JP7180879B2 - Network scanning device, computer-readable recording medium recording programs and programs to be executed by a computer - Google Patents

Description

The present invention relates to a network scanning device, a program to be executed by a computer, and a computer-readable recording medium recording the program.

With the commercialization of the fifth generation mobile communication (5G) system, many things such as mobile terminals, computers, sensors and web cameras will be connected to the Internet. Such mobile terminals and computers connected to the Internet are called IoT (Internet of Things) devices.

In the IoT age, the number of IoT devices connected to communication networks is expected to increase rapidly. Among IoT devices, it is expected that IoT devices that perform wireless communication will be illegally used without sufficient security, and will be used for cyberattacks such as DDoS (Distributed Denial of Service attack). .

In order to avoid such a situation, it is necessary to perform a network scan on IoT devices connected to a communication network and investigate whether security measures are taken for each IoT device.

Conventionally, the network scan described in Non-Patent Document 1 is known. The network scan described in Non-Patent Document 1 scans applications in the IPv4 space, and is performed by the following method.

First, a port scan is performed on the IPv4 space to investigate whether or not there is a response. Then, handshake is performed with various protocols (HTTP (Hypertext Transfer Protocol), HTTPS (Hypertext Transfer Protocol Secure), POP3 (Post Office Protocol version 3), etc.) to the host that receives the response, and the message is acquired. do. After that, extract useful keywords for vulnerability assessment from the obtained messages. Metadata and tag information are added to the keywords. Keywords with metadata and tag information are registered in the database as structure data.

Z. Durumeric, et al., “A Search Engine Backed by Internet-Wide Scanning”, CCS15, October 12-16, 2015. Katsunari Yoshioka, Kosuke Murakami, and Tsutomu Matsumoto, “A network scanning method for detecting malware-infected hosts and automatic generation of detection signatures,” Information Processing Society of Japan Transactions, Vol. 51, No. 9, 1633-1644 (Sep. 2010). J. MACQUEEN, "SOME METHODS FOR CLASSIFICATION AND ANALYSIS OF MULTIVARIATE OBSERVATIONS," Proc. of 5th Berkeley Symposium on Mathematical Statistics and Probability, pp. 281-297, 1967. G. Shakhnarovich, T. Darrell, and P. Indyk, "Nearest-Neighbor Methods in Learning and Vision: Theory and Practice", The MIT Press, 2005. ISBN 0-262-19547-X.

However, the network scan described in Non-Patent Document 1 targets one port of each IoT device, not all ports. As a result, in the network scan described in Non-Patent Document 1, there is no concept of reducing the communication resources used in the network scan when all the ports of each IoT device are network scanned. Therefore, in the network scan described in Non-Patent Document 1, it is difficult to reduce communication resources and perform the network scan.

Therefore, according to the embodiments of the present invention, a network scanning device capable of executing network scanning with a reduced amount of communication resources is provided.

Moreover, according to the embodiment of the present invention, there is provided a program for causing a computer to execute a network scan with a reduced amount of communication resources.

Furthermore, according to an embodiment of the present invention, there is provided a computer-readable recording medium recording a program for causing a computer to execute network scanning with a reduced amount of communication resources.

(Configuration 1)
According to an embodiment of the present invention, a network scanning device comprises estimating means and coping means. The estimating means performs an estimating process for estimating the cause of the network scan failure based on the scan response and scan responsiveness that are the results of the network scan, for the plurality of terminal devices. The coping means executes a coping process for the network scan failure according to the estimation result by the estimating means.

(Configuration 2)
In configuration 1, the estimating means estimates that the cause of network scan failure is any one of the first cause, second cause, third cause and fourth cause based on the scan response and scan responsiveness. do. The first cause is that the port of the terminal device that is the target of the network scan is blocked, and the second cause is insufficient communication quality in communication with the terminal device that is the target of the network scan. The third cause is that the terminal device that is the target of the network scan is not connected to the network, and the fourth cause is that the terminal device that is the target of the network scan is connected. The network is congested.

(Composition 3)
In configuration 2, the estimation means is
In one terminal device, when there are ports with scan responses and ports without scan responses, presuming that the cause of network scan failure is the first cause,
Cause of network scan failure when the number of terminal devices whose scan responsiveness is worse than normal in a predetermined area is less than a threshold value determined based on the total number of terminal devices present in the predetermined area presumed to be the second cause,
When there is no scan response for all ports of one terminal device, presuming that the cause of network scan failure is the third cause,
When the number of terminal devices whose scan responsiveness is worse than normal within a predetermined area is equal to or greater than a threshold value, the cause of network scan failure is estimated to be the fourth cause.

(Composition 4)
In Configuration 2 or Configuration 3, the coping means re-executes the network scan when the cause of network scan failure is the second cause or the third cause.

(Composition 5)
Further, according to the embodiment of the present invention, the program performs estimation processing for estimating the cause of network scan failure based on the scan responses and scan responsiveness that are the results of the network scan to the plurality of terminal devices. a first step performed for
The coping means causes the computer to further execute a second step of coping with network scan failure according to the estimation result in the first step.

(Composition 6)
In configuration 5, the estimating means, in the first step, determines the cause of network scan failure based on the scan response and scan responsiveness as a first cause, a second cause, a third cause, and a fourth cause. presumed to be either
The first cause is that the port of the terminal device that is the target of the network scan is blocked.
The second cause is insufficient communication quality in communication with the terminal device that is the target of the network scan.
The third cause is that the terminal device that is the target of the network scan is not connected to the network.
A fourth cause is that the network to which the terminal device that is the target of the network scan is connected is congested.

(Composition 7)
In configuration 6, the estimation means, in a first step,
estimating that the cause of network scan failure is the first cause when there are ports with scan responses and ports without scan responses in one terminal device;
Cause of network scan failure when the number of terminal devices whose scan responsiveness is worse than normal in a predetermined area is less than a threshold value determined based on the total number of terminal devices present in the predetermined area presumed to be the second cause,
When there is no scan response for all ports of one terminal device, presuming that the cause of network scan failure is the third cause,
When the number of terminal devices whose scan responsiveness is worse than normal within a predetermined area is equal to or greater than a threshold value, the cause of network scan failure is estimated to be the fourth cause.

(Composition 8)
In Configuration 6 or Configuration 7, the coping means executes the network scan again in the second step when the cause of the failure of the network scan is the second cause or the third cause.

(Composition 9)
Further, according to the embodiment of the present invention, the recording medium is a computer-readable recording medium recording the program according to any one of Structures 5 to 8.

It is possible to reduce the amount of communication resources when executing a network scan.

1 is a schematic diagram of a communication system in an embodiment of the invention; FIG. FIG. 2 is a schematic diagram of the network scanning device shown in FIG. 1 according to the first embodiment; 3 is a conceptual diagram of a host information database shown in FIG. 2; FIG. It is a figure which shows the example of clustering. FIG. 10 is a diagram showing another specific example of clustering; FIG. 3 is a conceptual diagram of the clustering database shown in FIG. 2; 4 is a conceptual diagram of a scan schedule; FIG. FIG. 4 is a diagram showing time dependence of traffic; FIG. 4 is a diagram showing time dependence of traffic in a plurality of terminal devices; 4 is a conceptual diagram of network scanning according to Embodiment 1. FIG. It is a figure which shows the state where communication is congested. 3 is a flowchart for explaining the operation of the network scanning device shown in FIG. 2; FIG. 4 is a schematic diagram of a network scanning device according to Embodiment 2; 14 is a schematic diagram of the host information database shown in FIG. 13; FIG. FIG. 10 is a diagram showing a comparison of scan response delays between a wireless terminal and a wired terminal; 14 is a flowchart for explaining the operation of the network scanning device shown in FIG. 13; FIG. 17 is a flowchart for explaining the detailed operation of step S10 of FIG. 16; FIG. FIG. 18 is a flowchart for explaining the detailed operation of step S105 of FIG. 17; FIG. FIG. 3 is a schematic diagram of a network scanning device according to Embodiment 3; FIG. 20 is a conceptual diagram of a host information database shown in FIG. 19; FIG. 4 illustrates a method for determining the cause of network scan failure; FIG. 20 is a flowchart for explaining the operation of the network scanning device shown in FIG. 19; FIG. FIG. 23 is a flow chart for explaining the detailed operation of step S21 of FIG. 22; FIG. FIG. 4 is a schematic diagram of a network scanning device according to Embodiment 4; 25 is a flowchart for explaining the operation of the network scanning device shown in FIG. 24; 25 is another flowchart for explaining the operation of the network scanning device shown in FIG. 24; FIG. 5 is a schematic diagram of a network scanning device according to Embodiment 5; FIG. 28 is a flow chart for explaining the operation of the network scanning device shown in FIG. 27; FIG. FIG. 28 is another flowchart for explaining the operation of the network scanning device shown in FIG. 27; FIG. FIG. 11 is a schematic diagram of a network scanning device according to Embodiment 6; 31 is a schematic diagram of the host information database shown in FIG. 30; FIG. 31 is a flowchart for explaining the operation of the network scanning device shown in FIG. 30; FIG. 11 is a schematic diagram of a network scanning device according to Embodiment 7; 34 is a flowchart for explaining the operation of the network scanning device shown in FIG. 33; 34 is another flowchart for explaining the operation of the network scanning device shown in FIG. 33;

An embodiment of the present invention will be described in detail with reference to the drawings. The same or corresponding parts in the drawings are denoted by the same reference numerals, and the description thereof will not be repeated.

FIG. 1 is a schematic diagram of a communication system according to an embodiment of the invention. Referring to FIG. 1, communication system 10 according to the embodiment of the present invention includes network scanning device 1, base stations BS1 and BS2, Internet provider ISP, and terminal devices TM1-TM18.

A network scanning device 1, base stations BS1, BS2, an Internet provider ISP (Internet Service Provider) and terminal devices TM1-TM13 are arranged in a communication space.

The base station BS1 is the base station of the wireless communication network CNW1, the base station BS2 is the base station of the wireless communication network CNW2, and the Internet provider ISP is the carrier of the wired communication network CNW3.

The wireless communication networks CNW1 and CNW2 are communication networks that perform wireless communication according to mutually different wireless communication standards.

In the embodiment of the present invention, each of the terminal devices TM1-TM18 may be a wireless terminal, and some of the terminal devices TM1-TM18 may be wireless terminals and the rest may be wired terminals. .

The terminal devices TM1 to TM6 are arranged outside the radio communication network CNW2 and inside the radio communication network CNW1.

The terminal device TM7 is arranged in the overlapping area of the radio communication network CNW1 and the radio communication network CNW2.

The terminal devices TM8 to TM13 are arranged outside the radio communication network CNW1 and inside the radio communication network CNW2.

The terminal devices TM14 to TM18 are arranged in the wired communication network CNW3 and connected to the Internet provider ISP via wires.

Each of the terminal devices TM1 to TM13 has two wireless communication modules capable of wireless communication with the base stations BS1 and BS2. Therefore, each of the terminal devices TM1-TM13 can wirelessly communicate with the base station BS1 or the base station BS2.

The terminal devices TM1-TM6 wirelessly communicate with the base station BS1, the terminal device TM7 wirelessly communicates with the base station BS1 or the base station BS2, and the terminal devices TM8-TM13 wirelessly communicate with the base station BS3.

The terminal devices TM14 to TM18 perform wire communication via the Internet provider ISP.

The network scanning device 1 performs network scanning on the terminal devices TM1 to TM18 by a method to be described later.

[Embodiment 1]
FIG. 2 is a schematic diagram of the first embodiment of the network scanning device 1 shown in FIG. Referring to FIG. 2 , network scanning device 1 includes network scanner 11 , scan analysis manager 12 , host information database 13 , clustering manager 14 , clustering database 15 and scan scheduler 16 .

The network scanner 11 receives scan timings from the scan scheduler 16, and based on the received scan timings, for example, uses a known Nmap (Non-Patent Document 2) to identify terminal devices connected to the network 20 to be scanned. Do a network scan on the port.

The network scanner 11 receives a scan response for network scanning from a terminal device connected to the network 20 and outputs the received scan response to the user (made up of network security or the like) 30 and the scan analysis manager 12 .

The scan analysis manager 12 receives scan responses from the network scanner 11 and communication logs during network scanning. Then, the scan analysis manager 12 generates a scan result in which the address of the terminal device to be scanned and the scan response are associated with each other based on the scan response, and stores the generated scan response in the host information database 13. create or update the host information database 13;

The host information database 13 stores scan results. The clustering manager 14 holds in advance the global IP addresses and domain names of all terminal devices existing in the network scan area (for example, Japan). The clustering manager 14 reads the scan results from the host information database 13, and classifies a plurality of terminal devices to be network scanned into clusters based on the read scan results. The clustering manager 14 then stores the classification results (correspondence between clusters and terminal devices) in the clustering database 15 to create or update the clustering database 15 .

The scan scheduler 16 reads scan results from the host information database 13 and reads classification results (correspondence between clusters and terminal devices) from the clustering database 15 . Scan scheduler 16 also receives scan requirements from user 30 . The scan scheduler 16 holds in advance the global IP addresses and domain names of all terminal devices existing in an area (for example, Japan) where network scanning is performed.

Then, based on the scan requirements, scan results, and classification results (correspondence between clusters and terminal devices), the scan scheduler 16 determines scan timings for network scans and terminals to be subjected to network scans at each scan timing by a method described later. Generate a scan schedule associated with the device. Then, the scan scheduler 16 outputs the scan schedule to the network scanner 11 and controls the network scanner 11 to execute the network scan according to the scan schedule.

FIG. 3 is a conceptual diagram of the host information database 13 shown in FIG. Referring to FIG. 3, host information database 13 includes time t, IP address Add _i (i=1 to I, I is the total number of terminal devices), domain name DN _i , scan response SR _i , and the scan response delay SRD _i . Time t, IP address Add _i , domain name DN _i , scan response SR _i and scan response delay SRD _i are associated with each other.

Time t is represented by YYYY/MM/DD/hh/mm/ss (year/month/day/hour/minute/second). Time t represents the time at which the test input in the network scan was sent to the terminal device that is the target of the network scan.

The IP address Add _i consists of the global IP address of the terminal device that is the target of the network scan.

The domain name DN _i is converted using a PTR (PoinTeR record) record based on the IP address Add _i .

The scan response _SRi consists of "1" when the scan response is returned, and consists of "0" when the scan response is not returned.

The scan response delay SRD _i consists of the time from when the test input is sent until when the scan response SR _i is returned.

FIG. 4 is a diagram showing a specific example of clustering. FIG. 5 is a diagram showing another specific example of clustering.

FIG. 4 shows an example of clustering by IP address. In a company network, it is unknown how many areas IP addresses are deployed in, but in a university network, for example, close IP addresses are used within a radius of several hundred meters. Therefore, the terminals in the university network are grouped into one cluster.

Also, in cellular networks and ISP networks, IP addresses close to each other within a radius of several tens of meters are used, so terminal devices having these IP addresses are classified into one cluster.

FIG. 5 shows an example of clustering based on domain name and radio environment conditions. For example, domains in which a network is deployed in a narrow area such as a university are clustered in domain units.

Also, like companies A and B, terminal devices connected to base stations/access points (APs) that are spatially separated but have similar radio environment conditions are classified into one cluster. do. A terminal device in company A performs wireless communication with a base station or AP installed in company A, and a terminal device in company B communicates with a base station or AP installed in company B. , the terminal device in company A and the terminal device in company B are in similar wireless environment conditions. By referring to the domain name, the clustering manager 14 can determine whether or not the terminal device is installed in the company, so that terminal devices with similar wireless environment conditions can be clustered.

FIG. 6 is a conceptual diagram of the clustering database 15 shown in FIG. Referring to FIG. 6, clustering database 15 includes clusters A, B, and C, for example. Clusters A and B are clusters clustered by IP address, and cluster C is a cluster clustered by domain name.

Cluster A consists of p terminal devices having IP addresses Add ₁ to Add _p (p is an integer equal to or greater than 2) that are close to each other. Cluster B consists of (s+1) terminal devices having IP addresses Add _q to Add _q+s (q is an integer different from p, s is an integer equal to or greater than 1) that are close to each other. Cluster C has domain names x ₁ x ₁ x ₁ . com through x _j x _j x _j . com (j is an integer equal to or greater than 2).

In FIG. 6, the clustering database 15 includes clusters A and B clustered by IP address and cluster C clustered by domain name. Without limitation, the clustering database 15 may be composed of clusters clustered only by IP addresses, may be composed of clusters clustered only by domain names, or may be composed of clusters clustered only by similar radio environment conditions. clusters, and typically clusters clustered by at least one of IP addresses, domain names, and similar radio environment conditions.

The clustering manager 14 refers to the host information database 13 shown in FIG. 3 and sorts the I terminal devices stored in the host information database 13 by at least one of IP addresses, domain names and similar wireless environment conditions. are classified into clusters, and the clustering database 15 shown in FIG. 6 is created or updated.

FIG. 7 is a conceptual diagram of a scan schedule. Referring to (a) of FIG. 7, scan schedule SCSHD has a total scan time length T _S _total, and T _S (T _S is an integer equal to or greater than 1) scan timing 1 _S to scan timing T _S including.

The total scan time length T _S _total is set to, for example, one day, and each of scan timing 1 _S to scan timing T _S has a time length of, for example, one hour. The scan timing t _S (t _S =1 _S to T _S ) includes a start time t _start , an end time t _end , and target addresses Add ₁ to Add _n (n is an integer greater than or equal to 1 and less than or equal to I).

The start time t _start represents the time to start the network scan at the scan timing _tS , and the end time t _end represents the time to end the network scan at the scan timing _tS . Therefore, the network scanner 11 ends the network scan when the end time t- _end arrives at the scan timing t- _S .

Each of the target addresses Add ₁ to Add _n consists of a global IP address. Target addresses Add ₁ to Add _n represent n terminal devices that are targets of network scanning.

Each of scan timings 1 _S to t _S −1 and _{t S +1} to T _S other than scan timing t S has the same configuration as scan timing t _S shown in FIG.

The scan timings 1 _S to T _S may have the same time length (=t _end −t _start ) or may have different time lengths (=t _end −t _start ). . Also, the scan timings 1 _S to T _S may have the same number of IP addresses, or may have different numbers of IP addresses.

When the network scan is executed first, the scan timings 1 _S to T _S shown in FIG. 7(a) are used.

Also, when network scanning is performed at timings when communication is idle, scan timings 1 _S ' to T _S ' (T _S ' is an integer equal to or greater than 1) shown in FIG. 7B are used. In (b) of FIG. 7, the scan timings 1 _S ′ to T _S ′ are set apart in time. This is because a plurality of time periods during which communication is not available do not touch each other.

The configuration of scan timing t _S ' (t _S '=1 _S ' to T _S ') is the same as the configuration of scan timing t _S described above.

Also, the scan timings t _S and t _S ′ do not mean one time, but are concepts having a predetermined length of time from the start time t _start to the end time t _end .

A method for determining the scan timing t _S ′ will be described. FIG. 8 is a diagram showing the time dependence of traffic. In FIG. 8, the vertical axis represents traffic and the horizontal axis represents time. Also, curve k1 indicates the time dependence of traffic in terminal A, for example, and curve k2 indicates the time dependence of traffic in terminal B different from terminal A, for example.

Referring to (a) of FIG. 8, in terminal device A, traffic increases during the night rather than during the day (see curve k1). That is, in the terminal device A, communication is idle during the day and congested during the night. Referring to (b) of FIG. 8, in terminal device B, traffic increases during the daytime rather than at nighttime (see curve k2). That is, in the terminal device B, communication is congested during the daytime and idle during the nighttime.

As a result, in the terminal device A, the amount of resources used for communication can be reduced by performing the network scan during the daytime rather than at nighttime, and in the terminal device B, the network scan is performed at nighttime rather than during the daytime. can reduce the amount of resources used for communication.

Therefore, the _scan scheduler 16 refers to the host information database ₁₃ shown in FIG. Based on the time dependence of traffic, the congestion degree Ct _,i of communication around the terminal device i at time t is calculated.

The degree of congestion C _t,i is the ratio of the resource amount required for communication of at least one terminal device i to the total resource amount of the network to which the terminal device i is connected. For example, when the time dependence of traffic around terminal device i is represented by curve k1 shown in FIG. less traffic when communicating with Therefore, the degree of congestion C _t,i is smaller during the day and larger during the night.

Therefore, the scan scheduler 16 calculates the congestion degree Ct, _i by calculating the ratio of the traffic of at least one terminal device i at each time t to the total allowable traffic of the network to which the terminal device i is connected. . In other words, the degree of congestion C _t,i is the ratio of traffic that can be used by at least one terminal device i to the total traffic that can be used.

Then, the scan scheduler 16 substitutes the calculated congestion degree C _t,i into the following equation (1) _, and sets the constraint conditions (equation (2) to Determine the scan indices s _t,i under equation (4)).

In equation (1), t=0, 1, 2, 3, . . . , 23 and i is the index of the terminal device. The scan index _st,i consists of "1" when the network scan is performed for the terminal device _i of the IP address Addi at the time t, and consists of "0" when the network scan is not performed.

Equation (2) constrains the number of network scans to be once a day. In equation (3), W _i is the amount of communication resources required for network scanning of terminal device i having IP address Add _i , and D _t is the amount of available communication resources at time t. Therefore, Equation (3) constrains the total amount of communication resources used for network scanning at time t. In Equation (4), F _i,j consists of "1" if there is interference between the terminal device i and the terminal device j, and consists of "0" if there is no interference. Therefore, Equation (4) indicates that when interference occurs between terminal device i and terminal device j, the scan timing of terminal device i and the scan timing of terminal device j are set to mutually different scan timings. Constrain.

By performing a network scan according to the method described in the embodiments of the present invention, it is possible to reduce the amount of communication resources of terminal devices or communication paths. In the case of wireless communication, this communication resource amount consists of the wireless resource amount, and in the case of wired communication, it consists of the wired resource amount. In this case, the wireless resource amount is determined by frequency band×communication time, and the wired resource amount is determined by communication time.

The scan scheduler 16 determines the value (“1” or “0”) of the scan index st _,i so as to satisfy the equation (1) under the constraint conditions (equations (2) to (4)). Then, the scan scheduler 16 creates scan timings 1 _S ' to T _S ' based on the scan index s _t,i consisting of "1". That is, the scan scheduler 16 sets the scan timing 1 so that the addition result obtained by adding the congestion degree C _t,i of each terminal device i to the terminal device to be the network scan target and the total time length of the network scan is equal to or less than the threshold value C_th. Create _S ' to T _S '.

Scan scheduler 16 preferably determines the value ("1" or "0") of scan index _{s_t,i} according to the following equation.

According to equation (5), the scan scheduler 16 determines the value (“1” or “0”) of the scan index s _t, i so that the sum of the congestion degrees C _t,i is minimized. Then, the scan scheduler 16 uses the determined value of the scan index s _t,i (“1” or “0”) to determine the degree of congestion C _{t,i when performing a network scan for one terminal device.} are added for a plurality of terminal devices and the total time length of the network scan, and the scan timings 1 _S ′ to T _S ′ are determined so as to minimize the addition result.

FIG. 9 is a diagram showing time dependency of traffic in a plurality of terminal devices. In FIG. 9, the vertical axis represents traffic and the horizontal axis represents time. A curve k3 shows, for example, the time dependence of traffic at a plurality of terminal devices.

Referring to FIG. 9, the traffic in a plurality of terminal devices is low from time _t1 to time _t2 , from time _t3 to time _t4 , and from time _t5 to time _t6 . Become.

In Equation (1), the smaller each congestion degree C _t,i is, the more easily the total C_total becomes equal to or less than the threshold C_th. Also in equation (5), the smaller the congestion degree Ct _,i , the easier it is for the total sum C_total to be minimized.

Therefore, when the values of the scan indices s _t,i are determined by the formula (1) or the formula (5), the multiple scan indices s _t,i consisting of "1" are obtained from the time t ₁ to the time t ₂ shown in FIG. , from time _t3 to time _t4 , and from time _t5 to time _t6 .

As a result, scan scheduler 16 determines start time t _start =t ₁ , end time t _end =, based on multiple scan indices s _t,i =1 with times t between times t ₁ and t ₂ . t ₂ , and scan timing 1 _S ′ including IP address Add _i . In addition, the scan scheduler 16 sets a start time t _start =t ₃ and an end time t _end = _{t based on a plurality of scan indices st,i} =1 having times t between times t ₃ and t ₄ . ₄ , and the scan timing 2 _S ′ containing the IP address Add _i . In addition, scan scheduler 16 determines start time t _start =t ₅ and end time t _end =t based on multiple scan indices st _,i =1 with times t between times t ₅ and t ₆ . ₆ , and the scan timing 3 _S ′ containing the IP address Add _i .

Then, the scan scheduler 16 outputs the created scan timings 1 _S ′ to 3 _{S ′} to the network scanner 11 .

The scan scheduler 16 may further create scan timings 1 _S ′ to 3 _S ′ using clusters. In this case, _the scan scheduler 16 refers to the clustering database 15 shown in FIG _. Timing 1 _S '), s terminal devices with IP addresses Add _q to Add _q+s included in cluster B are included in one scan timing (for example, scan timing 2 _S '), and the domain included in cluster C Name x ₁ x ₁ x ₁ . com through x _j x _j x _j . com may be included in one scan timing (for example, scan timing 3 _S ′) to create scan timings 1 _S ′ to 3 _S ′.

When creating scan timing 1 _S ' to scan timing 3 _S ' using clusters, all terminal devices included in one cluster should be included in one scan timing, so scan timing 1 _S ' to scan timing 3 The computation time can be reduced when creating _S '.

FIG. 10 is a conceptual diagram of network scanning according to the first embodiment. Referring to FIG. 10, network scanner 11 performs network scanning on terminal device A during the day and network scanning on terminal device B at night. As a result, the amount of communication resources when network scanning is performed on the terminal devices A and B can be reduced.

FIG. 11 is a diagram showing a state in which communication is congested. Referring to FIG. 11, when network scanner 11 executes a network scan on three terminal devices via one AP, the target of network scan for a certain period of time concentrates on one AP and the communication quality deteriorates. do.

However, as described above, when the terminal device i and the terminal device j interfere with each other, the network scan for the terminal device i and the network scan for the terminal device j are performed at mutually different scan timings (see equation (4)). , it is possible to avoid a situation in which the network scan is concentrated on one AP, and it is possible to obtain good scan responses from the terminal devices targeted for the network scan.

FIG. 12 is a flow chart for explaining the operation of the network scanning device 1 shown in FIG. Referring to FIG. 12, when the operation of network scanning device 1 is started, network scanner 11 scans all terminal devices at arbitrary scan timings (for example, scan timings 1 to T shown in (a) of FIG. 7). , a network scan is executed (step S1).

The network scanner 11 receives the scan response from the terminal device, measures the scan response delay, and outputs the scan response and the scan response delay to the scan analysis manager 12 .

After that, the scan analysis manager 12 creates or updates the host information database 13 by the method described above based on the scan response and scan response delay received from the network scanner 11 (step S2).

Subsequently, the clustering manager 14 classifies a plurality of terminal devices into clusters based on the host information database 13 (step S3), and creates or updates the clustering database 15. FIG.

Based on the host information database 13, the scan scheduler 16 determines the degree of congestion Ct _,i of the terminal device i at time t for all terminal devices (step S4).

Then, the scan scheduler 16 determines the value of the scan index st _,i so as to satisfy the equation (1) or (5) (step S5).

Then, the scan scheduler 16 creates scan timings based on all the scan indices _st,i consisting of "1" (step S6), and outputs the created scan timings to the network scanner 11. FIG.

The network scanner 11 executes network scanning based on the scan timing received from the scan scheduler 16 (step S7).

The scan analysis manager 12 then updates the host information database 13 based on the scan results received from the network scanner 11 using the method described above.

Then, the scan scheduler 16 refers to the host information database 13 and determines whether or not there is a scan response (step S8).

In step S8, when it is determined that there is no scan response, the scan scheduler 16 controls the network scanner 11 to execute the network scan at another scan timing, or indicates that the terminal devices are interfering with each other. A flag is set (step S9).

Then, when it is determined in step S8 that there is a scan response, or after step S9, the operation of the network scanning device 1 ends.

In step S9, by setting a flag indicating that the terminal devices are interfering with each other, in the next network scan, the interfering terminal devices are scanned at different scan timings.

In addition, in the flowchart shown in FIG. 12, in step S5, the clustering database 15 may be further referenced to perform a network scan.

In this case, the scan scheduler 16 creates scan timings by executing a process of including all terminal devices included in one cluster in one scan timing for all clusters, and sends the created scan timings to the network scanner 11. Based on the scan timing received from the scan scheduler 16, the network scanner 11 executes a process of performing a network scan for all terminal devices included in one cluster at one scan timing for all clusters. .

According to the flowchart shown in FIG. 12, the addition result obtained by adding the degree of congestion _Ct,i when a network scan is performed for one terminal device with respect to a plurality of terminal devices and the total time length of the network scan is the threshold value. The scan timings 1 _S ' to T _S ' are determined so as to be less than (or minimum), and the network scan is executed based on the determined scan timings 1 _S ' to T _S '. It is possible to reduce the amount of communication resources compared to executing a network scan at an arbitrary timing without considering .

In Embodiment 1, the operation of network scanning device 1 may be realized by software. In this case, the network scanning device 1 includes a CPU (Central Processing Unit), a ROM (Read Only Memory) and a RAM (Random Access Memory). The ROM stores a program Prog_A consisting of steps of the flow chart shown in FIG.

The CPU reads the program Prog_A from the ROM, executes the read program Prog_A, and performs network scanning during a period of idle communication. The RAM temporarily stores the value of the determined scan index st _,i .

Also, the program Prog_A may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_A is loaded into the computer, the computer reads the program Prog_A from the recording medium, executes it, and executes a network scan when communication is not available.

Therefore, the recording medium recording the program Prog_A is a computer-readable recording medium.

In the above, the scan scheduler 16 adds the congestion degree C _t,i of each terminal device i to the terminal device to be network scanned and the total time length of the network scan so that the addition result is equal to or less than the threshold C_th (or the minimum). Although it has been described that the scan timings 1 _S ' to T _S ' are created so that the It is only necessary to detect the time period during which the amount of communication occurs, and determine the detected time value as the scan timings 1 _S ' to T _S ' of the network scan.

In the above description, the total scan time length T _S _total is one day, but in the first embodiment, the total scan time length T _S _total is not limited to one day. and generally any length of time.

[Embodiment 2]
13 is a schematic diagram of a network scanning device according to Embodiment 2. FIG. 13, network scanning apparatus 1A according to the second embodiment replaces scan analysis manager 12, host information database 13 and scan scheduler 16 of network scanning apparatus 1 shown in FIG. 2 with scan analysis manager 12A and host information database, respectively. 13A and a scan scheduler 16A, and the rest is the same as the network scan device 1. FIG.

Based on the scan response delay received from the network scanner 11, the scan analysis manager 12A determines the attribute of the terminal device that is the target of the network scan by a method described later, adds the determined attribute, and adds the determined attribute to the host information database. Create or update 13A.

Scan analysis manager 12A otherwise performs the same functions as scan analysis manager 12A.

The host information database 13A is configured by adding the attributes of each terminal device to the host information database 13 shown in FIG.

The scan scheduler 16A refers to the host information database 13A and/or the clustering database 15, extracts wireless terminals, creates a scan schedule for performing a network scan on the extracted wireless terminals, and executes the created scan schedule. Output the schedule to the network scanner 11 . In this case, the scan scheduler 16A creates a scan schedule at arbitrary timing without considering the free time zone described in the first embodiment.

FIG. 14 is a schematic diagram of the host information database 13A shown in FIG. Referring to FIG. 14, host information database 13A is obtained by adding port number PN _r and attributes to host information database 13 shown in FIG.

The port number PN _r is the port number used by each terminal device for communication. In the host information database 13A, the scan response SR _i and the scan response delay SRD _i are stored corresponding to each port number PN _r . Also, an attribute (wireless terminal or wired terminal) is stored corresponding to each IP address Add _i and domain name DN _i .

FIG. 15 is a diagram showing a comparison of scan response delays between a wireless terminal and a wired terminal. In FIG. 15, the vertical axis represents scan response delay, and the horizontal axis represents sample number.

Referring to FIG. 15, scan packets for network scan were simulated by known psping, 1000 scan packets were transmitted to each of wireless terminals and wired terminals, and scan response delays SRD _i were measured. This psping transmits a packet simulating a scan packet and measures the scan response delay SRD _i . A packet that mimics this scan packet constitutes a "test input".

Then, based on the scan response delay SRD _i , a threshold is obtained by a known K-means method (Non-Patent Document 3), and it is verified whether wireless terminals and wired terminals can be classified. As a result, it was found that the threshold SRD_th1 obtained by the K-means method can classify wireless terminals and wired terminals with an accuracy of about 99%. That is, if the scan response delay SRD _i is equal to or less than the threshold SRD_th1, the network scan target is the wired terminal, and if the scan response delay SRD _i is greater than the threshold SRD_th1, the network scan target is the wireless terminal. It was found to be able to classify with an accuracy of about 99%.

Therefore, the thresholds SRD_th1 and SRD_th2 are determined by the K-means method, and the threshold SRD_th2 is further set as shown in FIG. If the scan response delay SRD _i is equal to or less than the threshold SRD_th1 (SRD _i ≦SRD_th1), the network is a wired network, and the scan response delay SRD _i is greater than the threshold SRD_th1 and equal to or less than the threshold SRD_th2 (SRD_th1<SRD_th1 ₎ . SRD_th2), the network is a wireless LAN (Local Area Network), and if the scan response delay SRD _i is greater than the threshold SRD_th2, the network is classified as a cellular network.

When the number of attributes is k (k is an integer equal to or greater than 2), the scan analysis manager 12A uses the K-means method to classify each terminal device into one of k attributes. thresholds SRD_th1 to SRD_thk are obtained.

After that, the scan analysis manager 12A compares the scan response delay SRD _i from one port of one terminal device with k−1 thresholds SRD_th1 to SRD_thk to classify one port into one of k attributes. for all ports. Then, the scan analysis manager 12A takes the attribute in which the most ports are classified as the attribute of that one terminal device. That is, the scan analysis manager 12A determines the attribute of the terminal device by majority logic.

The scan analysis manager 12A executes this process for multiple terminal devices and classifies each of the multiple terminal devices into one of k attributes.

FIG. 16 is a flow chart for explaining the operation of the network scanning device 1A shown in FIG.

The flowchart shown in FIG. 16 is obtained by replacing steps S4 to S6 of the flowchart shown in FIG. 12 with steps S10 to S12 and deleting steps S8 to S9, and otherwise is the same as the flowchart shown in FIG. be.

Referring to FIG. 16, when the operation of network scanning device 1A is started, steps S1 to S3 described above are sequentially executed.

After step S3, the scan analysis manager 12A refers to the host information database 13A, classifies a plurality of terminal devices into one of the k attributes (step S10), and updates the host information database 13A.

Then, the scan scheduler 16A refers to the updated host information database 13A, extracts wireless terminals from the plurality of terminal devices based on the attributes of the terminal devices (step S11), and scans the extracted wireless terminals through a network scan. subject to

Subsequently, the scan scheduler 16A creates scan timings for executing network scans targeting wireless terminals (step S12). In this case, the scan scheduler 16A creates a scan schedule at arbitrary timing without taking into consideration the free time zone described in the first embodiment. The scan scheduler 16 A then outputs the created scan schedule to the network scanner 11 .

After that, step S7 described above is executed, and the operation of the network scanning device 1A ends.

FIG. 17 is a flow chart for explaining the detailed operation of step S10 of FIG.

17, after step S3 of FIG. 16, the scan analysis manager 12A classifies the ports into k attributes based on the scan response delays SRD _i stored in the host information database 13A. k−1 thresholds SRD_th1 to SRD_thk for determining by machine learning (for example, K-means method) (step S101). In this case, the scan analysis manager 12A has a machine learner (for example, a machine learner that performs machine learning by the K-means method), inputs the scan response delay SRD _i to the machine learner, thresholds SRD_th1 to SRD_thk are obtained as outputs. Note that the machine learning device is not limited to a machine learning device that performs machine learning by the K _- means method. Any machine learning device may be used as long as it is a learning device.

After step S101, the scan analysis manager 12A sets i=1 (step S102), and detects all port numbers that have received the scan response SR of the terminal device i (step S103).

After that, the scan analysis manager 12A sets the port number _PNr of the terminal device i to the minimum port number PN_min (step S104).

Then, the scan analysis manager 12A compares the scan response delay SRD _i corresponding to the port number PN _r of the terminal device i with k−1 thresholds SRD_th1 to SRD_thk to determine the port having the port number PN _r as k attributes. (step S105).

The scan analysis manager 12A then determines whether the port number _PNr is the maximum port number PN_max (step S106).

When it is determined in step S106 that the port number PN _r is not the maximum port number PN_max, the scan analysis manager 12A changes the port number PN _r of the terminal device i to the next largest port number after the current port number PN _r . Set (step S107).

Thereafter, the series of operations proceeds to step S105, and steps S105 to S107 are repeatedly executed until it is determined in step S106 that the port number _PNr is the maximum port number PN_max.

Then, when it is determined in step S106 that the port number PN _r is the maximum port number PN_max, the scan analysis manager 12A classifies the terminal device i into the attribute in which the most ports are classified (step S108). .

Subsequently, the scan analysis manager 12A determines whether i=I (step S109).

When it is determined in step S109 that i is not equal to I, the scan analysis manager 12A sets i=i+1 (step S110).

Thereafter, the series of operations proceeds to step S103, and steps S103 to S110 are repeatedly executed until it is determined that i=I in step S109.

Then, when it is determined that i=I in step S109, the series of operations proceeds to step S11 in FIG.

Steps S105 to S107 are steps for classifying all ports of terminal device i into one of k attributes. Then, when it is determined in step S106 that the port number PN _r is the maximum port number PN_max, in step S108 the terminal device i is classified into the attribute with the largest number of ports classified. That is, the scan analysis manager 12A classifies terminal device i into one of k attributes according to majority logic.

Further, steps S103 to S110 are steps for classifying all of the plurality of terminal devices into one of k attributes.

FIG. 18 is a flow chart for explaining the detailed operation of step S105 of FIG. In FIG. 18, the port of the terminal device i is classified into one of the attribute of a wired terminal of a wired network, the attribute of a wireless terminal of a wireless LAN, and the attribute of a wireless terminal of a cellular network. A detailed operation of step S105 will be described.

Referring to FIG. 18, after step S104 or step S107 in FIG. 17, scan analysis manager 12A determines whether or not scan response delay SRD _i is equal to or less than threshold SRD_th1 (step S1051).

When it is determined in step S1051 that the scan response delay SRD _i is equal to or less than the threshold SRD_th1, the scan analysis manager 12A classifies the port having the port number PN _r into the wired terminal attribute of the wired network (step S1052).

On the other hand, when it is determined in step S1051 that the scan response delay SRD _i is not equal to or less than the threshold SRD_th1, the scan analysis manager 12A determines whether the scan response delay SRD _i is greater than the threshold SRD_th1 and equal to or less than the threshold SRD_th2. is determined (step S1053).

In step S1053, when it is determined that the scan response delay SRD _i is greater than the threshold SRD_th1 and equal to or less than the threshold SRD_th2, the scan analysis manager 12A sets the port having the port number PN _r as the attribute of the wireless terminal of the wireless LAN. (step S1054).

On the other hand, when it is determined in step S1053 that the scan response delay SRD _i is greater than the threshold SRD_th1 and not equal to or less than the threshold SRD_th2, the scan analysis manager 12A assigns the port having the port number PN _r to the wireless terminal of the cellular network. Classify into attributes (step S1055).

After any one of steps S1052, S1054 and S1055, the series of operations proceeds to step S106 in FIG.

According to the flowchart shown in FIG. 16 (including the flowchart shown in FIG. 17 and the flowchart shown in FIG. 18), the scan scheduler 16A extracts only the wireless terminals from among the plurality of terminal devices as network scan targets, Since the network scan is executed for the wireless terminal that has detected (see steps S10 to S12 and S7 in FIG. 16), the communication resource amount (radio resource amount) when executing the network scan can be further reduced compared to the first embodiment. .

In Embodiment 2, the operation of network scanning device 1A may be realized by software. In this case, the network scanning device 1A has a CPU, ROM and RAM. The ROM stores a program Prog_B comprising steps of the flowchart shown in FIG. 16 (including the flowcharts shown in FIGS. 17 and 18).

The CPU reads the program Prog_B from the ROM, executes the read program Prog_B, and performs a network scan on the wireless terminal. The RAM temporarily stores the determined k threshold values SRD_th1 to SRD_thk.

Also, the program Prog_B may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_B is loaded into the computer, the computer reads the program Prog_B from the recording medium, executes it, and performs a network scan on the wireless terminal.

Therefore, the recording medium recording the program Prog_B is a computer-readable recording medium.

Note that in the second embodiment, the k thresholds SRD_th1 to SRD_thk may not be determined by machine learning, and may consist of predetermined fixed values.

In the above description, the attribute classification of the terminal device is performed using the scan response delay SRD _i , but in the embodiment of the present invention, the delay jitter of the scan response SR _i is used to attribute classification may be performed, and in general, the attribute classification of the terminal device may be performed using the scan responsiveness. When using scan responsiveness to classify terminal i into one of k attributes, scan analysis manager 12A compares terminal i's scan responsiveness to a threshold of k−1 to classify terminal i as k attribute.

Other descriptions in the second embodiment are the same as those in the first embodiment.

[Embodiment 3]
19 is a schematic diagram of a network scanning device according to Embodiment 3. FIG. 19, network scanning apparatus 1B according to the third embodiment replaces scan analysis manager 12, host information database 13 and scan scheduler 16 of network scanning apparatus 1 shown in FIG. 2 with scan analysis manager 12B and host information database, respectively. 13B and a scan scheduler 16B, and the rest is the same as the network scan device 1. FIG.

The scan analysis manager 12B estimates the cause of network scan failure by a method described later, based on the scan response delay SRD _i of the network scan targeting a plurality of terminal devices.

More specifically, based on the scan response delay SRD _i , the scan analysis manager 12B classifies the network scan failure causes into the following first cause, second cause, third cause and fourth cause. Presumed to be either.

(First cause)
This is because the port of terminal device i, which is the target of network scanning, is blocked.

(Second cause)
The reason is that the quality of communication with the terminal device i, which is the target of the network scan, is insufficient.

(Third cause)
The reason is that the terminal device i, which is the target of the network scan, is not connected to the network.

(Fourth cause)
The reason is that the network to which the terminal device i, which is the target of the network scan, is connected is congested.

When the scan analysis manager 12B presumes the cause of network scan failure, the scan analysis manager 12B adds the presumed cause to create or update the host information database 13B.

FIG. 20 is a conceptual diagram of the host information database 13B shown in FIG. Referring to FIG. 20, host information database 13B is obtained by changing the attributes of host information database 13A shown in FIG. 14 to failure causes, adding base station and location information, and otherwise being the same as host information database 13A. is.

A failure cause is provided corresponding to the port number _PNr of each terminal device i. The cause of failure is stored for the port number with no scan response SR _i (the port number PN _r corresponding to the scan response SR _i composed of “0”), and the port number with the scan response SR _i (“1”). is not stored for the port number PN _r ) corresponding to the scan response SR _i consisting of

The base station and location information are provided corresponding to the IP address Add _i of the terminal device i. The position information is then represented by xy coordinates, for example. The scan analysis manager 12B holds in advance the location information [x _i , y _i ] of all the terminal devices i and the correspondence relationship between all the terminal devices i and the base stations. Accordingly, scan analysis manager 12B can create or update host information database 13B.

When the terminal device i is a mobile terminal, the scan analysis manager 12B periodically receives the position information [x _i , y _i ] of the terminal device i from the terminal device i, and the received position information [x _i , y _i ] and the time t at which the position information [x _i , y _i ] was received are associated with each other and stored in the host information database 13B. Also, when the terminal device i is a mobile terminal, the scan analysis manager 12B periodically receives the IP addresses Add _i of all the terminal devices i that are performing wireless communication from the base station (base station BS1 or BS2). Then, based on the received IP address Add _i of the terminal device i, the correspondence relationship between the terminal device i and the base station is updated.

Describes how to estimate the cause of network scan failure. Network scan failures are broadly classified into the following two types.

(1) Failure Not Dependent on Wired/Wireless This failure is a failure in which there is no possibility of obtaining a scan response SR _i no matter how many times the network scan is performed within the network scan time.

(2) Failure due to wireless communication path This failure is a failure for which a scan response may be obtained by re-executing the network scan within the network scan time.

The reasons for the above failures (1) and (2) are as follows.

(1-1) The port is closed.

If the port of terminal device i, which is the target of network scanning, is closed, basically no matter how many times network scanning is performed for that port, scan response SR _i will be sent unless the setting is changed. can't get On the other hand, a free port can obtain a scan response SR _i . Therefore, if a port with a scan response SR _i and a port with no scan response SR _i exist in the terminal device i, it can be recognized that the port with no scan response SR _i is closed.

(1-2) Terminal device i is not connected to the network.

Possible reasons why the terminal device i is not connected to the network are that the terminal device i is powered off or that the terminal device i is connected to another network. In this case, basically, if there is no change in the state of the terminal device i (such as when the power is turned on) during the length of time for executing the network scan, the network scan is executed for that port as many times as necessary. However, the scan response SR _i cannot be obtained. Therefore, when the scan response SR _i cannot be obtained for all the ports of the terminal i, it can be recognized that the terminal i is not connected to the network.

(1-3) Terminal device i cannot respond due to OS (Operating System) load or the like.

If it does not respond completely, it is synonymous with (1-2) above.

(2-1) Frequent wireless frame errors due to poor communication quality (for example, insufficient SNR (Signal to Noise Ratio)) These errors occur behind buildings, underground, and in undeveloped areas (in the mountains). Then, when the communication quality is insufficient, some terminal devices i have a large delay until the scan response SR _i arrives, or there is no scan response SR _i . Therefore, when the response of a small number of terminal devices is worse than that of the surrounding terminal devices, it can be estimated that this cause has occurred. Then, in this case, if the network scan is executed again after a few minutes or so within the time for executing the network scan, the problem may be improved.

Therefore, N_SR_anomaly is the number of terminals whose scan response delay SRD _i is greater than that in normal times (that is, when "insufficient communication quality" or "network congestion" does not occur), and the number of terminals connected to the same base station (or AP) is N_SR_anomaly. A region in which a plurality of terminal devices are arranged or a region with a radius of several tens of meters is defined as a “predetermined region”, the number of terminal devices existing in the predetermined region is N_preg, and Z is a real number that satisfies 0<Z≦1 Then, if N_SR_anomaly<N_preg×Z holds, it can be estimated that the cause of network scan failure for N_SR_anomaly terminal devices is “insufficient communication quality”.

Here, the scan response delay _{SRD i is X} [ ms] or more, it is determined that "scan response delay SRD _i is longer than normal". That is, when the scan response delay SRD _i satisfies SRD _i ≧DL_ave _i +X, it is determined that “the scan response delay SRD _i is longer than normal”. X [ms] is a margin for accurately detecting a scan response delay SRD _i that is longer than normal, and is, for example, the standard deviation or an integral multiple of the standard deviation in the distribution of the scan response delays SRD _i .

In this case, if there is no past scan response delay SRD _i , the above determination is not performed, and if the number of past scan response delays SRD _i is 1 or more but less than x, then Average delay DL_ave _i is calculated within the range of the number of scan response delays SRD _i .

Note that the fact that N_SR_anomaly<N_preg×Z is established means that N_SR_anomaly is smaller than a threshold value (=N_preg×Z) determined based on the total number of terminal devices N_preg present in a predetermined area, and N_SR_anomaly The fact that <N_preg×Z does not hold means that N_SR_anomaly is equal to or greater than the threshold (=N_preg×Z).

Also, Z is set to a specific numerical value according to the type of network. For example, when the network exists in an area where radio wave propagation conditions are poor, such as behind buildings, underground, and undeveloped land, Z is set to a single value that satisfies, for example, 0.5<Z≦1. If the propagation condition is good, Z is set to one value that satisfies 0<Z≦0.5, for example.

Furthermore, it may be determined that "scan response delay SRD _i is larger than normal" by machine learning of the k-neighborhood method (Non-Patent Document 4).

Using the k-neighborhood method, it is determined that "scan response delay SRD _i is larger than normal" by the following procedure.

(i) Extract a partial time series with a certain window width from the time series data immediately before the scan response delay SRD _i .

(ii) Calculate all distances to the newly acquired data points and each data point in the partial time series.

(iii) Select k _S shortest distances among the distances calculated in (ii) above, and take the average of them as the degree of abnormality of the newly obtained data points.

(iv) If the degree of anomaly is greater than or equal to a certain threshold, it is detected as an outlier (that is, "scan response delay SRD _i is larger than normal").

The scan analysis manager 12B incorporates a machine learning device that performs machine learning by the k-neighborhood _method . Take the scan response delay SRD _i as output. Then, the scan analysis manager 12B determines the above N_SR_anomaly by counting the number of scan response delays SRD _i that are larger than normal.

Furthermore, the reason why the area with a radius of several tens of meters is defined as the "predetermined area" is that the cause of network scan failure is also estimated for the terminal device (wireless terminal) in the ad-hoc network.

If it is out of service for a long time, it means that it is not connected to the network, so it can be handled in the same way as in (1-2) above.

(2-2) Timeout due to Congestion This is when the scan response SR _i does not return within the time to execute the network scan due to communication congestion.

In this case, for all terminal devices i connected to the network, a situation occurs such as a long delay until the scan response SR _i is returned and no scan response SR _i . Therefore, if the response of terminal device i in the entire network is poor, it is presumed that this is the cause.

Therefore, when N_SR_anomaly≧N_preg×Z holds, it is possible to presume that the cause of network scan failure for N_preg terminal devices (that is, all terminal devices existing within a predetermined area) is “network congestion”.

FIG. 21 is a diagram showing a method of estimating the cause of network scan failure. Referring to FIG. 21, network scanner 11 scans ports A, B, and C of terminal device TM and obtains scan response SR _i from port B. Unable to get response SR _i . Therefore, when the same terminal device has a port with a scan response SR _i and a port without a scan response SR _i , it is presumed that the cause of network scan failure is "port blockage" (( a) see).

Further, the network scanner 11 cannot obtain the scan responses SR _i from all of the ports A, B, and C as a result of performing the network scan on the ports A, B, and C of the terminal device TM. Therefore, if there are no scan responses SR _i from all ports, the cause of network scan failure is presumed to be "no network connection" (see FIG. 21(b)).

Furthermore, some of the terminal devices are hidden behind buildings, and communication quality is insufficient, resulting in large delays. Therefore, only a small number of terminal devices, when the delay is large, presume that the cause of network scan failure is "insufficient communication quality" (see (c) in FIG. 21).

Furthermore, due to congestion, the network scan was not performed and timed out. Therefore, when the delay of many terminal devices is large, it is presumed that the cause of network scan failure is "network congestion" (see (d) in FIG. 21).

If the cause of the network scan failure is "no network connection", the network scan may be executed again because the cause of the failure may be another cause.

Also, if the cause of the network scan failure is "insufficient communication quality", the communication quality will recover if the terminal device i gets out of the shadow of the building. Execute again.

If the cause of the network scan failure is "port blockage", the network scan is not executed again because there is no attack such as DDoS. Also, if the cause of the network scan failure is "network congestion", this cause is fed back to the scan scheduler 16B, and the network scan can be executed at the timing when communication is not mixed. , do not perform a network scan, and perform a network scan at another scan timing.

FIG. 22 is a flow chart for explaining the operation of the network scanning device 1B shown in FIG. The flowchart shown in FIG. 22 is obtained by replacing steps S4 to S9 of the flowchart shown in FIG. 12 with steps S21 to S23, and the rest is the same as the flowchart shown in FIG.

Referring to FIG. 22, when the operation of network scanning device 1B is started, steps S1 to S3 described above are sequentially executed.

After step S3, the scan analysis manager 12B estimates the cause of network scan failure based on the host information database 13B (step S21).

After that, the scan scheduler 16B creates a scan timing for executing the network scan again for the terminal devices for which the network scan failed due to the second or third cause (step S22). A scan timing is output to the network scanner 11 .

Based on the scan timing received from the scan scheduler 16B, the network scanner 11 re-executes the network scan targeting the terminal devices for which the network scan failed (step S23). This completes the operation of the network scanning device 1B.

Note that in step S22, if the cause of network scan failure is the second cause, the scan scheduler 16B creates a scan timing at a timing at least several minutes after the end of the previous network scan, and scans the network. Output to the scanner 11 . Further, when the cause of network scan failure is the third cause, the scan scheduler 16B creates scan timing at arbitrary timing and outputs it to the network scanner 11 .

FIG. 23 is a flow chart for explaining the detailed operation of step S21 of FIG.

Referring to FIG. 23, after step S3 in FIG. 22, the scan analysis manager 12B refers to the host information database 13B to refer to the recorded scan response delay SRD _i of each terminal device i. Calculate the average delay DL_ave _i (step S211).

The scan analysis manager 12B then sets y=1 (step S212). Note that y is an integer that satisfies 1≤y≤N_area, and N_area is the total number of predetermined areas. After that, the scan analysis manager 12B refers to the host information database 13B and determines that the scan response delay SRD _i is longer than the average delay DL_ave _i by X [ms] or more among the plurality of terminal devices located within the predetermined area y. N_SR_anomaly terminal devices are detected (step S213).

Then, the scan analysis manager 12B determines whether N_SR_anomaly<N_preg×Z holds (step S214).

When it is determined in step S214 that N_SR_anomaly<N_preg×Z is established, the scan analysis manager 12B estimates that the cause of network scan failure for N_SR_anomaly terminal devices is "insufficient communication quality" (step S215).

On the other hand, when it is determined in step S214 that N_SR_anomaly<N_preg×Z does not hold (that is, if it is determined that N_SR_anomaly≧N_preg×Z holds), the scan analysis manager 12B controls N_preg terminal devices (that is, "Network congestion" is presumed as the cause of network scan failure for all terminal devices existing in a predetermined area (step S216).

After step S215 or step S216, the scan analysis manager 12B determines whether y=N_area (step S217).

When it is determined in step S217 that y is not N_area, the scan analysis manager 12B sets y=y+1 (step S218). After that, the series of operations moves to step S213. Steps S213 to S218 are repeated until it is determined in step S217 that y=N_area.

Then, in step S217, when it is determined that y=N_area, the scan analysis manager 12B refers to the host information database 13B, and the cause of network scan failure is not presumed, and at least one V terminal devices without scan response SR _i are detected from the port (step S219). Note that V is the total number of terminal devices for which the cause of network scan failure has not been estimated and for which there is no scan response SR _i from at least one port.

Subsequently, the scan analysis manager 12B sets v=1 (step S220). Note that v is an integer that satisfies 1≤v≤V. Thereafter, terminal device v determines whether or not there is a scan response SR _i for all ports (step S221).

In step S221, when it is determined that there is no scan response SR _i for all ports in the terminal device v, the scan analysis manager 12B presumes that the cause of the network scan failure for the terminal device v is "no network connection". (step S222).

On the other hand, in step S221, when it is determined that there is a scan response SR _i for at least one port in the terminal device v, the scan analysis manager 12B sets the cause of network scan failure for the terminal device v as "port blocked". is estimated (step S223). After that, the scan analysis manager 12B records the scan response delay SRD _i in the host information database 13B (step S224).

After step S222 or step S224, the scan analysis manager 12B determines whether v=V (step S225).

When it is determined in step S225 that v is not V, the scan analysis manager 12B sets v=v+1 (step S226). After that, the series of operations moves to step S221. Steps S221 to S226 are repeated until v=V is determined in step S225.

Then, when it is determined that v=V in step S225, the series of operations proceeds to step S22 in FIG.

In step S213, the scan analysis manager 12B refers to the host information database 13B and uses the k-neighborhood method to determine the scan response delay SRD _i among the plurality of terminal devices located within the predetermined area. N_SR_anomaly terminal devices, which are larger than normal, may be detected. Therefore, in step S213, the scan analysis manager 12B should detect N_SR_anomaly terminal devices whose scan response delay SRD _i is larger than normal.

In addition, in step S211, the scan analysis manager 12B refers to the host information database 13B, and performs processing for detecting terminal devices that do not have a scan response _{SR i in} a predetermined area from the recorded scan responses SR i. area, and in step S213, the number of terminal devices detected in step S211 may be detected as the above N_SR_anomaly in each predetermined area.

In the flowchart shown in FIG. 23, steps S211 to S218 are steps for estimating the cause of network scan failure for terminal devices located in a predetermined area. It is a step of estimating the cause of network scan failure for terminals that have not been inferred. The reason why the scan response delay SRD _i is recorded in the host information database 13B in step S224 is as follows. That is, when it is estimated that the cause of network scan failure is "port blockage", the terminal device v has sufficient security and is not illegally used for cyberattacks such as DDoS attacks. is. Therefore, this is to meet the demand for recording as many scan response delays SRD _i in the normal terminal device v as possible.

According to the flowchart shown in FIG. 22 (including the flowchart shown in FIG. 23), among the terminal devices that failed the network scan, targeting only the terminal devices that failed the network scan due to the second cause or the third cause, A network scan is performed again (see steps S22 and S23). Therefore, the targets of network scanning are reduced, and the communication resources required for executing network scanning can be reduced.

In Embodiment 3, the operation of network scanning device 1B may be realized by software. In this case, the network scanning device 1B has a CPU, ROM and RAM. The ROM stores a program Prog_C consisting of steps of the flowchart shown in FIG. 22 (including the flowchart shown in FIG. 23).

The CPU reads the program Prog_C from the ROM, executes the read program Prog_C, estimates the cause of network scan failure, and targets terminal devices that fail the network scan due to the second or third cause. , and run the network scan again. The RAM temporarily stores the detected number N_SR_anomaly.

Also, the program Prog_C may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_C is loaded into the computer, the computer reads the program Prog_C from the recording medium and executes it, presumes the cause of the network scan failure, and determines whether the network scan has failed due to the second or third cause. Execute the network scan again for the terminal devices for which the scan failed.

Therefore, the recording medium recording the program Prog_C is a computer-readable recording medium.

In the above description, the cause of network scan failure is estimated using _the scan response delay SRD _i . The cause of network scan failure may be estimated, and in general, the cause of network scan failure may be estimated using scan responsiveness. In this case, in step S213 of FIG. 23, the scan analysis manager 12B determines whether the scan responsiveness among the plurality of terminal devices located within the predetermined area is a predetermined value (=X) or more than the average value of the scan responsiveness. N_SR_anomaly terminal devices are detected. That is, in step S213 of FIG. 23, the scan analysis manager 12B detects N_SR_anomaly terminal devices whose scan responsiveness is worse than normal.

Then, in step S214 of FIG. 23, the scan analysis manager 12B sets the number N_SR_anomaly of terminal devices whose scan responsiveness is worse than normal to a threshold value determined based on the total number N_preg of terminal devices existing within a predetermined area. If it is less than (=N_preg*Z), presume the cause of network scan failure to be the second cause.

In addition, as described above, executing a network scan on a terminal device for which the cause of failure of the network scan is the second or third cause is to execute a coping process for the failure of the network scan. Therefore, the network scanning device 1B according to the third embodiment should estimate the cause of the failure of the network scanning, and execute a coping process for the failure of the network scanning.

Then, executing a network scan for a terminal device (or a wireless terminal) for which the network scan has failed due to the above-described second or third cause constitutes "countermeasure processing."

Other descriptions in the third embodiment are the same as those in the first embodiment.

[Embodiment 4]
24 is a schematic diagram of a network scanning device according to Embodiment 4. FIG. Referring to FIG. 24, network scanning device 1C according to the fourth embodiment is similar to network scanning device 1A except that scan scheduler 16A of network scanning device 1A shown in FIG. 13 is replaced with scan scheduler 16C. is.

The scan scheduler 16C refers to the host information database 13A and extracts wireless terminals from a plurality of terminal devices. Then, scan scheduler 16C creates scan timings for executing network scans on the extracted wireless terminals by the method in the first embodiment, and outputs the created scan timings to network scanner 11 .

The scan scheduler 16C also refers to the host information database 13A, creates scan timings for executing network scans on a plurality of terminal devices by the method in the first embodiment, and stores the scan timings in the created scan timings. The scanning timing is readjusted by excluding terminal devices other than the wireless terminal from the terminal devices that have been detected, and the readjusted scan timing is output to the network scanner 11.例文帳に追加

FIG. 25 is a flow chart for explaining the operation of the network scanning device 1C shown in FIG.

The flowchart shown in FIG. 25 is obtained by adding steps S10 and S11 of the flowchart shown in FIG. 16 between steps S3 and S4 of the flowchart shown in FIG. 12, and the rest is the same as the flowchart shown in FIG. be.

Referring to FIG. 25, when the operation of network scanning device 1C is started, the above-described steps S1-S3, S10, S11, and S4-S9 are sequentially executed, and the operation of network scanning device 1C is completed.

In step S4 of the flowchart shown in FIG. 25, the congestion degree Ct _,i of the wireless terminal i extracted in step S11 is determined for all wireless terminals i by the method described in the first embodiment.

Then, in step S5, the determined congestion degree C _t,i is used to determine the value of the scan index s _t,i so as to satisfy equation (1) or (5), and in step S6, the wireless terminal Among them, the scan timing for the network scan targeting the wireless terminals having the scan index st _,i consisting of "1" is created, and in step S7, the network scan targeting the wireless terminals is executed when communication is idle. executed in time.

As a result, the network scan executed according to the flowchart shown in FIG. 25 (including the flowchart shown in FIG. 17) is more efficient than the network scan in the first embodiment (network scan executed according to the flowchart shown in FIG. 12). The number of target terminal devices can be reduced, and the network at the timing when communication is freer than the network scan (network scan executed according to the flowchart shown in FIG. 16 (including the flowchart shown in FIG. 17)) in Embodiment 2 Can run scans.

Therefore, in Embodiment 4, the amount of communication resources (radio resource amount) when executing network scan can be further reduced than in Embodiments 1 and 2. FIG.

FIG. 26 is another flow chart for explaining the operation of the network scanning device 1C shown in FIG.

The flowchart shown in FIG. 26 is obtained by replacing step S7 of the flowchart shown in FIG. 12 with steps S10 and S11 of the flowchart shown in FIG. 16 and new steps S13 and S14. Same as flow chart.

Referring to FIG. 26, when the operation of network scanning device 1C is started, steps S1 to S6, S10 and S11 described above are sequentially executed.

After step S11, the scan scheduler 16C readjusts the scan timing by excluding terminal devices other than wireless terminals from the scan timing created in step S6 (step S13), and uses the readjusted scan timing as the network scanner. 11.

The network scanner 11 receives the readjusted scan timing from the scan scheduler 16C and executes network scanning based on the readjusted scan timing (step S14). After that, steps S8 and S9 described above are sequentially executed, and the operation of the network scanning device 1C ends.

When the operation of the network scanning device 1C is executed according to the flowchart shown in FIG. 26, the operations of steps S5 and S6 and the operations of steps S10 and S11 can be executed in parallel. Computation time may be faster than when the operation is executed.

In Embodiment 4, the operation of network scanning device 1C may be realized by software. In this case, the network scanning device 1C has a CPU, a ROM and a RAM. 25 (including the flowchart shown in FIG. 17) or a program Prog_E including the steps of the flowchart shown in FIG. 26 (including the flowchart shown in FIG. 17). Remember.

The CPU reads the program Prog_D or the program Prog_E from the ROM, executes the read program Prog_D or the program Prog_E, and executes a network scan only for the wireless terminal when communication is idle. The RAM temporarily stores the determined scan index st _,i values and k thresholds SRD_th1 to SRD_thk.

Also, the program ProgD or program Prog_E may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_D or the program Prog_E is loaded into the computer, the computer reads out the program Prog_D or the program Prog_E from the recording medium and executes it. Run a network scan.

Therefore, the recording medium recording the program Prog_D or the program Prog_E is a computer-readable recording medium.

Other descriptions in the fourth embodiment are the same as those in the first and second embodiments.

[Embodiment 5]
27 is a schematic diagram of a network scanning device according to Embodiment 5. FIG. Referring to FIG. 27, network scanning device 1D according to the fifth embodiment is obtained by replacing scan scheduler 16B of network scanning device 1B shown in FIG. 19 with scan scheduler 16D, and otherwise is the same as network scanning device 1B. is.

The scan scheduler 16D refers to the host information database 13B and extracts a terminal device whose network scan failure is caused by the second or third cause. Then, the scan scheduler 16D creates scan timings for executing network scans on the extracted terminal devices by the method in the first embodiment, and outputs the created scan timings to the network scanner 11. FIG.

The scan scheduler 16C also refers to the host information database 13B, creates scan timings for executing network scans on a plurality of terminal devices by the method in the first embodiment, and stores the scan timings in the created scan timings. The terminal device whose cause of network scan failure is the first cause or the fourth cause is excluded from the detected terminal devices, the scan timing is readjusted, and the readjusted scan timing is output to the network scanner 11.例文帳に追加

FIG. 28 is a flow chart for explaining the operation of the network scanning device 1D shown in FIG.

In the flowchart shown in FIG. 28, step S21 of the flowchart shown in FIG. 22 is added between steps S3 and S4 of the flowchart shown in FIG. 12, and step S4 is changed to step S4A. 12 is the same as the flowchart shown in FIG.

Referring to FIG. 28, when the operation of network scanning device 1D is started, steps S1 to S3 and S21 described above are sequentially executed. In this case, the detailed operation of step S21 is executed according to the flowchart shown in FIG.

After step S21, the scan scheduler 16D, based on the host information database 13B, targets the terminal devices for which the network scan failed due to the second or third cause, and calculates the degree of congestion C _t, The determination of _i is executed for all target terminal devices (step S4A).

Thereafter, steps S5 to S9 described above are sequentially executed, and the operation of the network scanning device 1D ends.

According to the flowchart shown in FIG. 28, the scan timing is created only for the terminal devices for which the network scan failed due to the second or third cause, and the network scan is executed at the timing when communication is idle ( See steps S4A, S5 to S7).

As a result, the network scan executed according to the flowchart shown in FIG. 28 (including the flowchart shown in FIG. 23) is more efficient than the network scan in the first embodiment (network scan executed according to the flowchart shown in FIG. 12). The number of target terminal devices can be reduced, and the network at the timing when communication is freer than the network scan (network scan executed according to the flowchart shown in FIG. 22 (including the flowchart shown in FIG. 23)) in Embodiment 3 Can run scans.

Therefore, in the fifth embodiment, the amount of communication resources for executing network scan can be further reduced compared to the first and third embodiments.

FIG. 29 is another flow chart for explaining the operation of the network scanning device 1D shown in FIG.

The flowchart shown in FIG. 29 is obtained by replacing step S7 in the flowchart shown in FIG. 12 with step S21 in the flowchart shown in FIG. 22 and new steps S24 and S25. are the same.

Referring to FIG. 29, when the operation of network scanning device 1D is started, steps S1 to S6 and S21 described above are sequentially executed. In this case, the detailed operation of step S21 is executed according to the flowchart shown in FIG.

After step S21, the scan scheduler 16D readjusts the scan timing by excluding terminal devices other than the terminal device that failed the network scan due to the second or third cause from the scan timing created in step S6 ( Step S 24 ), the readjusted scan timing is output to the network scanner 11 . That is, the scan scheduler 16D readjusts the scan timings for the terminal device that failed the network scan due to the second cause and the terminal device that failed the network scan due to the third cause, and readjusts the scan timing to the network scanner 11. Output.

The network scanner 11 receives the readjusted scan timing from the scan scheduler 16D and executes network scanning based on the readjusted scan timing (step S25).

Thereafter, steps S8 and S9 described above are sequentially executed, and the operation of the network scanning device 1D ends.

When the operation of the network scanning device 1D is executed according to the flowchart shown in FIG. 29, the operations of steps S5 and S6 and the operation of step S21 can be executed in parallel. Computation time may be faster than when

In Embodiment 5, the operation of network scanning device 1D may be realized by software. In this case, the network scanning device 1D has a CPU, a ROM and a RAM. 28 (including the flowchart shown in FIG. 23) or a program Prog_G including each step of the flowchart shown in FIG. 29 (including the flowchart shown in FIG. 23). Remember.

The CPU reads the program Prog_F or the program Prog_G from the ROM, executes the read program Prog_F or the program Prog_G, and targets only the terminal devices for which the network scan failed due to the second or third cause, and performs communication. Run a network scan when you have free time. The RAM temporarily stores the values of the determined scan indices _st,i and the number N_SR_anomaly.

Also, the program Prog_F or program Prog_G may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_F or program Prog_G is loaded into the computer, the computer reads and executes the program Prog_F or program Prog_G from the recording medium, and the network scan fails due to the second or third cause. A network scan is executed only for terminal devices when communication is idle.

Therefore, the recording medium recording the program Prog_F or program Prog_G is a computer-readable recording medium.

Other descriptions in the fifth embodiment are the same as those in the first and third embodiments.

[Embodiment 6]
FIG. 30 is a schematic diagram of a network scanning device according to Embodiment 6. FIG. Referring to FIG. 30, network scanning device 1E according to the sixth embodiment replaces scan analysis manager 12A, host information database 13A and scan scheduler 16A of network scanning device 1A shown in FIG. 13 with scan analysis manager 12C and host information database, respectively. 13C and a scan scheduler 16E, and the rest is the same as the network scan device 1A.

The scan analysis manager 12C executes the terminal device attribute classification described in the second embodiment and the network scan failure cause estimation described in the third embodiment, and based on the attribute classification result and the cause estimation result to create or update the host information database 13C.

The host information database 13C is configured by adding the attribute of the terminal device i to the host information database 13B shown in FIG.

The scan scheduler 16E refers to the host information database 13C, targets the wireless terminals for which the network scan failed due to the second or third cause, and considers the timing when communication is available in the first embodiment. Instead, it creates scan timings for executing network scans at arbitrary timings, and outputs the created scan timings to the network scanner 11 .

FIG. 31 is a schematic diagram of the host information database 13C shown in FIG. Referring to FIG. 31, host information database 13C is the same as host information database 13A except that the cause of network scan failure is added to host information database 13A shown in FIG.

As described in the third embodiment, the cause of network scan failure is stored in correspondence with the port number PN _r of the port for which the network scan failed among the plurality of ports of each terminal device i.

The scan scheduler 16E refers to the host information database 13C shown in FIG. 31 to determine the port number PN _r of the port for which the network scan failed due to the second or third cause among the terminal devices whose attribute is wireless terminal. To extract a terminal device (= wireless terminal) that supports , and outputs the created scan timing to the network scanner 11 .

FIG. 32 is a flow chart for explaining the operation of the network scanning device 1E shown in FIG.

The flowchart shown in FIG. 32 is obtained by replacing step S12 of the flowchart shown in FIG. 16 with steps S21 and S22 shown in FIG. 22, and the rest is the same as the flowchart shown in FIG.

Referring to FIG. 32, when the operation of network scanning device 1E is started, steps S1 to S3, S10, S11, S21, S22 and S7 described above are sequentially executed, and the operation of network scanning device 1E is completed.

In this case, the detailed operation of step S10 is executed according to the flowchart shown in FIG. 17 (the flowchart is included in FIG. 18). Further, the detailed operation of step S21 is executed according to the flowchart shown in FIG.

According to the flowchart shown in FIG. 32, wireless terminals are extracted from a plurality of terminal devices, and among the extracted wireless terminals, the terminal devices (=wireless terminals) failing the network scan due to the second or third cause. A scan timing is created for executing a network scan at an arbitrary timing, and the network scan is executed based on the created scan timing (see steps S11, S21, S22, and S7).

As a result, the network scan executed according to the flowchart shown in FIG. 32 (including the flowchart shown in FIG. 17 (including the flowchart shown in FIG. 18) and the flowchart shown in FIG. 23) is similar to the network scan in Embodiment 2 ( 22 (including the flowchart shown in FIG. 23) in Embodiment 3. The number of wireless terminals targeted for network scanning is reduced compared to the network scanning using network scanning.

Therefore, in the sixth embodiment, the communication resource amount (radio resource amount) for executing network scan can be further reduced compared to the second and third embodiments.

In Embodiment 6, the operation of network scanning device 1E may be realized by software. In this case, the network scanning device 1E has a CPU, ROM and RAM. 32 (including the flowchart shown in FIG. 17 (including the flowchart in FIG. 18) and the flowchart shown in FIG. 23).

The CPU reads the program Prog_H from the ROM, executes the read program Prog_H, and performs the network scan at an arbitrary timing targeting only the wireless terminals for which the network scan failed due to the second or third cause. Run. The RAM temporarily stores the thresholds SRD_th1 to SRD_thk and the number N_SR_anomaly.

Also, the program Prog_H may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_H is loaded into the computer, the computer reads the program Prog_H from the recording medium and executes it, targeting only the terminal devices that fail the network scan due to the second or third cause. , to perform a network scan at any time.

Therefore, the recording medium recording the program Prog_H is a computer-readable recording medium.

Other descriptions in the sixth embodiment are the same as those in the first, second, and third embodiments.

[Embodiment 7]
33 is a schematic diagram of a network scanning device according to Embodiment 7. FIG. Referring to FIG. 33, network scanning device 1F according to the seventh embodiment is obtained by replacing scan scheduler 16E of network scanning device 1E shown in FIG. 30 with scan scheduler 16F. is.

The scan scheduler 16F refers to the host information database 13C, creates scan timings for executing network scans at timings when communication is idle in the first embodiment, and classifies attributes of terminal devices in the second embodiment. , and cause estimation for estimating the cause of network scan failure in the third embodiment. Then, the scan scheduler 16F extracts wireless terminals for which the network scan failed due to the second or third cause from a plurality of terminal devices, and scan timing when executing the network scan on the extracted wireless terminals. are created by the method in the first embodiment, and the created scan timings are output to the network scanner 11 .

The scan scheduler 16F also refers to the host information database 13C, creates scan timings for executing network scans on a plurality of terminal devices by the method in the first embodiment, and stores the scan timings in the created scan timings. A wireless terminal whose cause of failure in network scanning is the first cause or the fourth cause is excluded from the received terminal devices, the scan timing is readjusted, and the readjusted scan timing is output to the network scanner 11.例文帳に追加

FIG. 34 is a flow chart for explaining the operation of the network scanning device 1F shown in FIG.

In the flowchart shown in FIG. 34, steps S10 and S11 of the flowchart shown in FIG. 16, step S21 of the flowchart shown in FIG. 22, and new step S26 are inserted between steps S3 and S4 of the flowchart shown in FIG. It is the same as the flowchart shown in FIG. 12 except that step S4 is changed to step S4B.

Referring to FIG. 34, when the operation of network scanning device 1F is started, steps S1 to S3, S10, S11 and S21 described above are sequentially executed.

In this case, the detailed operation of step S10 is executed according to the flowchart shown in FIG. 17 (the flowchart is included in FIG. 18). Further, the detailed operation of step S21 is executed according to the flowchart shown in FIG.

After step S21, the scan scheduler 16F refers to the host information database 13C and extracts wireless terminals for which the network scan failed due to the second or third cause (step S26).

Then, based on the host information database 13C, the scan scheduler 16F determines the degree of congestion Ct _,i of the wireless terminal i (=the wireless terminal extracted in step S26) at time t for all wireless terminals i (=step S26). (step S4B).

Thereafter, steps S5 to S9 described above are sequentially executed, and the operation of the network scanning device 1F ends.

According to the flowchart shown in FIG. 34, wireless terminals are extracted from a plurality of terminal devices, and among the extracted wireless terminals, the wireless terminals for which the network scan failed due to the second or third cause are targeted for communication. A scan timing for executing a network scan is created at a timing when is vacant, and the network scan is performed based on the created scan timing (see steps S11, S21, S26, S4B, and S5 to S7).

As a result, the network scan executed according to the flowchart shown in FIG. 34 (including the flowchart shown in FIG. 17 (including the flowchart shown in FIG. 18) and the flowchart shown in FIG. 23) is similar to the network scan in Embodiment 1 ( network scan according to the flowchart shown in FIG. 16), network scan according to the second embodiment (network scan executed according to the flowchart shown in FIG. 16), and network scan according to the third embodiment (the flowchart shown in FIG. including), the number of terminal devices to be subjected to the network scan is reduced.

Therefore, in Embodiment 7, the communication resource amount (radio resource amount) when executing a network scan can be further reduced than in Embodiments 1, 2, and 3. FIG.

FIG. 35 is another flow chart for explaining the operation of the network scanning device 1F shown in FIG.

In the flowchart shown in FIG. 35, step S7 of the flowchart shown in FIG. 12 is changed to steps S10, S11, S21, S26, and S25 described above, and a new step S24A is added between steps S26 and S25. Others are the same as the flowchart shown in FIG.

Referring to FIG. 35, when the operation of network scanning device 1F is started, steps S1 to S6, S10, S11, S21 and S26 described above are sequentially executed.

After step S26, the scan scheduler 16F excludes terminal devices other than wireless terminals and wireless terminals for which the network scan failed due to the first or fourth cause from the scan timing generated in step S6. The scan timing is readjusted (step S24A). That is, the scan scheduler 16F reschedules the scan timing for the wireless terminals that failed the network scan due to the second cause and the wireless terminals that failed the network scan due to the third cause among the plurality of terminal devices. adjust. Then, the scan scheduler 16F outputs the readjusted scan timing to the network scanner 11. FIG. Thereafter, steps S25, S8, and S9 described above are sequentially executed, and the operation of the network scanning device 1F ends.

When the operations of the network scanning device 1F are executed according to the flowchart shown in FIG. 35, the operations of steps S5 and S6 and the operations of steps S10, S11, S21, and S26 can be executed in parallel. Computation time may be faster than when the operation of the network scanning device 1F is executed.

In Embodiment 7, the operation of network scanning device 1F may be realized by software. In this case, the network scanning device 1F has a CPU, a ROM and a RAM. 34 (including the flowchart shown in FIG. 18 and the flowchart shown in FIG. 23), or the program Prog_I shown in FIG. (including the flowchart shown in FIG. 18) and the flowchart shown in FIG. 23).

The CPU reads the program Prog_I or the program Prog_J from the ROM, executes the read program Prog_I or the program Prog_J, and targets only the wireless terminals for which the network scan has failed due to the second or third cause, and performs communication. Run a network scan when you have free time. The RAM temporarily stores the values of the determined scan indices _st,i , the thresholds SRD_th1 to SRD_thk and the number N_SR_anomaly.

Also, the program Prog_I or the program Prog_J may be recorded on a recording medium such as a CD or DVD and distributed. When the recording medium recording the program Prog_I or the program Prog_J is loaded into the computer, the computer reads the program Prog_I or the program Prog_J from the recording medium and executes it, and the network scan fails due to the second or third cause. A network scan is executed only for terminal devices when communication is idle.

Therefore, the recording medium recording the program Prog_I or the program Prog_J is a computer-readable recording medium.

Other descriptions in the seventh embodiment are the same as those in the first, second, and third embodiments.

The embodiments of the present invention are characterized by estimating the cause of the failure of the network scan and executing a coping process for the failure of the network scan by the method described above.

Therefore, according to Embodiments 1 to 7 described above, the network scanning device according to the embodiment of the present invention only needs to have the following configuration.

(Configuration 1)
The network scanning device comprises estimating means and coping means. The estimating means performs an estimating process for estimating the cause of the network scan failure based on the scan response and scan responsiveness that are the results of the network scan, for the plurality of terminal devices. The coping means executes a coping process for the network scan failure according to the estimation result by the estimating means.

(Configuration 2)
In configuration 1, the estimating means estimates that the cause of network scan failure is any one of the first cause, second cause, third cause and fourth cause based on the scan response and scan responsiveness. do. The first cause is that the port of the terminal device that is the target of the network scan is blocked, and the second cause is insufficient communication quality in communication with the terminal device that is the target of the network scan. The third cause is that the terminal device that is the target of the network scan is not connected to the network, and the fourth cause is that the terminal device that is the target of the network scan is connected. The network is congested.

(Composition 3)
In configuration 2, the estimation means is
In one terminal device, when there are ports with scan responses and ports without scan responses, presuming that the cause of network scan failure is the first cause,
Cause of network scan failure when the number of terminal devices whose scan responsiveness is worse than normal in a predetermined area is less than a threshold value determined based on the total number of terminal devices present in the predetermined area presumed to be the second cause,
When there is no scan response for all ports of one terminal device, presuming that the cause of network scan failure is the third cause,
When the number of terminal devices whose scan responsiveness is worse than normal within a predetermined area is equal to or greater than a threshold value, the cause of network scan failure is estimated to be the fourth cause.

(Composition 4)
In Configuration 2 or Configuration 3, the coping means re-executes the network scan when the cause of network scan failure is the second cause or the third cause.

(Composition 5)
In any one of configurations 1 to 4, the network scanning device further includes timing determining means and scanning means. The timing determination means detects a time zone in which the traffic volume is a second traffic volume smaller than the first traffic volume based on the network scan data that is the result of the network scan, and scans the detected time zone. is determined as the scan timing of The scanning means performs network scanning on the plurality of terminal devices based on the scanning timing determined by the timing determining means.

(Composition 6)
In configuration 5, the ratio of the amount of communication available to at least one terminal device among the plurality of terminal devices to the total amount of available communication is defined as the degree of congestion, and the timing determining means scans the network for the degree of congestion of the terminal device. The scan timing is determined so that the addition result of the total time length of the target terminal device and the network scan is equal to or less than the threshold value.

(Composition 7)
In configuration 6, the timing determining means determines scan timing so that the addition result is minimized under the constraints.

(Composition 8)
In any one of configurations 5 to 7, the network scanning device further comprises classifying means. The classifying means classifies the plurality of terminal devices into a plurality of clusters. The timing determination means extracts a desired number of terminal devices from each of the plurality of clusters classified by the classification means, determines scan target terminal devices to be subjected to network scanning, and determines scan target terminal devices to be scanned. A time period during which the traffic becomes the second traffic is determined as the scan timing.

(Composition 9)
In any one of configuration 1 to configuration 8, the network scanning device further comprises threshold determining means and classifying means. The threshold determination means determines, by machine learning, thresholds for classifying the plurality of terminal devices into the plurality of attributes based on the scan responsiveness that is the result of the network scan. The classification means performs an attribute classification process for the plurality of terminal devices, comparing the scan responsiveness of one terminal device with a threshold value and classifying the one terminal device into one of a plurality of attributes. Then, the scanning means extracts target wireless devices to be subjected to network scanning from the plurality of terminal devices based on the classification results classified by the classifying means, and the timing determining means determines the extracted target wireless devices. Execute a network scan at the specified scan timing.

(Configuration 10)
In configuration 9, when the scan responsiveness is a plurality of scan responsivenesses for a plurality of ports of one terminal device, the classification means compares the scan responsiveness for one port with a threshold to classify one port. a first classification process of executing a process of classifying all of a plurality of ports into one of a plurality of attributes; The attribute classification processing is executed by executing the second classification processing for classifying one terminal device for all of the plurality of terminal devices.

(Composition 11)
In configuration 9 or configuration 10, when the plurality of attributes are K attributes (K is an integer equal to or greater than 2), the threshold determination means classifies the plurality of terminal devices into K attributes based on scan responsiveness. K−1 thresholds for are determined by the machine learning. In the attribute classification process, the classification means classifies one terminal device into one of K attributes by comparing the scan responsiveness with K−1 thresholds.

(Composition 12)
In any of Configurations 9 through 11, scan responsiveness consists of scan response delay, which is the time from sending a test input in a network scan to receiving a response from the terminal device.

Further, according to the first to seventh embodiments described above, the program according to the embodiment of the present invention only needs to have the following configuration.

(Composition 13)
a first step in which the estimating means performs an estimating process for estimating the cause of the failure of the network scan based on the scan response and the scan responsiveness that are the results of the network scan, for a plurality of terminal devices;
The coping means causes the computer to execute a second step of coping with network scan failure according to the estimation result in the first step.

(Composition 14)
In configuration 13, the estimating means, in the first step, determines the cause of the network scan failure based on the scan response and scan responsiveness as a first cause, a second cause, a third cause and a fourth cause. presumed to be either
The first cause is that the port of the terminal device that is the target of the network scan is blocked.
The second cause is insufficient communication quality in communication with the terminal device that is the target of the network scan.
The third cause is that the terminal device that is the target of the network scan is not connected to the network.
A fourth cause is that the network to which the terminal device that is the target of the network scan is connected is congested.

(Composition 15)
In configuration 14, the estimating means, in a first step,
estimating that the cause of network scan failure is the first cause when there are ports with scan responses and ports without scan responses in one terminal device;
Cause of network scan failure when the number of terminal devices whose scan responsiveness is worse than normal in a predetermined area is less than a threshold value determined based on the total number of terminal devices present in the predetermined area presumed to be the second cause,
When there is no scan response for all ports of one terminal device, presuming that the cause of network scan failure is the third cause,
When the number of terminal devices whose scan responsiveness is worse than normal within a predetermined area is equal to or greater than a threshold value, the cause of network scan failure is estimated to be the fourth cause.

(Composition 16)
In Configuration 14 or Configuration 15, in the second step, when the network scan fails due to the second or third cause, the network scan is performed again.

(Composition 17)
In any one of Configurations 13 to 16, the timing determining means detects a time zone in which the traffic is the second traffic less than the first traffic, based on network scan data indicating the result of the network scan. and a third step of determining the detected time zone as the scan timing of the network scan;
The scanning means further causes the computer to execute a fourth step in which network scanning is performed on the plurality of terminal devices based on the scanning timing determined in the third step.

(Composition 18)
In configuration 17, the congestion degree is the ratio of the traffic that can be used by at least one of the plurality of terminal devices to the total traffic that can be used,
In the third step, the timing determination means determines the scan timing so that the addition result obtained by adding the congestion degree of the terminal device to the terminal device to be network scanned and the total time length of the network scan is equal to or less than a threshold value. do.

(Composition 19)
In configuration 18, in the third step, the timing determining means determines scan timing so that the result of addition is minimized under the constraints.

(Configuration 20)
In any one of configurations 17 to 19, the classifying means further causes the computer to perform a fifth step of classifying the plurality of terminal devices into a plurality of clusters;
In a third step, the timing determination means extracts a desired number of terminal devices from each of the plurality of clusters classified in the fifth step to determine scan target terminal devices to be subjected to network scanning, and A time period during which the communication traffic for the terminal device to be scanned is the second communication traffic is determined as the scan timing.
(Composition 21)
In any one of configurations 13 to 20, the threshold determination means determines by machine learning a threshold for classifying the plurality of terminal devices into the plurality of attributes based on the scan responsiveness that is the result of the network scan. a step;
a seventh step in which the classifying means performs an attribute classification process for the plurality of terminal devices, wherein the scanning responsiveness of one terminal device is compared with a threshold value to classify the one terminal device into one of a plurality of attributes; ,
An eighth aspect, wherein the scanning means extracts target wireless devices to be subjected to network scanning from the plurality of terminal devices based on the classification results classified by the classifying means, and executes network scanning on the extracted target wireless devices. and causing the computer to further execute the steps.

(Composition 22)
In configuration 21, in a seventh step, the classifying means compares the scan responsiveness for one port with a threshold when the scan responsiveness is multiple scan responsiveness for multiple ports of one terminal device. a first classification process for classifying one port into one of a plurality of attributes according to a plurality of attributes for all of the plurality of ports; Attribute classification processing is executed by executing a second classification process for classifying one terminal device into the classified attribute for all of the plurality of terminal devices.

(Composition 23)
In configuration 21 or configuration 22, in the sixth step, when the plurality of attributes are K attributes (K is an integer equal to or greater than 2), the threshold determination means determines the plurality of terminal devices based on the scan responsiveness. Determining K-1 thresholds for classifying into K attributes by machine learning,
In the seventh step, the classification means classifies one terminal device into one of K attributes by comparing the scan responsiveness with K−1 thresholds in the attribute classification process.

(Composition 24)
In any of configuration 21 to configuration 23, scan responsiveness consists of scan response delay, which is the time from sending a test input in network scanning to receiving a response from the terminal device.

Furthermore, according to the above-described Embodiments 1 to 7, the recording medium according to the embodiment of the present invention only needs to have the following configuration.

(Composition 25)
A computer-readable recording medium recording the program according to any one of Structures 13 to 24.

It should be considered that the embodiments disclosed this time are illustrative in all respects and not restrictive. The scope of the present invention is indicated by the scope of the claims rather than the description of the above-described embodiments, and is intended to include all modifications within the scope and meaning equivalent to the scope of the claims.

The present invention is applied to a network scanning device, a program to be executed by a computer, and a computer-readable recording medium recording the program.

1, 1A, 1B, 1C, 1D, 1E, 1F network scanning device, 10 communication system, 11 network scanner, 12, 12A, 12B, 12C scan analysis manager, 13, 13A, 13B, 13C host information database, 14 clustering manager , 15 clustering database, 16, 16A, 16B, 16C, 16D, 16E, 16F scan scheduler, 20 network to be scanned, 30 users.

Claims (9)

an estimating means for performing an estimating process for estimating the cause of the failure of the network scan based on the scan response and the scan responsiveness, which are the results of the network scan, for a plurality of terminal devices;
and a coping means for executing a coping process for the failure of the network scan according to the estimation result by the estimating means. The estimating means estimates the cause of the failure of the network scan to be any one of a first cause, a second cause, a third cause and a fourth cause based on the scan response and the scan responsiveness. death,
The first cause is that the port of the terminal device that is the target of the network scan is blocked,
The second cause is insufficient communication quality in communication with the terminal device that is the target of the network scan,
the third cause is that the terminal device that is the target of the network scan is not connected to a network;
2. The network scanning device according to claim 1, wherein said fourth cause is congestion of a network to which said terminal device which is a target of said network scanning is connected. The estimation means is
in one terminal device, when there are ports with the scan response and ports without the scan response, presuming that the cause of the failure of the network scan is the first cause;
When the number of terminal devices whose scan responsiveness is worse than normal within a predetermined area is less than a threshold value determined based on the total number of terminal devices existing within the predetermined area, the network scan fails. presuming that the cause is the second cause,
estimating that the cause of the failure of the network scan is the third cause when there is no scan response for all ports of one of the terminal devices;
When the number of terminal devices whose scan responsiveness is worse than normal in the predetermined area is equal to or greater than the threshold value, the cause of network scan failure is estimated to be the fourth cause. Item 3. The network scanning device according to item 2. 4. The network scanning device according to claim 2, wherein said coping means executes network scanning again when the cause of failure of said network scanning is said second cause or said third cause. a first step in which an estimating means performs an estimating process for a plurality of terminal devices of estimating the cause of the failure of the network scan based on the scan response and the scan responsiveness that are the results of the network scan;
A program for causing a computer to execute a second step in which coping means executes a coping process for the failure of the network scan according to the estimation result in the first step. In the first step, the estimating means determines the cause of the failure of the network scan as a first cause, a second cause, a third cause and a fourth cause based on the scan response and the scan responsiveness. is assumed to be either
The first cause is that the port of the terminal device that is the target of the network scan is blocked,
The second cause is insufficient communication quality in communication with the terminal device that is the target of the network scan,
the third cause is that the terminal device that is the target of the network scan is not connected to a network;
6. The program to be executed by a computer according to claim 5, wherein said fourth cause is congestion of a network to which said terminal device which is a target of said network scan is connected. The estimation means, in the first step,
in one terminal device, when there are ports with the scan response and ports without the scan response, presuming that the cause of the failure of the network scan is the first cause;
In a predetermined area, when the number of terminal devices whose scan responsiveness is worse than normal is less than a threshold value determined based on the total number of terminal devices present in the predetermined area, the network scan is performed. Presuming that the cause of failure is the second cause,
estimating that the cause of the failure of the network scan is the third cause when there is no scan response for all ports of one of the terminal devices;
When the number of terminal devices whose scan responsiveness is worse than normal in the predetermined area is equal to or greater than the threshold value, the cause of network scan failure is estimated to be the fourth cause. Item 7. A program to be executed by the computer according to Item 6. Claim 6 or Claim 7, wherein, in said second step, said coping means executes a network scan again when the cause of said network scan failure is said second cause or said third cause. A program for executing the computer described in . A computer-readable recording medium recording the program according to any one of claims 5 to 8.

Images