WO2017068771A1

WO2017068771A1 - Switch abnormality detection device, switch abnormality detection method, and program storage medium

Info

Publication number: WO2017068771A1
Application number: PCT/JP2016/004597
Authority: WO
Inventors: 安仁高宮
Original assignee: 日本電気株式会社
Priority date: 2015-10-22
Filing date: 2016-10-17
Publication date: 2017-04-27
Also published as: JP2019024146A

Abstract

In order to enable a system for detecting a switch abnormality in a network including a plurality of switches to be promptly introduced, a switch abnormality detection device 1 is provided with an information collection unit 7, a characteristic amount calculation unit 4, and an abnormality determination unit 5. The information collection unit 7 collects information indicating internal states of a plurality of switches included in a network. The characteristic amount calculation unit 4 compares the internal state of an object switch that is one of the plurality of switches with the internal states of the other switches using the collected information, and calculates a characteristic amount that characterizes the object switch on the basis of the result of the comparison. The abnormality determination unit 5 diagnoses the object switch on the basis of the calculated characteristic amount.

Description

Switch abnormality detection device, switch abnormality detection method, and program storage medium

The present invention relates to a technique for detecting an abnormality of a switch included in a network.

A method has been proposed for detecting network abnormalities involving multiple switches.

In the network monitoring tool disclosed in Non-Patent Document 1, information indicating the expected normal operation of the network is input as a check item list. This monitoring tool makes it possible to find anomalies by comparing the results of remote monitoring of switches and hosts in a network with a check item list.

The entire disclosure of Non-Patent Document 1 is incorporated herein by reference. The following analysis was made by the present inventors.

The monitoring tool described in Non-Patent Document 1 can detect network abnormality by holding information on expected network operation as a check item in advance.

When adopting this monitoring tool, it is necessary to prepare a large list of check items in advance in a large-scale network such as a data center. At this time, in order to perform correct setting, advanced knowledge specific to the network to be monitored is required. In addition, a long preparation period is required to introduce the monitoring tool.

The present invention has been devised to solve the above problems. That is, a main object of the present invention is to provide a technique capable of quickly introducing a system for detecting an abnormality of a switch of a network including a plurality of switches.

The switch abnormality detection device according to the first aspect of the present invention includes:
An information collection unit that collects information indicating internal states of a plurality of switches included in the network;
Using the collected information, the internal state of the target switch that is one of the plurality of switches is compared with the internal state of the other switches, and the target switch is determined based on the result of the comparison. A feature quantity calculation unit for calculating a feature quantity to be characterized;
An abnormality determination unit that diagnoses the target switch based on the calculated feature amount;
It has.

The switch abnormality detection method according to the second aspect of the present invention includes:
Computer
Collect information indicating the internal state of multiple switches in the network,
Using the collected information, the internal state of the target switch that is one of the plurality of switches is compared with the internal state of the other switches, and the target switch is determined based on the result of the comparison. Calculate the feature value to characterize,
The target switch is diagnosed based on the calculated feature amount.

A program storage medium according to the third aspect of the present invention provides:
A process of collecting information indicating internal states of a plurality of switches included in the network;
Using the collected information, the internal state of the target switch that is one of the plurality of switches is compared with the internal state of the other switches, and the target switch is determined based on the result of the comparison. A process for calculating a characteristic amount to be characterized;
A process of diagnosing the target switch based on the calculated feature amount;
Is stored in the computer program.

The program storage medium is, for example, a non-transitory computer-readable storage medium.

The switch abnormality detection device, the switch abnormality detection method, and the program storage medium according to the present invention make it possible to quickly introduce a system that detects a network switch abnormality including a plurality of switches.

It is a block diagram which illustrates the composition of the switch abnormality detection device concerning one embodiment of the present invention. It is a block diagram which illustrates the composition of the switch abnormality detection device of a 1st embodiment concerning the present invention. It is a figure which illustrates a transfer rule. It is a figure explaining the normalization operation | movement of a transfer rule. It is a flowchart which illustrates an example of operation of a switch abnormality detection device of a 1st embodiment.

First, an outline of one embodiment will be described. Note that the reference numerals of the drawings attached to this summary are merely examples for facilitating understanding, and are not intended to limit the present invention to the illustrated embodiment.

FIG. 1 is a block diagram illustrating the configuration of a switch abnormality detection device 1 according to an embodiment. Referring to FIG. 1, the switch abnormality detection device 1 includes an information collection unit 7, a feature amount calculation unit 4, and an abnormality determination unit 5. The information collection unit 7 has a function of collecting information (for example, transfer rules used when transferring packets) indicating internal states of a plurality of switches included in the network. The feature amount calculation unit 4 uses the collected information to compare the internal state of one switch (hereinafter also referred to as a target switch) among a plurality of switches included in the network with the internal state of other switches. . The feature amount calculation unit 4 has a function of calculating a feature amount that characterizes the target switch based on the comparison result. The abnormality determination unit 5 has a function of diagnosing the target switch based on the calculated feature value.

The switch abnormality detection device 1 makes it possible to quickly introduce a system for detecting a switch abnormality in a network including a plurality of switches. This is because the switch abnormality detection device 1 calculates the feature amount based on the information indicating the internal state collected from the switch, and can diagnose the switch according to the calculated feature amount. This is because it is not necessary to prepare.

Note that the feature quantity calculation unit 4 may calculate the feature quantity of the target switch using information obtained by normalizing the collected information. The normalized information is obtained, for example, by performing processing for replacing the physical port number in the match and action included in the transfer rule with a wild card and deleting the statistical information included in the transfer rule.

Also, the feature amount calculation unit 4 may calculate the entry weight according to the number of appearances of the entry included in the normalized transfer rule.

For example, the feature amount calculation unit 4 can obtain the weight g (i) of the entry i using the following equation (1).

Note that “n” in equation (1) represents the total number of switches. “P _ij ” is obtained by the following equation (2).

“X (i, j)” in Expression (2) represents the number of appearances of the normalized entry i in the transfer rule of the switch j. In addition, the feature quantity calculation unit 4 calculates the switch feature quantity calculated using the obtained weight g (i) and the number of appearances of the entry i (for example, the feature quantity of the switch j represented by the following expression (3) | xj |).

“M” in Equation (3) represents the total number of normalized entries in the forwarding rule of the switch.

Further, the abnormality determination unit 5 may determine that the target switch is abnormal when the feature amount of the target switch is larger than the threshold value.

Further development of the switch abnormality detection device 1 having such a configuration is, for example, to be applied to switch abnormality detection in a network having a plurality of switches having equivalent settings such as a data center core switch.

That is, referring to FIG. 2, the switch abnormality detection device 1 according to the expanded form includes a collection unit 2, a preprocessing unit 3, a feature amount calculation unit 4, and an abnormality determination unit 5. The collection unit 2 has a function of collecting transfer rules as the internal state of the switch 6 constituting the network. The preprocessing unit 3 has a function of normalizing the collected transfer rules. The feature amount calculation unit 4 has a function of calculating the feature amount for each switch 6 based on the normalized transfer rule. The abnormality determination unit 5 has a function of determining an abnormal switch based on the calculated feature amount.

Such a switch abnormality detection device 1 detects an abnormal switch only by comparing feature amounts without preparing a check item list for abnormality detection by calculating feature amounts calculated for each switch. Can do. In addition, the switch abnormality detection device 1 can also detect the switch 6 with incorrect setting information from the plurality of switches 6.

<First Embodiment>
Next, the switch abnormality detection device according to the first embodiment of the present invention will be described in detail with reference to the drawings.

[Constitution]
FIG. 2 is a block diagram illustrating the configuration of the switch abnormality detection device 1 according to the first embodiment. Referring to FIG. 2, the switch abnormality detection device 1 includes a collection unit 2, a preprocessing unit 3, a feature amount calculation unit 4, and an abnormality determination unit 5.

The collection unit 2 periodically collects transfer rules held by the switches 6 constituting the network. Further, the collection unit 2 outputs the collected transfer rules to the preprocessing unit 3.

FIG. 3 illustrates transfer rules collected by the collection unit 2. The transfer rule has a plurality of entries for each switch 6, and each entry has a match, an action, a priority, and statistical information as attributes.

The match includes a determination condition for determining whether or not to process a packet entering the switch 6. For example, the match “VLANID (Virtual LAN (Local Area Network) IDentification)” = “10” includes information that the process indicated by the action attribute is performed on the packet when the VLAN ID field of the packet is “10”. The action attribute includes information on processing performed on a packet corresponding to the match determination condition. For example, “FWD (forward) port = 5” represents an action (action) for forwarding a packet to the fifth port of the switch. The priority represents the priority for each entry. Match determination is performed in descending order of priority. The statistical information represents the packet transfer amount processed according to the entry.

The pre-processing unit 3 normalizes the transfer rule entry by replacing the physical port number part included in the match and action with the wild card and deleting the statistical information for the collected transfer rule. By normalizing the transfer rules, similar transfer rule entries that differ only in physical port numbers are regarded as the same entry. In addition, the preprocessing unit 3 outputs the normalized transfer rule to the feature amount calculation unit 4.

FIG. 4 is a diagram for explaining an operation example of transfer rule normalization by the preprocessing unit 3. The pre-processing unit 3 changes the part representing the physical port number of “InPort = 5” in the match to the symbol “*” representing the wild card, and makes “InPortIn = *”. Also, the pre-processing unit 3 changes the physical port number portions of “FWD port = 5” and “FWD port = 4” in the action to the symbol “*” representing the wild card in the same manner. = * ". Further, the preprocessing unit 3 deletes the statistical information.

The feature amount calculation unit 4 calculates a feature amount for each switch 6 based on the normalized transfer rule. For example, first, the feature amount calculation unit 4 obtains a weight g (i) using log-entropy for each entry i in the transfer rule using the above-described equation (1), and obtains the obtained weight g (i ) To give the entry i a weight between 0 and 1. For example, the feature quantity calculation unit 4 assigns the weight “0” (g (i) = 0) to the entry i included in all networks, and the weight “1” to the entry i included in only one specific switch. (G (i) = 1) is given. Here, for example, it is assumed that the setting of each switch is equivalent. In this case, an entry i having a large weight g (i) by log-entropy indicates that there is some abnormality such as a setting error or failure.

Note that the weight g (i) based on the formula (1) is merely an example, and the weight for weighting the entry i is not limited to the weight g (i) obtained by the specific function shown in the formula (1).

Further, for each switch 6, the feature amount calculation unit 4 uses the expression (3) based on the weight g (i) of the entry i and the number of appearances x (i, 特徴 j), and the feature amount in the jth switch 6. | xj | is calculated. Here, “x (i, j)” in the expression (3) represents the number of times the normalized entry i appears in the transfer rule of the j-th switch j. The feature amount calculation unit 4 estimates that the switch 6 having a larger feature amount | xj | is more likely to have some abnormality than the other switches.

Note that the feature quantity | xj | for the j-th switch 6 shown in Expression (3) is merely an example. The feature quantity that characterizes the switch 6 is not limited to the feature quantity | xj | obtained by the specific function shown in Expression (3), and each of the monotonically increasing functions of g (i) and x (i, j). If it is.

The abnormality determination unit 5 presents a list of switches 6 having a feature quantity | xj | that is larger than a preset threshold value to the administrator.

[Operation]
Next, an operation example of the switch abnormality detection device 1 of the first embodiment will be described with reference to the flowchart of FIG.

In step S1, the collection unit 2 collects transfer rules possessed by the switch 6 constituting the network.

In step S2, the preprocessing unit 3 changes the part of the physical port number included in the match and action to a wild card for the collected transfer rule, and deletes the statistical information, thereby normalizing the transfer rule entry. Turn into.

In step S3, the feature quantity calculation unit 4 calculates a feature quantity for each switch based on the normalized transfer rule.

In step S4, the abnormality determination unit 5 determines whether there is a switch 6 having a feature amount larger than a preset threshold value.

When there is a switch 6 having a feature quantity larger than the threshold (Yes in step S4), the abnormality determination unit 5 manages a list of the switches 6 having a feature quantity larger than the threshold as candidates for an abnormal switch in step S5. Present to the person.

Next, the effect of the first embodiment will be described. The switch abnormality detection device 1 according to the first embodiment compares the feature amount that can be calculated from the internal state of the switch 6 with the feature amount of the other switch 6, and detects the abnormal switch 6 based on the comparison result. For this reason, the switch abnormality detection device 1 according to the first embodiment does not prepare a check item list for abnormality detection for a network including a large number of switches having the same setting such as a core switch of a data center without preparing a check item list. Can be guessed.

The switch abnormality detection device 1 of the first embodiment can be applied to management of a network including switches having equivalent settings as an example.

A part or all of the above-described embodiment can be described as in the following supplementary notes, but is not limited thereto.
[Appendix 1]
An information collection unit that collects information indicating internal states of a plurality of switches included in the network;
A feature amount calculating unit that calculates a feature amount characterized by comparing an internal state of one of the plurality of switches with an internal state of another switch, using the collected information;
An abnormality determination unit that diagnoses the one switch based on the calculated feature amount,
A switch abnormality detection device characterized by that.
[Appendix 2]
A pre-processing unit that normalizes the collected information;
The feature amount calculation unit calculates a feature amount of the one switch using the normalized information;
The switch abnormality detection device according to appendix 1.
[Appendix 3]
The information collection unit collects transfer rules held by the plurality of switches as information indicating the internal state;
The switch abnormality detection device according to attachment 2.
[Appendix 4]
The feature amount calculation unit calculates the weight of the entry according to the number of appearances of the entry included in the normalized transfer rule, and calculates the feature amount of the one switch using the calculated weight and the number of appearances ,
The switch abnormality detection device according to attachment 3.
[Appendix 5]
The preprocessing unit replaces the physical port number in the match and action included in the forwarding rule with a wildcard;
The switch abnormality detection device according to appendix 3 or appendix 4.
[Appendix 6]
The preprocessing unit deletes statistical information included in the transfer rule;
The switch abnormality detection device according to any one of attachments 3 to 5.
[Appendix 7]
The abnormality determining unit determines that the one switch is abnormal when the feature amount of the one switch is larger than a predetermined threshold.
The switch abnormality detection device according to any one of supplementary notes 1 to 6.
[Appendix 8]
A computer collecting information indicating an internal state of a plurality of switches included in the network;
Calculating, using the collected information, a characteristic amount that characterizes the internal state of one of the plurality of switches by comparing it with the internal state of another switch;
Diagnosing the one switch based on the calculated feature amount,
A switch abnormality detection method characterized by the above.
[Appendix 9]
The computer normalizing the collected information;
Calculating a feature amount of the one switch using the normalized information.
The switch abnormality detection method according to appendix 8.
[Appendix 10]
The computer collects transfer rules held by the plurality of switches as information indicating the internal state;
The switch abnormality detection method according to appendix 9.
[Appendix 11]
The computer determines the weight of the entry according to the number of appearances of the entry included in the normalized transfer rule;
Calculating the feature amount of the one switch using the obtained weight and the number of appearances,
The switch abnormality detection method according to appendix 10.
[Appendix 12]
The computer includes replacing a physical port number in a match and action included in the forwarding rule with a wildcard;
The switch abnormality detection method according to appendix 10 or appendix 11.
[Appendix 13]
The switch abnormality detection method according to any one of appendix 10 to appendix 12, wherein the computer includes a step of deleting statistical information included in the transfer rule.
[Appendix 14]
The computer includes a step of determining that the one switch is abnormal when a feature amount of the one switch is larger than a predetermined threshold.
The switch abnormality detection method according to any one of supplementary notes 8 to 13.
[Appendix 15]
A process of collecting information indicating internal states of a plurality of switches included in the network;
A process for calculating a characteristic amount characterized by comparing an internal state of one of the plurality of switches with an internal state of another switch using the collected information;
Causing the computer to execute a process of diagnosing the one switch based on the calculated feature amount,
A program characterized by that.
[Appendix 16]
Normalizing the collected information;
Causing the computer to execute a process of calculating a feature amount of the one switch using the normalized information.
The program according to appendix 15.
[Appendix 17]
Causing the computer to execute a process of collecting transfer rules held by the plurality of switches as information indicating the internal state;
The program according to appendix 16.
[Appendix 18]
A process for obtaining the weight of the entry according to the number of appearances of the entry included in the normalized transfer rule;
Causing the computer to execute a process of calculating a feature amount of the one switch using the obtained weight and the number of appearances;
The program according to appendix 17.
[Appendix 19]
Causing the computer to execute processing for replacing physical port numbers in matches and actions included in the forwarding rule with wildcards;
The program according to appendix 17 or appendix 18.
[Appendix 20]
The program according to any one of appendix 17 to appendix 19, which causes the computer to execute a process of deleting statistical information included in the transfer rule.
[Appendix 21]
When the feature amount of the one switch is greater than a predetermined threshold, the computer is caused to execute a process of determining that the one switch is abnormal.
The program according to any one of Supplementary Note 15 to Supplementary Note 20.

It should be noted that the entire disclosure of Non-Patent Document 1 is incorporated herein by reference. Within the scope of the entire disclosure (including claims) of the present invention, the embodiment can be changed and adjusted based on the basic technical concept. Further, various combinations or selections of various disclosed elements (including each element of each claim, each element of each embodiment, each element of each drawing, etc.) are possible within the framework of the entire disclosure of the present invention. is there. That is, the present invention of course includes various variations and modifications that can be made by those skilled in the art according to the entire disclosure including the claims and the technical idea. In particular, with respect to the numerical ranges described in this document, any numerical value or small range included in the range should be construed as being specifically described even if there is no specific description.

This application claims priority based on Japanese Patent Application No. 2015-208272 filed on October 22, 2015, the entire disclosure of which is incorporated herein.

DESCRIPTION OF SYMBOLS 1 Switch abnormality detection apparatus 2 Collection part 3 Preprocessing part 4 Feature-value calculation part 5 Abnormality determination part 6 Switch 7 Information collection part

Claims

Information collecting means for collecting information indicating internal states of a plurality of switches included in the network;
Using the collected information, the internal state of the target switch that is one of the plurality of switches is compared with the internal state of the other switches, and the target switch is determined based on the result of the comparison. A feature amount calculating means for calculating a feature amount to be characterized;
An abnormality determining means for diagnosing the target switch based on the calculated feature amount;
A switch abnormality detection device comprising:
Comprising pre-processing means for normalizing the collected information;
The feature amount calculating means calculates the feature amount of the target switch using the normalized information;
The switch abnormality detection device according to claim 1.
The information collecting means collects transfer rules held by the plurality of switches as information indicating the internal state;
The switch abnormality detection device according to claim 2.
The feature amount calculating means calculates the weight of the entry according to the number of appearances of the entry included in the normalized transfer rule, and calculates the feature amount of the target switch using the calculated weight and the number of appearances. ,
The switch abnormality detection device according to claim 3.
The preprocessing means replaces a physical port number in a match and action included in the forwarding rule with a wildcard;
The switch abnormality detection device according to claim 3 or 4.
The preprocessing means deletes statistical information included in the transfer rule;
The switch abnormality detection device according to any one of claims 3 to 5.
The abnormality determining means determines that the target switch is abnormal when the feature amount of the target switch is greater than a threshold value.
The switch abnormality detection device according to any one of claims 1 to 6.
Computer
Collect information indicating the internal state of multiple switches in the network,
Using the collected information, the internal state of the target switch that is one of the plurality of switches is compared with the internal state of the other switches, and the target switch is determined based on the result of the comparison. Calculate the feature value to characterize,
A switch abnormality detection method for diagnosing the target switch based on the calculated feature amount.
The computer is
Normalizing the collected information;
The switch abnormality detection method according to claim 8, wherein the feature amount of the target switch is calculated using the normalized information.
The computer
Collecting forwarding rules held by the plurality of switches as information indicating the internal state;
The switch abnormality detection method according to claim 9.
The computer
Obtaining the weight of the entry according to the number of appearances of the entry included in the normalized transfer rule;
Calculating the feature amount of the target switch using the obtained weight and the number of appearances;
The switch abnormality detection method according to claim 10.
The previous computer is
Replace the physical port number in the match and action included in the forwarding rule with a wildcard.
The switch abnormality detection method according to claim 10 or 11.
The computer
Deleting statistical information contained in the forwarding rule;
The switch abnormality detection device according to any one of claims 10 to 12.
The computer
When the feature amount of the target switch is larger than a threshold, it is determined that the target switch is abnormal.
The switch abnormality detection method according to any one of claims 8 to 13.
A process of collecting information indicating internal states of a plurality of switches included in the network;
Using the collected information, the internal state of the target switch that is one of the plurality of switches is compared with the internal state of the other switches, and the target switch is determined based on the result of the comparison. A process for calculating a characteristic amount to be characterized;
A process of diagnosing the target switch based on the calculated feature amount;
A program storage medium for storing a computer program for causing a computer to execute.
Processing to normalize the collected information;
The program storage medium according to claim 15, which causes a computer to execute a process of calculating a feature amount of the target switch using the normalized information.
17. The program storage medium according to claim 16, which causes a computer to execute a process of collecting transfer rules held by the plurality of switches as information indicating the internal state.
A process of calculating the weight of the entry according to the number of appearances of the entry included in the normalized transfer rule;
18. The program storage medium according to claim 17, which causes a computer to execute a process of calculating a feature amount of the target switch using the obtained weight and the number of appearances.
The program storage medium according to claim 17 or 18, which causes a computer to execute processing for replacing a physical port number in a match and action included in the transfer rule with a wild card.
The program storage medium according to any one of claims 17 to 19, which causes a computer to execute a process of deleting statistical information included in the transfer rule.
The program storage medium according to any one of claims 15 to 20, which causes a computer to execute a process of determining that the target switch is abnormal when a feature amount of the target switch is larger than a threshold value.