Patent Publication Number: US-11394599-B2

Title: System for estimating contact duration between a pair of communication apparatuses

Description:
TECHNICAL FIELD 
     The present invention relates to a system for monitoring communication state between communication apparatuses by passive means in a network. 
     BACKGROUND TECHNOLOGY 
     In TCP/IP communication, ARP (Address Resolution Protocol) is used to fetch a destination MAC address of the device corresponding to a destination IP address. 
     ARP is used to obtain a MAC address (Physical layer address) from an IP address. The MAC address and corresponding IP address is cached in the “ARP table”. A communication apparatus (source apparatus) broadcasts an ARP packet containing the destination IP address. A communication apparatus corresponding to the destination IP address receives the broadcast ARP packet and transmits a unicast ARP packet, in which its MAC address is included, to the source apparatus. The source apparatus receives the unicast ARP packet extracts the destination MAC address and caches it in its ARP table. Later, the communication apparatus (source apparatus) is able to transmit an IP packet to a destination IP address by referring to the ARP table. 
     Further, the information in the ARP table is retained for a specified period of time (Aging Time), and is deleted after the aging time elapses. After the information is deleted, the ARP table information is regenerated by the procedure described above when the need arises. 
     DISCLOSURE OF THE INVENTION 
     Problem to be Solved by the Invention 
     As described above, in TCP/IP communication, ARP packets are broadcast in a network, as a result it is possible to monitor communication state between a pair of communication apparatuses by monitoring broadcast ARP packets. For example, it is possible to monitor broadcast ARP packets in a network within a predetermined period, and estimate “Contact Duration” for communication apparatus pairs based on the time (Time-Stamp) at which the ARP packets were seen. Here, “Contact Duration” is defined as an estimate of how long communication has continued between a pair of communication apparatuses. 
     The purpose of the present invention is to provide a system for monitoring the communication state between a pair of communication apparatuses by passive means in the network and estimating the “Contact Duration” between the pair of communication apparatuses. 
     Means to Solve the Problem 
     In order to achieve the above purpose, the invention described in claim  1  is a system for estimating “Contact Duration” between a pair of communication apparatuses by passive means in a network in which communication apparatuses Ci (i is a natural number greater than or equal to 2) and a monitoring apparatus M are connected, wherein the monitoring apparatus M comprises of. 
     a packet collection unit configured to collect ARP packets broadcast in the network by communication apparatus Ci, add Time-Stamp information to the collected ARP packet, and store the collected packet with Time-stamp in a storage device DB; 
     a packet extraction unit configured to extract the ARP packets in which the destination MAC address is the same as the MAC address of communication apparatus Cj (j is a natural number greater than or equal to 2, j is not equal to i) from the ARP packets stored in said storage device DB, wherein the Time-Stamp information of the ARP packets is within a predetermined time range TM; 
     a communication state identification unit configured to estimate “Contact Duration” between communication apparatus Ci and communication apparatus Cj based on Time-Stamp information of the ARP packets (Source MAC address: Ci, Destination MAC address: Cj) extracted by said packet extraction unit; and 
     a communication state display unit configured to graphically show “Contact Duration” between communication apparatus Ci and communication apparatus Cj within the time range TM estimated by said communication state identification unit. 
     The invention described in claim  2  is the system according to claim  1 , wherein said communication state identification unit estimates 
     “Contact Duration” between communication apparatus Ci and communication apparatus Cj using equation (2) under constraint of equation (1) from the Time-Stamp information TSm (m: a natural number, p: a natural number, q: a natural number, p≤m≤q, 1≤≤p≤N−1, 2≤q≤N, N: Number of extracted ARP packets) of ARP packets (Source MAC address: Ci, Destination MAC address: Cj) within the time range TM and a predetermined monitoring parameter MPi of the communication apparatus Ci.
 
{TS m+1 −TS m }&lt;MP i   (1)
 
Contact Duration={TS q −TS p }+MP i   (2)
 
     The invention described in claim  3  is the system according to claim  2 , wherein said parameter MPi is defined as a time interval value based on the characteristics of communication apparatus Ci and is defined for each communication apparatus Ci. 
     The invention described in claim  4  is the system according to claim  1 - 3 , wherein said communication state identification unit computes “Contact Duration” as the sum of multiple “Contact Durations” calculated by the equation (2) under condition of the equation (1). 
     The invention described in claim  5  is the system according to claim  1 - 4 , wherein said communication state identification unit generates an alarm, if “Contact Duration” exceeds a predetermined threshold. 
     The invention described in claim  6  is the system according to claim  1 - 5 , wherein said communication state display unit comprises of: 
     a unit configured to graphically show “Contact Duration” between communication apparatus Ci and communication apparatus Cj on a displayed link between said communication apparatus Ci and said communication apparatus Cj by utilizing the difference in line shape; 
     a unit configured to graphically show “Alarm Notification” on said link if the alarm is generated; and 
     a unit configured to graphically show “Contact Duration” between communication apparatus Ci and communication apparatus Cj for each predetermined time slot. 
     Effect of the Invention 
     The invention produces the effect of being able to monitor communication state between communication apparatuses by passive means in the network and estimate “Contact Duration” between a pair of communication apparatuses without causing any additional load on the network. 
     “Contact Duration” is defined as an estimate of how long communication has continued between a pair of communication apparatuses. Therefore, the invention produces the effect of being able to quantitatively grasp “Contact Duration” for communication apparatus pairs. 
     Further, the invention produces the effect of detecting an unauthorized access if “Contact Duration” between a pair of communication apparatuses exceeds a predetermined threshold. 
    
    
     
       BRIEF DESCRIPTION OF DRAWINGS 
         FIG. 1  shows an example of network configuration for carrying out “Execution Example 1” of the present invention. 
         FIG. 2  shows a flowchart of an example process executed by the monitoring apparatus for carrying out “Execution Example 1” of the present invention. 
         FIG. 3  shows an example of data recorded in the recording device DB and an example of “Contact Duration” estimation for carrying out “Execution Example 1” of the present invention. 
         FIG. 4  shows an example of a graphical display of the “Contact Duration” between C 1  and C 2 , between C 1  and C 3 , between C 1  and C 4 , and between C 1  and C 5  for carrying out “Execution Example 1” of the present invention. 
         FIG. 5  shows an example of a graphical display of the “Contact Duration” between C 1  and C 2  for carrying out “Execution Example 1” of the present invention. 
     
    
    
     EXPLANATION OF CODES USED IN THE DIAGRAMS 
     
         
         M: monitoring apparatus 
         C 1 ˜Cn: communication apparatuses 
       
    
     BEST MODE FOR CARRYING OUT THE INVENTION 
     In the following, the prototype embodying best mode of the present invention is described with reference to figures. However, the present invention is not limited to this prototype. 
     1. Execution Example 1 
     The system for carrying out “Execution Example 1” of the present invention are concretely explained with reference to  FIG. 1-5 . 
     As shown in  FIG. 1 , the monitoring apparatus M estimates “Contact Duration” between a pair of communication apparatuses by monitoring ARP packets broadcast by communication apparatuses by passive means in a network in which communication apparatuses Ci (i is a natural number greater than or equal to 2) and a monitoring apparatus M are connected. Here, “Contact Duration” is defined as an estimate of how long communication has continued between a pair of communication apparatuses. Also, the network as described above is assumed to be a relatively small company LAN or intranet. 
     Next, the process executed by the monitoring apparatus M is concretely explained with reference to  FIG. 2 . As shown in  FIG. 2 , the packet collection unit S 01  collects ARP packets broadcast in the network by communication apparatus Ci, adds Time-Stamp information to the ARP packets, and stores the Source MAC address, Destination IP address, and Time-Stamp information of the ARP packets in a storage device DB. 
     An example of data recorded in the recording device DB is shown in  FIG. 3  “Table-2”. As shown in  FIG. 3  “Table-2”, in this example, 10 ARP request packets broadcast by communication apparatus C 1  are recorded in the recording device DB with the Time-Stamp information (TS 1  to TS 10 ) added. Further, referring to “Table-1”, information of “Destination MAC address” corresponding to “Destination IP address” is stored in the DB. Here, “Table-1” generated as the latest table containing the IP address and corresponding MAC address of a communication apparatus is stored in the recording device DB by the monitoring apparatus M. 
     Next, the packet extraction unit S 02  extracts the ARP packets in which the destination MAC address is the same as the MAC address of a communication apparatus Cj (j is a natural number greater than or equal to 2, j is not equal to i) from the ARP packets stored in the storage device DB, wherein the Time-Stamp information of the ARP packets is within a predetermined time range TM. 
     As shown in  FIG. 3  “Table-3”, in this example, the ARP packets in which the destination MAC address is the same as the MAC address of communication apparatus C 2  are extracted from ARP request packets broadcast from communication apparatus C 1  within the time range TM. As a result, 5 packets with Time-Stamp value is “TS 1 ”, “TS 4 ”, “TS 5 ”, “TS 9 ”, and “TS 10 ” have been extracted. 
     Next, the communication state identification unit S 03  estimates “Contact Duration” between communication apparatus Ci and communication apparatus Cj based on Time-Stamp information of the ARP packets (Source MAC address: Ci, Destination MAC address: Cj) extracted by said packet extraction unit. 
     The communication state identification unit S 03  estimates “Contact Duration” between communication apparatus Ci and communication apparatus Cj using equation (2) under constraint of equation (1) from the Time-Stamp information TSm (m: a natural number, p: a natural number, q: a natural number, p≤m≤q, 1≤p≤N−1, 2≤q≤N, N: Number of extracted ARP packets) of ARP packets (Source MAC address: Ci, Destination MAC address: Cj) within the time range TM and a predetermined monitoring parameter MPi of the communication apparatus Ci.
 
{TS m+1 −TS m }&lt;MP i   (1)
 
Contact Duration={TS q −TS p }+MP i   (2)
 
     Here, said parameter MPi is defined as a time interval value based on the characteristics of communication apparatus Ci and is defined for each communication apparatus Ci. Further, for example, said parameter MPi is defined a little larger than “Aging Time” with reference to “Aging Time” set in the ARP table of communication apparatus Ci. 
     Further, the communication state identification unit S 03  computes the “Contact Duration” as the sum of multiple “Contact Durations” calculated by the equation (2) under condition of the equation (1). 
     Next, the process for estimating “Contact Duration” is concretely explained with reference to  FIG. 3 . 
     &lt;Case-1&gt; 
     When Time-Stamp value (“TS 1 ”, “TS 4 ”, “TS 5 ”, “TS 9 ”, and “TS 10 ”) of ARP request packets satisfies the equation (1), that is, in case 
     {TS 4 −TS 1 }&lt;MP 1 , and {TS 5 −TS 4 }&lt;MP 1 , and {TS 9 −TS 5 }≥MP 1 , and {TS 10 −TS 9 }&lt;MP 1 , “Contact Duration” is estimated as follows.
 
Contact Duration={TS10−TS1}+MP1
 
&lt;Case-2&gt;
 
     When Time-Stamp value (“TS 1 ”, “TS 4 ”, “TS 5 ”, “TS 9 ”, and “TS 10 ”) of ARP request packets does not satisfy the equation (1), for example, in case 
     {TS 4 −TS 1 }&lt;MP 1 , and {TS 5 −TS 4 }&lt;MP 1 , and {TS 9 −TS 5 }≥MP 1 , and {TS 10 −TS 9 }&lt;MP 1 , “Contact Duration” is estimated as follows.
 
Contact Duration={TS5−TS1}+{TS10−TS9}+MP1
 
     “Case-1” and “Case-2” shown above are an example of a method for estimating “Contact Duration”. It makes it possible to quantitatively grasp “Contact Duration” of a communication apparatus pair by estimating “Contact Duration” 
     Further, the communication state identification unit S 03  generates an alarm, if “Contact Duration” exceeds a predetermined threshold. Therefore, it becomes possible to detect an unauthorized access if “Contact Duration” of a communication apparatus pair exceeds a predetermined threshold. 
     Also, for example, it is conceivable that said threshold is defined based on the following criteria. 
     &lt;Criteria for Defining the Threshold&gt; 
     
         
         (a) The threshold is defined separately for each time period TM.
       For example, the threshold is defined to be large, because the number of accesses is high during the daytime (for example 8:00-20:00) and the threshold is defined to be small because the number of accesses is low during the nighttime (for example 20:00-8:00).   
     
         (b) The threshold is defined based on the characteristics of the communication apparatus pair Ci and Cj.
       For example, when communication apparatus Cj is a server, the threshold value is defined in consideration of the number of accesses from communication device Ci to the server.   
     
       
    
     Next, communication state display unit S 04  graphically displays “Contact Duration” between communication apparatus Ci and communication apparatus Cj within the time range TM identified in said communication state identification unit. Communication state display unit S 04  is specifically described below. 
     (A) a unit configured to graphically indicate “Contact Duration” between communication apparatus Ci and communication apparatus Cj on a link between said apparatus Ci and said apparatus Cj by utilizing the difference in line shape; 
     (B) a unit configured to graphically indicate “Alarm Notification” on said link if the alarm is generated; 
     (C) a unit configured to graphically display “Contact Duration” between communication apparatus Ci and communication apparatus Cj for each predetermined time slot; 
     The unit (A) is described with reference to  FIG. 4 .  FIG. 4  shows an example graphical display of “Contact Duration” between C 1  and C 2 , between C 1  and C 3 , between C 1  and C 4 , and between C 1  and C 5 . 
     As shown in  FIG. 4 , “Contact Duration” within Time-Slot “8:00-9:00” is displayed, and “Contact Duration” within Time-Slot “21:00-22:00” is displayed. In addition, the Time-Slot value can be arbitrarily selected. 
     As shown in  FIG. 4 , “Contact Duration” within Time-Slot “8:00-9:00” between C 1  and C 2  is “30 min”, “Contact Duration” between C 1  and C 3  is “10 min”, “Contact Duration” between C 1  and C 4  is “0 min”, and “Contact Duration” between C 1  and C 5  is “20 min”. Then, “Contact Duration” is graphically indicated by utilizing the line shape. In this example, “Contact Duration” is graphically indicated by making the line thickness proportional to the numerical value of “Contact Duration”. Here, as an indicator, not only the line thickness but also the line type, line color, or some other line attribute may be used. 
     Also, “Contact Duration” for Time-Slot “21:00-22:00” between C 1  and C 2  is “0 min”, “Contact Duration” between C 1  and C 3  is “20 min”, “Contact Duration” between C 1  and C 4  is “50 min”, and “Contact Duration” between C 1  and C 5  is “0 min”. In a manner similar to the above, “Contact Duration” is graphically indicated by utilizing the line thickness. 
     In the example shown in  FIG. 4 , within Time-Slot “8:00-9:00”, it can be seen that although there is no access between C 1  and C 4 , there are many accesses between C 1  and C 2 . Also, within Time-Slot “21:00-22:00”, it can be seen that although there is no access between C 1  and C 2 , and between C 1  and C 5 , there are many accesses between C 1  and C 4 . 
     Next, the unit (B) is described with reference to  FIG. 4 . As described above, it generates an alarm, if “Contact Duration” exceeds a predetermined threshold. In the example shown in  FIG. 4 , “Contact Duration” within Time-Slot “21:00-22:00” between C 1  and C 4  is “50 min”, and “Contact Duration” is graphically indicated by utilizing the line shape (for example, line color) if “Contact Duration” exceeds the threshold. This makes it possible to easily indicate the link of a communication apparatus pair for which the alarm has been notified. 
     Next, the unit (C) is described with reference to  FIG. 5 .  FIG. 5  shows an example of graphically indicating “Contact Duration” between C 1  and C 2 . 
     As shown in  FIG. 5 , “Contact Duration” between C 1  and C 2  is shown for each predetermined Time-Slot. In the example shown in  FIG. 5 , “Contact Duration” within Time-Slot “8:00-9:00”, Time-Slot “9:00-10:00”, Time-Slot “21:00-22:00”, and Time-Slot “22:00-23:00” is shown. In addition, the Time-Slot value can be arbitrarily selected. 
     As shown in  FIG. 5 , “Contact Duration” for Time-Slot “8:00-9:00” is “30 min”, “Contact Duration” for Time-Slot “9:00-10:00” is “15 min”, “Contact Duration” for Time-Slot “21:00-22:00” is “50 min”, and “Contact Duration” for Time-Slot “8:00-9:00” is “55 min”. Then, “Contact Duration” is graphically displayed by utilizing the bar height in a bar graph. 
     In the example shown in  FIG. 5 , within Time-Slot “21:00-23:00”, it can be seen that there are many accesses between C 1  and C 2 . 
     As described above, “Contact Duration” is defined as an estimate of how long the communication has continued between a pair of communication apparatuses. Therefore, it is possible to quantitatively grasp the “Contact Duration” for communication apparatus pairs in a network. Further, it is possible to easily detect an unauthorized access from the alarm that is raised if “Contact Duration” exceeds a predetermined threshold.