Evaluation device, evaluation method and recording medium

• US 10,341,248 B2
• Filed: 01/26/2016
• Issued: 07/02/2019
• Est. Priority Date: 02/02/2015
• Status: Active Grant

• Current Assignee: Nippon Telegraph and Telephone Corporation, Osaka University
• Original Assignee: Nippon Telegraph and Telephone Corporation
• Inventors: Takahashi, Yousuke, Ishibashi, Keisuke, Kamiyama, Noriaki, Shiomoto, Kohei, Ohsita, Yuichi, Murata, Masayuki
• Primary Examiner(s): Sefcheck, Gregory B
• Assistant Examiner(s): Van, Jenkey
• Application Number:
  US15/540,439
• Publication Number:
  US 20170373983A1
• Time in Patent Office: 1,253 Days
• Field of Search: None
• CPC Class Codes: H04L 43/026 using flow identification
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 43/20 the monitoring system or the monitored elements being virtualised, abstracted or software-defined entities, e.g. SDN or NFV
• CPC Class Codes: H04L 47/36 by determining packet size, e.g. maximum transfer unit [MTU]
• CPC Class Codes: H04L 49/253 using establishment or release of connections between ports
• CPC Class Codes: H04M 11/00 Telephonic communication systems specially adapted for combination with other electrical systems

Abstract

An evaluation device includes a first evaluator configured, for each record used for transmission control of data circulating in a network, to evaluate extent of variation of an amount of the data, based on a history of the amounts of the data matching a condition of the record; a second evaluator configured, for each of the records, to evaluate a size of a space represented by the record, based on the condition of the record; and a calculator configured, for each of the records, to calculate an index value representing a possibility that a predetermined or a greater amount of the data matches the condition of the record within a fixed period of time, based on an evaluation result by the first evaluator, and an evaluation result by the second evaluator. Therefore, it is possible to evaluate a possibility of a sudden occurrence of a flow whose traffic volume is large.

Claims

1. An evaluation device, comprising:

a communication interface configured to communicate with a control device which is connected to a network that includes at least one transfer device and to receive, from the control device, records used for transmission control of data currently circulating in the network; and

processing circuitry configured to implement

a first evaluator configured, for each of the records, to evaluate extent of variation of an amount of the data, based on a history of the amounts of the data matching a condition of the record;

a second evaluator configured, for each of the records, to evaluate a size of a space represented by the record, based on the condition of the record; and

a calculator configured, for each of the records, to calculate an index value representing a possibility that the respective record corresponds to a future spike flow at a future time when a predetermined or a greater amount of the data matches the condition of the record within a fixed period of time, based on an evaluation result by the first evaluator, and an evaluation result by the second evaluator,

wherein the processing circuitry is configured to control an output of an indication of a possibility that one of the records corresponds to a future spike flow based on the calculated index values for each of the records.

2. The evaluation device as claimed in claim 1, wherein the first evaluator calculates a standard deviation for the history of the amounts of the data, to evaluate the extent of the variation, based on comparing each of the amounts of the data constituting the history with the standard deviation.

3. The evaluation device as claimed in claim 1, wherein the first evaluator calculates a standard deviation and an average for the history of the amounts of the data, to evaluate the extent of the variation, based on a value obtained by dividing the standard deviation by the average.

4. The evaluation device as claimed in claim 1, wherein the second evaluator evaluates the size of the space, based on a number of items whose values are not specified, among the items constituting the condition.

5. The evaluation device as claimed in claim 1, wherein the second evaluator evaluates the size of the space, based on a number of bits whose values are not determined, among the bits constituting the condition.

6. An evaluation method executed by a computer, the method comprising:

communicating with a control device which is connected to a network that includes at least one transfer device and receiving, from the control device, records used for transmission control of data currently circulating in the network;

a first evaluation step, for each of the records, evaluating extent of variation of an amount of the data, based on a history of the amounts of the data matching a condition of the record;

a second evaluation step, for each of the records, evaluating a size of a space represented by the record, based on the condition of the record; and

a calculation step, for each of the records, calculating an index value representing a possibility that the respective record corresponds to a future spike flow at a future time when a predetermined or a greater amount of the data matches the condition of the record within a fixed period of time, based on an evaluation result by the first evaluation step, and an evaluation result by the second evaluation step; and

controlling an output of an indication of a possibility that one of the records corresponds to a future spike flow based on the calculated index values for each of the records.

7. A non-transitory computer-readable recording medium having a program stored therein for causing a computer to execute a method, the method comprising:

communicating with a control device which is connected to a network that includes at least one transfer device and receiving, from the control device, records used for transmission control of data currently circulating in the network;

a first evaluation step, for each of the records, evaluating extent of variation of an amount of the data, based on a history of the amounts of the data matching a condition of the record;

a second evaluation step, for each of the records, evaluating a size of a space represented by the record, based on the condition of the record; and

a calculation step, for each of the records, calculating an index value representing a possibility that the respective record corresponds to a future spike flow at a future time when a predetermined or a greater amount of the data matches the condition of the record within a fixed period of time, based on an evaluation result by the first evaluation step, and an evaluation result by the second evaluation step; and

controlling output of an indication of a possibility that one of the records corresponds to a future spike flow based on the calculated index values for each of the records.