3. Yes. In step 154, the event determination unit 58 reads the communication amount at each time of the determined event from the table (FIGS. 19A to 19C).

  In step 156, the event determination unit 58 associates the peak time (ts) of the determined event (for example, FIG. 19A) with the peak time of the determination content storage table 80 (FIG. 9). Then, the event determination unit 58 subtracts the traffic volume distribution at each time of the event read in step 154 from the traffic volume distribution of each time traffic volume storage table 72 (FIG. 5). In other words, it is assumed that the communication amount stored in each time communication amount storage table 72 has the distribution shown in FIG. It is assumed that the event having the peak at time t2 in FIG. 20A is determined to be the event E1 as shown in FIG. 20B by the process in step 112 (FIG. 14). Note that the distribution of traffic at each time in the event E1 (FIG. 20B) is stored in the table database 30 as a table. In step 156, the peak time ts in FIG. 20B is made to coincide with the time t2 in FIG. In this matched state, the traffic distribution (FIG. 20 (B)) at each time of the determined event is subtracted from the traffic distribution (FIG. 20 (A)) of each time traffic table 72. The As a result, the distribution shown in FIG. 20A becomes the distribution shown in FIG. 20C by subtracting the event E1 shown in FIG. 20B. FIG. 32A shows a graph of the traffic volume distribution of each time traffic volume storage table 72 in a time range wider than the time range shown in FIG. As shown in FIG. 32A, the traffic at each time of the event determined for peak p1 is subtracted from the traffic in each time traffic storage table 72. In the traffic volume of each time traffic volume storage table 72, the peak p1 disappears as shown in FIG.

  In step 156, the table updating unit 56 further updates each time communication amount storage table 72 (FIG. 5). That is, the communication amount (FIG. 20A) at each time in each time communication amount storage table 72 becomes the value of the communication amount in FIG.

  In step 158, the table update unit 56 recalculates the time differential value based on each time traffic storage table 72 (FIG. 5) and updates the time differential value storage table 74 (FIG. 6). Further, the table updating unit 56 performs the above-described (Step 124 (FIG. 15)) based on the updated time communication amount storage table 72 (FIG. 5) and the updated time differential value storage table 74 (FIG. 6). In this way, the peak traffic volume is obtained and the peak traffic volume storage table 76 (FIG. 7) is updated. In step 160, the event determination unit 58 determines an event for the undetermined peak. That is, each peak traffic volume (actual value) stored in the peak traffic volume storage table 76 (FIG. 7) is acquired, and each event peak traffic volume storage table 78 (FIG. 8) corresponds to each event. The stored peak traffic (threshold value) is acquired. An event is determined for an undetermined peak based on each peak traffic (actual value) and peak traffic (threshold). Specifically, the same processing as steps 126 and 128 in FIG. 15 is performed.

  In step 162, the event determination unit 58 determines whether or not the above processing (step 160) has been performed for all undetermined peaks. If the determination in step 162 is negative, the event determination process returns to step 160. If the determination in step 162 is affirmative, in step 164, the event determination unit 58 determines whether there is an event that can be determined. That is, when an event is determined by the processing of step 160, step 164 is affirmative. That is, as shown in FIG. 20A, at the peak position at time t3, it is not known whether this event is event E1 or event E2. However, when the distribution of the traffic volume of the event E1 shown in FIG. 20B is subtracted from the traffic volume distribution of each time traffic volume storage table 72, the distribution of the traffic volume shown in FIG. The distribution is as shown in 20 (C). That is, the threshold value TS2 of the event E2 may be located within a range of ± 5% of the peak traffic at time t3. In this case, the event determination unit 58 can determine that the event is the event E2. In this case, an affirmative determination is made in step 164, and the event determination process returns to step 154, and the above processes (steps 154 to 164) are executed. If the determination in step 164 is negative, the event determination unit 58 proceeds to step 144 in FIG.

  Thus, for example, as shown in FIGS. 34B and 20A, a plurality of events may be instructed from the client terminal 12 to the server terminal 16 within a certain period of time. In this case, communication of data for each instruction overlaps, and the peak communication amount of the overlapped communication may be larger than the peak communication amount corresponding to each event. Even in this case, it is assumed that the event having the peak at time t2 in FIG. 20A is determined to be the event E1, as shown in FIG. 20B, by the processing in step 112 (FIG. 14). In step 156, the traffic volume (FIG. 20B) at each time of the determined event is subtracted from the traffic volume of the time traffic volume storage table 72 (FIG. 20A). As a result, the distribution shown in FIG. 20A becomes the distribution shown in FIG. 20C by subtracting the event E1 shown in FIG. 20B. More specifically, the peak traffic volume (threshold value) TS2 of the event E2 may be located within a range of ± 5% of the peak traffic volume at the time t3. In this case, the event is the event E2. It is determined. That is, in the process of step 112, the event E2 is determined by the above process (steps 152 to 160) for the peak p2 for which the event could not be determined. Thereafter, step 164 is affirmed, and the peak p2 disappears from each time traffic storage table 72 as shown in FIG. 32C by the processing of steps 154 to 158 again.

  Steps 160 to 164 in FIG. 18 are an example of the determination performed by the first determination unit in the technology of the present disclosure. Step 156 in FIG. 18 is an example of subtraction performed by the subtraction unit in the technology of the present disclosure. Step 160 in FIG. 18 is an example of a determination performed by the second determination unit in the technology of the present disclosure.

  In the processing up to step 142 (FIG. 17), there may be a peak time in which the event is not determined among the peak times stored in the peak traffic storage table 76 of FIG. For example, there may be a case where it is not possible to determine which event is a certain peak time or a plurality of events are determined as candidates. Therefore, the next process (step 144 in FIG. 17) is executed to determine an event with respect to a peak time when it is not determined which event.

  An example of the processing of step 144 in FIG. 17 is shown as a flowchart in FIG. In step 172 of FIG. 21, the event determination unit 58 searches the event content storage table 82 (FIG. 10) for events that occur regularly. Events that occur on a regular basis include events E5 and E3. That is, at event E5, as shown in FIG. 22A, data is transmitted so that the peak positions coincide at 12:34 every day. In the event E3, as shown in FIG. 22B, data is transmitted so that a peak occurs every day from 12:00 to 14:00.

  In step 174, the event determination unit 58 determines whether or not the above-mentioned scheduled occurrence event is stored in the event content storage table 82 (FIG. 10). In each case where 12:34, 12 o'clock to 14 o'clock are stored as event occurrence times corresponding to the events E5 and E3 in the event content storage table 82 (FIG. 10), step 174 is positively determined. It becomes. If step 174 is negative, the event determination process proceeds to step 184. If step 174 is affirmative, the event determination process proceeds to step 176.

  In step 176, the event determination unit 58 searches the peak traffic data storage table 76 (FIG. 7) for whether there is an undetermined peak that has occurred in all occurrence times searched in the above process (step 172). That is, it is searched whether there is an undetermined peak located at 12:34 every day during the billing period, as shown in FIG. 22A. Further, as shown in FIG. 22B, it is searched whether there is an undetermined peak whose peak position matches every day from 12:00 to 14:00 during the billing period. In step 178, the event determination unit 58 has the search result of step 176, that is, the peak positions generated at all times (12:34 or 12: 00-14: 00) every day during the billing period are not matched. Determine whether there is a judgment peak. If the determination result in step 178 is affirmative, the process proceeds to step 180. If the determination result in step 180 is negative, the event determination process proceeds to step 184.

  In step 180, the event determination unit 58 determines that the undetermined peak determined in the above processing (steps 176 to 178) is a scheduled event, for example, event E5 or event E3.

  In step 182, the event determination unit 58 reads the distribution of the communication amount at each time of the determined event from the tables of FIGS. 19 (A) to 19 (C). Further, in step 182, the event determination unit 58 subtracts the read traffic volume distribution from the traffic volume distribution of each time traffic volume storage table 72 (FIG. 5). The table updating unit 56 stores the time traffic data storage table 72 (FIG. 5), the time differential value storage table 74 (FIG. 6), and the peak traffic data storage table 76 (FIG. 7) (steps 156, 158 (FIG. 5)). Update as in 18)).

  In step 184, the event determination unit 58 searches the event content storage table 82 (FIG. 10) for an event where a repetitive peak occurs. Examples of events in which repeated peaks occur include events E2 and E6. That is, as shown in FIG. 23A, when the execution of the event E2 is instructed, the distribution of data traffic for the instruction is a distribution of communication traffic in which the peak position repeats twice. Yes. When the execution of the event E6 is instructed, as shown in FIG. 23B, the distribution of data traffic for the instruction is a distribution of communication traffic in which the peak position is repeated three times. Yes.

  In step 186, it is determined whether or not an event that causes the repeated communication peak is registered in the event content storage table 82. For example, when 2 is stored as the number of repetitions corresponding to the event E2 in the event content storage table 82 and 3 is stored as the number of repetitions corresponding to the event E6, The determination result is affirmative. If the determination result of step 186 is affirmative, the event determination process proceeds to step 188. If the determination result of step 186 is negative, the event determination process proceeds to step 196.

  In step 188, the undetermined event repeatedly generated in the peak traffic data storage table 76 (FIG. 7) is searched and compared with all the repetition counts searched in the above process (step 184). For example, for event E2, the peak position repeats twice within a predetermined period. In this way, it is determined whether or not there is an event in the peak communication amount storage table 76 in which the peak position repeats twice within a predetermined period. For example, it is determined whether or not there is an event E2 by determining whether or not the peak time pt1 and the peak time pt2 are within the predetermined period. In step 190, the event determination unit 58 determines whether there is a search result. If the determination result in step 190 is affirmative, the event determination process proceeds to step 192. If the determination result in step 190 is negative, the event determination process proceeds to step 196. In step 192, the event determination unit 58 determines an event of repeated occurrence. That is, when the peak position is repeated twice in a certain period, it is determined as event E2, and when the peak position is repeated three times, it is determined as event E6. In step 194, the event determination unit 58 executes the same process as in step 182.

  By the above processing (steps 184 to 194), for example, as shown in FIG. 32C, it is detected that the peaks p31, p32, and p33 are repeated three times within a predetermined time. These peaks P31, P32, and P33 are determined to be event E6, and the traffic volume distribution corresponding to event E6 is subtracted from the traffic volume distribution of each traffic volume storage table 72 (FIG. 5). The peaks P31, P32, and P33 are eliminated from the communication amount of each communication amount storage table 72 (FIG. 5).

  In step 196, the event determination unit 58 searches the event content storage table 82 (FIG. 10) for an event having a dependency relationship between events. That is, for example, as shown in FIG. 24A, when there is an instruction to execute event E2, there is a high probability that there is an instruction to execute event E4. When there is an instruction to execute the event E2, there may be an instruction to execute another event instead of the event E4. However, as shown in FIG. 24B, when there is an instruction to execute the event E4, the event just before that is only the event E2. As described above, when there is an instruction to execute the first determination event, the dependency relationship between the events is set such that the immediately preceding event is always the second determination event corresponding to the first determination event. There is an event to have. In step 198, the event determination unit 58 determines whether or not an event having the above dependency relationship is registered. For example, when the event E2 is stored as the dependent event corresponding to the event E4 in the event content storage table 82, the determination result in step 198 is affirmative. If the determination result of step 198 is affirmative, the event determination process proceeds to step 200. If the determination result of step 198 is negative, the event determination process proceeds to step 146 (FIG. 17).

  In step 200, the event determination unit 58 performs the above processing (step 196) from the peak communication amount storage table 72 (FIG. 5), the determination content storage table 80 (FIG. 9), and the event content storage table 82 (FIG. 10). Search for dependency events searched in. That is, the event determination unit 58 acquires the peak time of the undetermined peak based on the peak communication amount storage table 72 (FIG. 5) and the determination content storage table 80 (FIG. 9). Based on the determination content storage table 80 (FIG. 9), the event determination unit 58 stores the event stored in the event content storage table 82 (FIG. 10) for the peak time immediately after the peak time of the undetermined peak. It is determined whether E4 is determined. In step 202, the event determination unit 58 determines whether there is a search result. If the determination result in step 202 is affirmative, the event determination process proceeds to step 204. In step 204, the event determination unit 58 determines that the event E2 is an undetermined event having a dependency. In step 206, processing similar to that in steps 182 and 194 is executed. After the process of step 206, the event determination process proceeds to step 146 of FIG.

Each of steps 180, 192, and 204 in FIG. 21 is an example of a determination performed by the first determination unit in the technology of the present disclosure. Each of steps 182, 194, and 206 in FIG. 21 is an example of subtraction performed by the subtraction unit in the technology of the present disclosure.
Note that the order of steps 172 to 184 (first processing), steps 184 to 194 (second processing), and steps 196 to 206 (third processing) in FIG. 21 is not limited to the order shown in FIG. For example, the second process may be the first and the second process may be the first process or the third process, and the third process is the first and the second process may be the first process or the third process. It may be the second reason.

  Through the processing described above, a scheduled occurrence event, an event in which a repetitive peak occurs, and an event whose occurrence depends on another event are determined, and the distribution of the traffic volume of the determined event is stored in each time traffic volume storage table 72 (FIG. 5). ) Is subtracted from. After this subtraction, the remaining undetermined events may be determined by the total traffic. Therefore, the process of step 146 in FIG. 17 is executed. An example of the processing in step 146 of FIG. 17 is shown as a flowchart in FIG.

  In step 212 of FIG. 25, the event determination unit 58 starts the occurrence event as shown in FIG. 26, for example, from each time communication amount storage table 72 (FIG. 5) and time differential value storage table 74 (FIG. 6). Time t0 and end time t200 are calculated. That is, the time differential value for each predetermined time from the start time t0 to the peak time t100 is +, and from the peak time t100 to the end time t200, the time differential value for each predetermined time is-. In this way, the start time t0 and the end time t200 are calculated from the positive and negative of the time differential value in the time differential value storage table 74. In step 212, the event determination unit 58 further calculates an event occurrence period T that is a period between the start time t0 and the end time t200.

  In step 214, the event determination unit 58 calculates the total communication amount x in the generation period T from each time communication amount storage table 72 (FIG. 5). That is, the event determination unit 58 calculates the total communication amount x by adding the communication amounts from the start time t0 to the end time t200.

  As described above, since the total communication amount is different for each event, the total communication amount (threshold value) of each event is stored in the event content storage table 82 (FIG. 10) corresponding to the identification information of each event. Therefore, in step 216, the actual total communication amount x calculated in the above process (step 214) is compared with the total communication amount (threshold value) of each event referenced from the event content storage table 82 (FIG. 10).

  In step 218, the event determination unit 58 determines whether there is only one total communication amount (threshold) of events that falls within ± 5% for each calculated actual total communication amount x. If the determination result of step 218 is affirmative, the event determination unit 58 determines an event in step 220.

  In step 222, the table updating unit 56 reads the communication amount of the determined event for each time from the table (FIG. 19A to FIG. 19C). Is subtracted from the communication amount of each time communication amount storage table 72 (FIG. 5) The table update unit 56, as described above (steps 156, 157 (FIG. 18)), each time communication amount storage table 72 (FIG. 5) The time differential value storage table 74 (FIG. 6) and the peak communication amount storage table 76 (FIG. 7) are updated.

  As shown in FIG. 35 (A), FIG. 35 (B), FIG. 27 (A), FIG. 27 (B), and FIG. 28 (A), an event is accurately determined based on peak traffic and total traffic. It may not be possible. That is, events A and B are not identified. In this case, even if the event can be determined as event A by the process of step 144 (FIG. 17) for determining the event based on the number of repetitions, the occurrence time zone, and the like, it may be impossible to determine event B. This is because the distribution of the communication amount of the data for the instruction of the event A overlaps the distribution of the communication amount of the data for the instruction of the event B. Therefore, when the event A can be determined as the event A by the processing of step 144 (FIG. 17), each communication amount of the event A is subtracted from each communication amount of each time communication amount storage table 72. Therefore, the event is determined to be event B as shown in FIG. 28C by the processing of steps 216 to 220 (FIG. 25). Therefore, the event of the peak P4 shown in FIG. 32 (D) disappears from each time traffic storage table 72 as shown in FIG. 32 (E).

  Steps 218 and 220 in FIG. 25 are an example of the determination performed by the second determination unit in the technology of the present disclosure.

  Even with the above processing, a plurality of events may exist as candidates for undetermined peaks. Therefore, the next process (step 148 in FIG. 17) is executed.

  FIG. 29 is a flowchart showing an example of the process in step 148 of FIG. In step 232 of FIG. 29, the event determination unit 58 stores the event identification information in which a plurality of event (candidate) identification information is stored in the determination content storage table 80 (FIG. 9) corresponding to the peak time in FIG. This is stored in the undetermined occurrence event storage table 84 shown. That is, for example, in the determination content storage table 80 shown in FIG. 9, event identification identification information E1, E2 is stored corresponding to the peak time pt1, and event identification information is stored corresponding to the peak time pt2. E2 and E3 are stored correspondingly. Therefore, in this step 232, for example, event identification information E1 and E2 is stored in correspondence with the peak communication amount pa1 and candidate events corresponding to the peak time pt1. Corresponding to the peak time pt2, the peak traffic amount pa2 and event identification information E2 and E3 are stored as candidate events.

  In step 234, the event determination unit 58 obtains the total communication amount of the undetermined occurrence event as described above (steps 212 and 214 (FIG. 25)), and the obtained total communication amount and the total communication amount of each candidate event. The difference (absolute value) from (threshold) is calculated. For example, the total communication amount of the undetermined occurrence event is 100 bytes, the total communication amount (threshold value) of the event E1 is S1 (see FIG. 10) = 105 bytes, and the total communication amount (threshold value) of the event E2 Is S2 (see FIG. 10) = 95 bytes. In this case, the total traffic volume (threshold) 105 of the event E1−the total traffic volume of the undetermined event 100 = 5 bytes. In addition, the total communication amount (threshold value) 95 of the event E2−the total communication amount 100 of the undetermined event = 5 bytes. Compare the absolute values of each. That is, the event determination unit 58 calculates the ratio of the probability that the undetermined event is the event E1: the probability that the undetermined event is the event E2. For example, 1: 1 is calculated.

  In step 236, the event determination unit 58 refers to the occurrence probability of each candidate event from the event content storage table 82 (FIG. 10) and compares them. That is, the event determination unit 58 reads out the occurrence probability P1 stored corresponding to the event E1 and the occurrence probability P2 stored corresponding to the event E2 from the event content storage table 82. The event determination unit 58 calculates the probability that the undetermined event is the event E1: the probability that the undetermined event is the event E2. For example, P1: P2 = 0.1: 0.6 is calculated.

  In step 238, when the event before or after the undetermined event is known, the event determination unit 58 refers to the correlation probability of each candidate event with the preceding and following events from the event content storage table 82 (FIG. 10) and compares them. To do. That is, for example, the event determination unit 58 assumes that the event before the undetermined event is E3. As for the probability that the event E1 will occur after the event E3, C1 is stored in the event content storage table 82 (FIG. 10). The probability that the event E2 will occur after the event E3 is stored in the event content storage table 82 as C2. For example, when C1 is 0.1 and C2 is 0.5, the probability that the undetermined event is event E1 is C1: C2, that is, the probability that the undetermined event is event E2 is 0. .1: 0.5.

  In step 240, the event determination unit 58 calculates an occurrence probability obtained by combining the comparison results in steps 234 to 238, and determines whether or not the calculated occurrence probability is greater than 95%, for example. That is, the probability that the undetermined event is event E1 is: 1 × 1 × 1: 1 × 6 × 5 = 1: 30. Therefore, the probability that the undetermined event is event E2 is 1/31, that is, 3.2%, and the probability that the undetermined event is event E2 is 30/31, that is, 96.8%. . The probability of being event E2 is over 95%. Therefore, in step 242, the event determination unit determines that the undetermined event is event E2.

  If step 240 is negative, step 242 is skipped and the event determination process proceeds to step 244.

  In step 244, the event determination unit 58 determines whether or not there is a peak to which the above processing (234 to 242) is not applied. If the determination result of step 244 is affirmative, the event determination process proceeds to step 232. If the determination result in step 244 is negative, in step 246, the event determination unit 58 determines whether or not the event determined in the above processing (234 to 242) exists. If the determination in step 246 is affirmative, each communication amount of the determined event is subtracted in step 248, and the event determination process proceeds to step 230.

  Through the above processing, the events for the peaks P5, P6, and P7 shown in FIG. 32E are determined, and the events for these peaks P5, P6, and P7 are extinguished as shown in FIG. The

  There may be an event that could not be determined by the processing described above. Accordingly, in step 150 of FIG. 17, if there is an event that could not be determined, the event determination unit 58 stores it as an unregistered event. The event determination process proceeds to step 118 in FIG.

  By the event determination process described above, an event instructed to be executed from the client terminal 12 to the server terminal 16 is determined within the billing period. Therefore, in step 118, the event transmission unit 60 transmits the determined event information to the billing processing apparatus 18. Based on the received event information, the accounting processing device 18 calculates the type of event instructed to be executed within the accounting period and the number of times of each type, and creates accounting information. The client terminal 12 is charged.

  Incidentally, data communication unrelated to the event is performed from the client terminal 12 to the server terminal 16. It is necessary to avoid being charged for such data communication. In this regard, in the present embodiment, the threshold (peak traffic) corresponding to each event stored in each event peak traffic storage table 78 (FIG. 8) and the undetermined peak traffic are calculated. By comparing, the event corresponding to the undetermined peak traffic is determined. In addition, by comparing the event occurrence time corresponding to the event with the occurrence time of the undetermined peak in the event content storage table 82 (FIG. 10), an event corresponding to the undetermined peak traffic is obtained. Determined. Therefore, even if data communication unrelated to the event is performed, there is no charge for such data communication.

  In each event peak communication volume storage table 78 (FIG. 8) and event content storage table 82 (FIG. 10), the peak communication volume and total communication volume (threshold value) in data communication unrelated to the event are stored. It is remembered. Therefore, when an event is determined corresponding to the undetermined peak traffic as described above, the event is within a range of ± 5% of the determined peak traffic before creating the billing information. It is determined whether or not the peak communication amount (threshold value) in the data communication unrelated to the data can be accommodated. If the result of the determination is affirmative, the event is not determined for the peak communication volume for which the event has been determined. Therefore, charging for data communication unrelated to the event is further prevented.

Next, the effect of this embodiment will be described. (First effect)
The type of processing that the client terminal 12 has caused the server terminal 16 to execute can be understood by looking at the contents of the packet in the data transmitted from the client terminal 12 to the server terminal 16 in order to execute the processing. . However, if the client terminal 12 and the server terminal 16 are connected by the VPN server 10 and the transmitted data is encrypted, the VPN server 10 cannot see the contents of the packet. However, in the present embodiment, the peak communication amount, the total communication amount, the peak occurrence time, the number of peak occurrences, and other events of the data transmitted from the client terminal 12 to the server terminal 16 for the above instruction An event is determined from dependency information. These pieces of information can be known even if the data to be transmitted is encrypted. Therefore, it is possible to know what processing is instructed without looking at the contents of the data packet transmitted from the client terminal to the server terminal without modifying the client application.

(Second effect)
For example, even if one event is determined for one peak with respect to the peak traffic of data transmitted from the client terminal 12 to the server terminal 16 for the above instruction, the event may not be determined for another peak. This is because the distribution of the communication amount of the data instructing the one event overlaps the distribution of the communication amount of the data corresponding to another peak. Therefore, in the present embodiment, when one event is determined, each communication amount of the one event is subtracted from each communication amount in each time communication amount storage table 72. Therefore, the distribution of the communication amount of the instruction data of the one event that overlaps the distribution of the communication amount of the data corresponding to another peak is removed. For this reason, an event can be judged about another peak.

(Third effect)
In the present embodiment, information other than the peak communication amount and total communication amount of the data transmitted from the client terminal 12 to the server terminal 16 for the above instruction includes the peak occurrence time, the peak occurrence count, and other events. The event is determined from the dependency information. These pieces of information do not depend on the peak communication amount or the total communication amount, and are different for each event. Therefore, a plurality of events having the same or close peak traffic and total traffic can be distinguished. Furthermore, even when the transmission speed when the client terminal 12 transmits data to the server terminal 16 is limited to a constant value, the event can be determined for the peak.

(Fourth effect)
There may be a plurality of candidate events for a certain peak. In the present embodiment, an event is determined for a certain peak based on a value indicating the probability that each of a plurality of candidate events corresponds to the certain peak. Therefore, it is possible to specify one event for the certain peak.

Next, a modification of the present embodiment will be described.
(First modification)
In the present embodiment, when an event is identified based on the peak traffic in the process in step 112 (FIG. 15) in FIG. 14 or in step 160 in FIG. 18, the communication at the peak is again performed in step 160. The event is judged for another peak based on the quantity. Instead of determining an event for another peak based on the peak traffic, the technique of the present disclosure can perform an event for another peak based on the total traffic, as executed in step 146 of FIG. You may judge.

(Second modification)
In the present embodiment, after step 182, step 194, and step 206 in FIG. 21 are executed, an event is determined for another peak based on the total traffic in step 146 in FIG. 17. The technique of the present disclosure may determine an event for another peak based on the traffic at the peak time, as executed in steps 126 and 128 in FIG. 15 instead of the process in step 146 in FIG.

(Third Modification)
In the present embodiment, when it is determined that there are a plurality of candidate events for one peak as a result of the process of step 160 of FIG. 18, the process of step 144 of FIG. 17 is executed. The technique of the present disclosure may execute the process of step 148 of FIG. 17 when there are a plurality of candidate events as a result of the process of step 160 of FIG.

(Fourth modification)
In FIG. 18, the processes of steps 160 to 164 are executed after steps 156 and 158. That is, when an event can be determined for a certain peak based on the peak traffic, the processing for subtracting the distribution of the traffic is executed, and an event is determined for another peak again based on the peak traffic. . The technology of the present disclosure may determine an event for another peak based on the total communication amount, as executed in step 146 of FIG.

(Fifth modification)
When an event is determined in at least one of steps 180, 192, and 204 in FIG. 21, the corresponding steps 182, 194, and 206 are immediately executed. In the technology of the present disclosure, when an event is determined in at least one of steps 180, 192, and 204, the peak traffic determined according to the event is used to check whether the event is correctly determined. The process may be executed. That is, the peak traffic volume (threshold value) of the determined event (FIG. 8) is compared with the actual traffic volume at the peak time (FIG. 5). It is determined whether or not the peak traffic volume (threshold value) (FIG. 8) of the determined event falls within ± 5% of the actual traffic volume at the peak time (FIG. 5). If this determination is affirmative, corresponding steps 182, 194, 206 may be executed.

(Sixth Modification)
When an event is determined for a certain peak, the distribution distribution of the traffic is immediately subtracted at step 156 in FIG. 18, steps 182, 194, 206 in FIG. 21, and step 22 in FIG. As shown in FIG. 20A, the technology of the present disclosure determines whether or not the data communication of the event execution instruction overlaps, and determines that the data communication of the event execution instruction overlaps. Only in this case, the communication amount distribution may be subtracted. Note that whether or not the event execution instruction data communication overlaps is determined by determining whether or not the communication amount (FIG. 5) is not 0 at the time when the time differential value (FIG. 6) changes from − to +. Do. If the amount of communication (FIG. 5) is not 0 at the time when the time differential value (FIG. 6) changes from − to +, it can be determined that data communication of event execution instructions overlaps.

(Seventh Modification)
In step 236 of FIG. 29, the event determination unit 58 uses the occurrence probability of each candidate event in the event content storage table 82 (FIG. 10). The technology of the present disclosure may use the average number of occurrences.

(Eighth modification)
The process of step 122 in FIG. 15 may be executed every time the time and traffic volume are stored in each time traffic volume storage table 72.

  All documents, patent applications and technical standards mentioned in this specification are to the same extent as if each individual document, patent application and technical standard were specifically and individually stated to be incorporated by reference. Incorporated by reference in the book.

  Regarding the above embodiment, the following additional notes are disclosed.

(Appendix 1)
Communication over a predetermined time of data transmitted by the client device to instruct the server device that executes the specified processing of the plurality of different types of processing to execute each of the plurality of processing. A storage unit for storing the distribution of the amount corresponding to each process;
A first determination unit that determines which of the plurality of processes is the first process that the client apparatus has instructed the server apparatus to execute;
The first determination is based on the distribution of the first communication amount that is the distribution of the communication amount of the data transmitted from the client device to the server device within a certain period including the predetermined time in which the first process is instructed. A subtracting unit for subtracting a second traffic amount distribution that is a distribution of the traffic amount over the predetermined time stored in the storage unit corresponding to the process determined by the unit for the first process;
Based on the remaining portion of the first traffic volume distribution obtained by subtracting the second traffic volume distribution by the subtracting unit, the client device instructs the server device and remains within the predetermined period. A second determination unit that determines which of the plurality of processes is a second process;
The process determination apparatus provided with.

(Appendix 2)
The storage unit further stores a mode of occurrence of the peak of the traffic corresponding to the processing,
The first determination unit is configured to generate a peak of data traffic corresponding to the first process based on a data traffic transmitted from the client device to the server device within the predetermined period. The process according to Supplementary Note 1, wherein it is determined which of the plurality of processes is the first process by determining whether or not it corresponds to the generation mode stored in the storage unit Judgment device.

(Appendix 3)
The processing determination apparatus according to appendix 2, wherein the generation mode is the generation time of the peak or the number of occurrences of the peak within a predetermined time.

(Appendix 4)
Among the plurality of processes, there are a first determination process and a second determination process that occur in correspondence with each other,
The storage unit further stores a relationship between the first determination process and the second determination process,
When the first determination process is determined as the process instructed from the client device to the server device, the first determination unit is configured to determine the first determination unit based on the relationship stored in the storage unit. The process determination apparatus according to any one of Supplementary Note 1 to Supplementary Note 3, wherein the first process is determined to be the second determination process.

(Appendix 5)
The storage unit further stores a peak data communication amount corresponding to each of the plurality of processes,
The first determination unit includes a peak data communication amount corresponding to the first processing determined based on a data communication amount transmitted from the client device to the server device within the predetermined period, and And determining which of the plurality of processes the first process is based on the peak data traffic stored corresponding to each of the plurality of processes in the storage unit The process determination apparatus according to appendix 1.

(Appendix 6)
The second determination unit includes a peak data communication amount corresponding to the second processing obtained based on a data communication amount transmitted from the client device to the server device within the predetermined period, and And determining which of the plurality of processes the second process is based on the peak data traffic stored in the storage unit corresponding to each of the plurality of processes. The processing determination apparatus according to appendix 5.

(Appendix 7)
In the storage unit, a communication amount at the peak of data corresponding to each of the plurality of processes is further stored,
The second determination unit includes a peak communication amount corresponding to the second process obtained based on a communication amount of data transmitted from the client device to the server device within a certain period, and Additional note for determining which of the plurality of processes is the second process based on the peak communication amount of data stored in the storage unit corresponding to each of the plurality of processes The processing determination apparatus according to any one of 1 to 4 above.

(Appendix 8)
The storage unit further stores a total communication amount of data within the predetermined time corresponding to each of the plurality of processes.
The second determination unit includes a total communication amount of data corresponding to the second processing obtained based on a communication amount of data transmitted from the client device to the server device within a certain period, and Based on the total communication amount of data stored in the storage unit corresponding to each of the plurality of processes, the second process determines which of the plurality of processes. The processing determination device according to any one of appendix 5.

(Appendix 9)
When the second determination unit determines that a plurality of processes among the plurality of processes are candidates for the second process, each of the plurality of processes that are candidates is the second process. The process determination apparatus according to any one of appendices 1 to 8, wherein the second process determines which of the plurality of processes is a candidate based on a value indicating the probability.

(Appendix 10)
The value indicating the probability that each of the plurality of candidate processes is the second process is the total communication amount within the predetermined time in the second process and each of the plurality of candidate processes. If the determination process is determined for a difference from the total communication amount within a predetermined time, an occurrence probability of each of the plurality of candidate processes, and a process different from the second process, the determination The process determination apparatus according to appendix 9, which is a value based on at least one occurrence probability of each of the plurality of candidate processes in relation to the process.

(Appendix 11)
The processing determination device according to any one of appendices 1 to 10, wherein data transmitted from the client device to the server device is encrypted.

(Appendix 12)
Data unrelated to the service is transmitted from the client device to the server device,
The process determination apparatus according to any one of appendices 1 to 11, wherein the plurality of processes are processes in a service provided by the server apparatus.

(Appendix 13)
On the computer,
Determining which of the plurality of processes is the first process in which the client apparatus transmits data to the server apparatus that executes the instructed process of each of the different types of processes. And
From the distribution of the first traffic volume, which is the distribution of the traffic volume of the data transmitted from the client device to the server device within a certain period including the predetermined time when the first process is instructed, the plurality of processes Based on the determination, the first distribution is stored in a storage unit that stores a distribution of communication amount over a predetermined time of data transmitted from the client device to the server device to instruct each execution. Subtracting the second traffic volume distribution, which is the distribution of the traffic volume over a predetermined time stored corresponding to the process determined for
Based on the remaining first distribution amount distribution portion 4 obtained by subtracting the second distribution amount distribution by the subtraction, the client apparatus instructs the server apparatus to remain within the predetermined period and remain. A process determination program for executing a process including determining which of the plurality of processes is the process of 2.

(Appendix 14)
The storage unit further stores a mode of occurrence of the peak of the traffic corresponding to the processing,
In the determination of the first process, the peak of the data traffic corresponding to the first process is generated based on the data traffic transmitted from the client device to the server device within the predetermined period. Wherein the first process is a process among the plurality of processes by determining whether or not it corresponds to the generation mode stored in the storage unit. Processing judgment program.

(Appendix 15)
The processing determination program according to appendix 14, wherein the generation mode is the generation time of the peak or the number of occurrences of the peak within a predetermined time.

(Appendix 16)
Among the plurality of processes, there are a first determination process and a second determination process that occur in correspondence with each other,
The storage unit further stores a relationship between the first determination process and the second determination process,
In the determination of the first process, when the first determination process is determined as a process instructed from the client apparatus to the server apparatus, based on the relationship stored in the storage unit, The processing determination program according to any one of Supplementary Note 13 to Supplementary Note 15, which determines that the first process is the second determination process.

(Appendix 17)
The storage unit further stores a peak data communication amount corresponding to each of the plurality of processes,
In the determination of the first process, the peak data traffic corresponding to the first process determined based on the data traffic transmitted from the client device to the server device within the predetermined period. And the communication amount of the peak data stored in the storage unit corresponding to each of the plurality of processes, which of the plurality of processes is the first process. The processing determination program according to attachment 13 for determining.

(Appendix 18)
In the determination of the second process, the peak data communication amount corresponding to the second process obtained based on the data communication amount transmitted from the client device to the server device within the predetermined period. And whether the second process is one of the plurality of processes based on the communication amount of peak data stored in the storage unit corresponding to each of the plurality of processes. The processing determination program according to appendix 17.

(Appendix 19)
In the storage unit, a communication amount at the peak of data corresponding to each of the plurality of processes is further stored,
In the determination of the second process, a peak communication amount corresponding to the second process obtained based on a communication amount of data transmitted from the client device to the server device within a certain period; and Based on the peak traffic of data stored in the storage unit corresponding to each of the plurality of processes, the second process determines which of the plurality of processes is the second process. The processing determination program according to any one of appendix 13 to appendix 16.

(Appendix 20)
The storage unit further stores a total communication amount of data within the predetermined time corresponding to each of the plurality of processes.
In the determination of the second process, a total communication amount of data corresponding to the second process obtained based on a communication amount of data transmitted from the client device to the server device within a certain period; and Supplementary note 13 for determining which of the plurality of processes is the second process based on a total communication amount of data stored in the storage unit corresponding to each of the plurality of processes. The processing determination program according to any one of?

(Appendix 21)
In the determination of the second process, when it is determined that a plurality of processes among the plurality of processes are candidates for the second process, each of the plurality of processes that are candidates is the second process. The processing determination program according to any one of appendices 13 to 20, which determines which of the plurality of candidate processes is the second process based on a value indicating certainty.

(Appendix 22)
The value indicating the probability that each of the plurality of candidate processes is the second process is the total communication amount within the predetermined time in the second process and each of the plurality of candidate processes. If the determination process is determined for a difference from the total communication amount within a predetermined time, an occurrence probability of each of the plurality of candidate processes, and a process different from the second process, the determination The process determination program according to appendix 21, which is a value based on at least one of the occurrence probabilities of each of the plurality of candidate processes in relation to the process.

(Appendix 23)
23. The processing determination program according to any one of appendices 13 to 22, wherein data transmitted from the client device to the server device is encrypted.

(Appendix 24)
Data unrelated to the service is transmitted from the client device to the server device,
The process determination program according to any one of appendices 13 to 23, wherein the plurality of processes are processes in a service provided by the server device.

(Appendix 25)
On the computer,
Determining which of the plurality of processes is the first process in which the client apparatus transmits data to the server apparatus that executes the instructed process of each of the different types of processes. And
From the distribution of the first traffic volume, which is the distribution of the traffic volume of the data transmitted from the client device to the server device within a certain period including the predetermined time when the first process is instructed, the plurality of processes Based on the determination, the first distribution is stored in a storage unit that stores a distribution of communication amount over a predetermined time of data transmitted from the client device to the server device to instruct each execution. Subtracting the second traffic volume distribution, which is the distribution of the traffic volume over a predetermined time stored corresponding to the process determined for
Based on the remaining portion of the distribution of the first traffic volume obtained by subtracting the distribution of the second traffic volume by the subtraction, the client device instructs the server device to remain within the predetermined period and remain. A process determination method for executing a process including determining which of the plurality of processes is the process of 2.

(Appendix 26)
The storage unit further stores a mode of occurrence of the peak of the traffic corresponding to the processing,
In the determination of the first process, the peak of the data traffic corresponding to the first process is generated based on the data traffic transmitted from the client device to the server device within the predetermined period. 25. The appendix 24 according to appendix 24, wherein it is determined which of the plurality of processes is the first process by determining whether or not it corresponds to the generation mode stored in the storage unit. Processing judgment method.

(Appendix 27)
27. The process determination method according to supplementary note 26, wherein the generation mode is an occurrence time of the peak or the number of occurrences of the peak within a predetermined time.

(Appendix 28)
Among the plurality of processes, there are a first determination process and a second determination process that occur in correspondence with each other,
The storage unit further stores a relationship between the first determination process and the second determination process,
In the determination of the first process, when the first determination process is determined as a process instructed from the client apparatus to the server apparatus, based on the relationship stored in the storage unit, 28. The process determination method according to any one of appendix 25 to appendix 27, in which the first process is determined to be the second determination process.

(Appendix 29)
The storage unit further stores a peak data communication amount corresponding to each of the plurality of processes,
In the determination of the first process, the peak data traffic corresponding to the first process determined based on the data traffic transmitted from the client device to the server device within the predetermined period. And the communication amount of the peak data stored in the storage unit corresponding to each of the plurality of processes, which of the plurality of processes is the first process. The processing determination method according to Supplementary Note 15 for determination.

(Appendix 30)
In the determination of the second process, the peak data communication amount corresponding to the second process obtained based on the data communication amount transmitted from the client device to the server device within the predetermined period. And whether the second process is one of the plurality of processes based on the communication amount of peak data stored in the storage unit corresponding to each of the plurality of processes. The process determination method according to attachment 29.

(Appendix 31)
In the storage unit, a communication amount at the peak of data corresponding to each of the plurality of processes is further stored,
In the determination of the second process, a peak communication amount corresponding to the second process obtained based on a communication amount of data transmitted from the client device to the server device within a certain period; and Based on the peak traffic of data stored in the storage unit corresponding to each of the plurality of processes, the second process determines which of the plurality of processes is the second process. 29. The process determination method according to any one of appendix 25 to appendix 28.

(Appendix 32)
The storage unit further stores a total communication amount of data within the predetermined time corresponding to each of the plurality of processes.
In the determination of the second process, a total communication amount of data corresponding to the second process obtained based on a communication amount of data transmitted from the client device to the server device within a certain period; and Supplementary Note 25 for determining which of the plurality of processes is the second process based on a total communication amount of data stored in the storage unit corresponding to each of the plurality of processes. The process determination method according to any one of?

(Appendix 33)
In the determination of the second process, when it is determined that a plurality of processes among the plurality of processes are candidates for the second process, each of the plurality of processes that are candidates is the second process. The process determination method according to any one of appendices 25 to 32, which determines which of the plurality of candidate processes is the second process based on a value indicating certainty.

(Appendix 34)
The value indicating the probability that each of the plurality of candidate processes is the second process is the total communication amount within the predetermined time in the second process and each of the plurality of candidate processes. If the determination process is determined for a difference from the total communication amount within a predetermined time, an occurrence probability of each of the plurality of candidate processes, and a process different from the second process, the determination The process determination method according to supplementary note 33, which is a value based on at least one occurrence probability of each of the plurality of candidate processes in relation to the process.

(Appendix 35)
35. The process determination method according to any one of appendices 25 to 34, wherein data transmitted from the client device to the server device is encrypted.

(Appendix 36)
Data unrelated to the service is transmitted from the client device to the server device,
The process determination method according to any one of appendices 25 to 34, wherein the plurality of processes are processes in a service provided by the server device.

DESCRIPTION OF SYMBOLS 10 VPN server 12, 14 Client terminal 16 Server terminal 30 Table database 56 Table update part 58 Event determination part

Claims (6)

Communication over a predetermined time of data transmitted by the client device to instruct the server device that executes the specified processing of the plurality of different types of processing to execute each of the plurality of processing. A storage unit for storing the distribution of the amount corresponding to each process;
A first determination unit that determines which of the plurality of processes is the first process that the client apparatus has instructed the server apparatus to execute;
The first determination is based on the distribution of the first communication amount that is the distribution of the communication amount of the data transmitted from the client device to the server device within a certain period including the predetermined time in which the first process is instructed. A subtracting unit for subtracting a second traffic amount distribution that is a distribution of the traffic amount over the predetermined time stored in the storage unit corresponding to the process determined by the unit for the first process;
Based on the remaining portion of the first traffic volume distribution obtained by subtracting the second traffic volume distribution by the subtracting unit, the client device instructs the server device and remains within the predetermined period. A second determination unit that determines which of the plurality of processes is a second process;
The process determination apparatus provided with. On the computer,
Which of the plurality of processes is the first process in which the client apparatus transmits data to the server apparatus that executes the process instructed to execute among the different types of processes. And
From the distribution of the first traffic volume, which is the distribution of the traffic volume of the data transmitted from the client device to the server device within a certain period including the predetermined time when the first process is instructed, the plurality of processes Based on the determination, the first distribution is stored in a storage unit that stores a distribution of communication amount over a predetermined time of data transmitted from the client device to the server device to instruct each execution. Subtracting the second traffic volume distribution, which is the distribution of the traffic volume over a predetermined time stored corresponding to the process determined for
Based on the remaining portion of the distribution of the first traffic volume obtained by subtracting the distribution of the second traffic volume by the subtraction, the client device instructs the server device to remain within the predetermined period and remain. A process determination program for executing a process including determining which of the plurality of processes is the process of 2. The storage unit further stores a mode of occurrence of the peak of the traffic corresponding to the processing,
In the determination of the first process, the peak of the data traffic corresponding to the first process is generated based on the data traffic transmitted from the client device to the server device within the predetermined period. The method according to claim 2, wherein the first process is determined from among the plurality of processes by determining whether the first process corresponds to the generation mode stored in the storage unit. Processing judgment program. In the determination of the second process, when it is determined that a plurality of processes among the plurality of processes are candidates for the second process, each of the plurality of processes that are candidates is the second process. The processing determination program according to claim 2 or 3, wherein the second process determines which of the plurality of candidate processes is based on a value indicating certainty. Data unrelated to the service is transmitted from the client device to the server device,
The process determination program according to any one of claims 2 to 4, wherein the plurality of processes are processes in a service provided by the server device. On the computer,
Determining which of the plurality of processes is the first process in which the client apparatus transmits data to the server apparatus that executes the instructed process of each of the different types of processes. And
From the distribution of the first traffic volume, which is the distribution of the traffic volume of the data transmitted from the client device to the server device within a certain period including the predetermined time when the first process is instructed, the plurality of processes Based on the determination, the first distribution is stored in a storage unit that stores a distribution of communication amount over a predetermined time of data transmitted from the client device to the server device to instruct each execution. Subtracting the second traffic volume distribution, which is the distribution of the traffic volume over a predetermined time stored corresponding to the process determined for
Based on the remaining portion of the distribution of the first traffic volume obtained by subtracting the distribution of the second traffic volume by the subtraction, the client device instructs the server device to remain within the predetermined period and remain. A process determination method for executing a process including determining which of the plurality of processes is the process of 2.

Images