Abstract: A control device that controls a communication system in which a network device and a virtual network device on a cloud communicate with each other through a tunnel, the control device including: a calculation unit that calculates a predicted value of the number of future setting entries in the virtual network device; an autoscale execution unit that executes scale-out or scale-in of the virtual network device on the basis of a result of comparison between the predicted value and a threshold; and a control unit that performs routing control between an application and the virtual network device in a service platform on the cloud.

Abstract: A control apparatus configured to, in a network constituted by the multiple communication apparatuses, control one or more anchor nodes designated in advance among the multiple communication apparatuses, includes: a route creation unit configured to create route information including labels of communication apparatuses or links to be passed through, based on an input required condition; a route compression unit configured to divide the labels included in the route information in units of anchor nodes, and compress at least a portion of the labels included in the route information into a compressed label that can be expanded in at least one anchor node among the communication apparatuses determined based on the route information, so as not to exceed a processing limit of a communication apparatus determined based on the route information; and a distribution unit configured to distribute information for expanding the compressed label to the at least one anchor node.

Abstract: A control device that controls a communication system in which a network device and a virtual network device on a cloud communicate with each other through a tunnel, the control device including: a calculation unit that calculates a predicted value of the number of future setting entries in the virtual network device; an autoscale execution unit that executes scale-out or scale-in of the virtual network device on the basis of a result of comparison between the predicted value and a threshold; and a control unit that performs routing control between an application and the virtual network device in a service platform on the cloud.

Abstract: Provided is an infection-spreading attack detection system and method, as well as a program enabling an occurrence of an infection-spreading attack to be detected with high accuracy. A first feature amount is calculated based on traffic information on a packet transferred by a transfer device, and M partial address space(s) are identified to be a monitoring target based on the first feature amount. A second feature amount is calculated for each of the M partial address space(s) based on the traffic information related to the M partial address space(s). Abnormality detection determination is performed on each of the M partial address space(s) based on the second feature amount. Whether the infection-spreading attack has occurred is determined by evaluating M determination results.

Abstract: An occurrence of an infection-spreading attack and an attack source thereof are detected with high accuracy. A first feature value is calculated based on traffic information regarding a packet forwarded by a forwarding device, and M partial address spaces to be monitored are specified based on the first feature value. A second feature value is calculated for each address of a terminal in a network, based on traffic information regarding the M partial address spaces, the second feature value is learned to classify terminal addresses into a plurality of clusters, and whether or not each of the clusters is an infection-spreading attack is determined to generate cluster information. Whether or not an infection-spreading attack has occurred and an address of a terminal that is an attack source are specified based on the second feature value and the cluster information.

Abstract: A communication management apparatus suppresses occurrence of a communication anomaly in a cluster by including: an acquisition unit acquiring quantities of traffic of communications performed by one or more communication units operating in each of a plurality of computers constituting a cluster; a prediction unit predicting future quantities of traffic of the communications; an identification unit calculating, for each of the computers, a total of the future quantities of traffic of the communication units operating in the computer and identifying a first computer for which the total exceeds a threshold; and a move control unit controlling, for a communication unit operating in the first computer, move to a second computer.

Abstract: A path information managing apparatus includes a storage unit configured to store, in association with a virtual IP address, a locator of each of a plurality of aggregation routers and a locator of each of a plurality of virtual accommodation routers that are accommodated in each aggregation router and accommodate cluster, an acquisition unit configured to acquire the locator of the aggregation router associated with the virtual IP address and the locator of each virtual accommodation router, in response to an inquiry for a virtual IP address to a destination of a packet, the inquiry being transmitted from an accommodation router that receives the packet from a terminal, and a transmission unit configured to transmit, to the accommodation router, the acquired locator of the aggregation router, the acquired locator of each virtual accommodation router, and a weight of each virtual accommodation router, or the locator of any virtual accommodation router.

Abstract: A communication management apparatus suppresses occurrence of a communication anomaly in a cluster by including: an acquisition unit acquiring quantities of traffic of communications performed by one or more communication units operating in each of a plurality of computers constituting a cluster; a prediction unit predicting future quantities of traffic of the communications; an identification unit calculating, for each of the computers, a total of the future quantities of traffic of the communication units operating in the computer and identifying a first computer for which the total exceeds a threshold; and a move control unit controlling, for a communication unit operating in the first computer, move to a second computer.

Abstract: A communication system realizes End-to-End communication between communication devices via at least one service function by using Segment Routing IPv6. The communication system includes: transfer means for transferring a packet received from one of the communication devices at a communication origin of the End-to-End communication, by using an abstracted ID obtained by abstracting a segment ID in a prescribed range determined in advance; and conversion means for converting, upon receipt of the packet including the abstracted ID, the abstracted ID into an address or a segment ID of a service function instance providing the service function.

Abstract: A control apparatus configured to, in a network constituted by the multiple communication apparatuses, control one or more anchor nodes designated in advance among the multiple communication apparatuses, includes: a route creation unit configured to create route information including labels of communication apparatuses or links to be passed through, based on an input required condition; a route compression unit configured to divide the labels included in the route information in units of anchor nodes, and compress at least a portion of the labels included in the route information into a compressed label that can be expanded in at least one anchor node among the communication apparatuses determined based on the route information, so as not to exceed a processing limit of a communication apparatus determined based on the route information; and a distribution unit configured to distribute information for expanding the compressed label to the at least one anchor node.

Abstract: An occurrence of an infection-spreading attack and an attack source thereof are detected with high accuracy. A first feature value is calculated based on traffic information regarding a packet forwarded by a forwarding device, and M partial address spaces to be monitored are specified based on the first feature value. A second feature value is calculated for each address of a terminal in a network, based on traffic information regarding the M partial address spaces, the second feature value is learned to classify terminal addresses into a plurality of clusters, and whether or not each of the clusters is an infection-spreading attack is determined to generate cluster information. Whether or not an infection-spreading attack has occurred and an address of a terminal that is an attack source are specified based on the second feature value and the cluster information.

Abstract: Provided is an infection-spreading attack detection system and method, as well as a program enabling an occurrence of an infection-spreading attack to be detected with high accuracy. A first feature amount is calculated based on traffic information on a packet transferred by a transfer device, and M partial address space(s) are identified to be a monitoring target based on the first feature amount. A second feature amount is calculated for each of the M partial address space(s) based on the traffic information related to the M partial address space(s). Abnormality detection determination is performed on each of the M partial address space(s) based on the second feature amount. Whether the infection-spreading attack has occurred is determined by evaluating M determination results.