JP6660283B2 - Traffic demand forecasting device, traffic demand forecasting method, and program - Google Patents

Description

  The present invention relates to network traffic control technology.

  In recent years, with the diversification of network services, sudden traffic fluctuations have increased. As traffic fluctuations, such as OS updates, popular video streaming distribution, distribution of popular applications, backup communication between corporate locations and data centers, etc., when traffic increases rapidly over the entire network, live events such as Olympics and concerts, commuting congestion, etc. It is assumed that the traffic occurrence locations are locally concentrated. Sudden traffic fluctuations caused by these "events" cause network congestion. The telecommunications carrier needs to avoid network congestion even when sudden traffic fluctuations occur due to some event.

  As a method of avoiding congestion, it is conceivable to add network resources in accordance with the peak value of the traffic volume. However, since it takes time to add resources, it is difficult to respond to congestion caused by sudden event traffic by adding resources. In addition, a sudden increase in traffic caused by an event or the like is often temporary, and it is costly to add resources to respond to the event.

  As a technology for efficiently accommodating traffic by dynamically allocating limited network resources, there is a traffic engineering (TE) technology. TE dynamically controls the traffic route according to the traffic demand and the utilization state of network resources, thereby improving the traffic accommodation efficiency. As an example of TE, path control for minimizing the maximum link utilization rate in the network and minimizing the average delay time can be considered.

  Among the TEs, a TE that predicts a future traffic demand and performs traffic path control based on the prediction result is referred to as a prediction type TE. An advantage of the predictive TE is that by performing route control in consideration of future traffic fluctuation, it is possible to avoid congestion that may occur in the future in advance. By predicting the traffic demand due to the event in advance by the prediction type TE and dynamically changing the route of the traffic, it is considered possible to avoid network congestion due to sudden traffic fluctuation at the time of the event occurrence. .

  However, in the prediction type TE, if the prediction of the traffic demand is missed, the traffic is concentrated on a specific link, and the resource use efficiency is reduced. Therefore, if the prediction of the event information is incorrect, the efficiency of the route control may be significantly reduced.

  Therefore, in order to implement traffic control corresponding to sudden traffic fluctuations occurring due to events, etc., it is possible to utilize event information and perform appropriate control according to the accuracy (precision accuracy) of the event information , Traffic control technology is required.

  Regarding the prediction of traffic demand, Non-Patent Document 1 uses a model combining a neural network and fuzzy theory to examine the relationship between the learning period and the granularity of data and the accuracy of prediction with respect to short-term prediction. Is disclosed. Further, Non-Patent Document 2 discloses that traffic volume of the Internet backbone is predicted up to six months ahead by using multi-resolution analysis by Weblet transform.

  In the approaches described in Non-Patent Documents 1 and 2, the short-term standard deviation and the long-term trend are predicted by modeling a traffic generation pattern from past time-series data of traffic. However, in traffic prediction using time-series data, future fluctuations are predicted based on past fluctuations, so it is difficult to predict sudden traffic fluctuations unlike any in the past, such as when an event occurs. It is.

  When the route control utilizing the event information is performed by the above approach, there is a problem that when the event occurs, the traffic control efficiency is largely degraded due to the prediction failure of the traffic demand.

  Non-Patent Document 3 and Patent Document 1 describe that a large number of flows having different 5-tuples (source address, destination address, source port number, destination port number, protocol number) are aggregated, and similar characteristics are obtained. It is disclosed to generate a macro flow that is the set of flows shown. Here, we classify the traffic volume of 5-tuple flows into predictable macro flows and hard-to-predict macro flows, and use predictive TE only for predictable macro flows, thereby eliminating the problem of predictive TE that is a problem of predictive TE. Solved. In this approach, traffic fluctuation components in the past are analyzed, and traffic demand is separated into predictable and unpredictable components, and different route control is performed for each component. Note that a stable macro flow in Patent Document 1 corresponds to a predictable macro flow, and a non-stable macro flow corresponds to a difficult to predict macro flow.

  However, when the above approach is applied to event traffic control, sudden traffic generated by an event or the like is classified as an unpredictable macro flow. Since it is difficult to assign an optimal route to a macro flow that is difficult to predict, there is a problem that as the ratio of event traffic increases, the utilization efficiency of network resources decreases.

  Non-Patent Document 4 uses not only time-series data of past traffic but also external information such as TV rating and distribution information of popular programs to guarantee the quality of Video on Demand (VoD) service. It is disclosed that the amount of additional resources to be provided is estimated.

  This conventional technology improves the prediction accuracy of peak traffic volume by taking advantage of the negative correlation between TV ratings and VoD service usage rates and the fact that traffic increases during the time when popular programs are distributed. Let me. For example, the traffic demand forecast model calculated from the past traffic demand, such as "22: 00-23: 00 on Saturdays and public holidays" and "22: 00-23: 00 on Tuesdays when popular dramas are distributed" 2 shows that the prediction error of the prediction model is reduced by modifying the prediction model based on external information that the traffic volume increases.

  In the above approach, highly accurate traffic prediction is made possible by utilizing external information other than time-series data of past traffic for traffic prediction. However, in this approach, since congestion is avoided by adding resources, there are problems that it takes a long time to respond and the cost is high.

M. F. Zhani, H. Elbiaze, and F. Kamoun, "Analysis and prediction of real network traffic," Journal of Networks, vol. 4, no. 9, pp. 855-865, nov 2009. K. Papagiannaki, N. Taft, Z.-L. Zhang, and C. Diot, "Longterm forecasting of internet backbone traffic: Observations and initial models," in Proceedings of INFOCOM, vol. 2, mar 2003, pp. 1178- 1188. Y. Takahashi, K. Ishibashi, M. Tsujino, N. Kamiyama, K. Shiomoto, T. Otoshi, Y. Ohsita, and M. Murata, "Separating predictable and unpredictable flows via dynamic flow mining for effective traffic engineering." 2016 IEEE International Conference on Communications (ICC). IEEE, 2016. H. Hasegawa, S. Kouno, A. Shiozu, M. Sasaki, and S. Shimogawa, "Predictive network traffic engineering for streaming video service." 2013 IFIP / IEEE International Symposium on Integrated Network Management (IM 2013) .IEEE, 2013 .

Yousuke Takahashi, Keisuke Ishibashi, Kohei Shiomoto, Yuichi Ohshita, Masayuki Murata, "Flow Aggregation Apparatus, Method and Program", JP-A-2015-156529

  In a network in which sudden traffic fluctuations occur due to an event or the like, when performing route control for efficient accommodation of traffic (target example: minimization of maximum link utilization rate, minimization of average delay time), a conventional technique is used. Then, there were the following problems.

  That is, as in the technology disclosed in Non-Patent Documents 1 and 2, when route control is performed by predicting traffic demand based on past traffic demand by modeling traffic demand from past time-series data, Unpredictable sudden traffic fluctuations cannot be predicted, and the degree of attainment of the target of the route control is greatly deteriorated due to the prediction failure.

  Further, when the traffic demand is separated into predictable and difficult-to-predict components as in the techniques disclosed in Non-patent Document 3 and Patent Document 1, and different route control is performed for each component, the problem of mis-prediction occurs. Although it is improved to some extent, the event traffic is classified as a component that is difficult to predict, so that the degree of attainment of the route control target is deteriorated.

  Also, when resources are added in advance by traffic demand prediction based on external information as in the technique disclosed in Non-Patent Document 4, highly accurate traffic prediction is possible, but it takes a long time to respond, Additional costs are also large.

  The present invention has been made in view of the above points, and makes it possible to use event information as external information to predict traffic demand with high accuracy, and to classify event traffic with high accuracy based on background traffic. It is another object of the present invention to provide a technique for realizing route control in a short time and with a high degree of achievement of a target.

According to the disclosed technology, it is a traffic demand forecasting device that forecasts a traffic demand in a network,
From traffic information collected from the network, an acquisition unit that acquires background traffic that is traffic that is not related to event information,
And the variance of the predicted value of the event traffic in the event information, compares the average of the background traffic, the if the variance is greater than the average of the background traffic, and unpredictable classify characteristics of the event traffic, the dispersion Is smaller than the average of the background traffic, the characteristics of the event traffic are classified as predictable, and for each of the prediction difficult and the predictable, the event traffic demand is totaled to calculate a traffic matrix. Means for providing a traffic demand forecasting device.

  According to the disclosed technology, it is possible to accurately predict traffic demand by utilizing event information as external information, and to classify event traffic with high accuracy based on background traffic. A technology for realizing a route control with a high level of accuracy is provided.

FIG. 1 is a diagram for describing an outline of an embodiment of the present invention. FIG. 1 is a system configuration diagram according to an embodiment of the present invention. 1 is a configuration diagram of a flow aggregation device 100. FIG. 3 is a diagram for explaining a flow database 101. FIG. 2 is a diagram illustrating an example of a hardware configuration of a flow aggregation device 100. FIG. 7 is a diagram illustrating an algorithm of a traffic demand calculation unit for each characteristic. It is a figure which shows the processing flow of the traffic demand calculation part 103 classified by characteristic. It is a figure which shows the example of a classification of event traffic. It is a figure which shows the mathematical algorithm of a predictable macro flow. It is a figure which shows the mathematical algorithm of a macro flow which is hard to predict.

  Hereinafter, embodiments of the present invention (the present embodiment) will be described with reference to the drawings. The embodiments described below are merely examples, and embodiments to which the present invention is applied are not limited to the following embodiments.

(About control unit in the present embodiment)
In the present embodiment, traffic is controlled in units called flows. The unit in the flow is a unit called a micro flow, which is a unique flow with different 5-tuple (source address, destination address, source port number, destination port number, protocol number), and a macro flow that aggregates micro flows A unit called is used. A macro flow is a flow that identifies flow header information (5-tuple) in any combination.

(Overview of technology)
First, an overview (image) of the technology according to the present embodiment will be described with reference to FIG. FIG. 1 shows the sum of the traffic demand between a certain destination node. Here, it is assumed that a certain event causes sudden traffic to occur at 14:00 to 14:30, 17:00 to 17:30, and 20:00 to 20:30. FIG. 1 shows that all traffic is separated into predictable and unpredictable components (such separation is possible with the technique of Patent Document 1).

  In the technology according to the present embodiment, the event information (information including information on the destination node, an arbitrary 5-tuple macro flow, the event start time, the event end time, the traffic amount, and the like) (according to the accuracy of prediction) is used. And appropriate traffic control is possible. For example, when the variance of the event traffic volume in the event information from 14:00 is large compared to the background traffic, the event information is determined to have low accuracy, and it is more appropriate to classify the event information as difficult to predict. Is determined.

  Further, for example, when the variance of the event traffic amount in the event information from 20:00 is smaller than the background traffic, the event information is determined to have high accuracy, and it is better to classify the event information as predictable. Deemed appropriate.

  By such a determination, it is not necessary to classify all event traffic into components that are difficult to predict as in the related art, and appropriate route control can be realized.

  Note that the event information has a high degree of accuracy (it may be rephrased that the event information is accurate), for example, “the variance of the amount of event traffic with respect to the amount of background traffic is low”, and It refers to event information that satisfies that “event macro flow can appropriately separate background traffic and event traffic”.

  As for the accuracy of event information, for example, when considering event information that "event traffic of 200 to 250 Mbps occurs from 19:00 to 19:30 due to popular video distribution", the event accuracy is "200 to 250 Mbps". Equivalent to " "229 to 230 Mbps" is considered to be event information with high accuracy, and "100 to 500 Mbps" is considered to be event information with low accuracy. However, the accuracy is relatively determined by the background traffic. For example, if the average value of the background traffic in the past is 10 Mbps, the accuracy of “200 to 250 Mbps” is considered to be low because there is a variance nearly five times that of the background traffic. If it is 10 Gbps, "200 to 250 Mbps" can be considered to have high accuracy. This corresponds to the above-mentioned "variance of the amount of event traffic with respect to the amount of background traffic".

  Regarding "the event macro flow can appropriately separate the background traffic and the event traffic", the event macro flow is defined as the macro flow (source address, destination address, source port number, destination port) included in the event information. Number, protocol number), for example, the macro flow is represented as "10.0.0.1, *, *, *, 6". "*" Indicates that no specific value is specified.

  Here, for example, “*, *, *, *, 6” can be considered as low-accuracy event information, and “10.0.0.1,20.0.0.1,80, *, 6” can be considered as high-accuracy event information. That is, since "*, *, *, *, 6" indicates all communications by TCP (protocol number 6), the event information that "the event sent by TCP occurs" is regarded as background traffic. Event traffic cannot be appropriately separated, and can be considered as event information with low accuracy. In addition, "10.0.0.1,20.0.0.1,80, *, 6" means all communication by TCP (protocol number 6) and Http (port number 80) sent from 10.0.0.1 to 20.0.0.1 Therefore, the background traffic and the event traffic can be appropriately separated, and the event information can be considered to have high accuracy.

  The requirements for high accuracy of the event information include “the variance of the amount of event traffic with respect to the amount of background traffic is low” and “the event macro flow appropriately separates background traffic and event traffic. Using both "what can be done" is an example. For example, only "the variance of the amount of event traffic with respect to the amount of background traffic is low", or "the variance of the amount of event traffic with respect to the amount of background traffic is low"; However, the background traffic and the event traffic must be properly separated from each other. Also, the requirement is that the variance of the amount of event traffic is low relative to the amount of background traffic and that the event macro flow can appropriately separate the background traffic from the event traffic. Is also good.

(System configuration)
FIG. 2 shows a system configuration diagram in the present embodiment. As shown in FIG. 2, the system according to the present embodiment includes a flow aggregation device 100, a route calculation device 200, a control setting device 300 (may be referred to as a controller), and transfer devices 401 to 403 (may be referred to as nodes). , Terminals 501 to 504, and are connected to each other so that information can be transmitted and received between the devices as illustrated. Hereinafter, the transfer devices 401 to 403 are collectively referred to as a transfer device 400, and the terminals 501 to 504 are collectively referred to as a terminal 500. Further, the flow aggregation device 100 may be referred to as a traffic demand prediction device.

  The flow aggregation device 100 has a function of calculating a predicted value of a traffic demand and a predicted value of an event traffic demand in accordance with the input traffic information and event information, and transmitting these predicted values to the route calculation device 200.

  The route calculation device 200 is a device that calculates an optimum route according to the input network configuration information, traffic demand forecast, and event traffic demand forecast, and has a function of transmitting the route information to the control setting device 300.

  The control setting device 300 is a device that sets route information for all the transfer devices 300 in the network, and has a function of aggregating the traffic information transmitted from the transfer device 400 and transfers the traffic information to the flow aggregating device 100. Has functions.

  The transfer device 400 is a device that transfers traffic, and processes a packet according to route information. Further, the transfer device 400 has a function of measuring a traffic amount, collecting traffic information, and transmitting the traffic information to the control setting device 300. The terminal 500 is a device that generates traffic. Note that a configuration including the terminal 500 and the transfer device 400 may be referred to as a “network”.

  The network configuration information provided to the route calculation device 200 is network topology information such as nodes and links. The traffic information transmitted from the transfer device 400 to the control setting device 300 is time-series data of a micro flow. The traffic transmitted from the terminal 500 is obtained as traffic information via the node and the controller.

<About event information>
The event information provided to the flow aggregating apparatus 100 includes information of a destination node, an arbitrary 5-tuple macro flow, an event start time, an event end time, and a traffic volume. It is not necessary to have all the information, but at least information on the originating and terminating node, the event start time, and the event end time is required.

  A street number is assigned to each node, and the above-mentioned “destination node” is the number of the transmission node and the number of the destination node. The “arbitrary 5-tuple macro flow” is a macro flow that represents event traffic. The information on the traffic volume is, for example, the predicted value of the event traffic and the width (variance) of the predicted value of the event traffic.

  Event information is obtained from public information such as company press releases, news, SNS, OS update announcements, popular application distribution announcements, concert holding information, etc., or non-public information such as telecommunications carrier operation information. Then, the operator of the communication carrier inputs the macro flow format to the system (specifically, the flow aggregation device 100).

  The traffic resulting from the event is specified by an optional 5-tuple macro flow. Further, an unpredictable portion can be designated by “*” meaning “arbitrary”. In addition, when the prediction accuracy of the event traffic volume is ambiguous, it is possible to designate the traffic volume with a width as described above, such as the standard deviation of the traffic volume and the maximum and minimum values of the predicted traffic volume. it can.

  “From: 4, To: 7,“ 10.0.0.1, *, *, *, 6 ”, 14:00 to 14:30, 50 Mbps, ± 0 Mbps” is an example of event information. This event information indicates a prediction that a 50 Mbps event traffic "10.0.0.1, *, *, *, 6" will occur from node 4 to node 7 from 14:00 to 14:30. Note that "10.0.0.1, *, *, *, 6" means TCP protocol communication in which the IP address of the transmission source server is "10.0.0.1".

  Also, for example, event information such as “From: 5, To: 2,“ *, *, 80, *, 6 ”, 14:00 to 14:30, 110 Mbps, ± 10 Mbps” is transmitted from node 5 to node 2. This shows a prediction that event traffic of “*, *, 80, *, 6” of 100 to 120 Mbps will occur from 14:00 to 14:30. Note that “*, *, 80, *, 6” means Http communication using the TCP protocol.

  Among the devices constituting the system shown in FIG. 2, devices other than the flow aggregation device 100 can be realized by using the conventional technology. Hereinafter, the configuration of the flow aggregation device 100 will be described.

(About the configuration of the flow aggregation device 100)
FIG. 3 is a configuration diagram of the flow aggregation device 100. As shown in FIG. 3, the flow aggregation device 100 includes a flow database 101, a macro flow generation unit 102, and a traffic demand calculation unit 103 for each characteristic.

  The flow database 101 has a function of a multidimensional flow database disclosed in, for example, Japanese Patent Application Laid-Open No. 2015-75896. That is, the flow database 101 has a function of receiving traffic information and event information and separating the traffic information into microflows corresponding to events and microflows not corresponding to events.

  The function of the flow database 101 will be described with reference to FIG. As shown in FIG. 4A, a macro flow query corresponding to the above event information (specifically, an arbitrary 5-tuple macro flow included in the event information) and a flow corresponding to the above traffic information The data is input, and the corresponding microflow information (indicating the traffic information corresponding to the event) is output. In addition, non-applicable microflow information (pointing to traffic information not applicable to an event) can also be output.

  FIG. 4B shows an example of a macro flow query, and FIG. 4C shows an example of micro flow information corresponding to the macro flow query. With the function of the flow database 101, a macro flow relating to an event can be separated from the traffic information.

  Returning to FIG. 3, the macro flow generation unit 102 has a function of outputting macro flows having different characteristics from the micro flow data (for example, a function disclosed in Patent Document 1). Specifically, the macro flow generation unit 102 calculates a predictable / predictable traffic matrix of the background traffic.

  The characteristic-specific traffic demand calculation unit 103 receives macro flow (macro flow relating to an event / other macro flow) information as an input, and calculates a predicted value of traffic demand (traffic amount between all nodes) by characteristic. Further, it has a function of transmitting a traffic demand forecast for each characteristic to the route calculation device 200.

  As described above, in the present embodiment, as an example, the characteristics of the traffic are “predictable” and “difficult to predict”, and the “specific characteristics” in the characteristic traffic demand calculation unit 103 are “predictable” and “ Difficult to predict ". The “predictable” flow in the present embodiment is a flow in which traffic fluctuation from the past is small and the future traffic demand is predictable, and the “unpredictable” flow is a sudden increase in traffic demand suddenly. This is a flow for which future traffic demand is difficult to predict.

(Example of hardware configuration)
The flow aggregation device 100 according to the present embodiment can be realized, for example, by causing one or a plurality of computers to execute a program describing the processing content described in the present embodiment. That is, the functions of the flow aggregation device 100 are realized by executing a program corresponding to the processing performed by the flow aggregation device 100 using hardware resources such as a CPU, a memory, and a hard disk built in the computer. It is possible to Further, the above-mentioned program can be recorded on a computer-readable recording medium (a portable memory or the like) and can be stored or distributed. Further, it is also possible to provide the above program through a network such as the Internet or e-mail.

  FIG. 5 is a diagram illustrating an example of a hardware configuration of the flow aggregation device 100 when the flow aggregation device 100 is implemented by a computer. 5 includes a drive device 150, an auxiliary storage device 152, a memory device 153, a CPU 154, an interface device 155, a display device 156, an input device 157, and the like, which are interconnected by a bus B.

  A program for realizing the processing in the flow aggregation device 100 is provided by a recording medium 151 such as a CD-ROM or a memory card. When the recording medium 151 storing the program is set in the drive device 150, the program is installed from the recording medium 151 to the auxiliary storage device 152 via the drive device 150. However, the program need not always be installed from the recording medium 151, and may be downloaded from another computer via a network. The auxiliary storage device 152 stores installed programs and also stores necessary files and data.

  The memory device 153 reads the program from the auxiliary storage device 152 and stores it when there is an instruction to start the program. The CPU 154 implements functions related to the flow aggregation device 100 according to a program stored in the memory device 153. The interface device 155 is used as an interface for connecting to a network. The display 156 displays a GUI (Graphical User Interface) by a program. The input device 157 includes a keyboard, a mouse, buttons, a touch panel, and the like, and is used to input various operation instructions.

(Example of overall system operation)
Next, an example of traffic control utilizing event information will be described as an example of the overall operation of the system. In the system according to the present embodiment, the following steps S1 to S6 are repeated for each time step (unit time). For example, if the time step is 10 minutes, the first control is performed at a certain time (for example, 12:00), and the second control is performed at the next time (for example, 12:10). Is repeated.

  Step S1) The flow database 101 (eg, the above-described multidimensional flow database disclosed in Japanese Patent Application Laid-Open No. 2015-75896) in the flow aggregation device 100 associates the traffic information input from the control setting device 300 with the event information. Event traffic and other traffic not related to event information (hereinafter referred to as background traffic). The flow database 101 transmits the event information to the traffic demand calculation unit 103 for each characteristic, and transmits the microflow data of the background traffic to the macroflow generation unit 102.

  Step S2) The macro flow generation unit 102 aggregates the background traffic micro flows into macro flows for each characteristic (eg, predictable, difficult to predict) using, for example, a flow aggregation method disclosed in Patent Document 1. Then, the macro flow and the macro flow size for each characteristic are sent to the traffic demand calculation unit 103 for each characteristic.

  Step S3) The characteristic-specific traffic demand calculation unit 103 calculates the characteristic-specific traffic demand from the event information input from the flow database 101 and the macro flow information of the background traffic input from the macro flow generation unit 102, It is transmitted to the route calculation device 200. The traffic demand by characteristic in the present embodiment has information on characteristics (predictable or difficult to predict), time, destination node, and traffic volume per destination node.

  Step S4) The route calculation device 200 performs a route calculation. The route calculation device 200 transmits the solution of the route calculation (the traffic division ratio via each link from the transmission node to the reception node) and the macro flow information to the control setting device 300. In the present embodiment, the path calculation device 200 calculates the path of the predictable macro flow, and then calculates the path of the macro flow that is difficult to predict with respect to the remaining band.

  Step S5) The control setting device 300 updates the flow table for all the transfer devices 400.

  Step S6) Each transfer device 400 transfers the traffic generated by the terminal 500 based on the flow table.

(Method of calculating traffic demand by characteristics)
Next, a method for calculating the traffic demand by characteristic performed by the traffic demand calculation unit 103 by characteristic will be described in detail.

<Overall processing procedure for calculating traffic demand by characteristics>
The characteristic-specific traffic demand calculation unit 103 calculates the characteristic-specific traffic demand by executing the following procedure.

  Step S11) Event information is received from the flow database 101.

  Step S12) The macro flow generation unit 102 receives the macro flow information for each characteristic and destination node of the background traffic.

  Step S13) It is determined whether the event should be classified as predictable or difficult to predict, and a predictable / predictable traffic matrix of the event traffic is calculated. Details of this calculation method will be described later.

  The characteristic-specific traffic demand calculation unit 103 processes the event macro flow as a predictable macro flow when determining that the prediction of the event information is accurate, and processes the event macro flow when determining that the prediction of the event information is incorrect. Process as a macro flow that is difficult to predict.

  Step S14) The sum of the predictable / predictable traffic matrix of the background traffic calculated by the macro flow generation unit 102 and the predictable / predictable traffic matrix of the event traffic is calculated to calculate the predictable / predictable traffic matrix of all the traffic. I do.

  Step S15) The predictable / predictable traffic matrix of all traffic is transmitted to the route calculation device 200.

  Hereinafter, an example of a method for calculating a predictable / difficult-to-predict traffic matrix of event traffic, which is executed by the traffic demand calculating unit 103 for each characteristic, will be described. First, the definitions of the symbols used in the calculation are shown below.

<Definition of symbols>
−Time: t∈T
-Departure and arrival nodes: p, q
-Formulation of event information:

−時刻tにおける全トラヒック需要:

− Total traffic demand at time t:

−背景トラヒック需要:

− Background traffic demand:

−背景トラヒック需要の平均:

− Average background traffic demand:

−時刻t における予測可能マクロフローのトラヒックマトリックス:

− Traffic matrix of predictable macro flow at time t:

−時刻tにおける予測困難マクロフローのトラヒックマトリックス:

-The traffic matrix of the unpredictable macro flow at time t:

なお、「イベント情報に関する定式化」に関して、「実際のイベントトラヒック需要」は、観測（トラヒック情報）から得られた情報であり、それ以外は、「イベント情報」として与えられる情報である。

As for “formulation regarding event information”, “actual event traffic demand” is information obtained from observation (traffic information), and the other information is information given as “event information”.

  Further, regarding the “predicted value of event traffic demand at time t” in “formulation on event information” and the “width” thereof, the predicted value is entered even if t is not an event period. For example, if a certain event e is predicted to be 100 ± 10 Mbps, regardless of t, even before the start of the event, the “predicted value of event traffic demand” is 100 and its “width” is 10. . Also, since “actual event traffic demand” is an observed value, if t is before the start of the event, it is blank (it may be considered to be 0), and if t is after the start of the event, the measured value (for example, 95 Mbps) Is entered.

  “All traffic demand at time t” is a value obtained from the traffic information at time t.

<Calculation procedure of predictable and difficult-to-predict event traffic matrix>
FIG. 6 shows an example of an algorithm of a procedure executed by the traffic demand calculating unit 103 for each characteristic to calculate a predictable / predictable traffic matrix of event traffic. The meaning of each line is as shown. The background traffic used for calculating the predictable / difficult-to-predict traffic matrix of the event traffic is the sum of the background traffic obtained for each characteristic (information passed by a line from 102 to 103 in FIG. 3 (macro for each characteristic) Flow information).

  In FIG. 6, α and β are predetermined parameters. The exception macro flow list (MacroFlow_List_of_Exeption) in the fifth line is a list of macro flows that have too many "*" s and cannot appropriately separate event traffic from background traffic from event information. For example, when it is not possible to narrow down the event targets by port number, when both the destination address and the destination address are "*", it indicates such as "*, *, *, *, *", "*, *, *, *, 6 "," *, *, 80, *, * ",…).

  The elimination of the meaningless 5-tuple contributes to improving the prediction accuracy of the traffic volume using the event information. For example, when the event macro flow is designated as "*, *, *, *, *", the background traffic amount becomes 0, so that it becomes difficult to appropriately separate the event traffic for each characteristic. Therefore, by excluding the meaningless 5-tuple, it is possible to ignore the event information that is too ambiguous, prevent the traffic demand caused by the event from being disturbed, and prevent the deterioration of the efficiency of the route control. It becomes possible.

  A processing procedure executed by the traffic demand calculating unit 103 according to characteristics based on the algorithm shown in FIG. 6 will be described with reference to the flowchart in FIG. In the following description, the line corresponding to each step in FIG. 6 is described after the step number.

  First, the process is divided for each time, each destination node, and each event (step S101, second to fourth rows).

  As for “every time”, for example, if the time step is 10 minutes and the current time is 12:00, processing (event classification) is performed on “event information” from 12:10 to 12:20. I do. When the current time becomes 12:10, control is performed according to the processing performed at 12:00. At the same time, processing is performed on the “event information” from 12:20 to 12:30.

  Also, in the example where the time step is 10 minutes, dividing by time means that all event information is T = 0 (event information of 12:00-12:10), T = 1 (12:10-12:20 Event information), ....

  In addition, t of for each t in the second line in FIG. 6 represents the current time (eg, every 10 minutes). For example, when t = 12: 00, (each) event information of 12: 10-12: 20 , The processing of the fifth and subsequent rows is executed.

  Also, for example, if the event information input to the system is “100M traffic occurs at 13: 00-14: 00”, “12: 10-12: 20 event information” is empty. (0), and “13: 10-13: 20 event information” is a predicted value (100M). Regarding the determination of whether or not t (eg, 12:00) is within the event period, for example, the event period (before division) of “event information of 12: 10-12: 20” (for classification) is 11:30 If -12: 30, t is determined to be within the event period.

  Next, it is determined whether or not the event macro flow is included in the exception macro flow list (step S102, line 5). If Yes, the event information is ignored (step S110, line 6).

  If the determination result in step S102 is No, it is determined whether or not the event has started at t (step S103, lines 8 and 13). Before the start of the event, it is determined whether or not the variance of the event traffic is larger than the average of the past background traffic (step S104, line 9).

  If the determination result in step S104 is Yes, the event is classified as difficult to predict (step S105, line 10). If the determination result in step S104 is No, the event is classified as predictable (step S106, line 12).

  If it is determined in step S103 that the event is within the event period, it is determined whether the actual event traffic is greater than the predicted value of the event traffic (step S107, line 14).

  If the determination result in step S107 is Yes, the event is classified as difficult to predict (step S108, line 15). If the determination result in step S107 is No, the event is classified as predictable (step S109, line 17).

  Then, the traffic demand calculation unit 103 for each characteristic totals the traffic demand for each characteristic and for each destination node, and calculates a traffic matrix (step S111).

  FIG. 8 shows an example (image) of classifying event traffic by the above-described method. FIG. 8A shows an example in which the variance of the event traffic is smaller than the average of the background traffic, so that the event traffic is classified as predictable. FIG. 8B shows an example in which event traffic is classified as difficult to predict because the variance of event traffic is larger than the average of background traffic.

  FIG. 8C shows an example in which the actual event traffic is larger than the predicted value of the event traffic, and is classified from predictable to difficult to predict from a certain time. In this way, by feeding back the control result of the event traffic, the correctness of the event information can be verified, and congestion due to the disappointment of the event information can be avoided.

<Example of criteria for classification>
The “average of background traffic” in the procedure executed by the traffic demand calculating unit 103 by characteristics described above is an example of a criterion for classifying event traffic into components that are predictable and components that are difficult to predict. The criterion for classifying the event traffic into a predictable component and a component that is difficult to predict is not limited to this. For example, `` variance of background traffic '', `` average and variance of background traffic '', `` average and variance of predictable traffic '', `` coefficient of variation of background traffic (CV) '', `` coefficient of variation of predictable traffic (CV) '' Can be used as a reference. Here, “predictable traffic” corresponds to predictable traffic in a macro flow for each characteristic generated by the macro flow generation unit 102.

  The above C.V. is as follows.

v_t:時刻t におけるトラヒック量
上記の基準を用いた場合でも、「背景トラヒックの平均」を用いた場合と同様にイベントトラヒックを分類することが可能である。

v _t : Traffic volume at time t Even when the above criterion is used, it is possible to classify event traffic in the same manner as when using “average of background traffic”.

  Note that "predictable / difficult to predict" is an example of a traffic classification, and is not limited to this. For example, classification by a user application such as "call / text / movie" or classification by a user terminal such as "fixed / mobile" is also possible. In these cases, by obtaining packet information using a DPI (Deep Packet Inspection) device or the like, it is possible to perform classification in the same manner as the classification of “predictable / predictable”.

(About mathematical optimization calculation executed by the route calculation device 200)
Hereinafter, a mathematical optimization calculation as an example of the route calculation in the route calculation device 200 will be described. Note that the calculation here is an example, and the present invention is not limited to this.

<Mathematical optimization model for predictable macro flow>
A mathematical optimization model for a predictable macro flow is formulated by a multi-product flow problem. The mathematical optimization model based on the multi-product flow problem is as follows.

The network is represented by an effective graph G (V, E). Here, V represents a set of nodes, and E represents a set of links. The link from the node i∈V to the node j∈V is represented as link (i, j) ∈E. The usable bandwidth capacity of link (i, j) ∈E is represented by c _ij .

The traffic matrix representing the traffic demand _tpq from the node p to the node q is represented as Q = { _tpq }. x _ij ^pq indicates a passing rate of the traffic demand t _pq passing through the link (i, j), and is called a routing variable. U _link indicates the congestion rate of the network, and a value of a routing variable that minimizes U _link is obtained in an equation described later.

  An example of a mathematical programming problem called a multi-product flow problem used in the present embodiment is shown in equations (1.1) to (1.6) in FIG.

Equation (1.1) shows an objective function that minimizes the congestion rate of the network, and (1.2) to (1.6) are constraints. Equations (1.2) and (1.3) show the flow conservation rule. Equation (1.4) indicates that the sum of traffic passing through link (i, j) does not exceed link capacity × congestion ratio. Equations (1.5) and (1.6) indicate that the routing variable x _ij ^pq and the congestion ratio U _{link of the} network indicate a value range.

  The path calculation device 200 calculates the path for the predictable macro flow by performing the above mathematical optimization calculation.

<Mathematical optimization model for macro flow that is difficult to predict>
The mathematical optimization model for hard-to-predict macro flows is formulated by the load balancing flow problem. The mathematical optimization model based on the load distribution flow problem is as follows.

The network is represented by an effective graph G (V, E). Here, V represents a set of nodes, and E represents a set of links. The link from the node i∈V to the node j∈V is represented as link (i, j) ∈E. The usable bandwidth capacity of link (i, j) ∈E is represented by c _ij .

h _equarity indicates the fairness of traffic from node p to node q. x _ij ^pq indicates the rate of traffic demand passing through the link (i, j) from node p to node q,
Called routing variables. The traffic passing ratio from the node p to the node q is determined from the fairness of the traffic. In the expression (2.1) described later, the value of the routing variable that minimizes the sum of _hequarity is obtained. That is, the fairness of traffic is maximized for each pair (p, q) of each node.

  Examples of the mathematical programming problem of the load distribution flow problem used in the present embodiment are shown in equations (2.1) to (2.6) in FIG.

  Equation (2.1) shows an objective function that maximizes fairness of traffic passing through (minimizes unfairness), and (2.2) to (2.6) are constraints.

Equations (2.2) and (2.3) show the flow conservation rule. Equation (2.4) indicates that the traffic passing through link (i, j) does not exceed the ratio of link capacity × traffic fairness of traffic. Equations (2.5) and (2.6) show the range of the routing variable x _ij ^pq and the network fairness _hequarity .

  The path calculation device 200 calculates the path for the macro flow that is difficult to predict by performing the above mathematical optimization calculation.

(Effects of Embodiment)
By utilizing event information for traffic control, it is possible to realize highly efficient route control while avoiding congestion even when a sudden traffic fluctuation due to an event or the like occurs.

  Further, since the header of the event information can be flexibly specified by a macro flow (arbitrary 5-tuple combination), even ambiguous event information can be used for path control. For example, it is difficult to predict which user (destination address) will watch a video from the video distribution information, but in the present technology, it is possible to specify the destination address with "*" meaning arbitrary. Therefore, even such ambiguous event information can be used for route control.

  That is, in the related art, since the route control is performed on the assumption that the traffic volume is always correctly predicted, it is necessary for the operator to determine whether or not to use the event information. All event information is classified as difficult to predict, and it is difficult to improve the accuracy of route control.

  On the other hand, in the technology according to the present embodiment, even when the predicted value of the traffic volume generated in the event is given with a certain width, it should be classified as predictable or classified as difficult to predict. Can be appropriately determined. By classifying ambiguous event information in a predictable manner, it is possible to improve the accuracy of route control. In the present embodiment, ambiguity is allowed by determining whether the variance of the event traffic is greater than the average of the background traffic. The MacroFlow_List_Exception shown in FIG. 6 contributes to avoiding deterioration of path control accuracy due to mis-prediction by excluding event information that is too vague.

  As described above, the technology according to the present embodiment makes it possible to use event information as external information to predict traffic demand with high accuracy, and to classify event traffic with high accuracy based on background traffic. Thus, a route control with a high degree of achievement of the target in a short time is realized.

  In addition, by classifying event traffic based on a reference value (eg, variance of background traffic), ambiguous event information can be widely applied as external information. Furthermore, highly accurate prediction is possible by excluding extremely ambiguous event information and re-classifying event information according to the difference between the event traffic after the event has occurred and the predicted value.

(Summary of Embodiment)
As described above, according to the present embodiment, a traffic demand prediction device that predicts a traffic demand in a network, comprising, from traffic information collected from the network, The acquisition means for acquiring, and the variance of the predicted value of the event traffic in the event information, and the background traffic, determine the characteristics of the event traffic, and calculate the traffic demand for each characteristic. A traffic demand prediction device, comprising: a calculation unit.

  The characteristic traffic demand calculation means may change the characteristic of the event traffic by comparing a predicted value of the event traffic in the event information with actual event traffic.

  The characteristic is predictable or difficult to predict, and the characteristic-specific traffic demand calculating means is configured to accurately predict the event traffic in the event information based on a comparison between the variance of the predicted value of the event traffic and the background traffic. The characteristic may be predicted when it is estimated that there is, and the characteristic may be difficult to predict when it is estimated that the prediction of the event traffic in the event information is not accurate.

  Note that the flow aggregation device 100 is an example of a traffic demand prediction device. The flow database 101 and the macro flow generation unit 102 are examples of an acquisition unit. The traffic demand calculation unit 103 is an example of a traffic demand calculation unit.

  Although the present embodiment has been described above, the present invention is not limited to the specific embodiment, and various modifications and changes may be made within the scope of the present invention described in the appended claims. It is possible.

Reference Signs List 100 Flow aggregation device 200 Route calculation device 300 Control setting device 401 to 403 Transfer device 501 to 504 Terminal 101 Flow database 102 Macro flow generation unit 103 Traffic demand calculation unit by characteristic 150 Drive device 152 Auxiliary storage device 153 Memory device 154 CPU
155 Interface device 156 Display device 157 Input device

Claims (5)

A traffic demand forecasting device for forecasting traffic demand in a network,
From traffic information collected from the network, an acquisition unit that acquires background traffic that is traffic that is not related to event information,
And the variance of the predicted value of the event traffic in the event information, compares the average of the background traffic, the if the variance is greater than the average of the background traffic, and unpredictable classify characteristics of the event traffic, the dispersion Is smaller than the average of the background traffic, the characteristics of the event traffic are classified as predictable, and for each of the prediction difficult and the predictable, the event traffic demand is totaled to calculate a traffic matrix. And a means for predicting traffic demand. The said characteristic traffic demand calculation means changes the characteristic of the said event traffic by comparing the predicted value of the event traffic in the said event information with the actual event traffic. The characteristic of Claim 1 characterized by the above-mentioned. Traffic demand forecasting device. A traffic demand forecasting method executed by a traffic demand forecasting device that forecasts traffic demand in a network,
From traffic information collected from the network, an acquisition step of acquiring background traffic that is traffic not related to event information,
And the variance of the predicted value of the event traffic in the event information, compares the average of the background traffic, the if the variance is greater than the average of the background traffic, and unpredictable classify characteristics of the event traffic, the dispersion Is smaller than the average of the background traffic, the characteristics of the event traffic are classified as predictable, and for each of the prediction difficult and the predictable, the event traffic demand is totaled to calculate a traffic matrix. And a traffic demand forecasting method. In the characteristic traffic demand calculation step, the traffic demand prediction device changes the characteristic of the event traffic by comparing a predicted value of the event traffic in the event information with actual event traffic. The traffic demand forecasting method according to claim 3 . Program for causing a computer to function as each unit in the traffic demand prediction apparatus according to claim 1 or 2.

Images