JP7103035B2 - System, method and program - Google Patents

Description

The present invention relates to systems, methods and programs.

There is known a technique of accessing a server on a network from a terminal such as a personal computer and using various services (so-called cloud services) provided by each server.

In the use of cloud services as described above, users often use various services individually even in an organization such as a company to which a plurality of users belong. In such a case, it is possible to reduce the cost by collectively contracting the services used by a plurality of users in the organization. In addition, the service used by one user may be useful for another user. In view of this situation, there was a need to aggregate the usage status of various services within the same organization.

As a prior art, for example, Japanese Patent Application Laid-Open No. 2013-255196 (Patent Document 1) discloses a technique for extracting an IP (Internet Protocol) address included in a header sample in flow information and specifying a server as a communication destination. ing. According to Patent Document 1, it is possible to centrally monitor the traffic of the entire network and detect abnormal traffic.

However, although Patent Document 1 is a technique for identifying an accessed server, it does not associate user information with server information, and is insufficient from the viewpoint of utilizing the aggregated result of cloud service usage status. there were. Therefore, there has been a demand for a technique for aggregating usage status based on access history to various services.

The present invention has been made in view of the above problems in the prior art, and an object of the present invention is to provide a system, a method, and a program for aggregating the usage status of a cloud service by a user.

That is, according to the present invention, an acquisition means for acquiring communication information in which a source and a communication destination communicate with each other when using a network service,
An extraction means for extracting communication destination identification information that identifies the communication destination based on the communication information, and
A specific means for identifying the network service used based on the communication destination identification information, and
By increasing the number of times the network service is used specified by the specific means, a system including a totaling means for totaling the usage status of the network service is provided.

As described above, according to the present invention, there is provided a system, a method and a program for aggregating the usage status of cloud services by users.

The figure which shows the schematic structure of the hardware of the whole system in embodiment of this invention. The figure which shows the hardware configuration included in the server apparatus of this embodiment. The software block diagram included in the server apparatus of this embodiment. The figure which shows the example of the communication destination management table and the source management table in this embodiment. The figure which shows the example of the usage situation summary table in this embodiment. The flowchart which shows the process of totalizing the usage situation based on the flow sample in this embodiment. The flowchart which shows the process of creating a communication destination management table in this embodiment. The figure which shows the example of the HTML source code of the website which provides various services.

Hereinafter, the present invention will be described with reference to embodiments, but the present invention is not limited to the embodiments described later. In each of the figures referred to below, the same reference numerals are used for common elements, and the description thereof will be omitted as appropriate.

Further, for convenience of explanation, an embodiment of monitoring a network using sFLOW (registered trademark; the same applies hereinafter) will be described below. However, sFLOW is merely an example and does not limit the embodiment. Further, the embodiment does not have to adopt the sampling-based flow technique as exemplified by sFLOW, and may be, for example, an embodiment in which the network is monitored by a method other than sampling.

FIG. 1 is a diagram showing a schematic configuration of hardware of the entire system 100 according to the embodiment of the present invention. FIG. 1 shows a configuration in which a plurality of server devices 111 and 112 and a plurality of information processing devices 140 are connected via the Internet 120 as an example of the system 100 of the present embodiment. The information processing device 140 accesses the network via the network switch 131 and communicates with various server devices. Further, in the present embodiment, in order to monitor the access of the information processing apparatus 140 to the network by using sFLOW, the sFLOW collector 132 and the flow sample for acquiring the sampling information of the network switch 131 (hereinafter referred to as a flow sample). Is included in the intermediary device 133 that transmits the information to the server device 111. Although the Internet 120 is illustrated as an example of the network of the present embodiment in FIG. 1, it may be, for example, a LAN (Local Area Network).

The server devices 111 and 112 are devices that provide various services (so-called cloud services) including applications on the network. The number of server devices 111 and 112 in this embodiment is not particularly limited to that shown in FIG. Further, one server device does not necessarily have to provide one service, and one server device may provide a plurality of services. In the following, the server device 111 that provides the application that collects the network usage status in the present embodiment and the server device 112 that provides the other application are conveniently distinguished from each other.

The information processing device 140 is, for example, a device such as a personal computer. The information processing device 140 can access the network, for example, by being operated by a user, and can use various cloud services provided by various server devices.

In the present embodiment using the sFLOW protocol, the sFLOW collector 132 acquires a flow sample sampled from packets input / output to / from the network switch 131. Further, the sFLOW collector 132 transfers the flow sample to the intermediary device 133. The intermediary device 133 transmits the flow wample acquired from the sFLOW collector 132 to the server device 111 that collects the network usage status. The flow sample may be transmitted to the server device 111 at regular intervals or at arbitrary timings. Further, the intermediary device 133 may be configured to transmit only during a period in which the network usage status is aggregated.

Next, the hardware configuration of the server device 111 will be described. FIG. 2 is a diagram showing a hardware configuration included in the server device 111 of the present embodiment. The server device 111 includes a CPU 201, a RAM 202, a ROM 203, a storage device 204, and a communication I / F 205, and each hardware is connected via a bus.

The CPU 201 is a device that executes a program that controls the operation of the server device 111 and performs a predetermined process. The RAM 202 is a volatile storage device for providing an execution space for a program executed by the CPU 201, and is used for storing and expanding programs and data. The ROM 203 is a non-volatile storage device for storing programs, firmware, and the like executed by the CPU 201.

The storage device 204 is a readable and writable non-volatile storage device that stores the OS that functions the server device 111, various applications, setting information, various databases, and the like. The communication I / F 205 connects the server device 111 and the network, and enables communication with other devices via the network. Communication via the network may be either wired communication or wireless communication, and various data can be transmitted and received using a predetermined communication protocol.

Although the hardware configuration has been described by exemplifying the server device 111 in FIG. 2, the same hardware configuration can be used for other devices constituting the system 100 of the present embodiment. In addition to the hardware shown in FIG. 2, each device may include, for example, a monitor for displaying various information.

The hardware configuration included in each device of the present embodiment has been described above by exemplifying the server device 111. Next, the functional means executed by each hardware in the present embodiment will be described with reference to FIG. FIG. 3 is a software block diagram included in the server device 111 of the present embodiment.

The server device 111 includes each module of a communication information acquisition unit 310, a management table reference unit 320, a usage status aggregation unit 330, a communication destination management table creation unit 340, and a table storage unit 350. Further, the table storage unit 350 stores the communication destination management table 351, the transmission source management table 352, and the usage status aggregation table 353. The details of each functional means will be described below.

The communication information acquisition unit 310 is a means for acquiring a flow sample from the intermediary device 133. The flow sample refers to the IP address of the information processing device 140 that accessed the network (hereinafter referred to as "source IP address") and the IP address accessed by the information processing device 140 (hereinafter referred to as "communication destination IP address"). Information such as) is included. The communication information acquisition unit 310 analyzes the acquired flow sample and extracts the source IP address and the communication destination IP address included in the flow sample. In the present embodiment, the usage status of the cloud service is totaled based on the source IP address and the communication destination IP address. In order to acquire the flow sample, the communication information acquisition unit 310 may periodically make a transmission request to the intermediary device 133, or may make a transmission request by the operation of the user. Further, the intermediary device 133 may be configured to periodically transmit a flow sample.

The management table reference unit 320 is a means for searching and referencing various management tables based on various IP addresses. The management table reference unit 320 searches the communication destination management table 351 and the source management table 352 based on the extracted IP address, and specifies the user information of the information processing apparatus 140, the service information of the access destination, and the like.

The usage status totaling unit 330 is a means for totaling the usage status by creating and updating the usage status totaling table 353 that totals the network usage status. The usage status aggregation unit 330 aggregates the usage status of the cloud service based on the user information and service information specified by the management table reference unit 320. In addition, the usage status totaling unit 330 can notify the user of the totaled usage status, whereby the cloud service can be efficiently utilized.

The communication destination management table creation unit 340 is a means for creating the communication destination management table 351 based on the analyzed flow sample. The communication destination management table 351 does not have to be created by the communication destination management table creation unit 340, and may be created, for example, by the administrator inputting each item.

The table storage unit 350 is a means for storing various tables by controlling the storage device 204. In the table storage unit 350 of the present embodiment, the communication destination management table 351, the transmission source management table 352, and the usage status totaling table 353 are stored. Details of each table will be described with reference to FIGS. 4 and 5. FIG. 4 is a diagram showing an example of the communication destination management table 351 and the transmission source management table 352 in the present embodiment. Further, FIG. 5 is a diagram showing an example of the usage status aggregation table 353 in the present embodiment.

As shown in FIG. 4A, the communication destination management table 351 is a database in which the communication destination IP address field 402, the domain name field 404, and the service name field 406 are stored. The communication destination IP address is an address for identifying a server that provides a service on the network. The domain name is a unique name of the server corresponding to the communication destination IP address. The service name is the name of various cloud services. In FIG. 4A, as an example of the cloud service, “storage service A”, “accounting service B”, etc. are stored in the service name field 406, and the IP address and domain name corresponding to each service are associated with each other. Is stored.

As shown in FIG. 4B, the source management table 352 is a database in which the source IP address field 408, the user name field 410, the affiliation department field 412, and the job type field 414 are stored. The source IP address is an address assigned to the information processing device 140 connected to the network. The user name is the name of the user who uses each information processing device 140. Affiliation and occupation indicate various categories to which a user belongs in various organizations such as companies and organizations. In FIG. 4B, "A product division" and "B product division" are given as examples of departments to which they belong, and "development", "sales", and "accounting" are given as examples of occupations.

As shown in FIG. 5, the usage status aggregation table 353 is a database in which the service name field 502 and the total usage count field 504 are stored. The service name of the cloud service is stored in the service name field 502, and the total number of times each cloud service is used is stored in the total usage count field 504. Further, the usage status aggregation table 353 may store a usage count breakdown field 506 for each department to which the user belongs, a usage count breakdown field 508 for each job type, and the like. By referring to the usage status aggregation table 353, the administrator and the user can easily grasp the usage status of the network and can efficiently utilize various services.

In addition, by associating attributes related to users such as departments and job types and totaling usage status, services that are frequently used by users in specific departments and job types can be collectively contracted. It can lead to cost reduction. In addition, it is possible to improve work efficiency by encouraging users of a specific department or occupation to use a cloud service that is frequently used.

The configurations of the various tables shown in FIGS. 4 and 5 are examples, and the embodiments are not limited. Therefore, the database may have a configuration that includes fields other than those shown in FIGS. 4 and 5.

The software block described with reference to FIG. 3 corresponds to a functional means realized by the CPU 201 executing the program of the present embodiment to make each hardware function. In addition, all of the functional means shown in each embodiment may be realized by software, or some or all of them may be implemented as hardware that provides equivalent functions.

Further, all of the above-mentioned functional means do not necessarily have to be included in one server device 111 with the configuration shown in FIG. For example, in another preferred embodiment, each functional means may be realized by the collaboration of a plurality of devices.

Up to this point, each functional means of the present embodiment has been described. Next, detailed processing executed by each of the above-mentioned functional means will be described. FIG. 6 is a flowchart showing a process of totaling the usage status based on the flow sample in the present embodiment. In the example of the embodiment described below, a terminal having a source IP address of "11.22.33.44" is used and a communication destination IP address is "100.22.33.44". It is assumed that a cloud service is used (hereinafter referred to as this embodiment). Moreover, it will be described with reference to FIG. 4 and FIG. 5 as appropriate.

The server device 111 starts the process from step S1000, and in step S1001, the process branches depending on whether or not it is within the usage status aggregation period. If it is not within the aggregation period (NO), the process proceeds to step S1009 and the process ends. If it is within the aggregation period (YES), the process proceeds to step S1008. By branching the processing in this way, the usage status for a predetermined period can be aggregated, and the statistical usage status can be aggregated.

In step S1002, the process is branched depending on whether or not the communication information acquisition unit 310 has acquired the flow sample. If the flow sample has not been acquired (NO), the process returns to step S1001 and the process is repeated to wait for the input of the flow sample. If a flow sample is obtained (YES), the process proceeds to step S1003.

In step S1003, the communication information acquisition unit 310 acquires a flow sample from the intermediary device 133, and extracts the communication destination IP address and the source IP address from the flow sample. The flow sample of this embodiment includes "11.22.33.44" as the source IP address and "100.22.33.44" as the communication destination IP address.

In the following step S1004, the management table reference unit 320 searches the communication destination management table 351 based on the extracted communication destination IP address (“100.22.33.44”). Then, in step S1005, the management table reference unit 320 refers to the domain name field 404 and the service name field 406 corresponding to "100.22.33.44" included in the communication destination management table 351. In this embodiment, the domain name "storageaa.com" and the service name "storage service A" can be acquired.

If the extracted communication destination IP address is not included in the communication destination IP address field 402 of the communication destination management table 351, a new communication destination IP address, a domain name corresponding to the communication destination IP address, and a service name are used. May be defined.

In addition, the management table reference unit 320 searches the source management table 352 based on the extracted source IP address (“11.22.33.44”) in step S1006. Then, in step S1007, the management table reference unit 320 refers to the user name field 410, the affiliation department field 412, and the job type field 414 corresponding to "11.22.33.44". In this embodiment, it is possible to acquire the user name "Taro Yamada", the department information "A product division", and the job type information "development".

In step S1008, the usage status totaling unit 330 counts up the number of times the service is used in the usage status totaling table 353 based on various information acquired in steps S1005 and S1007. In this embodiment, since the "storage service A" is used, the numerical value of the total usage count field 504 corresponding to the storage service A in the usage status aggregation table 353 of FIG. 5 is incremented by one.

Further, in order to efficiently utilize the aggregated result of the usage status, the count of the usage status aggregation table 353 may be increased based on the information related to the user. In this embodiment, since the user of the "A product division" used the service, even if the number of times the storage service A is used is counted up for the "A product division" in the usage count breakdown field 506 by department to which the service belongs. good. Further, since the job type of the user is "development", the number of times of use of the storage service A may be counted up for "development" in the job type usage count breakdown field 508 in the same manner.

In step S1008, after the usage status totaling unit 330 counts up the usage status totaling table 353, the process returns to step S1001. After that, by repeating each of the above-mentioned processes, the usage status of the cloud service can be aggregated until the aggregation period ends.

The application that collects the network usage status of the present embodiment can notify the administrator and the user of the aggregated usage status data. For example, by notifying the administrator, the administrator can understand how the cloud service is used, and can reduce costs by making a collective contract for the service. In addition, by notifying the user of the usage status data, the user can grasp what kind of service other users with the same attribute (affiliation department or occupation) are using, so that the service is also useful for himself / herself. You can know.

By executing the process shown in FIG. 6, it is possible to aggregate the usage status that contributes to efficient utilization. By the way, in step S1004 of FIG. 6, when the communication destination IP address is not included in the communication destination management table 351, the domain name, service name, etc. corresponding to the IP address are defined in order to aggregate the usage status. There is a need to. The definition of the item of the communication destination management table 351 can be executed by the communication destination management table creation unit 340.

Hereinafter, the process of creating the communication destination management table 351 will be described with reference to FIGS. 7 and 8. FIG. 7 is a flowchart showing a process of creating the communication destination management table 351 in the present embodiment. FIG. 8 is a diagram showing an example of html source code of a website that provides various services.

The communication destination management table creation unit 340 starts the process from step S2000, and branches the process depending on whether or not the target communication destination IP address is included in the communication destination management table 351 in step S2001. If the communication destination IP address is included (YES), it is not necessary to update the communication destination management table 351. Therefore, the process proceeds to step S2008 to end the process. If the communication destination IP address is not included (NO), the process proceeds to step S2002.

In step S2002, the domain name is acquired based on the communication destination IP address to be processed. The domain name can be obtained by inquiring the DNS (Domain Name System) server using, for example, the nslookup command. In the example of FIG. 8, "storageaa.com" corresponding to each IP address is inquired by the nslookup command with the communication destination IP addresses "100.22.33.44" and "1100.22.33.55" as arguments. You can get domain names such as "" and "accountbb.com".

After that, in step S2003, the server of the acquired domain name is accessed. In step S2003, HTTP (Hypertext Transfer Protocol) can be used as an example of the communication protocol. In step S2003, the domain is accessed, and in subsequent step S2004, the HTML source file is acquired from the accessed server. The HTML source file is, for example, the code shown in FIGS. 8A and 8B.

In step S2005, the acquired HTML source file is referred to, and the process is branched depending on whether or not the title line is included. Whether or not the title line is included can be determined by, for example, whether or not the source file contains the "title" tag. If the title line is included as in the source file of FIG. 8A (YES), the process proceeds to step S2006.

In step S2006, the title line included in the source file is set as the service name, and the communication destination management table 351 is created. In the example of FIG. 8A, since the title line is “storage service A”, “storage service A”, the communication destination IP address “100.22.33.44”, and the domain name “storageaa.com” Create a table that associates with. After step S2006, the process proceeds to step S2008, and the communication destination management table creation unit 340 ends the process of creating the communication destination management table 351.

Further, in the process of step S2005, if the title line is not included as in the source file of FIG. 8B, the process proceeds to step S2007 (NO). Since the source file does not include the title line, in step S2007, the domain name is set as the service name and the communication destination management table 351 is created. In the example of FIG. 8B, the communication destination IP address "1102.23.33.44" is associated with the domain name "accountbb.com", and the service name is also "accountbb.com". To create. After step S2007, the process proceeds to step S2008, and the communication destination management table creation unit 340 ends the process of creating the communication destination management table 351.

The communication destination management table 351 can be created by the above-mentioned process. The creation of the communication destination management table 351 by the above-mentioned method is an example, and may be performed by a method other than the above-mentioned method. For example, the communication destination management table 351 may be created by an administrator or the like inputting each item.

According to the embodiment of the present invention described above, it is possible to provide a system, a method and a program for aggregating the usage status of the cloud service by the user.

Each function of the embodiment of the present invention described above can be realized by a device executable program described in C, C ++, C #, Java (registered trademark), etc., and the program of the present embodiment is a hard disk device, a CD- It can be stored and distributed in a device-readable recording medium such as a ROM, MO, DVD, flexible disk, EEPROM, or EPROM, and can be transmitted via a network in a format that other devices can.

Although the present invention has been described above with embodiments, the present invention is not limited to the above-described embodiments, and as long as the present invention exerts its actions and effects within the range of embodiments that can be inferred by those skilled in the art. , Is included in the scope of the present invention.

100 ... System, 111, 112 ... Server device, 120 ... Internet, 131 ... Network switch, 132 ... sFLOW collector, 133 ... Mediation device, 140 ... Information processing device, 201 ... CPU, 202 ... RAM, 203 ... ROM, 204 ... Storage device, 205 ... Communication I / F, 310 ... Communication information acquisition unit, 320 ... Management table reference unit, 330 ... Usage status totaling unit, 340 ... Communication destination management table creation unit, 350 ... Table storage unit, 351 ... Communication destination Management table, 352 ... Source management table, 353 ... Usage summary table

Japanese Unexamined Patent Publication No. 2013-255196

Claims (6)

An acquisition means for acquiring communication information that the source and the communication destination communicate with each other when using a network service.
An extraction means for extracting communication destination identification information for identifying the communication destination and source identification information for identifying the source based on the communication information.
Based on the communication destination identification information, the network service that has been used is specified , and based on the source identification information, the attribute of the source that uses the network service is specified , and a specific means.
By increasing the number of times the network service is used specified by the specific means, the totaling means for totaling the usage status of the network service is included.
The aggregation means is characterized in that the number of times of use is increased for each of the attributes, and the aggregation result of totaling the usage status for each attribute is notified to the sender of the same attribute as the attribute.
system. The system according to claim 1, wherein the specifying means identifies at least one of the domain name and the name of the network service. The system according to claim 1 or 2 , further comprising a creation means for creating a table in which a title row acquired based on the communication information is set as a service name. The system according to any one of claims 1 to 3 , wherein the aggregation means aggregates the number of times the network service has been used within a predetermined aggregation period. It is a method of totaling the usage status of network services.
A step of acquiring communication information in which the source and the communication destination communicate with each other when using the network service, and
Based on the communication information, a step of extracting communication destination identification information for identifying the communication destination and source identification information for identifying the source, and a step of extracting the source identification information.
A step of identifying the network service that has been used based on the communication destination identification information, and identifying the attribute of the source that uses the network service based on the source identification information .
Including a step of totaling the usage status of the network service by increasing the number of times the network service is used specified in the specifying step.
The aggregation step includes a step of increasing the number of times of use for each of the attributes and notifying a sender of the same attribute as the attribute of the aggregation result of totaling the usage status for each of the attributes.
Method. A program executed by a device that aggregates the usage status of network services.
An acquisition means for acquiring communication information in which a source and a communication destination communicate when using a network service.
An extraction means for extracting communication destination identification information that identifies the communication destination and source identification information that identifies the source based on the communication information.
A specific means that identifies the network service that has been used based on the communication destination identification information, and identifies the attribute of the source that uses the network service based on the source identification information .
By increasing the number of times the network service is used specified by the specific means, the network service can be made to function as a totaling means for totaling the usage status of the network service .
The aggregation means is characterized in that the number of times of use is increased for each of the attributes, and the aggregation result of totaling the usage status for each attribute is notified to the sender of the same attribute as the attribute.
program.

Images