Patent Application
20190356564
The present invention relates to a network system, mode determining apparatus, method, and non-transitory medium.
In a system via a network (networked system), an end-to-end response time has a great influence on quality of experience (QoE: also known as “user experience quality”) of an application. For instance, bi-directional communication is performed in an interactive-type application such as an online game, in which a server, on reception of an operation input from a user terminal, forwards, to the terminal, screen information to be displayed on the terminal. For this reason, such factors as response time, delay, and jitter may affect user experience (UX). On the other hand, bandwidth becomes an issue in a batch type application in which communication from a server to a terminal is performed. It is noted that a quality of the user experience corresponds to QoE.
It is known that conditions to meet QoS (Quality of Service) (e.g., bandwidth, transmission delay, etc.) or QoE requirements (e.g., response time), and traffic patterns (data volume, cycle) are different for each mode of an application. In order to ensure fine-grained QoS and QoE for each mode of an application, the mode of the application needs to be estimated in some way.
On the other hand, it may be unrealistic to modify all applicable existing applications so that each application notifies its mode. Therefore, there is a need for a technology that is able to estimate a mode of an application based on network traffic patterns and so forth.
As a technique for identifying a traffic type based on network traffic, there is a protocol identification technology. The protocol identification technology captures a packet (frame), which is a protocol data unit (PDU) flowing through a network, using a packet capture (packet monitor), analyzes a header of each packet, and extracts and displays, for instance, a source, a destination, a protocol (for instance TCP (Transmission Control Protocol), HTTP (Hypertext Transfer Protocol), etc.), a length (byte counts) and detailed information of the packet, and actual data content. Note that PDU is referred to as “frame” in a data link layer (layer 2 (L2)) and as “packet” in a network layer (layer 3 (L3)) of OSI (Open Systems Interconnection) Reference Model by ISO (International Organization for Standardization). Further, PDU is referred to as “segment” in TCP and “datagram” in UDP (User Datagram Protocol) of a transport layer (layer 4 (L4)).
There is known a product in which a software implementing a packet capture function is installed on a computer node to monitor packets. For instance, as illustrated in
Further, in protocol determination using packet capture, for instance, for a single session, the protocol is determined based on a fixed amount of packets from the start of the session.
A single session is, however, assumed to always operate in an identical protocol. Therefore, a protocol cannot be used directly to analyze modes of an application.
As used herein, a mode of an application refers to an operation unit of the application, which is obtained by partitioning temporally operation of the application into plural units meaningful for the application. A different mode will have a different traffic pattern in a network. Between a terminal and an application server, examples of modes include Mode 1 (transferring a large amount of data), Mode 2 (periodic data transfer), and Mode 3 (idle) (refer to
Further, in a case of a sensor (IoT (Internet of Things) sensor) comprising a communication function, examples of modes include periodic data transmission, unscheduled data transmission, sleep, etc. In a case of a self-driving automobile, examples of modes include driving on a high traffic road, driving on a low traffic road, and stop.
For instance, Non-Patent Literature 1 discloses a technology that classifies network traffic using supervised machine-learning. This technology classifies traffic (per TCP connection) for each application category using a supervised Naive Bayes classifier. As input, feature values (flow duration, TCP port, packet arrival interval (mean, variance, etc.), payload size (mean, variance, etc.), effective bandwidth based upon entropy, and Fourier Transform of the packet arrival interval) obtained from a terminated TCP connection and category information of the communication in the TCP connection are used. As output, for instance, the following classification results for each application category (network traffic allocated to each category) are obtained.
DATABASE: postgres, sqlnet, oracle, ingres
INTERACTIVE: ssh, klogin, rlogin, telnet
MAIL: imap, pop2/3, smtp
SERVICES: X11, dns, ident, ldap, ntp
ATTACK: Internet worm and virus attacks
Since the disclosure of Non-Patent Literature 1 utilizes duration (flow duration) of a flow (TCP connection), connection must be terminated. It is noted that the Naïve Bayes classifier is a classifier which is based on Bayes' theorem that assumes that each feature vector of each class has a Gaussian distribution. It is known that the Naïve Bayes classifier can be applied to a complex situation using a simple calculation method. Feature vectors and labels are learned as training data and supplied feature vectors are classified into labels in a classification phase.
In
The following discusses an example using the method schematically illustrated in
What mode determination needs to do is to determine each of modes divided in time-series according to traffic, as schematically illustrated in
Further, as a technology that monitors packets flowing through a network, and identifies a network application to detect unauthorized access, for instance, Patent Literature 1 discloses a method for identifying a network application by analyzing codes included in a payload rather than packet header information in order to solve problems that a large amount of packets or flows must be observed to identify an application and that an identification accuracy by an identification technique alone is insufficient due to limited observable information. The method of Patent Literature 1 includes a packet observation process of obtaining packets from network traffic, a histogram extraction process of dividing a packet payload into codes of an arbitrary bit length for each of k packets (k is a natural number not less than 2) obtained in the packet observation process and generating a histogram based on how often each code which is obtained in the divided portions of the packet payload, appears; a similarity evaluation process of evaluating changes in the configuration of the packet payload based on changes in code distribution among k histograms generated by the histogram extraction process; and a detection process of identifying an application type based on the configuration changes of the packet payload evaluated in the similarity evaluation process, and identifies a network application by sequentially executing each of the processes above.
Further, for instance, in malware detection and DLP (Data Loss Prevention) fields, Patent Literature 2 discloses a configuration in which a similarity evaluation apparatus that evaluates similarity between a comparison source file and a comparison target file generates comparison source section feature values and comparison target section feature values indicating a predetermined entropy value of each section of comparison source divided files and comparison target divided files obtained by dividing the comparison source file and the comparison target file into a plurality of sections, performs correction of each of the comparison source section feature values and the comparison target section feature values by means of DP (Dynamic Programming) matching, compares each section of the corrected comparison source section feature value and the corrected comparison target section feature value, and evaluates the similarity between the comparison source file and the comparison target file in a system that derives the entropy value of a file and evaluates the similarity of files using the entropy value. In the disclosure of Patent Literature 2, the matching accuracy is improved by shifting divided data blocks back and forth using DP. It is, however, not possible to remove a noise itself which is mixed in the learning model.
Further, Patent Literature 3 discloses a configuration of a learning apparatus facilitating learning of time-series patterns which serves as elements constituting time-series data. The learning apparatus extracts, for instance, N pieces of data for model learning from the time-series data by shifting the position of a window, derivers an i-th item of the data for model learning to an i-th learning module and each learning module performs update-learning to update model parameters that define a pattern learning model using the data for model learning. In the disclosure of Patent Literature 3, a learning accuracy is improved by adding a data extraction part that divides the data for learning into a plurality of blocks and distributes the data to learning modules. It is based on a premise that entire data to be learned is available in advance. Accordingly, the learning apparatus in the Patent Literature 3 cannot be used for real-time mode determination using a packet sequence.
The following gives an analysis of related technologies.
In order to ensure QoS or QoE for each mode of an application in a networked system, it is desirable to realize a technology that accurately determines a mode in real time, based on, for instance, network traffic data.
Further, if one tries to apply the protocol identification technology described with reference to
The present invention has been invented in view of the above and it is an object of the invention to provide an apparatus, system, method, and non-transitory computer readable medium, each capable of improve determination accuracy, in monitoring traffic to perform mode determination in real-time.
According to an aspect of the present invention, there is provided a mode determination apparatus comprising:
a processor; and
a memory storing program instructions executable by the processor,
wherein the processor is configured to execute:
a filter process that receives traffic data for learning to learn, by using training data, a timing of mode switching in the traffic data for learning;
a mode learning process that generates a mode learning model to be used for mode determination, based on the traffic data for learning and the training data that correspond to the timing of mode switching; and
a mode determination process that determines, by using the mode learning model, a mode of actual traffic data received.
According to another aspect of the present invention, there is provided a mode determination method using a computer, comprising:
a filtering process that includes
receiving traffic data for learning and performing learning of timing at which mode switching in the traffic data occurs, using training data;
a model learning process that includes
generating a mode learning model used for mode determination, based on the traffic data for learning and the training data that correspond to the timing of mode switching; and
a mode determination process that includes
determining a mode of actual traffic data received, using the mode learning model.
According to yet another aspect of the present invention, there is provided a network system comprising a mode determination apparatus that includes: a filter that receives traffic data for learning and performs learning of timing at which mode switching in the traffic data occurs, using training data; and a mode learning part that generates a mode learning model for mode determination, based on the traffic data for learning and the training data that correspond to the timing of the mode switching, wherein mode determination apparatus determines a mode of traffic data, using the mode learning model; and a network control apparatus that controls the traffic of a network based on a result of mode determination by the mode determination apparatus.
According to yet another aspect of the present invention, there is provided a program causing a computer to execute:
a filtering process of receiving traffic data for learning and performing learning of timing at which mode switching in the traffic data occurs, using training data; a model learning process of generating a mode learning model for mode determination based on the traffic data for learning and the training data that correspond to the timing of mode switching; and a mode determination process of determining a mode of actual traffic data, using the mode learning model.
According to the present invention, there is provided a computer readable recording medium (non-transitory computer readable recording medium, such as for instance, a semiconductor storage (such as RAM (Random Access Memory), ROM (Read Only Memory), or EEPROM (Electrically Erasable and Programmable ROM)), HDD (Hard Disk Drive), CD (Compact Disc), or DVD (Digital Versatile Disc)) that stores the program above.
According to the present invention, it becomes possible to improve determination accuracy, in monitoring traffic to perform mode determination in real-time. Still other features and advantages of the present invention will become readily apparent to those skilled in this art from the following detailed description in conjunction with the accompanying drawings where only exemplary embodiments of the invention are shown and described, simply by way of illustration of the best mode contemplated of carrying out this invention. As will be realized, the invention is capable of other and different embodiments, and its several details are capable of modifications in various obvious respects, all without departing from the invention. Accordingly, the drawing and description are to be regarded as illustrative in nature, and not as restrictive.
According to an embodiment of the present invention, a mode determination apparatus comprises a filter part and a mode learning part.
The filter part receives traffic data for learning and training data, performs learning of timing at which mode switching in the traffic data occurs and generates (updates) a timing learning model.
The mode learning part generates (updates) a mode learning model used for mode determination, based on the traffic data for learning and the training data that correspond to the timing of the mode switching.
The mode determination apparatus may be configured to include a mode determination part that performs mode determination of actual traffic data, using the mode learning model.
The mode determination part receives actual traffic data and determines modes for data (actual traffic data) corresponding to timing information of the timing learning model, using the mode learning model.
Further, the filter part generates the timing learning model using the traffic data for learning and the training data, and judges traffic based on the learning model. In order to clarify this point, the filter part is also referred to as, for instance, “learning filter” or “learning-type filter.”
According to an embodiment of the present invention, learning and determination may be performed by selecting, for instance, a start timing of a mode that includes a lot of information which is effective in determining the mode.
According to an embodiment of the present invention, a learning filter that determines a timing in which mode determination is performed is provided before a mode learner that learns modes, and 2-step learning and 2-step determination are performed. According to the mode of the present invention, the determination accuracy in real-time mode determination can be improved.
The following describes a comparative example, in which the protocol identification technology described with reference to
Referring to
For instance, a decision tree may be used as the mode learning model 302, though not thereto. A decision tree is a tree structure for classifying data expressed by sets of attributes and the values thereof {attribute 1=value 1, . . . , attribute n=value n} into several classes. Each internal node of a decision tree is labeled with an attribute, branches from the internal node have possible values of the attribute, and a leaf node is the final classification. In a determination phase, data in the (attribute, value) format is supplied to a learning model decision tree, and a leaf node classification reached via branches of internal nodes from the root while testing the values of the attributes is outputted as the determination result. A mode learning part 101 may use, for instance, ID3 (Iterative Dichotomiser 3), CART (Classification and Regression Tree), or random forests as a supervised learning algorithm for outputting a decision tree.
In the above comparative example in which the protocol identification technology is applied to simple mode determination, modes will be frequently misjudged. This is because learning and determination is performed at parts having small differences in an amount of information other than the switching points of packet sequence modes, which are not suitable for learning/determination.
In an embodiment of the present invention, with reference to
The mode learner 101 receives the traffic data 105 for learning, the training data (mode) 106, and the timing information detected by the learning filter 110 and performs learning of modes, using timings (windows) each containing a lot of information effective for mode determination. As the timing, for instance, a start time of a mode may be used. The mode learner 101 performs learning of modes, using traffic data of intervals (time windows), in each of which difference in amount of information between modes is large. As a result, an accuracy in mode learning may be improved. In addition, since mode learning/determination is performed only at timing suitable for mode determination, an accuracy in mode determination may be improved.
Referring to
The mode determination part 103 determines modes of traffic data (traffic data suitable for mode determination) corresponding to the windows 107 notified by the learning filter 110 using a mode learning model 102.
The second-stage mode learner 101 receives the traffic data for learning and the training data and learns modes at the timings suitable for learning modes (for instance, mode switching timings) (a second-stage learning: S2).
The second-stage mode determination part 103 determines modes at the timings learned by the first-stage learning filter 110 (a second-stage determination: S4).
In
As is clear from the comparison between 9c (modes determined according to an aspect of the present invention) in (c) and 9d (modes determined in the comparative example) in (d) in
In
The mode learning part 101 receives the traffic data for learning, the training data, and timing information detected by the learning filter part 110, and performs learning, based on the traffic data for learning and mode information corresponding to the timing information, to create the mode learning model 102. For instance, a mode start time that contains a lot of information that are useful to determine a mode is used as the timing. The mode learning part 101 performs learning of data using time windows having large differences in units of information between modes. In the mode learning part 101, an accuracy in determining modes is improved since modes are determined only at timings suitable for mode determination.
The packet acquisition part 113 supplies a packet sequence to the learning filter part 110 (S11). The learning filter part 110 receives the packets (traffic data for learning) and determines whether or not the packet sequence constitutes a mode switching point, using the training data DB 112 (S12). In the step S12, for instance, the learning filter part 110 may detect a switching point by using the following method.
The learning filter part 110 searches for a correct mode (
Next, the learning filter part 110 learns that a point of time at which the mode change is detected is a determination timing of the packet sequence and updates the timing learning model 111 (S13). An example is given below.
The learning filter part 110 extracts a packet sequence from a current packet supplied and history information of past packets, using a predetermined window. For instance, the following describes a case wherein a current packet supplied by the packet acquisition part 113 and the last packet therebefore are extracted. The current supplied packet and the last packet are temporarily stored in a memory (not illustrated) in the learning filter part 110. The learning filter part 110 calculates feature values of the extracted packets. For instance, the feature values may be statistics (e.g., maximum value, minimum value, mean, variance, sum, etc.) on a packet size or statistics (e.g., maximum value, minimum value, mean, variance, sum, etc.) on the packet arrival interval. Size information of an entire packet stored in a header of a received packet may be extracted as the packet size. For instance, a datagram length field (16 bits) information of an IP (Internet Protocol) packet header may be extracted. Time difference between time-stamps when a packet and a previous packet are respectively received by the packet acquisition part 113 may be used as the packet arrival interval.
The learning filter part 110 learns the calculated feature values of the extracted packets in association with a fact that “the current packet is a mode switching timing” in supervised learning (updates the timing learning model).
Next, the learning filter part 110 provides the mode learning part 101 with packet sequences necessary for learning in the mode learning part 101 (S14).
The learning filter part 110 extracts a packet sequence which corresponds to predetermined windows and is to be used by the mode learning part 101 to learn modes, from the current packet and a predetermined number of past packets therebefore supplied by the packet acquisition part 113, and transmits the extracted packet sequence to the mode learning part 101.
When it is determined that a result in the step S12 does not indicate a switching point, the learning filter part 110 learns that the packet sequence is “not a determination timing” and updates the timing learning model (S16). The process in the step S16 is basically the same as that in the step S13 except for the correct data to be learned and the subsequent processes. In the step S16, the learning filter part 110 extracts a packet sequence from the supplied packet and the packet history information using predetermined windows and calculates feature values from the extracted packet sequence. The learning filter part 110 learns, using supervised learning, the calculated feature values in association with a fact that the current packets do not represent a mode switching timing.
The mode learning part 101 learns that the extracted packet sequence represents Mode so-and-so (“Mode X” in
The packet acquisition part 113 supplies a packet sequence from actual traffic data to the learning filter part 110 (S21).
The learning filter part 110 receives packets (actual traffic data) and determines whether or not the packet sequence represents a mode switching point, using the timing learning model 111, based on the feature values of the packets (S22). For instance, the learning filter part 110 recognizes a switching point using the following method. The learning filter part 110 stores the packets supplied by the packet acquisition part 113, as packet history information, in a storage part not illustrated.
The learning filter part 110 extracts a packet sequence from the supplied packets and the packet history information using the same windows used in the learning phase. The learning filter part 110 calculates feature values from the extracted packet sequence. For instance, the learning filter part 110 uses the same feature values as those used in the learning phase (packet size and packet arrival interval) as the feature values (features in the determination phase).
The learning filter part 110 determines whether or not the supplied packets represent a mode switching timing, using the calculated feature values and the timing learning model 111 created in the learning phase.
The learning filter part 110 provides the mode determination part 103 with a packet sequence necessary for the mode determination part 103 to determine a mode (S23).
The mode determination part 103 determines a mode of the packet sequence supplied by the learning filter part 110, using the mode learning model 102 and stores a determination result in the determination result DB 104 (S24). For instance, the mode determination part 103 performs the following processing as the mode determination.
The mode determination part 103 calculates feature values (for instance, statistics on packet size and packet arrival interval, etc.) from the packet sequence supplied by the learning filter part 110.
The mode determination part 103 determines to which mode the packets supplied by the learning filter part 110 belong, using the calculated feature values and the mode learning model 102 created in the learning phase.
In the example illustrated in
The mode learning part 101 may use ID3 or CART as the learning algorithm of the decision tree. Although
The controller 1100 controls the operation of the learning phase and the determination phase of the learning filter part 110. For instance, the controller 1100 activates the first switching point determination section 1102A (deactivates the second switching point determination section 1102B) in the learning phase. The activated first switching point determination section 1102A determines whether or not a packet sequence represents a mode switching point by referring to the training data DB 112. Further, the controller 1100 controls the packet supply section 1107 to supply a packet sequence to the mode learning part 101 in the learning phase. Further, settings of the controller 1100 for the learning and determination phases may be entered from, for instance, a predetermined operation terminal to the controller 1100.
The controller 1100 activates the second switching point determination section 1102B (deactivates the first switching point determination section 1102A) in the determination phase. The activated second switching point determination section 1102B determines whether or not a packet sequence represents a mode switching point by referring to the timing learning model 111. The controller 1100 controls the packet supply section 1107 to supply a packet sequence extracted by the packet sequence extraction section 1103 to the mode determination part 103 in the determination phase.
The packet holding section 1101 holds a packet or packet sequence acquired by the packet acquisition part 113 in a buffer memory not illustrated in the drawing. The buffer memory of the packet holding section 1101 may be a FIFO (First In First Out) buffer of a predetermined length (capacity). The packet sequence extraction section 1103 extracts a packet sequence from the packet sequences in the packet holding section 1101 in the determination phase.
In the learning phase, the first switching point determination section 1102A determines whether or not the current packet (the last packet stored in the FIFO buffer) represents a mode switching point, based on the training data DB 112, by referring to the current packet and past packets out of the plurality of packets held in the packet holding section 1101. For instance, whether or not the current packet represents a mode switching point may be determined by referring to the training data (correct modes) of the current packet and the previous packet. When the current packet represents a switching point, the packet sequence extraction section 1103 extracts a packet sequence from the current and past packets supplied by the packet acquisition part 113 and held in the packet holding section 1101, using arbitrary windows (time windows).
The feature value calculation section 1104 receives a packet sequence extracted by the packet sequence extraction section 1103 and calculates feature values of the packets in the learning and determination phases. The feature value calculation section 1104 may use statistics on the packet size (e.g., maximum value, minimum value, mean, variance, sum etc.) as the feature values. Statistics (e.g., maximum value, minimum value, mean, variance, sum etc.) on the packet arrival interval may also be used as the feature values. The statistics on the packet size may be calculated based on headers of the packets and the statistics on the packet arrival interval may be calculated based on time-stamp information when the packets are received. It is noted that in the determination phase, the feature value calculation section 1104 calculates the same feature values as those in the learning phase.
The supervised learning section 1105 is activated by the controller 1100 in the learning phase. It learns the feature values calculated by the feature value calculation section 1104 and that the current packet represents a mode switching timing in supervised learning.
In the determination phase, the packet sequence extraction section 1103 extracts a packet sequence from the packet holding section 1101, based on an instruction from the controller 1100 and hands the packet sequence extracted to the feature value calculation section 1104. The feature value calculation section 1104 calculates feature values of the packet sequence received from the packet sequence extraction section 1103. In the determination phase, the second switching point determination section 1102B activated by the controller 1100 refers to the feature values calculated by the feature value calculation section 1104 and the updated timing learning model 111 to determine whether or not the current packet (the latest packet stored in the FIFO buffer of the packet holding section 1101) represents a mode switching timing.
Based on an instruction from the controller 1100, the packet supply section 1107 supplies packets extracted by the packet sequence extraction section 1103 to the mode learning part 101 in the learning phase, and supplies packets extracted by the packet sequence extraction section 1103 to the mode determination part 101 in the determination phase.
The feature value calculation section 1011 calculates packet feature values from a packet sequence supplied by the learning filter part 110 in the learning phase. The packet feature values may be statistics on the packet size and packet arrival interval as described above.
The supervised learning section 1012 learns the feature values calculated by the feature value calculation section 1011 and information that a certain packet represents Mode so-and-so (the training data DB 112), using supervised learning. The mode learning model update section 1013 updates the mode learning model 102 based on the learning results.
The feature value calculation section 1031 calculates packet feature values of a packet sequence supplied by the learning filter part 110 in the determination phase. The packet feature values are the same as those used in the learning phase. The determination processing section 1032 determines to which mode the packets belong using the feature values calculated by the feature value calculation section 1031 and the mode learning model 102. The determination result output section 1033 outputs the determination results to the determination result DB 104. The determination result output section 1033 may output and display the determination results on a display apparatus not illustrated in the drawing.
The training data generation part 114 determines, to which mode the packet sequence supplied by the packet acquisition part 113 belongs, using, for instance, DPI, and updates the training data (for instance correct modes) DB 112. The training data generation part 114 supplies the packet sequence to the learning filter part 110.
The learning filter part 110 receives the packet sequence supplied by the training data generation part 114 and determines whether or not the packet sequence represents a mode switching point using the training data (correct modes) of the training data DB 112 created and updated by the training data generation part 114 (S33).
The learning filter part 110 calculates feature values (for instance statistics on the packet size and packet arrival interval) of a packet sequence extracted from the packet sequence which is supplied by the training data generation part 114 as in the first example embodiment. The learning filter part 110 learns the calculated feature values and that “the current packets represent a mode switching timing”, using supervised learning (S34).
The learning filter part 110 supplies the packet sequence representing a mode switching point to the mode learning part 101 (S35).
The mode learning part 101 learns that the packet sequence represents Mode so-and-so (“Mode X” in
When determining that the packet sequence does not represent a switching point as a result of the determination in the step S33, the learning filter part 110 learns that the packet sequence “is not a determination timing” and updates the timing learning model (S37). Since the operation in the determination phase according to the second example embodiment is the same as that in the first example embodiment described with reference to
According to the second example embodiment, training data (correct modes) are dynamically generated for a packet sequence from traffic flowing through a communication network, by using, for instance, DPI in the learning phase. As the traffic used to generate the training data (correct modes), actual traffic (such as traffic between a terminal and a server) flowing through a communication network can be used. According to the second example embodiment, it is made possible to generate training data reflecting traffic characteristic such as network load.
The network control instruction transmission part 115 receives a result of determination by the mode determination part 103, and when a mode change has occurred (Yes in S45), the network control instruction transmission part 115 transmits an instruction (control signal) to the network control apparatus 14 (S46) so that the QoE (and/or QoS) requirements for the mode after the change is met.
The network control instruction transmission part 115 may transmit to a base station (eNodeB) or wireless access point an instruction (control signal) controlling the number of resource blocks (RBs) allocated to a user terminal when controlling a bandwidth to meet the QoS or QoE requirements for the mode after the mode change. Alternatively, it may be configured to transmit a control signal scaling up/scaling out the performance of an application (VNF: Virtual Network Function) on a virtual machine (VM) realizing functions of a core network node using server virtualization to a management system (NFV (Network Function Virtualization) Management and Orchestration) of a virtual network constituting the network control apparatus 14. Alternatively, the mode determination apparatus 10B may be configured to be connected to, for instance, a network node of a core network. For instance, the mode determination apparatus 10B may work with an online charging system (OCS) in an EPC (Evolved Core network) and connect to a policy and charging rule function (PCRF) that manages and determines communication policy such as communication speed (bandwidth) according to the communication balance.
According to the present embodiment, it becomes possible to perform control such as allocation of communication bandwidths corresponding to the QoS or QoE after a mode switch.
A context aware engine 151 included in the mobile edge computing (MEC) 15 calculates conditions (demands) to meet QoS or QoE requirements according to an operation mode of an application and transmits parameters (wireless parameters) to satisfy the QoE requirements to, for instance, base stations (eNodeB) 14A and 14B. It is noted that in
The mode determination apparatus 10 may control a server in the MEC 15 via the network control apparatus 14 in
In the example embodiments above, a Naive Bayes classifier or a neural network may be used as a technique for learning a timing learning model and a mode learning model, in addition to a classifier such as a random forest. As a window for learning/determination, the following may be used.
1) Packet sequence immediately before a switching timing
2) Packet sequence immediately after a switching timing,
3) Packet sequences before and after a switching timing, or
A majority decision among the above 1) to 3) may be used.
Further, each disclosure of Patent Literatures 1 to 3 and Non-Patent Literature 1 cited above is incorporated herein in its entirety by reference thereto. It is to be noted that it is possible to modify or adjust the example embodiments or examples within the whole disclosure of the present invention (including the Claims) and based on the basic technical concept thereof. Further, it is possible to variously combine or select a wide variety of the disclosed elements (including the individual elements of the individual claims, the individual elements of the individual examples and the individual elements of the individual figures) within the scope of the Claims of the present invention. That is, it is self-explanatory that the present invention includes any types of variations and modifications to be done by a skilled person according to the whole disclosure including the Claims, and the technical concept of the present invention.
The example embodiments above can be described as the following supplementary notes (but not limited thereto).
A mode determination apparatus comprising:
a filter part that receives traffic data for learning and learns timing at which mode switching in the traffic data occurs, using training data; and
a mode learning part that generates a mode learning model for mode determination based on the traffic data for learning and the training data that correspond to the timing of mode switching, the mode determination apparatus determining a mode of actual traffic data, using the mode learning model.
The mode determination apparatus according to Supplementary Note 1, comprising the mode determination part that determines, by using the mode learning model, a mode of the actual traffic data corresponding to the timing learned by the filter part.
The mode determination apparatus according to Supplementary Note 2, wherein the filter part receives the actual traffic data, determines timing corresponding to mode switching, based on the learned timing, and supplies the actual traffic data of the timing corresponding to the mode switching to the mode determination part in a determination phase.
The mode determination apparatus according to any one of Supplementary Notes 1 to 3, further comprising a training data generation part that analyzes packets constituting the traffic data for learning, determines to which mode the packets belong, and creates the training data.
The mode determination apparatus according to any one of Supplementary Notes 1 to 4, further comprising a control instruction generation part that generates a control instruction signal for an apparatus that controls a network based on a result of mode determination by the mode determination part.
The mode determination apparatus according to any one of Supplementary Notes 1 to 5, comprising a packet acquisition part that captures packets flowing through a network.
The mode determination apparatus according to Supplementary Note 6, wherein the filter part in a learning phase, receives packets of traffic for learning acquired by the packet acquisition part, determines whether or not the packets correspond to a mode switching point, using the training data, calculates feature values of a packet sequence of a window of a predetermined length including the packets, learns the feature values and that the packets do or don't correspond to a mode switching timing, using supervised learning to update a timing learning model, and supplies the packet sequence including the packets to the mode learning part when the packets represent a mode switching timing.
The mode determination apparatus according to Supplementary Note 7, wherein the filter part in a determination phase, receives packets of actual traffic acquired by the packet acquisition part, calculates feature values of a packet sequence of the window of the predetermined length including the packets of the actual traffic, determines whether or not the packets represent a mode switching timing using the feature values and the timing learning model, and supplies the packet sequence including the packets to the mode determination part when the packets represent a mode switching timing.
The mode determination apparatus according to Supplementary Note 7 or 8, wherein the mode learning part calculates feature values of the packet sequence including the packets supplied by the filter part, learns the feature values and a mode to which the packets belong, using supervised learning to update a mode learning model.
The mode determination apparatus according to Supplementary Note 9, wherein the mode determination part calculates feature values of the packet sequence including the packets supplied by the filter part and determines to which mode the packets belong using the feature values and the mode learning model.
A mode determination method using a computer, comprising:
The mode determination method according to Supplementary Note 11, wherein the mode determination process includes
The mode determination method according to Supplementary Note 12, wherein
the filtering process in a determination phase comprises:
The mode determination method according to any one of Supplementary Notes 11 to 13, further comprising
The mode determination method according to any one of Supplementary Notes 11 to 14, further comprising
The mode determination method according to any one of Supplementary Notes 11 to 15, comprising
The mode determination method according to Supplementary Note 16, wherein the filtering process in a learning phase comprises:
The mode determination method according to Supplementary Note 17, wherein the filtering process in a determination phase comprises:
The mode determination method according to Supplementary Note 17 or 18, wherein the mode learning process comprises
The mode determination method according to Supplementary Note 19, wherein the mode determination process comprises
A program causing a computer to execute:
a filtering process of receiving traffic data for learning and performing learning of timing at which mode switching in the traffic data occurs using training data;
a model learning process of generating a mode learning model for mode determination based on the traffic data for learning and the training data that correspond to the timing of mode switching; and
a mode determination process of determining a mode of actual traffic data, using the mode learning model.
The program according to Supplementary Note 21, wherein the mode determination process determines a mode of the actual traffic data corresponding to the timing learned in the filtering process using the mode learning model.
The program according to Supplementary Note 22, wherein the filtering process in a determination phase receives the actual traffic data, determines timing corresponding to mode switching, based on the learned timing, and supplies the actual traffic data of the timing corresponding to the mode switching to the mode determination process.
The program according to any one of Supplementary Notes 21 to 23, causing the computer to further execute a training data creation process of analyzing packets constituting the traffic data for learning, determining to which mode the packets belong, and creating the training data.
The program according to any one of Supplementary Notes 21 to 24, causing the computer to further execute a control instruction generation process of generating a control instruction signal for an apparatus that controls a network based on a determination result in the mode determination process.
The program according to any one of Supplementary Notes 21 to 25, causing the computer to further execute a packet acquisition process of capturing a packet flowing through a network.
The program according to Supplementary Note 26, wherein the filtering process in a learning phase, receives packets of traffic for learning acquired in the packet acquisition process, determines whether or not the packets correspond to a mode switching point, using the training data, calculates feature values of a packet sequence of a window of a predetermined length including the packets, learns the feature values and that the packets do or don't correspond to a mode switching timing, using supervised learning to update a timing learning model, and supplies the packet sequence including the packets to the mode learning process when the packets represent a mode switching timing.
The program according to Supplementary Note 27, wherein the filtering process in a determination phase, receives packets of actual traffic acquired in the packet acquisition process, calculates feature values of a packet sequence of the window of the predetermined length including the packets of the actual traffic, determines whether or not the packets represent a mode switching timing using the feature values and the timing learning model, and supplies the packet sequence including the packets to the mode determination process, when the packets correspond to the mode switching timing.
The program according to Supplementary Note 27 or 28, wherein the mode learning process calculates feature values of the packet sequence including the packets supplied in the filtering process, learns the feature values and a mode to which the packets belong, using supervised learning to update a mode learning model.
The program according to Supplementary Note 29, wherein the mode determination process calculates feature values of the packet sequence including the packets supplied in the filtering process and determines to which mode the packets belong using the feature values and the mode learning model.
A network system comprising:
a mode determination apparatus that includes a filter that receives traffic data for learning and performs learning of timing at which mode switching in the traffic data occurs, using training data and a mode learning part generating a mode learning model for mode determination based on the traffic data for learning and the training data that correspond to the timing of mode switching, wherein the mode determination apparatus determines a mode of traffic data using the mode learning model; and
a network control apparatus that controls network traffic, based on a result of mode determination by the mode determination apparatus.
The network system according to Supplementary Note 31, wherein the mode determination apparatus comprises a mode determination part that determines, by using the mode learning model, a mode of the actual traffic data corresponding to the timing learned by the filter part.
The network system according to Supplementary Note 32, wherein the filter part in the mode determination apparatus in a determination phase receives the actual traffic data, determines timing corresponding to mode switching, based on the learned timing, and supplies the actual traffic data of the timing corresponding to the mode switching to the mode determination part.
A mobile edge computing (MEC) apparatus comprising the mode determination apparatus according to any one of Supplementary Notes 1 to 10.
A context aware engine apparatus comprising the mode determination apparatus according to any one of Supplementary Notes 1 to 10.
| Number | Date | Country | Kind |
|---|---|---|---|
| 2017-002158 | Oct 2017 | JP | national |
This application is a National Stage of International Application No. PCT/JP2018/000184, filed on Jan. 9, 2018, which claims the benefit of the priority of Japanese patent application No. 2017-002158 filed on Jan. 10, 2017, the disclosure of which is incorporated herein in its entirety by reference thereto.
| Filing Document | Filing Date | Country | Kind |
|---|---|---|---|
| PCT/JP2018/000184 | 1/9/2018 | WO | 00 |
