Network analysis device, management system, network analysis method and program

Patent metadata

Field	Value
Publication number	US-9686095-B2
Application number	US-201114362651-A
Country	US
Kind code	B2
Filing date	Dec 7, 2011
Priority date	Dec 7, 2011
Publication date	Jun 20, 2017
Grant date	Jun 20, 2017

Abstract

An electronic message information collector collects packets transferred on a building management system network and analysis results as first electronic message information. A storage stores the first electronic message information collected by the electronic message information collector. An electronic message information collector collects packets transferred on an equipment network and analysis results as second electronic message information. A storage stores the second electronic message information collected by the electronic message information collector. An electronic message associator associates the first electronic message information stored in the storage and the second electronic message information stored in the storage. A display displays the analysis results of the association by the electronic message associator.

First claim

The invention claimed is:

1. A network analysis device, comprising:
an electronic message collector collecting electronic messages, the electronic message collector including a first electronic message information collector collecting first electronic message information regarding electronic messages transferred on a first network and a second electronic message information collector collecting second electronic message information regarding electronic messages transferred on a second network;
a first storage storing the first electronic message information collected by the first electronic message information collector;
a second storage storing the second electronic message information collected by the second electronic message information collector; and
an electronic message associator associating the first electronic message information stored in the first storage and the second electronic message information stored in the second storage based on protocol interconversion scheme information between the first network and the second network, wherein
the electronic message associator determines a collected electronic message unassociated with stored electronic message information to be an abnormal electronic message, counts each electronic message determined to be abnormal electronic messages, and outputs a number of counted electronic messages and information regarding whether the determined abnormal electronic message transferred on the first network or the second network to a display.

2. The network analysis device according to claim 1 , wherein
the electronic message associator creates data for a list of electronic messages determined to be abnormal electronic messages and outputs the data created to the display.

3. The network analysis device according to claim 1 , further comprising:
a first analyzer analyzing electronic messages transferred on the first network; and
a second analyzer analyzing electronic messages transferred on the second network, wherein
the first electronic message information collector collects the electronic messages and analysis results analyzed by the first analyzer as the first electronic message information, and
the second electronic message information collector collects the electronic messages and analysis results analyzed by the second analyzer as the second electronic message information.

4. The network analysis device according to claim 1 , wherein
at least one of the first electronic message information collector and the second electronic message information collector sequentially extracts and collects the electronic messages received by a gateway device connecting the first network and the second network.

5. The network analysis device according to claim 1 , wherein
at least one of the first electronic message information collector and the second electronic message information collector extracts and collects the electronic messages accumulated by a gateway device connecting the first network and the second network at a time.

6. A management system, comprising:
a gateway device capable of accumulating electronic messages transferred on at least one of the first network and the second network and outputting the electronic messages at a time; and
the network analysis device according to claim 5 .

7. A network analysis method, comprising:
collecting electronic messages including first electronic message information regarding electronic messages transferred on a first network and second electronic message information regarding electronic messages transferred on a second network;
storing in a first storage the collected first electronic message information;
storing in a second storage the collected second electronic message information; and
associating the first electronic message information stored in the first storage and the second electronic message information stored in the second storage based on protocol interconversion scheme information between the first network and the second network, wherein
the associating includes determining that a collected electronic message unassociated with stored electronic message information is an abnormal electronic message counting each abnormal electronic message, and outputting a number of counted electronic messages and information regarding whether the determined abnormal electronic message transferred on the first network or the second network to a display.

8. A non-transitory computer-readable recording medium storing a program allowing a computer to function as:
an electronic message collector collecting electronic messages, the electronic message collector including a first electronic message information collector collecting first electronic message information regarding electronic messages transferred on a first network and a second electronic message information collector collecting second electronic message information regarding electronic messages transferred on a second network;
a first storage storing the first electronic message information collected by the first electronic message information collector;
a second storage storing the second electronic message information collected by the second electronic message information collector; and
an electronic message associator associating the first electronic message information stored in the first storage and the second electronic message information stored in the second storage based on protocol interconversion scheme information between the first network and the second network, wherein
the associating of the electronic message associator determines that an electronic message unassociated with stored electronic message information is an abnormal electronic message counts each electronic message determined to be abnormal electronic messages, and outputs a number of counted electronic messages and information regarding whether the determined abnormal electronic message transferred on the first network or the second network to a display.

Assignees

• Ochiai Akihiro
• Komiya Noriyuki
• Mitsubishi Electric Corp

Inventors

• Ochiai Akihiro
• Komiya Noriyuki

Classifications

• H04L43/04

  Processing captured monitoring data, e.g. for logfile generation · CPC title

• H04L43/0817

  by checking functioning · CPC title

• H04L41/50

  Network service management, e.g. ensuring proper service fulfilment according to agreements · CPC title

• H04L2012/285

  Generic home appliances, e.g. refrigerators · CPC title

• H04L41/22

  comprising specially adapted graphical user interfaces [GUI] · CPC title