RU2740534C1 - Information traffic monitoring device - Google Patents

Abstract

FIELD: computer equipment.

SUBSTANCE: invention relates to the computer equipment. Information traffic monitoring device comprises a current estimation signal generator, an evaluation value zone discriminator, a pulse distributor, a time interval counter, a switch, first and second search variable formers, first and second adder counters, first and second memory units, a division unit, a classifier, a search strategy register, a reset signal generator, a data display and recording unit, a threshold signal variation unit, a current day timer, a truncation threshold generation unit, a structural analyzer, a third, fourth, fifth memory unit, an analysis interval time controller.

EFFECT: technical result consists in providing the possibility of analyzing the input information flow in conditions of continuous dynamics of changing its state.

1 cl, 4 dwg

Description

The invention relates to computer technology and can be used as a device for structural and statistical analysis of information arrays circulating in a complex, controlled information (information and computing or telecommunication) system.

A device is known (see RF patent No. 2116670 "Information retrieval device", IPC G06F 17/30, published on 04/07/1997) containing a pulse distributor, first and second search variable shapers, summing counters and memory blocks, a search strategy register, a signal generator current assessment, discriminator of zones of assessment values, counter of time intervals, commutator, division unit, classifier, unit for changing threshold signals, timer of the current day, indication unit and generator of reset signals.

This device has a narrow field of application, since it cannot be used to analyze several parallel streams to find combinations of message start.

Known device (see RF patent No. 2149446 "Information retrieval device", IPC G06F 17/30, published 20.05.2000, bull. No. 14), which contains a current evaluation signal generator, a discriminator of evaluation value zones, a pulse distributor, a time interval counter , a switch, the first and second generators of the search variable, the first and second summing counters, the first and second memory blocks, a division unit, a classifier, a search strategy register, a reset signal generator, a block for changing threshold signals, a current day timer and a block for generating a truncation threshold.

However, this device provides a low search speed for message start combinations and a relatively low information content of traffic indicators that characterize the structure of information arrays.

The closest in technical essence to the claimed device (prototype) is a device for monitoring information traffic (see RF patent No. 2290691 "Device for monitoring information traffic" IPC G06F 17/18, G06F 17/30, published on 27.12.2006, bull. No. 36) containing a generator of signals of the current estimate, a discriminator of zones of values of an estimate, a distributor of pulses, a counter of time intervals, a switch, the first and second generators of the search variable, the first and second summing counters, the first and second memory blocks, a division unit, a classifier, a search strategy register, a generator reset signals, a block for displaying and recording data, a block for changing threshold signals, a timer for the current day, a block for generating a truncation threshold, a structural analyzer, the third, fourth and fifth memory blocks, while the output of the current evaluation signal generator is connected to the control input of the switch, outputs "Change state of the situation - Change "and" No change in the state of the Ots "of which are connected to the inputs of the first and second search variable generators, the output of the second search variable generator is connected to the information input of the second summing counter, the output of which is connected to the information input of the second memory block and the second information input of the division unit, the output of which is connected to the information input classifier, outputs "Change in the state of the situation - P" and "No change in the state of the situation - O" which are connected to the inputs of the same name and a reset signal generator and to the same inputs of the data display and recording unit, the "Reset" output of the reset signal generator is connected to the "Reset" input "Of the first memory block, the" Reset "input of the second memory block, the" Reset "input of the counter of time intervals and the" Reset "input of the truncation threshold formation block, the output" Maximum number of the time interval - N _max "of which is connected to the similar inputs of the search strategy register, the first and the second variable shapers th search, the output of the first generator of the search variable is connected to the information input of the first totalizing counter, the output of which is connected to the first information input of the dividing unit, the outputs "Change in the state of the situation - Measure" and "No change in the state of the situation - Ots" of the discriminator of zones of evaluation values are connected to the same the inputs of the switch, the first output of the pulse distributor is connected to the synchronization inputs of the current estimate signal generator and the discriminator of the estimate value zones, as well as to the clock input of the time interval counter, the output "Number of the current time interval - N _tech " which is connected to the same inputs of the truncation threshold formation unit and search strategy register, the outputs "Value of the upper classification threshold - P _clv " and "Value of the lower classification threshold - P _cln " which are connected to the classifier inputs of the same name, the second output of the pulse distributor is connected to the synchronizing input of the switch, the third output is the pulse distributor is connected to the synchronization inputs of the first and second memory blocks, the outputs of the first and second memory blocks are connected to the signal inputs of the first and second summing counters, the fourth output of the pulse distributor is connected to the synchronizing input of the classifier, the "Time" output of the current day timer is connected to the same inputs of the former signals of the current evaluation, the discriminator of the zones of evaluation values, the distributor of impulses, the unit for displaying and recording data and the block for changing the threshold signals, the outputs "Upper value of the search threshold - P _in " and "Lower value of the search threshold - P _n " which are connected respectively to the register inputs of the same name the search strategy and to the inputs of the same name of the block for generating the truncation threshold, the inputs "Start" and "Threshold" of the block for changing the threshold signals are connected to the inputs of the same name of the block for forming the threshold of truncation and are, respectively, the inputs "Start" and "Threshold" of the device, input "Numerical value of one - 1 ", entrance" Maxim the initial number of the time interval - N _max ", and the input" Sample size of the analysis interval - V _select "of the truncation threshold formation block are the same inputs of the device, the input" Zone 1 "of the first generator of the search variable and the input" Zone 2 "of the second generator of the search variable are respectively the inputs "Zone 1" and "Zone 2" of the device, the information output of the structural analyzer is connected to the information inputs of the current assessment signal generator and the discriminator of the assessment value zones, the "Deterministic combination" input, the "Unknown attribute" input, the "Desired attribute" input and the " The address of the unknown attribute - Address of the NP "of the display and data recording unit are connected respectively to the outputs of the same name of the structural analyzer, the output" Address "of which is connected to the inputs of the same name of the third, fourth and fifth memory blocks, the output" Data 1 "of the third memory block is connected to the inputs of the same name of the block display and record data and structure analyzer, output "Data 2" four of that memory block and the "Data 3" output of the fifth memory block are connected to the same-named inputs of the structural analyzer, the "Clock pulses" output of which is connected to the same-named inputs of the fourth and fifth memory blocks, the "Data 1 - write" output, "Data 2 - write" output and the "Data 3 - record" output of the data display and recording unit is connected to the same inputs of the third, fourth and fifth memory blocks, the "Address 3 - write" output of the data display and recording unit is connected to the same name input of the fifth memory block, the "Address 1, 2 - "recording" of the data display and recording unit is connected to the same-named inputs of the third and fourth memory blocks, the information and synchronizing inputs of the structural analyzer are, respectively, information and synchronizing inputs of the device.

The prototype implements the ability to provide a higher search speed for combinations of the beginning of messages by adjusting the value of the maximum number of the time interval during the entire analysis time. In addition, the prototype device provides an increase in the information content of traffic indicators characterizing the structure of information arrays, due to the structural analysis of deterministic combinations.

However, the prototype device has a drawback - a narrow field of application, limited by the ability to monitor information traffic, characterized by the absence of dynamics (impossibility) of changing the time intervals for analyzing the state of information arrays (input information flow) under conditions of continuous dynamics of changing these states, taking into account changing monitoring tasks and other influencing factors.

This is due to the fact that the prototype device does not allow dynamically adjusting the maximum time of the analysis interval for information arrays that are different both in intensity and in dynamically changing requirements for the timeliness of monitoring information traffic. This prototype device allows you to set the current analysis interval depending on the time of day, but monitors information traffic without limiting the maximum time for observing and evaluating the structure of information arrays, while a large number of information arrays coming from users are real - multifunctional, complex and manageable information (information and computing or telecommunication systems), can change their state in the dynamics of traffic (requirements for the quality, volume and timeliness of monitoring information traffic, for example, the current requirements for the values of the maximum analysis time, can change dynamically), under the influence of control actions on the information system based on the current requirements of subscribers or under the influence of various external factors.

This excludes the use of the prototype for timely and dynamic observation and evaluation of information arrays in real conditions, when in the dynamics of the functioning of the information traffic monitoring device within the controlled information (information-computing or telecommunication) system, not only the structure parameters of the estimated information arrays, properties the system itself and the environment, but also the requirements for the quality and timeliness of the implementation of monitoring information traffic [1-5].

The "state of the information array (input information flow)" is understood as a set of parameter values that characterize these arrays (structure, intensity of arrival, priorities of the information flow) at a particular moment in time.

The "maximum time for the analysis interval of information arrays" is understood as the maximum time for the implementation of a specific stage (cycle, interval) of monitoring information traffic in accordance with a given scenario (algorithm).

The aim of the invention is to develop a device for monitoring information traffic, providing an expansion of the scope of its application by implementing the possibility of analyzing the state of information arrays (input information flow) under conditions inherent in the real process of information exchange within the investigated (controlled) information (information-computing or telecommunication) system - in conditions of continuous dynamics of changing the parameters of observation and assessment of the state of information arrays, taking into account the influencing factors, a device capable of analyzing the input information flow taking into account both the dynamics of control actions or external factors, and the changing value of the key parameter for monitoring information traffic - control time, on based on dynamically adjusted analysis interval times.

This goal is achieved by the fact that a known device for monitoring information traffic, containing a signal generator of the current estimate, a discriminator of zones of values of the estimate, a pulse distributor, a counter of time intervals, a switch, the first and second generators of the search variable, the first and second summing counters, the first and second blocks memory, division unit, classifier, search strategy register, reset signal generator, data display and recording unit, threshold signal change unit, current day timer, truncation threshold generation unit, structural analyzer, third, fourth and fifth memory blocks, time controller is additionally included the analysis interval, intended for decryption, additional comparison, control and code entry, causing new values of the observation time and evaluation of the structure of controlled information arrays within the framework of dynamic correction of the information traffic monitoring time. In this case, the output of the current assessment signal generator is connected to the control input of the switch, the outputs "Change of the situation state - Measure" and "No change of the situation state - Ots" of which are connected to the inputs of the first and second search variable generators, the output of the second search variable generator is connected to the information input of the second totalizing counter, the output of which is connected to the information input of the second memory block and the second information input of the division unit, the output of which is connected to the information input of the classifier, the outputs "Change of the situation state - P" and "No change of the state of the situation - O" which are connected to the inputs of the same name of the reset signal generator and to the inputs of the same name of the data display and recording unit, the "Reset" output of the reset signal generator is connected to the "Reset" input of the first memory block, the "Reset" input of the second memory block, the "Reset" input of the time intervals counter and the "Reset" input formation block n truncation threshold, the output "Maximum number of the time interval - N _max " which is connected to the same inputs of the search strategy register, the first and second generators of the search variable, the output of the first generator of the search variable is connected to the information input of the first summing counter, the output of which is connected to the first information input of the block divisions, the outputs "Change in the state of the situation - Measure" and "No change in the state of the situation - Ots" of the discriminator of zones of evaluation values are connected to the inputs of the same name of the switch, the first output of the pulse distributor is connected to the synchronization inputs of the signal generator of the current evaluation and the discriminator of zones of evaluation values, as well as to clock input of the counter of time intervals, the output "Number of the current time interval - N _tech " which is connected to the inputs of the same name of the truncation threshold formation unit and the search strategy register, outputs "Value of the upper classification threshold - P _clv " and "Value of the lower threshold of cl assifications - P _cln "which are connected to the classifier inputs of the same name, the second output of the pulse distributor is connected to the synchronizing input of the switch, the third output of the pulse distributor is connected to the synchronization inputs of the first and second memory blocks, the outputs of the first and second memory blocks are connected to the signal inputs of the first and second, respectively totalisers, the fourth pulse distributor output connected to the clock input of the classifier outputs "upper value search threshold - P _a" and "low value search threshold - P _n" threshold signal change unit connected eponymous input register search strategies and to the like input forming a threshold unit truncation, inputs "Start" and "Threshold" of the block for changing the threshold signals are connected to the inputs of the same name of the block for forming the truncation threshold and are respectively the inputs "Start" and "Threshold" of the device, input "Numerical value of one - 1", input "Maximum number of the time interval - N _max ", and the input" Sample size of the analysis interval -V _select "of the truncation threshold formation block are the device inputs of the same name, the" Zone 1 "input of the first search variable generator and the" Zone 2 "input of the second search variable generator are respectively the" Zone 1 "inputs and "Zone 2" of the device, input "Deterministic combination", input "Unknown attribute", input "Seeking attribute" and input "Address of unknown attribute - NP address" of the display and data recording unit are connected to the outputs of the same name of the structural analyzer, output "Address" which is connected to the same inputs of the third, fourth and fifth memory blocks, the "Data 1" output of the third memory block is connected to the same inputs of the data display and recording unit and the structural analyzer, the "Data 2" output of the fourth memory block and the "Data 3" output of the fifth block memories are connected to the inputs of the same name of the structural analyzer, the output "Clock pulses" of which is connected to the inputs of the same name of the fourth and fifth blocks memory, the "Data 1 - write" output, the "Data 2 - write" output and the "Data 3 - write" output of the data display and recording unit are connected to the same inputs of the third, fourth and fifth memory blocks, the "Address 3 - write" output of the block data display and recording is connected to the same-name input of the fifth memory block, the "Address 1, 2-write" output of the display and data recording unit is connected to the same-name inputs of the third and fourth memory blocks, information and synchronizing inputs of the structural analyzer are information and synchronizing inputs of the device, respectively. The Time output of the current day timer is connected to the same inputs of the current assessment signal generator, the assessment value zone discriminator, the impulse distributor, the data display and recording unit, the threshold signal change unit and the analysis interval time controller, the information output of the structural analyzer is connected to the information input of the time controller analysis interval, the information output of which is connected to the information inputs of the current estimation signal generator and the discriminator of the estimation value zones, the correction input of the analysis interval time controller is the input "Analysis interval time correction" of the device.

The analysis interval time controller consists of a decoder of the corrected analysis interval time code and a comparison-correction register of the analysis interval time, while the input of the corrected analysis interval time code decoder is the correcting input of the analysis interval time controller and the input "Analysis interval time correction" of the device, the output of the corrected decoder of the analysis interval time code is connected to the check input of the analysis interval time comparison-correction register, the information input of which is the information input of the analysis interval time controller, and the information output of the analysis interval time comparison-correction register is the information output of the analysis interval time controller, the input for setting the current time of day the comparison-correction register of the analysis interval time is the "Time" input of the analysis interval time controller.

Thanks to a new set of essential features, due to the introduction of an analysis interval time controller designed for decryption, additional comparison, control and code input, which determines new values of the observation time and evaluation of the structure of controlled information arrays within the framework of dynamic correction of the monitoring time of information traffic, the claimed device achieves the possibility of expanding the scope of application of the device in conditions inherent in the real process of information exchange within the investigated (controlled) information (information-computing or telecommunication) system - in conditions of continuous dynamics of changing the observation parameters and assessing the state of information arrays, taking into account influencing factors, devices, able to analyze the input information flow, taking into account both the dynamics of control actions or external factors, and the changing value of the key monitoring parameter information traffic - control time, based on dynamically adjusted values of the analysis interval time.

The claimed device is illustrated by drawings, which show:

in fig. 1 is a block diagram of a device for monitoring information traffic;

in fig. 2 is a block diagram of an analysis interval time controller;

in fig. 3 is a block diagram of a structural analyzer;

in fig. 4 is a flow chart of the data display and recording unit.

The traffic monitoring device shown in FIG. 1, contains a signal generator of the current evaluation 1, a discriminator of zones of evaluation values 2, a distributor of pulses 3, a counter of time intervals 4, a switch 5, the first 6 and second 7 generators of the search variable, the first 8 and second 9 summing counters, the first 10 and second 11 blocks memory, dividing unit 12, classifier 13, search strategy register 14, reset signal generator 15, data display and recording unit 16, threshold signal change unit 17, current day timer 18, truncation threshold generation unit 19, structural analyzer 20, third 21, the fourth 22, the fifth 23 memory blocks and the time controller of the analysis interval 24.

The output 014 of the current assessment signal generator 1 is connected to the control input 54 of the switch 5, outputs 56 "Change in the state of the situation - Measure" and 57 "No change in the state of the situation - Ots" of which are connected to inputs 62 and 71, respectively, of the first 6 and second 7 generators of the search variable , the output 74 of the second generator of the search variable 7 is connected to the information input 92 of the second totalizing counter 9, the output 91 of which is connected to the information input 111 of the second memory unit 11 and the second information input 122 of the division unit 12, the output 123 of which is connected to the information input 136 of the classifier 13, outputs 132 "Change in the state of the situation - P" and 133 "No change in the state of the situation - O" which are connected respectively to the same inputs 151 and 152 of the reset signal generator 15 and to the same inputs 169 and 1610 of the data display and recording unit 16, output 153 "Reset "Of the reset signal generator 15 is connected to the input 103" Reset "first th memory block 10, input 114 "Reset" of the second memory block 11, input 43 "Reset" of the counter of time intervals 4 and input 1910 "Reset" of the block for forming the truncation threshold 19, output 198 "Maximum number of the time interval - N _max " which is connected to to the inputs of the same name 145, 64 and 73, respectively, of the search strategy register 14, the first 6 and second 7 generators of the search variable, the output 63 of the first generator of the search variable 6 is connected to the information input 81 of the first summing counter 8, the output of which is connected to the first information input 121 of the division unit 12, outputs 024 "Change in the state of the situation - Measure" and 025 "No change in the state of the situation - Ots" of the discriminator of zones of evaluation values 2 are connected respectively to the same inputs 52 and 53 of switch 5, the first output 31 of the pulse distributor 3 is connected to synchronization inputs 013 and 023 respectively, the signal generator of the current estimate 1 and the discriminator of the zones of values of the estimate 2, as well as to the tact input 41 of the counter of time intervals 4, output 42 "Number of the current time interval - N _tech " which is connected to the same inputs 199 and 146, respectively, of the block for forming the truncation threshold 19 and the search strategy register 14, outputs 143 "Value of the upper classification threshold - P _clv " and 144 "The value of the lower classification threshold - P _cln " which are connected to the same inputs 134 and 135 of the classifier 13, the second output 32 of the pulse distributor 3 is connected to the synchronizing input 51 of the switch 5, the third output 33 of the pulse distributor 3 is connected to the synchronization inputs 102 and 112 of the first 10 and second 12 memory blocks, outputs 101 and 113, respectively, of the first 10 and second 11 memory blocks are connected to the signal inputs 83 and 93, respectively, of the first 8 and second 9 summing counters, the fourth output 34 of the pulse distributor 3 is connected to the synchronizing input 131 of the classifier 13, the outputs 172 "The upper value of the search threshold - P _in " and 173 "The lower value of the threshold search - P _n "of the block for changing the threshold signals 17 are connected, respectively, to the like inputs 141 and 142 of the search strategy register 14 and, respectively, to the like inputs 196 and 197 of the block for forming the truncation threshold 19, the inputs 174" Start "and 175" Threshold "of the block for changing the threshold signals 17 are connected to the same inputs 191 and 192 of the block for forming the cutoff threshold 19 and are, respectively, inputs "Start" and "Threshold" of the device, input 193 "Numerical value of one - 1", input 194 "Maximum number of the time interval - N _max ", and input 195 "Sample size of the analysis interval - V _select " of the block for forming the truncation threshold 19 are the device inputs of the same name, the input 61 "Zone 1" of the first generator of the search variable 6 and the input 72 "Zone 2" of the second generator of the search variable 7 are, respectively, the inputs "Zone 1" and "Zone 2" of the device, input 161 "Deterministic combination", input 162 "Unknown attribute", input 163 "Searched attribute" and input 164 "Address of unknown attribute - NP address "of the display and data recording unit 16 are connected, respectively, to the same outputs 209, 2010, 2011 and 2012 of the structural analyzer 20, the output 204" Address "of which is connected to the same inputs 214, 224 and 234, respectively, of the third 21, the fourth 22 and the fifth 23 memory blocks, the output 213 "Data 1" of the third memory block 21 is connected to the same inputs 165 and 201, respectively, of the display and recording unit 16 and the structural analyzer 20, output 223 "Data 2" of the fourth memory block 22 and output 233 "Data 3" of the fifth of the memory unit 23 are connected, respectively, to the like inputs 202 and 203 of the structural analyzer 20, the output 205 "Clock pulses" of which is connected to the like inputs 225 and 235, respectively, of the fourth 22 and the fifth 23 memory blocks, output 166 "Data 1 - record", output 167 " Data 2 - record "and output 168" Data 3 - record "of the display and data recording unit 16 are connected to the same inputs 211, 221 and 231, respectively, of the third 21, fourth 22 and fifth In addition, 23 memory blocks, output 1611 "Address 3 - write" of the display and data recording unit 16 is connected to the same input 232 of the fifth memory block 23, output 1613 "Address 1, 2 - write" of the display and data recording unit 16 is connected to the same inputs 212 and 222, respectively, of the third 21 and fourth 22 memory blocks, the informational 207 and the synchronizing 208 inputs of the structural analyzer 20 are, respectively, the information and synchronizing inputs of the device. The output 181 "Time" of the current day timer 18 is connected to the inputs of the same name 011, 022, 35, 1612, 171 and 241, respectively, of the signal generator of the current estimate 1, the discriminator of the zones of values of the estimate 2, the distributor of pulses 3, the data display and recording unit 16, the change unit threshold signals 17 and the time controller of the analysis interval 24, the information output 206 of the structural analyzer 20 is connected to the information input 242 of the time controller of the analysis interval 24, the information output 243 of which is connected to the information inputs 012 and 021, respectively, of the signal generator of the current estimate 1 and the discriminator of the zones of values of the estimate 2 , the correction input 244 of the analysis interval time controller 24 is the "Analysis interval time correction" input of the device.

The time controller of the analysis interval 24 (Fig. 2) is intended for decryption, additional comparison, control and input of a code that causes new values of the observation time and evaluation of the structure of controlled information arrays within the framework of dynamic correction of the monitoring time of information traffic.

The time controller of the analysis interval 24 (Fig. 2) consists of a decoder of the corrected time code of the analysis interval 24.1 and a register of comparison-correction of the analysis interval time 24.2. In this case, the input 24.1-1 of the decoder of the corrected code of the analysis interval time 24.1 is the correction input 244 of the analysis interval time controller 24 and the input "Correction of the analysis interval time" of the device. The output 24.1-2 of the decoder of the corrected time code of the analysis interval 24.1 is connected to the check input 24.2-2 of the register of comparison-correction of the time of the analysis interval 24.2, the information input 24.2-4 of which is the information input 242 of the time controller of the analysis interval 24, and the information output 24.2-3 of the register comparison-correction of the time of the analysis interval 24.2 is the information output 243 of the time controller of the analysis interval 24. The input for setting the current time of day 24.2-1 of the register of comparison-correction of the analysis interval time 24.2 is the input 241 "Time" of the time controller of the analysis interval 24.

The decoder of the corrected time code of the analysis interval 24.1 of the time controller of the analysis interval 24 is intended for converting the decimal code, which determines the new value of the observation time and the estimation of the parameters of the monitored information flows (arrays) introduced in the control process, as part of the dynamic correction of the monitoring time of information traffic, into a binary code ... The decoder of the corrected time code of the analysis interval 24.1 can be technically implemented in the form of a commercially available linear decoder described in [Averchenkov O.E. Circuitry: hardware and software. - M .: DMK Press, 2012. - 588 p., S. 388-389].

The register of comparison-correction of the analysis interval 24.2 time controller of the analysis interval 24 is intended for additional verification (comparison) of the correspondence of the analysis time with the initial and newly introduced observation times and estimation of the parameters of the controlled information flows (arrays), the formation (input, retransmission based on the comparison results) of the signal launch and operation of the entire device in accordance with the new analysis interval time, taking into account the correction, as well as registration (recording) and storage of a new value of the analysis interval introduced in the dynamics of information traffic monitoring. The register comparison-correction of the analysis interval time 24.2 can be implemented technically on the basis of a commercially available comparison unit (digital comparator), as shown in [E. Ugryumov. Digital circuitry: textbook. manual for universities. - 3rd ed., Rev. and add. - SPb .: BHV-Petersburg, 2010 .-- 816 p., Pp. 102-104, fig. 2.6].

The generator of signals of the current estimate 1, which is included in the general block diagram, is intended to generate at the end of the current corrected analysis interval a binary signal characterizing the state of the situation and taking the values "Measure" or "Ots". The structure of the signal generator of the current evaluation 1, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 2).

The discriminator of zones of values of assessment 2, included in the general structural diagram, is designed to generate a signal about the zone number of the state in which the input information flow of the corresponding intensity is located. The structure of the discriminator of zones of values of assessment 2, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 3).

Pulse distributor 3, included in the general block diagram, is designed to synchronize the operation of the entire device by forming four pulse sequences, shifted relative to each other by some value Δt. The structure of the impulse distributor 3, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 4).

The counter of time intervals 4, included in the general structural diagram, is designed to count the number of observed time intervals and issue a combination about the number of the time interval "N _tech ". The counter of time intervals 4 can be technically implemented on the basis of a commercially available totalizing counter with a controlled reset, the circuit of which is known and described, for example, in [Ugryumov E.P. Digital circuitry: textbook. manual for universities. - 3rd ed., Rev. and add. - SPb .: BHV-Petersburg, 2010.-816 p., S. 247-248, fig. 3.47].

The switch 5, included in the general block diagram, is intended for switching the signal about the zone number to the input of the corresponding generator of the search variable according to the control signal coming from the generator of signals of the current estimate 1 and taking the values "Measure" and "Ots". The structure of the switch 5, the algorithm of its operation are known, are described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 5).

The first 6 and second 7 generators of the search variable included in the general block diagram are intended to construct the increments of the posterior integral probability distribution functions of the normal F _O (N) (the first generator of the search variable 6) and the rejected F _P (N) (the second generator of the search variable 7 ) the state of the input information flow on the N-th observation interval. The schemes of the first 6 and second 7 generators of the search variable are identical, their structure, as well as operating algorithms are known, are described in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 6).

The first 8 and the second 9 summing counters included in the general block diagram are designed to add the values of the increments F _O (N) and F _P (N) with the corresponding values of the empirical cumulative distribution function calculated for N-1 time interval F _O (N-1 ) and F _P (N-1). The first 8 and the second 9 summing counters are sequential multi-digit arithmetic adders, the circuits of which are known and described, for example, in [Milovzorov OV, Pankov I.G. Fundamentals of electronics: a textbook for open source software. - 5th ed., Rev. and add. - M .: Yurayt Publishing House, 2016 .-- 407 p., Pp. 182-183, fig. 3.38].

The first 10 and the second 11 blocks of memory included in the general block diagram are designed to store the increments F _O (N) and F _P (N) during one corrected analysis interval. The first 10 and the second 11 memory blocks are identical and can be implemented technically on the basis of commercially available universal registers of parallel action, the circuits of which are known and described, for example, in [Milovzorov OV, Pankov I.G. Fundamentals of electronics: a textbook for open source software. - 5th ed., Rev. and add. - M .: Yurayt Publishing House, 2016 .-- 407 p., Pp. 206-207, fig. 3.52].

The division unit 12, included in the general block diagram, is designed to divide the increment F _P (N) by the increment F _O (N) and output the likelihood ratio. The division unit 12 is a device for dividing two n-bit binary numbers without restoring the remainder, the scheme of which is known and described in [KP Bocharov, NN Nemshilov, EI Petrov, LI Sulin. Computing complexes of automated control systems. - L .: VAS, 1984 .-- 368 p., S. 88-90, fig. 3.24].

The classifier 13, included in the general block diagram, is designed to generate signals "Measure" or "Ots" based on the comparison of the input information with threshold values. The structure of the classifier 13, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 7).

The search strategy register 14, included in the general block diagram, is intended to form interval or point values of classification thresholds, depending on whether the number of the search interval is the limit or not. The structure of the search strategy register 14, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 8).

The reset signal generator 15, included in the general block diagram, is intended for combining the signals "Measure" and "Ots", their amplification and matching with subsequent blocks. The reset signal shaper 15 can be implemented technically on the basis of a commercially available two-input OR circuit, the structure and operation algorithms of which are known and described, for example, in [Averchenkov O.E. Circuitry: hardware and software. - M .: DMK Press, 2012 .-- 588 p., Pp. 39-40, fig. 1.22].

The data display and recording unit 16, included in the general block diagram, is designed to display information about the presence of the sought and unknown deterministic combinations and changes in the intensity of the input information flow, recording not previously defined known deterministic combinations into the fourth memory unit 22 with a simultaneous change in the third memory unit 21 values about the number of known deterministic combinations stored in the cells of the fourth memory block 22, writing undetermined previously sought deterministic combinations into the fifth memory block 23. Writing to the third 21, fourth 22 and fifth 23 memory blocks is carried out at the address determined by the hash function calculator 20.13 of the structural analyzer 20. The structure of the unit for displaying and recording data 16 is known, described in detail in the prototype (see RF patent No. 2290691 "Device for monitoring information traffic" IPC G06F 17/18, G06F 17/30, published on 27.12.2006, bull. 36), this block can be implemented technically ski on the basis of a microprocessor, as shown in [Ugryumov E.P. Digital circuitry: textbook. manual for universities. - 3rd ed., Rev. and additional - SPb .: BHV-Petersburg, 2010. - 816 p., pp. 378-384, fig. 6.21]. The operating algorithm of the data display and recording unit 16 is known, described in detail in the prototype and illustrated in FIG. 3 of this description.

The block for changing the threshold signals 17, included in the general block diagram, is designed to change the values of the threshold signals depending on the time of day. The structure of the block for changing the threshold signals 17, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 21166670 "Information retrieval device", IPC G06F 17/30, published on 07.04.1997, Fig. 9).

The current day timer 18, included in the general block diagram, is designed to set the time of day for the entire device. The structure of the current day timer 18 is known, described in the prototype (see RF patent No. 2290691 "Device for monitoring information traffic" IPC G06F 17/18, G06F 17/30, published on December 27, 2006, Bul. No. 36), it can be implemented technically according to the programmable interval timer scheme, as shown in [E. Ugryumov. Digital circuitry: textbook. manual for universities. - 3rd ed., Rev. and add. -SPb .: BHV-Petersburg, 2010. - 816 p., S. 486-493, fig. 7.22].

The block for forming the truncation threshold 19, included in the general block diagram, is designed to correct the value of the maximum number of the time interval "N _max " adequately to the input information flow throughout the entire corrected analysis interval. The structure of the block for the formation of the truncation threshold 19, as well as the algorithm of its operation are known and described in detail in (see RF patent No. 2149446 "Information retrieval device", IPC G06F 17/30, published 20.05.2000, bull. No. 14, Fig. 2) ...

Structural analyzer 20, included in the general block diagram, is designed to generate a trigger signal for the operation of the entire device, hashing and recognition of the sought and unknown deterministic combinations. The diagram of the structural analyzer 20 is known, described in detail in the prototype (see RF patent No. 2290691 "Device for monitoring information traffic" IPC G06F 17/18, G06F 17/30, published on December 27, 2006, bull. No. 36, Fig. 2) and illustrated in fig. 3 of this description. Structural analyzer 20 (see Fig. 3) contains an input register 20.1, a decoder 20.2, the first 20.3, the second 20.5 and the third 20.15 parallel registers, the counter 20.4, the first 20.6, the second 20.8 and the third 20.12 comparators, the first 20.7 and the second 20.17 elements And, element NOT 20.9, the first element 20.10 and the second element 20.11 OR, calculator hash function 20.13, RS-flip-flop 20.14 and pulse generator 20.16.

The third memory block 21, included in the general structural diagram, is designed to store pre-programmed values about the number of known deterministic combinations stored in the cells of the fourth memory block 22. The technical implementation of the third memory block 21 is possible on the basis of a register with read-only memory functions, a description of the operation and the scheme of such registers are known and are given, for example, in the book [Averchenkov O.E. Circuitry: hardware and software. - M .: DMK Press, 2012. - 588 p., S. 443-445].

The fourth memory block 22, included in the general block diagram, is intended for storing pre-programmed known deterministic combinations. The fourth memory block 22 is a register with the functions of a read-only memory, the circuit of which is known and described in [Averchenkov O.E. Circuitry: hardware and software. - M .: DMK Press, 2012. - 588 p., S. 443-445].

The fifth memory block 23, included in the general block diagram, is intended for storing the pre-programmed desired deterministic combinations. The technical implementation of the fifth memory block 23 is possible on the basis of a register with read-only memory functions, a description of the operation and a diagram of such registers are known and are given, for example, in [Averchenkov O.E. Circuitry: hardware and software. - M .: DMK Press, 2012. - 588 p., S. 443-445].

The device for monitoring information traffic operates as follows.

It is known [1-3] that from the point of view of expanding the scope of control devices, evaluating (monitoring) the traffic of complex information (information and computing or telecommunication) systems under conditions inherent in the real process of their functioning - under conditions of objectively changing in time not only properties traffic, the properties of the system itself and the environment, but also the requirements for the analysis parameters of the state of information arrays (input information flow), it is possible to vary the values of the key parameter for monitoring information traffic - the control time, based on the principle of dynamic correction of the analysis interval time values.

Obviously, when observing and assessing the state of controlled information arrays, not only the control actions on the input information flow, the information (information and computing or telecommunication) system itself or external factors, but also the current requirements for the monitoring time of information traffic, objectively change in time. Under these conditions, it is difficult to reliably analyze the input information flow, which directly depends on the dynamics of changes in time parameters, modes and methods of implementation of information traffic monitoring procedures, on the dynamics of internal and external influences on the controlled system, as well as on the dynamics of changes in requirements, goals and monitoring tasks. specific to the situation.

Analysis of works [1-5] devoted to algorithms and principles of control, estimation (monitoring) of traffic of complex information (information and computing or telecommunication) systems, allows us to conclude that it is possible to expand the scope of the device for monitoring information traffic based on the technical implementation of the principle of dynamic correction of values time of the analysis interval under conditions of continuous dynamics of changing the states of the input information flow, the states of the system generating this flow and taking into account the influencing factors.

The construction of a device for monitoring information traffic based on the proposed principle of operation allows to expand the scope of the device, to gain an advantage over the prototype, providing an analysis of the input information flow when the traffic parameters can change the values of their states under the influence of control actions (current requirements) or external factors.

The technical implementation of the principle of dynamic correction of the analysis time within the framework of monitoring information traffic in the claimed device was carried out by introducing external dynamic control of the analysis interval time (in the declared device - the input "Correction of the analysis interval time" of the device) and introducing registration, control and dynamic correction of the information traffic monitoring time (in the claimed device are implemented within the time controller of the analysis interval 24).

At the same time, as in the prototype, the claimed device implements the possibility of ensuring a high speed of searching for combinations of the beginning of messages and increasing the information content of traffic indicators characterizing the structure of information arrays. These capabilities are described in detail in the prototype (see RF patent No. 2290691 "Device for monitoring information traffic" IPC G06F 17/18, G06F 17/30, published on 27.12.2006, Bul. No. 36) and are implemented by adjusting the value of the maximum number of the time interval to throughout the analysis and due to the structural analysis of deterministic combinations.

Taking this into account, the information traffic in the claimed device is monitored with dynamic correction of the analysis interval time values.

The input information stream, synchronized with the clock pulses, is fed to the information input 207 of the structural analyzer 20 (FIG. 1).

In this case, the clock pulses synchronizing the input information flow initially (before the introduction of the correction) fix the current (initial, starting) time of the traffic analysis interval of the controlled complex information (information-computing or telecommunication) system.

Structural analyzer 20 (Fig. 3) generates a signal to start the operation of the entire device in the presence of a combination of the beginning of a message in the input information stream, and also searches for unknown and predetermined sought deterministic combinations and, if any, issues a corresponding signal to the output 2010 "Unknown attribute "Or output 2011" Searched feature ", as well as from its output 209 to input 161" Deterministic combination "of the data display and recording unit 16. The object of recognition for the current analysis interval are the sought and unknown deterministic combinations in the input information stream. Each deterministic combination representing a n-bit binary number is divided by a predetermined n-bit binary number with a remainder. The remainder is the hash value. According to the found value of the hash function, which is the address, in the fourth memory block 22, pre-programmed known deterministic combinations are found, they are compared with the received deterministic combination for the presence of a match. In case of mismatch of none of the deterministic combinations stored in the fourth memory block 22 with the received one, the signal "Unknown sign" is displayed, which is displayed by the data display and recording unit 16. Also, according to the found hash value, which is an address, in the fifth memory block 23 pre-programmed sought ones are found deterministic combinations and compare them with the received deterministic combination for coincidence. In case of coincidence of one of the deterministic combinations stored in the fifth memory block 23 with the received one, the signal "Seeking Sign" is issued, which is displayed by the data display and recording unit 16.

In the input register 20.1 of the structural analyzer 20 (Fig. 3), the deterministic combination under the action of sync pulses is converted from a serial code to a parallel one and enters the information input 20.2-1 of the decoder 20.2, the information input 20.3-2 of the first parallel register 20.3 and the information input 20.13-1 of the calculator hash functions 20.13.

In the decoder 20.2 of the structural analyzer 20 (see Fig. 3), when a combination of the beginning of the message appears at strictly defined output bits and at the output 20.1-3 of the input register 20.1, and then, after decryption, at the output 20.2-2 of the decoder 20.2, a start signal is generated of the whole device, which is fed to the control input 20.3-1 of the first parallel register 20.3, input 20.4-2 "Reset" of the counter 20.4, triggering input 20.13-2 of the hash function calculator 20.13, input 20.14-2 "Setting 1" of the RS-flip-flop 20.14 and to the information output 206 of the structural analyzer 20.

According to this signal, the deterministic combination from the output 20.1-3 of the input register 20.1, in addition to the decoder, is written into the first parallel register 20.3 and into the calculator of the hash function 20.13, at the output of the RS-flip-flop 20.14 according to the signal from the decoder 20.2, the level of a logical unit is set. In the first parallel register 20.3, the deterministic combination is stored for one initial (start) analysis interval. From the output 20.3-3 of the first parallel register 20.3, the deterministic combination is fed to the information input 20.5-2 of the second parallel register 20.5 and the first inputs 20.8-1 and 20.12-1, respectively, of the second 20.8 and third 20.12 comparators.

The counter 20.4 of the structural analyzer 20 (see Fig. 3) counts the number of clock pulses arriving at its input 20.4-1 from the output 20.17-3 of the second element AND 20.17, and gives a combination to the first comparator 20.6 about the number of received known deterministic combinations from the fourth memory block 22 into the structure analyzer 20 during one initial (start) analysis interval.

In the first comparator 20.6 of the structural analyzer 20 (see Fig. 3), under the action of clock pulses arriving at its control input 20.6-3 from the second element AND 20.17, the operation of comparing two combinations representing two m-bit binary numbers is performed, the first of which comes from the output 20.4-3 of the counter 20.4 to the first input 20.6-1 of the first comparator 20.6, and the second from the output 213 "Data 1" of the third memory block 21 to the second input 20.6-2 of the first comparator 20.6, and if there is a match, at the output 20.6-4 "Equality - A = B" the signal "1" is generated, which is fed to the first input 20.7-1 of the first element And 20.7.

In the second comparator 20.8 of the structural analyzer 20 (see Fig. 3), under the action of clock pulses arriving at its control input 20.8-3 from the second element AND 20.17, an operation is performed for comparing two deterministic combinations, which are two n-bit binary numbers, the first of which comes from the output 20.3-3 of the first parallel register 20.3 to the first input 20.8-1 of the second comparator 20.8, and the second from the output 223 "Data 2" of the fourth memory block 22 to the second input 20.8-2 of the second comparator 20.8, and if there is a match , at the output 20.8-4 "Equality -A = B" of the second comparator 20.8, a signal "1" is generated, which is fed to the second input 20.11-2 of the second element OR 20.11 and to the input 20.9-1 of the element NOT 20.9.

In the absence of a signal "1" (see Fig. 3) at the output 20.8-4 "Equality - A = B" of the second comparator 20.8, at the output 20.9-2 of the element NOT 20.9, a signal "1" is generated, arriving at the second input 20.7-2 of the first element AND 20.7. In this case, if there is a signal "1" at the first input 20.7-1 of the first element And 20.7, coming from the output 20.6-4 "Equality - A = B" of the first comparator 20.6, the signal "1" is generated at the output 20.7-3 of the first element And 20.7 , arriving at the first inputs 20.10-1 and 20.11-1, respectively, of the first 20.10 and the second 20.11 OR elements, the control input 20.15-2 of the third parallel register 20.15 and through the output 2010 "Unknown attribute" of the structural analyzer 20 to the input 162 "Unknown attribute" of the display unit and data records 16.

When a signal "1" (see Fig. 3) arrives at any input of the first element OR 20.10 from the output 20.7-3 of the first element And 20.7 or output 20.12-4 "Equality - A = B" of the third comparator 20.12, a signal is generated at its output "1" arriving at the control input 20.5-1 of the second parallel register 20.5. According to this signal, the deterministic combination is written into the second parallel register 20.5 and is fed through the output 209 "Deterministic combination" of the structural analyzer 20 to the input 161 "Deterministic combination" of the display and data recording unit 16.

When a signal "1" (see Fig. 3) arrives at any of the three inputs of the second element OR 20.11 from the output 20.7-3 of the first element AND 20.7, outputs 20.8-4 and 20.12-4 "Equality - A = B", respectively, of the second 20.8 or the third 20.12 comparators, at its output a signal "1" is generated, which is fed to the input 20.14-1 "Setting 0" of the RS-flip-flop 20.14. According to this signal, the RS-flip-flop 20.14 stops generating a signal "1" at the input 20.17-2 of the second element AND 20.17, while clock pulses stop arriving from the output 20.17-3 of the second element And 20.17, the work of the structural analyzer 20 at this analysis interval ends.

In the third comparator 20.12 (see Fig. 3), under the action of clock pulses arriving at the control input 20.12-3 from the second element AND 20.17, the operation of comparing two deterministic combinations is performed, which are two "-bit binary numbers, the first of which comes from output 20.3-3 of the first parallel register 20.3 to the first input 20.12-1 of the third comparator 20.12, and the second number from the output 233 "Data 3" of the fifth memory block 23 (see Fig. 1) to the second input 20.12-3 of the third comparator 20.12, and, if there is a match, at the output 20.12-4 "Equality - A = B" of the third comparator 20.12, a signal "1" is generated, which is fed to the second input 20.10-2 of the first element OR 20.10, the third input 20.11-3 of the second element OR 20.11 and through the output 2011 "Seeking feature" of the structural analyzer 20 to the input 163 "Seeking feature" of the data display and recording unit 16.

The calculator of the hash function 20.13 of the structural analyzer 20 (see Fig. 3) divides the deterministic combination received at its information input 20.13-1, which is an n-bit binary number, by a predetermined n-bit binary number by the method of restoring the remainder, which is the value hash function and is also an n-bit binary number, which is fed to the information input 20.15-1 of the third parallel register 20.15 and through the output 204 "Address" of the structural analyzer 20 (see Fig. 1) to the inputs 214, 224 and 234 " Address ", respectively, of the third 21, the fourth 22 and the fifth 23 memory blocks.

RS-flip-flop 20.14 structural analyzer 20 (see Fig. 3) controls the operation of the second element And 20.17, performing the function of a key. RS-flip-flop 20.14 unlocks the key (second element I 20.17) when the signal "1" appears at input 20.14-2 "Setting 1" and locks it when the signal "1" appears at input 20.14-1 "Setting 0".

When the signal "1" (see Fig. 3) arrives at the control input 20.15-1 of the third parallel register 20.15, the address generated by the calculator of the hash function 20.13 is written to the third parallel register 20.15 and from its output 20.15-3 through the output 2012 "Address NP "of the structural analyzer 20 is fed to the input 164" Address NP "(see Fig. 1) of the display and data recording unit 16.

The pulse generator 20.16 of the structural analyzer 20 (see Fig. 3) generates pulses that are fed to the second input 20.17-1 of the second element And 20.17. From the output 20.17-3 of the second element I 20.17, if there is a signal "1" at the first input from the output 20.14-3 of the RS-flip-flop 20.14, clock pulses are fed to the information input 20.4-1 of the counter 20.4, to the control inputs 20.6-3, 20.8-3 and 20.12-3, respectively, of the first 20.6, the second 20.8 and the third 20.12 comparators, as well as to inputs 225 and 235 "Clock pulses" (see Fig. 1), respectively, of the fourth 22 and fifth 23 memory blocks of the device.

From the output 213 of the third memory block 21 of the structural analyzer 20 (see Fig. 3), the preprogrammed values about the number of known deterministic combinations located in the cells of the fourth memory block 22 at the address coming from the output 20.13-3 of the hash function calculator 20.13 are read into second input 20.6-2 of the first comparator 20.6. From the output 223 of the fourth memory block 22, the pre-programmed known deterministic combinations located at the address coming from the 20.13-3 output of the hash function calculator 20.13 are sequentially read under the action of clock pulses coming from the output 20.17-3 of the second element AND 20.17, to the second input 20.8-2 of the second comparator 20.8. From the output 233 of the fifth memory block 23, the preprogrammed desired deterministic combinations located at the address coming from the output 20.13-3 of the hash function calculator 20.13 are sequentially read under the action of clock pulses coming from the output 20.17-3 of the second element AND 20.17, to the second input 20.12-2 of the third comparator 20.12. In this case, the set of known and sought-for deterministic combinations, stored respectively in the fourth 22 and the fifth 23 memory blocks, do not have the same deterministic combinations.

The signal for starting the operation of the entire device from the output 20.2-2 of the decoder 20.2, which is supplied, among other things, to the information output 206 of the structural analyzer 20 (Fig. 3), is generated for the current (initial, starting) time of the traffic analysis interval of the controlled complex information (information and computational or telecommunication) system, when the current (initial, start) time of the traffic analysis interval is set or there is no need to introduce external dynamic control of the traffic analysis time during the monitoring process.

Time correction of the traffic analysis interval in the claimed device is carried out as follows.

If during the monitoring process an external dynamic control of the traffic analysis interval time is initiated, from an external device in decimal code (either with the help of a human operator or with a special control device), through the "Analysis interval time correction" input of the device to the correcting input 244 of the controller time interval analysis 24 (see Fig. 1), new, additionally introduced in the dynamics of control, values of the time interval of traffic analysis.

The analysis interval time controller 24 may be implemented in accordance with the circuit shown in FIG. 2. Dynamic correction of the time values of the monitoring intervals of information traffic is carried out in the time controller of the analysis interval 24 as follows.

New, additionally introduced in the dynamics of the monitoring process, the values of the traffic analysis interval time in decimal code are fed through the correcting input 244 of the analysis interval time controller 24 to the input 24.1-1 of the decoder of the corrected analysis interval time 24.1 time code (see Fig. 2). The decoder of the corrected time code of the analysis interval 24.1 (see Fig. 2) of the time controller of the analysis interval 24, converts the decimal code, which determines the new value of the observation time introduced in the control process and the estimation of the parameters of the controlled information flows (arrays) within the framework of dynamic time correction monitoring of information traffic, in binary code, transfer of this new value from its output 24.1-2 to the test input 24.2-2 of the comparison-correction register of the analysis interval 24.2 for analysis (additional verification), storage and output in binary code through the information output 243 of the controller time of the analysis interval 24 to information inputs 012 and 021, respectively, of the signal generator of the current assessment 1 and the discriminator of the zones of assessment values 2, the start signal of the entire device, taking into account the new, subject to correction, the time value of the traffic analysis interval of the controlled complex information on-computing or telecommunication) system (see. fig. one).

Thus, in the comparison-correction register of the analysis interval 24.2 time controller of the analysis interval 24, an additional check (comparison) of the correspondence of the analysis time with the initial and newly introduced observation and estimation time of the parameters of the controlled information flows (arrays) is carried out, the formation (retransmission based on the results of comparison) the start signal and the operation of the entire device in accordance with the new analysis interval time, taking into account the correction, as well as registration (recording) and storage of a new value of the analysis interval introduced in the dynamics of information traffic monitoring.

In this case, at the information input 242 of the time controller of the analysis interval 24 (see Fig. 2), and therefore at the information input 24.2-4 of the comparison-correction register of the analysis interval 24.2 time, at the moments of time specified by the signals coming from block 18 through the input 241 "Time" of the analysis interval time controller 24 to the input of setting the current time of day 24.2-1 of the comparison-correction register of the analysis interval 24.2 time, there is a signal (from block 20) to start and operate the entire device in accordance with the initial (starting) time of the analysis interval. The register comparison-correction of the analysis interval time 24.2 (see Fig. 2) registers the initial code (recorded when preparing the device for operation, i.e. the initial analysis time) and compares it with the code of the new analysis interval time, which is newly introduced in the control dynamics, which comes through test input 24.2-2.

Moreover, the correction (formation, retransmission based on the comparison results) of the start signal and the operation of the entire device in accordance with the new time of the analysis interval, taking into account the correction, is carried out as follows. If at the test input 24.2-2 of the comparison-correction register of the analysis interval 24.2 there is a signal that determines the new time of the analysis interval entered in the control dynamics, this signal is identified as a priority one, and it is for the new time of the analysis interval that the start and operation signal of the entire device is transmitted. If there is no signal at the check input 24.2-2 of the comparison-correction register of the analysis interval 24.2 time, which causes a new time of the analysis interval entered in the monitoring control dynamics, then the previously recorded values of the code that sets the initial (previous) time of the analysis interval are considered priority.

In addition, the register for comparison-correction of the analysis interval time 24.2 registers (records) and stores in the decimal code the values of the previous analysis interval times until the next control action is introduced.

Thus, from the information output 24.2-3 (see Fig. 2) of the comparison-correction register of the analysis interval 24.2 through the information output 243 of the analysis interval time controller 24 to the information input 012 of the signal generator of the current estimate 1 and to the information input 021 of the discriminator of the value zones evaluation 2 (see Fig. 1), the logical values of the code are received, which sets new values of the analysis interval time introduced in the dynamics of monitoring control. This is, in fact, a signal to start the operation of the entire device, taking into account the new, taking into account the correction, the time value of the traffic analysis interval of the controlled complex information (information and computing or telecommunication) system.

The signal generator of the current estimate 1 and the discriminator of the zones of the values of the estimate 2 analyze the intensity of the input stream on a new, taking into account the correction, analysis time interval. In the signal generator of the current estimate 1 (see Fig. 1), upon completion of a new one, taking into account the correction, the time of the analysis interval, a binary signal is generated that characterizes the state of the situation. If the deviation of the number of message start combinations from the average value to the upper or lower side exceeds the threshold value, the output 014 of the signal generator of the current estimate 1 generates a signal "Measure", in other cases the signal "Ots" is generated. From the output 014 of the signal generator of the current estimate 1, the signal "Measure" or "Ots" is fed to the control input 54 of the switch 5. In the discriminator of zones of values of estimate 2, a signal is generated about the number of the zone of the state in which the input information flow of the corresponding intensity is at a new taking into account the correction, the analysis time interval. This zone number corresponds to a more accurate assessment of the state of the situation in comparison with the assessment obtained in the signal generator of the current assessment 1. From outputs 024 "Measure" or 025 "Ots" of the discriminator of zones of assessment values 2, the signal, respectively, "Measure" or "Ots" is sent to the same inputs 52 "Measure" or 53 "Ots" of the switch 5. In this case, the distributor of pulses 3 synchronizes the operation of the entire device by forming four pulse sequences shifted relative to each other by some value Δt, and the counter of time intervals 4 counts the number of observed new ones, with taking into account the correction, time intervals and outputs from its output 42 a combination about the number of the time interval to the input 146 "N _tech " of the search strategy register 14 and to the input 199 "N _tech " of the block for forming the truncation threshold 19.

The switch 5 (see Fig. 1), in accordance with the control signal from the generator of signals of the current estimate 1, arrives at its control input 54, provides the connection of the signal about the number of the zone of the state "Measure" or "Ots", respectively, to the input 62 of the first generator of the search variable 6 or to the input 71 of the second generator of the search variable 7, where, based on the signal about the zone number K _m (1 <j <m), the largest zone number K _m and the maximum number of observations N _max , the increments F _P (N) and F _{O are} plotted {N) empirical integral functions of the probability distribution of the rejected and normal traffic state at the N-th new, taking into account the correction, observation interval: F _P (N) = K _jn (N) / (K _mn × N _max ) and F _O (N ) = K _j0 (N) / (K _m0 × N _max ), as described in detail in the prototype device (see RF patent No. 2290691 "Device for monitoring information traffic" IPC G06F 17/18, G06F 17/30, published on 27.12. 2006, Bul. No. 36).

In the summing counters 8 and 9 (see Fig. 1), the values of the increments F _P (N) and F _O (N) are compared with the corresponding values of the empirical cumulative distribution function calculated for (N-1) new, with the correction, time interval F _P (N-1) and F _O (N-1), which come from outputs 101 and 113, respectively, of the first 10 and second 11 memory blocks: F _P (N) = F _P (N-1) + F _P (N ) and F _O (N) = F _O (N-1) + F _O (N). The values of F _P (N) and F _O (N) are fed, respectively, to the inputs 121 and 122 of the dividing unit 12, which performs the arithmetic division operation L (N) = F _P (N) / F _O (N) and outputs the likelihood ratio to the information entrance 136 of the classifier 13.

The classifier 13 (see Fig. 1) develops a decision on the state of the situation for a new, taking into account the correction, the time interval based on the comparison of the input information with the threshold values and issues from its outputs 132 or 133 the corresponding signal "P" or "O" to the corresponding inputs 169 or 1610 of the data display and recording unit 16 and to the corresponding inputs 151 or 152 of the reset signal generator 15.

The search strategy register 14 (see Fig. 1) generates the adjusted interval or point values of the classification thresholds depending on whether the number of the new, taking into account the correction, the search time interval is the limit or not. The signal from one of the outputs 143 "P _clv " or 144 "P _cln " of the search strategy register 14 is fed to the corresponding input 134 or 135 of the classifier 13. The reset signal generator 15 generates a "Reset" signal and sends it to the input 43 of the counter 4, inputs 103 and 114, respectively, of the first 10 and second 11 memory blocks, as well as to the input 1910 of the block for forming the truncation threshold 19 to transfer them to their initial state.

The unit for displaying and recording data 16 (see Fig. 1) displays information about the presence of the sought and unknown deterministic combinations in the input information stream and changes in the intensity of the input information stream on a new, subject to correction, analysis time interval when signals are received, respectively, from the structural analyzer 20 and classifier 13. If necessary, the unit for displaying and recording data 16 records previously unknown deterministic combinations into the fourth memory unit 22 and changes in the third memory unit 21 the values N of the number of known deterministic combinations to the values N + 1 stored in the cells of the fourth memory unit 22, and also records previously unselected deterministic combinations in the fifth memory unit 23. The operation algorithm of the data display and recording unit (hereinafter simply the algorithm) is shown in FIG. 4.

In block 1 of the algorithm (see Fig. 4), according to the data received from ports P5 ("Change in the state of the situation - P"), P6 ("No change in the state of the situation - O") and P8 ("Time"), there is a display and recording information about the change in the intensity of the input information flow for a new, taking into account the correction, analysis time interval.

In block 2 of the algorithm, according to the data received from ports P11 ("Determ. Comb."), P12 ("Unknown attribute") and P13 ("Seek. Attribute"), information about the presence of the desired or unknown attribute in the input information stream for a new, adjusted analysis time interval.

In block 3 of the algorithm, based on the information obtained from block 2 of the algorithm, the operator decides whether the deterministic combination is an unknown feature. If yes, then go to block 5 of the algorithm. If not, then go to block 4 of the algorithm.

In block 4 of the algorithm, based on the information received from block 2 of the algorithm and data from port P8 ("Time"), a deterministic combination is recorded, which is a known feature in time.

In block 5 of the algorithm, based on the information received from block 2 of the algorithm and data from ports P1 ("Data 1"), P8 ("Time"), P10 ("NP address"), a deterministic combination is recorded, which is an unknown feature, address determined by the calculator of the hash function 20.13 and data ("Data 1") in time.

In block 6 of the algorithm, the operator makes a decision to write an unknown feature into the area of the desired features. If yes, then go to block 8 of the algorithm. If not, then go to block 7 of the algorithm.

In block 7 of the algorithm, the operator makes a decision to write an unknown feature into the area of known features. If yes, then go to block 9 of the algorithm. If not, then the end.

In block 8 of the algorithm, the deterministic combination is determined as the desired one, and the "NP Address" is determined as the address of this combination.

In block 10 of the algorithm, a command is issued to ports P4 ("Data 3 - write") and P9 ("Address 3 - write"), according to which the combination received from block 8 of the algorithm is written to the fifth memory block 23 at the address received from block 8 of the algorithm.

In block 9 of the algorithm, the deterministic combination is determined as known, the value N stored in the third memory block 21 is changed, about the number of known deterministic combinations stored in the fourth memory block 22 by N + 1, the "NP address" is determined as the address of this combination and this value.

In block 11 of the algorithm, a command is issued to ports P2 ("Data 1 - write"), P3 ("Data 2 - write") and P7 ("Address 1, 2 - write"), in accordance with which the combination and value received from block 9 of the algorithm, are written into the third 21 and fourth 22 memory blocks at the address received from the block 9 of the algorithm.

The adaptation of the new values, taking into account the correction, the time intervals (thresholds) of the search to the time of day is carried out in block 17 (see Fig. 1), at the outputs of which the upper and lower values of the thresholds are formed, depending on the time of day. The current time code comes to its input from the current day timer 18, which sets the time of day for the entire device.

The block for forming the truncation threshold 19 (see Fig. 1) generates a new value "N _max " at the end of the current new, taking into account the correction, the analysis time interval, which is adequate to the characteristics of the input information stream, and issues it from its output 198 to the input 145 "N _max " of the search strategy register 14 and to the inputs 64 and 73 "N _max ", respectively, of the first 6 and second 7 generators of the search variable.

All blocks, devices and elements that process the signal, as well as the lines connecting them, must have a capacity corresponding to the width of the input operands and the accuracy of their transformations.

Thus, the proposed device for monitoring information traffic provides an expansion of the scope of its application due to the implementation of the possibility of analyzing the state of information arrays (input information flow) in conditions inherent in the real process of information exchange within the framework of the investigated (controlled) information (information-computing or telecommunication) system - in conditions of continuous dynamics of changing the parameters of observation and assessment of the state of information flows, taking into account influencing factors. The proposed device has the ability to analyze the input information flow taking into account both the dynamics of control actions or external factors, and the changing value of the key parameter for monitoring information traffic - control time, based on dynamically adjusted values of the analysis interval time.

The expansion of the field of application and analysis of the input information flow, taking into account the changing (adjustable) value of the analysis interval time in the device, is due to the decryption analysis interval 24 implemented in the time controller, additional comparison, control and code input, causing new values of the observation time and evaluation of the structure of controlled information arrays within the framework of dynamic correction of information traffic monitoring time.

This result is due to the receipt (for the current new, taking into account the correction, the analysis time interval) and recording into the display and recording unit of data 16 important for analysis and forecasting quantitative characteristics (parameters, data) of the input information stream, formed taking into account both the dynamics of control actions or external factors and changing (adjustable) in time current requirements for the time parameters of monitoring information traffic.

Analysis of the principle of operation of the claimed device for monitoring information traffic shows the obviousness of the fact that, along with the possibilities stored and described in the prototype to increase the search speed for combinations of the beginning of messages and increase the information content of traffic indicators characterizing the structure of information arrays, the device is capable of analyzing the input information flow under conditions, when, in the dynamics of the operation of a real information (information-computing or telecommunication) system, not only the properties of this system itself and the environment, the properties of the traffic of this system, but also the requirements for one of the main parameters of monitoring information traffic - the time of control (observation and evaluation).

This device allows you to analyze the input information flow in conditions of continuous dynamics of changing its states and taking into account influencing factors, which significantly expands the scope of the device, expands the functionality of control systems focused on quality control of information exchange in complex information (information and computing or telecommunication) systems where the declared traffic monitoring device will be used.

INFORMATION SOURCES

1. Olifer V.G., Olifer N.A. Computer networks. Principles, technologies, protocols. (4th edition) - SPb .: Peter, 2010 .-- 943 p.

2. Wilson E. Monitoring and analysis of networks. - M .: LORI, 2002 .-- 350 p .;

3. Blakhnov L.L., Ignatenkov V.G., Kuznetsov V.E. etc. Infocommunication networks: architecture, technology, standardization / Ed. A.A. Sakhnin. - M .: Radio and communication, 2004. -208 p .;

4. Zarkevich E.A., Sklyarov O.K., Ustinov S.A. Testing and monitoring of parameters in WDM networks. // Technologies and means of communication, No. 2, 2002. P. 10-16;

5. Evlanov L.G. Control of dynamic systems. - M .: Nauka, 1979 .-- 432 p.

Claims (2)

1. A device for monitoring information traffic containing a signal generator of the current assessment (1), a discriminator of zones of assessment values (2), a distributor of pulses (3), a counter of time intervals (4), a switch (5), the first (6) and the second (7 ) search variable generators, the first (8) and second (9) summing counters, the first (10) and second (11) memory blocks, the division unit (12), the classifier (13), the search strategy register (14), the reset signal generator (15), a unit for displaying and recording data (16), a unit for changing threshold signals (17), a timer for the current day (18), a unit for generating a truncation threshold (19), a structural analyzer (20), the third (21), the fourth (22 ) and the fifth (23) memory blocks, while the output (014) of the current assessment signal generator (1) is connected to the control input (54) of the switch (5), outputs (56) "Change in the state of the situation - Measurement" and (57) " The absence of a change in the state of the situation - Ots "which are connected to the inputs (62) and (71), respectively, of the first (6) and second rogo (7) of the search variable generators, the output (74) of the second search variable generator (7) is connected to the information input (92) of the second summing counter (9), the output (91) of which is connected to the information input (111) of the second memory block (11 ) and the second information input (122) of the dividing unit (12), the output (123) of which is connected to the information input (136) of the classifier (13), outputs (132) "Change in the state of the situation - P" and (133) "No change in state situations - O "which are connected respectively to the same inputs (151) and (152) of the reset signal generator (15) and to the same inputs (169) and (1610) of the data display and recording unit (16), the output (153)" Reset " the reset signal generator (15) is connected to the "Reset" input (103) of the first memory block (10), the "Reset" input (114) of the second memory block (11), the "Reset" input (43) of the counter of time intervals (4) and input (1910) "Reset" of the block of forming the truncation threshold (19), output (198) "Maximum number of time interval - N _max "of which is connected to the inputs of the same name (145), (64) and (73), respectively, of the search strategy register (14), the first (6) and second (7) search variable generators, the output (63) of the first variable generator search (6) is connected to the information input (81) of the first totalizing counter (8), the output (82) of which is connected to the first information input (121) of the dividing unit (12), outputs (024) "Change in the state of the situation - Measure" and ( 025) "No change in the state of the situation - Ots" of the discriminator of zones of evaluation values (2) are connected respectively to the same inputs (52) and (53) of the switch (5), the first output (31) of the pulse distributor (3) is connected to the synchronization inputs (013 ) and (023), respectively, of the current evaluation signal generator (1) and the discriminator of the evaluation value zones (2), as well as to the clock input (41) of the time intervals counter (4), the output (42) "Number of the current time interval - N _tech " which is connected to the inputs of the same name (199) and (146), respectively, of the block for forming the truncation threshold (19) and the search strategy register (14), outputs (143) "Value of the upper classification threshold - P _clv " and (144) "Value of the lower classification threshold - P _cln " which are connected to the inputs of the same name (134) and (135) of the classifier (13), the second output (32) of the pulse distributor (3) is connected to the synchronizing input (51) of the switch (5), the third output (33) of the pulse distributor (3) is connected to the synchronization inputs (102 ) and (112) of the first (10) and second (12) memory blocks, outputs (101) and (113), respectively, of the first (10) and second (11) memory blocks are connected to the signal inputs (83) and (93), respectively, of the first (8) and the second (9) summing counters, the fourth output (34) of the impulse distributor (3) is connected to the synchronizing input (131) of the classifier (13), the output (181) "Time" of the current day timer (18) is connected to the inputs of the same name (011), (022), (35), (1612), (171) and (241), respectively, of the signal generator of the current sc Enki (1), the discriminator of zones of evaluation values (2), the distributor of impulses (3), the unit for displaying and recording data (16) and the unit for changing the threshold signals (17), outputs (172) "Upper value of the search threshold - P _in " and (173) "The lower value of the search threshold - P _n " which is connected, respectively, to the inputs of the same name (141) and (142) of the search strategy register (14) and, respectively, to the inputs of the same name (196) and (197) of the truncation threshold formation unit (19) , inputs (174) "Start" and (175) "Threshold" of the block for changing the threshold signals (17) are connected to the same inputs (191) and (192) of the block for forming the cutoff threshold (19) and are respectively the inputs "Start" and "Threshold "Device, input (193)" Numerical value of one - 1 ", input (194)" Maximum number of the time interval - N _max "and input (195)" Sample size of the analysis interval - V _select "of the truncation threshold formation block (19) are with the same device inputs, input (61) "Zone 1" of the first generator of the search variable (6) and input (72) " Zone 2 "of the second generator of the search variable (7) are respectively the inputs" Zone 1 "and" Zone 2 "of the device, input (161)" Deterministic combination ", input (162)" Unknown attribute ", input (163)" Search attribute " and the input (164) "Address of the unknown attribute - NP address" of the display and data recording unit (16) are connected respectively to the outputs of the same name (209), (2010), (2011) and (2012) of the structural analyzer (20), output (204 ) "Address" which is connected to the same-named inputs (214), (224) and (234), respectively, of the third (21), fourth (22) and fifth (23) memory blocks, the output (213) "Data 1" of the third memory block ( 21), connected to the same inputs (165) and (201), respectively, of the data display and recording unit (16) and the structural analyzer (20), the output (223) "Data 2" of the fourth memory block (22) and the output (233) " Data 3 "of the fifth memory block (23) are connected, respectively, to the inputs of the same name (202) and (203) of the structural analyzer (20), the output (205)" Clock pulses "of which p Connected to the same inputs (225) and (235), respectively, of the fourth (22) and fifth (23) memory blocks, output (166) "Data 1 - write", output (167) "Data 2 - write" and output (168) "Data 3 - write" of the data display and recording unit (16) are connected to the same inputs (211), (221) and (231), respectively, of the third (21), fourth (22) and fifth (23) memory blocks, output (1611 ) "Address 3 - write" of the data display and recording unit (16) is connected to the input of the same name (232) of the fifth memory block (23), the output (1613) "Address 1, 2 - write" of the data display and recording unit (16) is connected to the same inputs (212) and (222), respectively, of the third (21) and fourth (22) memory blocks, the information (207) and synchronizing (208) inputs of the structural analyzer (20) are, respectively, information and synchronizing inputs of the device, characterized in that the time controller of the analysis interval (24) is additionally introduced, while the output (181) "Time" of the current day timer (18) is connected to the named input (241) of the analysis interval time controller (24), the information output (206) of the structural analyzer (20) is connected to the information input (242) of the analysis interval time controller (24), the information output (243) of which is connected to the information inputs (012 ) and (021), respectively, of the current estimation signal generator (1) and the discriminator of the estimation value zones (2), the correction input (244) of the analysis interval time controller (24) is the input "Analysis interval time correction" of the device. 2. The device for monitoring information traffic according to claim 1, characterized in that the time controller of the analysis interval (24) consists of a decoder of the corrected analysis interval time code (24.1) and a register of comparison-correction of the analysis interval time (24.2), while the input (24.1 -1) decoder of the corrected analysis interval time code (24.1) is the correcting input (244) of the analysis interval time controller (24) and the input "Correction of the analysis interval time" of the device, the output (24.1-2) of the decoder of the corrected analysis interval time code (24.1) connected to the check input (24.2-2) of the register of comparison-correction of the analysis interval time (24.2), the information input (24.2-4) of which is the information input (242) of the analysis interval time controller (24), and the information output (24.2-3) the register comparison-correction of the analysis interval time (24.2) is the information output (243) of the analysis interval time controller (24), the input for setting the current time of day (24.2-1) of the comparison-correction register of the analysis interval time (24.2) is the input (241) "Time" of the analysis interval time controller (24).

Images