JP6270539B2 - Communication identification method and apparatus - Google Patents

Description

  The present invention relates to a communication identification method and apparatus, and more particularly, to a communication identification method and apparatus for identifying communication performed by a communication terminal in the foreground and communication performed in the background.

  A technique for identifying the contents of communication executed by a communication terminal has been studied. Patent Document 1 discloses a technique for calculating periodicity from a time series change of communication traffic volume or data using Fourier transform or the like.

  In Patent Literature 2, communication traffic is measured and aggregated for each flow, and a cepstrum analysis that is a frequency analysis method is applied from the communication traffic characteristics for each flow to identify an application (type of communication service) from the flow. Technology is disclosed.

  In Patent Document 3, communication traffic is measured and aggregated for each flow, a feature amount is calculated from communication traffic characteristics for each flow, and machine learning is applied to identify the type (application) of the communication service from the flow. Technology is disclosed.

JP 2010-283668 A JP 2012-105043 A JP 2013-127504 A

  Due to the explosive spread of mobile terminals in recent years, various services have emerged, and not only foreground communication that is triggered by terminal user's communication request operation, but also the application itself Background communication that communicates with a server or the like has occurred at an arbitrary convenient timing.

  Each communication method differs in importance, urgency, data size, tolerance for delay and jitter, influence on the subjective evaluation of the terminal user, and so on, so that each communication method can be used for various purposes if it can be identified.

  However, in Patent Document 1, the purpose is abnormality detection, that is, trend change detection from normal times, and foreground / background communication cannot be identified. Patent Documents 2 and 3 are technologies aimed at identifying applications and communication services, and cannot identify foreground / background communication.

  An object of the present invention is to solve the above technical problem and provide a communication identification method and apparatus for identifying communication performed by a communication terminal establishing a session in the foreground and communication performed by establishing a session in the background. It is in.

  In order to achieve the above object, the present invention provides a communication identification apparatus that identifies a session established between a communication terminal and a communication partner as either foreground communication or background communication, and has the following configuration: There is a feature.

  (1) A means for classifying each session observed on the network into an SD group specific to the combination of the transmission source information and destination information, and a means for calculating an autocorrelation for the occurrence timing of each session for each SD group; And means for identifying the session of the SD group based on the autocorrelation calculation result.

  (2) A means for calculating a cross-correlation with respect to the occurrence timing of the session of the SD group and the session of another SD group is provided, and the SD group session is identified based on the autocorrelation and cross-correlation calculation results. I made it.

  (3) As a means for identifying communication, a session having a high cross-correlation with a session already identified for background communication is preferentially identified for background communication.

  (4) Even if communication with high cross-correlation between SD groups is recognized, if the difference in the occurrence timing of each session is less than a predetermined time difference, this is identified as foreground communication triggered by the user.

  (5) The comparison target session based on the difference in the occurrence time of the session is limited to the session identified in the foreground communication in advance.

According to the present invention, the following effects are achieved.
(1) Among communications executed by communication terminals, sessions with high autocorrelation coefficients of occurrence timing are identified as background communications that are automatically and mechanically executed by the OS and applications regardless of user operations. , User-derived / led foreground communication and background communication can be identified by passive packet capture at low cost and with only a small number of measurement points.

  (2) Even if the autocorrelation coefficient is low, a session with a high cross-correlation coefficient is identified as background communication, so sessions are established in the same procedure with multiple servers within the same background process. Repeated communication can be identified as background communication even if the autocorrelation between sessions belonging to the same SD group is low.

  (3) Since a session having a high cross-correlation with a session identified as background communication is highly likely to be background communication, it is possible to accurately identify such a session as background communication.

  (4) Even if communication with high cross-correlation between SD groups is recognized, if the difference in the occurrence timing of each session is less than the predetermined time difference, this is recognized as user-triggered communication and identified as foreground communication Therefore, for example, when browsing a web page with a multi-domain configuration, communication accessing a plurality of servers originating from a user can be identified as foreground communication.

  (5) In the foreground communication triggered by the user, the cross-correlation between sessions is high, and by limiting the comparison target to the foreground communication session in advance, it is possible to reduce the calculation amount and the calculation time required for identification.

It is the figure which showed the structure of the network to which the communication identification method of this invention is applied. It is the functional block diagram which showed the structure of one Embodiment of a capture apparatus. It is the flowchart which showed the calculation procedure of the autocorrelation in SD group. It is the flowchart which showed the calculation procedure of the cross correlation between SD groups. It is the flowchart which showed the 1st identification method. It is the functional block diagram which showed the structure of other embodiment of a capture apparatus. It is the flowchart which showed the 2nd identification method. It is the flowchart which showed the 3rd identification method.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. FIG. 1 is a block diagram showing the configuration of a network to which the communication identification method of the present invention is applied.

  A radio base station BS is installed in each area of the service providing range, and a radio mobile terminal MN (for example, a smartphone or a tablet terminal) in the area is accommodated in each radio base station BS. Each radio base station BS is connected to a radio access network RAN, and the radio access network RAN is connected to a gateway (GW) of the core network. The core network is connected to the Internet at the Internet Exchange (IX).

  Various servers that provide services in response to requests from each MN are connected to the Internet. In the present embodiment, the capture device 1 as a communication identification device is connected to a line L that connects the radio access network RAN and the core network as a line that can aggregate traffic between each MN and each server.

  FIG. 2 is a functional block diagram showing the configuration of the main part of one embodiment of the capture device 1. Here, the configuration unnecessary for the description of the present invention is omitted.

  The communication traffic measurement unit 101 captures packets transmitted and received on the line L, and logs various information including the session type (TCP, HTTP, UDP, etc.), occurrence timing, transmission source information, and destination information. Record in the management unit 102.

  The session classification unit 103 classifies each session into one of the SD groups based on the combination of the transmission source information (S) and the destination information (D). That is, sessions with the same transmission source information (S) and destination information (D) are classified into the same SD group, and different sessions are classified into different SD groups.

  In this embodiment, a transmission source IP address is adopted as transmission source information, and a destination IP address and a port number are adopted as destination information. The occurrence timing of each session is represented by the arrival time of the HTTP Request packet if it is an HTTP session, and is represented by the arrival time of a Syn packet that is sent and received in a three-handshake that is executed when the session is established for a TCP session. If so, it is represented by the arrival time of the packet observed for the first time in the session.

  Correlation calculation section 104 has the same and different transmission source for autocorrelation calculation section 104a that calculates autocorrelation (intra-SD group autocorrelation coefficient) regarding the occurrence timing of each session classified into the same group for each SD group. It includes a cross-correlation calculation unit 104b that calculates a cross-correlation (inter-SD group cross-correlation coefficient) regarding the occurrence timing of each session classified into the SD group. That is, the calculation target of the cross correlation in the present embodiment is the SD group having the same transmission source and different destination and the same transmission source user.

  The communication identification unit 105 compares the autocorrelation coefficient and the cross-correlation coefficient calculation results with a predetermined threshold, and identifies each SD group session as either background communication or foreground communication based on each comparison result To do.

  FIG. 3 is a flowchart showing the calculation procedure of the intra-SD group autocorrelation performed by the autocorrelation calculation unit 104a, and is repeated for all the SD groups in which the sessions are classified.

  In step S101, the occurrence timing of each session classified in the SD group (SD1) to be identified this time is discretized (binized) at a predetermined period τ seconds, and the number of sessions generated within each period τ is determined. It is converted into a number sequence in time series.

  In step S102, the same τ seconds as the period are set as the lag value (delay time) j for calculating the autocorrelation. In step S103, the autocorrelation coefficient AC (j) corresponding to the current lag value j is calculated based on the following equation (1). In the present embodiment, the autocorrelation coefficient AC (j) is obtained by calculating the sum of products by shifting the same number sequence by j. Note that i is an element identifier of the sequence, SD (i) is the value of the i-th element of the sequence, and N is the sequence length.

  In step S104, the current autocorrelation coefficient AC (j) calculation result is divided by the autocorrelation coefficient AC (0) when the lag value j = 0, as shown in the following equation (2). Thus, the autocorrelation coefficient AC (j) is normalized.

  In step S105, it is determined whether or not the lag value j has reached a predetermined upper limit value jmax. If j ≧ jmax, the process proceeds to step S106 to extend the lag value j by the period τ seconds, and then returns to step S103 to calculate and normalize the autocorrelation coefficient AC (j) corresponding to the updated lag value j Is repeated.

  FIG. 4 is a flowchart showing a cross-correlation calculation procedure performed by the cross-correlation calculation unit 104b. This procedure is repeated for all SD group pairs having the same source information (S) and different destination information (D). Now, a case where a session belonging to the SD group SD1 is identified based on a relationship with a session belonging to another SD group SD2 having different destination information (D) will be described as an example.

  In step S201, the occurrence timings of the sessions classified into the two SD groups SD1 and SD2 to be calculated this time are discretized (binized) at a predetermined period τ, and the number of sessions generated within each period is calculated. It is converted into a number sequence in time series. In step S202, τ seconds is set as the lag value j for calculating the cross-correlation.

  In step S203, the cross-correlation coefficient CC (j) corresponding to the current lag value j is calculated based on the following equation (3). In the present embodiment, the cross-correlation coefficient is obtained by calculating the sum of products by shifting two number sequences by τ.

  In step S204, the calculation result of the current cross-correlation coefficient CC (j) is calculated from the autocorrelation coefficients AC1 (0), AC2 (when the lag value j = 0, as shown in the following equation (4). The cross-correlation coefficient CC (j) is normalized by dividing by the square root of the product of (0).

  In step S205, it is determined whether or not the lag value j has reached a predetermined upper limit value jmax. If j ≧ jmax, the process proceeds to step S206 to extend the lag value j by the period τ seconds and then return to step S203 to calculate and normalize the cross-correlation coefficient CC (j) corresponding to the updated lag value j Is repeated. Such calculation of autocorrelation coefficient CC (j) is repeated while switching the calculation target to another SD group when there is another SD group having the same transmission source information.

  Next, a procedure in which the correlation calculation unit 104 and the communication identification unit 105 cooperate to identify each SD group session as either foreground communication or background communication will be described.

  FIG. 5 is a flowchart showing the first identification method. In step S300, the autocorrelation of sessions belonging to each SD group is calculated for each lag value j by the autocorrelation calculation unit 104a. In steps S301 and S302, for all SD groups for which autocorrelation has been calculated, each autocorrelation coefficient AC (j) calculated for each lag value j in each SD group is compared with a predetermined first threshold value Pref1. Is done. If there is even one autocorrelation coefficient AC (j) exceeding the first threshold Pref1, the process proceeds to step S310, and the session of the SD group is identified as background communication.

  When the identification of the background communication based on the autocorrelation is completed for all the SD groups, one of the SD groups that have not yet been identified in either the background communication or the foreground communication is set as the current attention SD group in step S303. Selected.

  In step S304, another SD group having the same transmission source information but different destination information is selected as a target of calculation of the current cross correlation. In step S305, the cross correlation CC (j) between the session of the target SD group and the other selected SD group is calculated for each lag value j by the cross correlation calculation unit 104b.

  In step S306, the cross-correlation coefficient CC (j) calculated for each lag value j is compared with a predetermined second threshold value Pref2. If there is even one cross-correlation coefficient CC (j) exceeding the second threshold Pref2, the process proceeds to step S311 and the session of the target SD group is identified as background communication.

  On the other hand, if there is no cross-correlation coefficient CC (j) exceeding the second threshold value Pref2, the process proceeds to step S307, and the cross-correlation between the target SD group and all other SD groups has been calculated. It is determined whether or not. If it has not been calculated, the process returns to step S304, and each of the above processes is repeated while changing another SD group to be calculated. If no cross-correlation exceeding the second threshold Pref2 is found in any other SD group, the process proceeds to step S308, and the current SD group session is identified as foreground communication.

  In step S309, determination is made based on whether all SD groups have been noticed. If not noticed, the process returns to step S303, and the above-described processes are repeated while changing the noticeable SD group.

  According to this embodiment, since a session having a high autocorrelation coefficient of occurrence timing is identified as background communication, a session in which an application periodically communicates with a server in the background regardless of a user operation is determined as background communication. Can be identified.

  In addition, when the inventor closely observed the session, some applications communicate with a plurality of servers during the synchronization process performed in the background, and such background communication is established with the same server. Although auto-correlation was not observed among multiple sessions, it was confirmed that cross-correlation was observed between sessions established with different servers and belonging to different SD groups.

  Here, in the present embodiment, even if the autocorrelation coefficient is low, a session having a high cross-correlation coefficient is identified as background communication. Therefore, a session is established with a plurality of servers within the same background process. Regarding communication, even if the autocorrelation between sessions belonging to the same SD group is low, it can be identified as background communication.

  FIG. 6 is a functional block diagram showing the configuration of the main part of another embodiment of the capture device 1. Here, the configuration unnecessary for the description of the present invention is omitted. The present embodiment is characterized in that a time difference reflecting unit 105a is provided that obtains a start time difference between sessions belonging to two SD groups to be subjected to cross-correlation coefficient calculation and reflects the difference in communication identification.

  FIG. 7 illustrates a second identification method in which the communication identification unit 105 and the correlation calculation unit 104 including the time difference reflection unit 105a cooperate to identify each SD group session as either foreground communication or background communication. It is the shown flowchart.

  In the first identification method, when autocorrelation or cross-correlation is recognized between sessions belonging to different SD groups, the communication related to the session is unconditionally identified as background processing.

  However, for example, in Web browsing, if multiple contents included in the Web page are distributed and distributed to multiple Web servers in different domains, sessions established between the Web servers are classified into different SD groups. Will be. Since the communication procedure for acquiring content from each Web server is the same, the cross-correlation of sessions between SD groups generally tends to increase.

  Therefore, such a session in Web browsing is identified as background communication, although it is foreground communication started in response to a user's browsing operation.

  On the other hand, according to the observation results of the inventor, in the web browsing for browsing the web page of the multi-domain configuration as described above, the occurrence time difference of the session for each web server is for multiple servers executed in other background processes. It has been empirically confirmed that it is sufficiently shorter than the time difference between the sessions.

  This is because in the background processing, the processing between the communication terminal and each server often proceeds sequentially according to a predetermined rule, whereas in web browsing, the processing with each server proceeds almost simultaneously and the processing load is reduced. This can be attributed to the fact that few downloads are the main process.

  Therefore, in this embodiment, even if communication with a high cross-correlation between SD groups is recognized, if the difference in the occurrence timing of each session is less than a predetermined time difference, this is recognized as user-initiated communication and the foreground is detected. Identified by communication. However, when the cross-correlation with the session already identified in the background process is high, the background process is identified regardless of the occurrence time difference.

  In steps S400 to S406 and S410, processing similar to that in steps S300 to S306 and S310 is executed. As a result, for any SD group of interest having at least one autocorrelation coefficient AC (j) exceeding the first threshold value Pref1, the process proceeds to step S410 and is identified as background communication.

  On the other hand, if it is determined in step S406 that there is at least one cross-correlation coefficient CC (j) exceeding the second threshold Pref2, the process proceeds to step S411, and the other SD group that is the determination target is determined. It is determined whether the session has been identified for background communication. If the session has already been identified for background communication, the process proceeds to step S413, and the session of the target SD group is also identified for background communication.

  This is a rule of thumb based on the rule of thumb that sessions that have a high cross-correlation with the session identified in the background communication are likely to be background communication as well, ensuring that such sessions Can be identified.

  On the other hand, if the session of the other SD group has not been identified as background communication, the process proceeds to step S412 and the session of the SD group of interest is communication derived from foreground communication that is started when a user operation is performed. It is determined whether or not.

  In the present embodiment, the time difference Δt between the occurrence timing of the session of the SD group of interest and the occurrence timing of the session of another SD group not identified in the background communication is compared with a predetermined reference time difference Δtref. . If the occurrence time difference Δt is shorter than the reference time difference Δtref, the process proceeds to step S408, and the session of the target SD group is identified as the foreground communication started by the user operation. On the other hand, if the occurrence time difference Δt is longer than the reference time difference Δtref, the process proceeds to step S407.

  In step S407, it is determined whether or not the cross-correlation between the current attention SD group and all other SD groups has been calculated. If it has not been calculated, the process returns to step 404, and the above-described processes are repeated while changing another SD group to be calculated. If no cross-correlation exceeding the second threshold Pref2 is found in any other SD group, the process proceeds to step S408, and the current SD group session is identified as foreground communication.

  In step S409, determination is made based on whether all SD groups have been noticed. If not noticed, the process returns to step S403, and the above processes are repeated while changing the noticeable SD group.

  In the second identification method described above, the comparison target for measuring the time difference Δt between the session of the SD group of interest and the occurrence timing is unconditional in step S412, but the present invention is not limited to this. Instead, as in the third embodiment shown in FIG. 8, in step S412, in response to the identification result in step S408, the comparison target may be limited to sessions that have already been identified for foreground communication.

  In the foreground communication triggered by the user, the cross-correlation between sessions becomes high. Therefore, by limiting the comparison target to the foreground communication session in advance, it is possible to reduce the calculation amount and the calculation time required for identification.

Further, in each of the above-described embodiments, the autocorrelation coefficient or the cross-correlation coefficient is compared with a predetermined fixed threshold value Pref1 or Pref2, and each session is selected from either foreground communication or background communication based on the magnitude relationship. It was explained as identifying. However, the present invention is not limited to this, and the 80th and 90th percentile values may be adaptively set to the thresholds Pref1 and Pref2, for example, from the calculated distribution of correlation characteristics. Further, the identification result does not need to be deterministic, and the likelihood determination may be performed.

  Similarly, the occurrence time difference Δtref, the sequence BIN, and the period τ are not limited to fixed values, and may be set from a distribution in the same manner as described above, or likelihood determination may be employed.

  DESCRIPTION OF SYMBOLS 101 ... Communication traffic measurement part, 102 ... Log information management part, 103 ... Session classification part, 104 ... Correlation calculation part, 104a ... Autocorrelation calculation part, 104b ... Cross correlation calculation part, 105 ... Communication identification part, 105a ... Time difference reflection Part

Claims (12)

In a communication identification device that identifies a session established between a communication terminal and a communication partner as either foreground communication or background communication,
Session classification means for classifying each session observed on the network into an SD group specific to the combination of the source information and destination information,
An autocorrelation calculating means for calculating autocorrelation related to the occurrence timing of each session for each SD group;
A communication identification device comprising communication identification means for identifying a session of the SD group based on the autocorrelation calculation result.   The communication identification device according to claim 1, wherein the communication identification unit identifies a session whose autocorrelation exceeds a predetermined first threshold as background communication. A cross-correlation calculating means for calculating a cross-correlation with respect to the occurrence timing of the session of the SD group and the session of the other SD group;
The communication identification apparatus according to claim 1, wherein the communication identification unit identifies the session of the SD group based on the calculation result of the autocorrelation and the cross correlation.   4. The communication identification apparatus according to claim 3, wherein the session of the SD group and the session of another SD group have the same source information and different destination information.   5. The communication identification unit according to claim 4, wherein a session of an SD group that has not been identified as background communication based on the autocorrelation calculation result is identified based on the crosscorrelation calculation result. Communication identification device.   6. The communication identification apparatus according to claim 3, wherein the communication identification unit identifies a session whose cross-correlation exceeds a predetermined second threshold as background communication. The cross-correlation calculating means calculates cross-correlation related to the occurrence timing of the SD group session and all other SD group sessions, respectively.
The communication identification device according to claim 6, wherein the communication identification unit identifies the session of the SD group as background communication if at least one cross-correlation exceeds a predetermined second threshold. 8. The communication according to claim 6 , wherein the communication identification unit identifies, as background communication, a session whose cross-correlation with a session already identified for background communication exceeds the predetermined second threshold value. 9. Identification device. Means for calculating a time difference between an occurrence time of a session of an SD group that was not identified in background communication based on the cross-correlation and an occurrence time of a session of the other SD group;
9. The communication identification apparatus according to claim 3, wherein a session of an SD group in which the occurrence time difference is equal to or less than a predetermined reference time difference is identified as foreground communication.   The communication identification apparatus according to claim 9, wherein the session of the other SD group is a session that has been previously identified as foreground communication. In a communication identification method for identifying a session established between a communication terminal and a communication partner as either foreground communication or background communication,
Each session observed on the network is classified into an SD group specific to the combination of the source information and destination information,
Calculate the autocorrelation for the occurrence timing of each session for each SD group,
A communication identification method for identifying a session of the SD group based on the autocorrelation calculation result. Further calculating a cross-correlation regarding the occurrence timing of the session of the SD group and the session of another SD group having a different destination from the SD group,
The communication identification method according to claim 11, wherein the session of the SD group is identified based on the calculation result of the autocorrelation and the cross correlation.