JP6347510B2 - Communication behavior analysis apparatus and user experience quality estimation method - Google Patents

Description

The present invention relates to a communication behavior analysis apparatus and a user experience quality estimation method for analyzing a communication user's behavior and associating it with a quality of experience, and in particular, analyzing a communication user's communication behavior based on communication traffic measured passively on a network. The present invention relates to a communication behavior analysis apparatus and a user experience quality estimation method .

  Patent Document 1 discloses a technique for estimating quality based on information obtained by active measurement of RTT, packet loss rate, and the like as a TCP quality estimation method based on active measurement.

  Patent Document 2 discloses a system in which a measurement agent intermittently transmits packets and measures the quality of a communication network to Active.

  Patent Document 3 discloses an apparatus that analyzes a user's communication behavior at an intermediate GW node of a network.

  Patent Document 4 discloses a system for modeling the movement of a user / terminal and how the communication is performed after the movement.

JP 2004-140596 A Japanese Patent Laid-Open No. 2004-7339 Japanese Patent Laid-Open No. 2004-147067 JP 2007-233849

  Since Patent Documents 1 and 2 perform active measurement of communication traffic, extra traffic and a load are generated along with the measurement. In addition, there are load and scalability problems associated with measurement. Furthermore, communication quality and communication behavior cannot be linked and analyzed.

  Patent Document 3 is intended for communication behavior analysis for security measures, and does not analyze the relationship between quality and behavior. Patent Document 4 cannot analyze communication quality and communication behavior in association with each other.

  On the other hand, apart from the above-mentioned patent documents, as a method for analyzing the relationship between communication quality and communication behavior and the quality of experience, a method for preparing a special monitor function on the terminal side, a subjective quality evaluation experiment, a questionnaire And so on. However, all of these methods have a problem that the processing is complicated and it is difficult to conduct a large-scale survey.

  The object of the present invention is to solve the above technical problems and represent the user's communication behavior as a result of analyzing the session aggregation status in units of users, and analyze the relationship between the session aggregation status and communication quality It is an object of the present invention to provide a communication behavior analysis device that makes it possible to estimate a communication quality condition that satisfies a user.

In order to achieve the above object, the communication behavior analysis apparatus and the user experience quality estimation method according to the present invention captures communication traffic passively on a network and determines each session having the same transmission source based on the occurrence interval. A means for aggregating a plurality of groups, a means for analyzing a relationship between a communication user's communication behavior and the user's perceived communication quality based on the analysis result of the communication quality of each aggregated session and the state of aggregation; and And a means for outputting an analysis result.

According to the present invention, the following effects are achieved.
(1) Based on a large amount of passively captured communication traffic, it is possible to analyze the relationship between the aggregation status and communication quality when sessions are aggregated according to a predetermined rule. Since the session aggregation status can represent the communication behavior of the communication user, the relationship between the quality of experience of the communication user and the communication behavior can be accurately analyzed.

  (2) The perceived quality or subjective quality of each user or user can be analyzed and grasped without directly inquiring the user or conducting a questionnaire survey.

It is the block diagram which showed the structure of the network to which the communication behavior analysis apparatus and sensible communication quality estimation apparatus of this invention are applied. It is the functional block diagram which showed the structure of the capture apparatus (communication behavior analysis apparatus) which concerns on 1st Embodiment of this invention. It is a figure for demonstrating the outline | summary of this invention. It is a sequence flow for demonstrating the measuring method of the quality characteristic for TCP connection. It is a sequence flow for demonstrating the measuring method of the quality characteristic for HTTP session. It is the figure which showed the analysis item of the bulk and the call. It is the state transition diagram which showed the procedure which analyzes the relationship between the state transition probability of a bulk continuation, and each communication quality. It is the figure which showed the relationship between the throughput at the time of browser communication (downloading) by HTTP and the bulk continuation rate It is the figure which showed the relationship between the throughput at the time of the video delivery (downloading) by HTTP, and a bulk continuation rate. It is the figure which showed the relationship between the bulk continuation rate at the time of browser communication (download) by HTTP, and HTTP response delay. It is the figure which showed the relationship between the bulk continuation rate at the time of the video delivery (downloading) by HTTP, and HTTP response delay. It is the figure which showed the relationship between the sum of the reset rate and timeout rate of a TCP connection, and HTTP response delay. It is the figure which showed the relationship between the number of HTTP sessions in a bulk, and CDF. It is the figure which showed the relationship between a bulk threshold value and the average value of the number of HTTP sessions in a bulk. It is the figure which showed the relationship between a bulk threshold value and the primary differential value of the average value of the number of HTTP sessions in a bulk, and a secondary differential value. It is the figure which showed the relationship between the transmission / reception data size per HTTP session in a bulk, and CDF. It is the figure which showed the relationship between a bulk threshold value and the average value of the transmission / reception data size per HTTP session in a bulk. It is the figure which showed the relationship with the primary differential value of the average value of the transmission / reception data size per HTTP session in a bulk with respect to a bulk threshold value, and a secondary differential value.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings. Here, first, an outline of the present invention will be described, and then a specific embodiment thereof will be described. In the following explanation, the connection at the transport layer (4th layer) is basically expressed as “connection”, and the connection at the higher layer is expressed as “(HTTP) session”. However, there are cases where both are represented by “(TCP / HTTP) session”.

  In the present invention, an action (communication action) in which a communication user operates his / her communication terminal to generate communication (communication action) is analyzed in a scalable manner by passively capturing the communication traffic, and the communication quality and the communication action are associated with each other. Furthermore, the quality of experience related to the communication of the user is estimated from the communication behavior estimated from the communication traffic. As the communication behavior, attention is particularly paid to the communication behavior that causes communication to be performed by operating the communication terminal on the communication application from when the communication application is activated to when it is terminated.

  Therefore, in the present invention, sessions are identified from the captured communication traffic, and a large number of sessions are aggregated in time series in bulk units based on their occurrence times.

  FIG. 3 is a diagram schematically showing a session (connection) aggregation method. For each session with the same transmission source, the occurrence time of the earliest session is set as a reference time, and this reference time and each subsequent session are shown. A time difference Δτ from the occurrence time of is calculated. In this embodiment, the identity of the transmission source is determined based on the transmission source address information. All sessions whose session occurrence interval Δτ is equal to or less than a predetermined first bulk threshold Δτbulk1 are aggregated into the same bulk #i, while sessions whose occurrence interval Δτ is greater than the first bulk threshold Δτbulk1 i + 1, bulk # i + 2 ... [Figure (a)].

  In addition, the final end time of the session aggregated in the i-th bulk #i adjacent in time series is compared with the first occurrence time of the session aggregated in the i + 1-th bulk # i + 1. If the time difference ΔT is equal to or less than the predetermined call threshold Δτcall, the bulks are aggregated into the same call #j, whereas if the time difference ΔT is greater than the predetermined call threshold Δτcall, the bulk is aggregated into the next call # j + 1 [ (B)].

  Here, for each session in the same bulk, after identifying whether the application is derived from the user's communication operation or performed in the background regardless of the user's communication operation, Only the communication operation may be analyzed. Further, for each session in a call or bulk, after identifying only a communication session caused by a user operation on the same application, only a communication operation derived from the same application may be analyzed. By analyzing these, for example, for each application, the experience quality related to the user's communication may be associated with the communication behavior of the user, and the experience quality of the communication user may be estimated from any communication behavior.

  Note that the bulk aggregation method for each session is not limited to the above, and as shown in FIG. 3C, for each session having the same source address information, the occurrence time of the nth session and n + An interval (session occurrence interval) Δτ with the occurrence time of the first session is sequentially calculated, and all sessions whose session occurrence interval Δτ is equal to or less than a predetermined second bulk threshold Δτbulk2 are aggregated into the same bulk #i, Sessions larger than the bulk threshold Δτbulk2 may be aggregated into the following bulk # i + 1, bulk # i + 2,.

  FIG. 1 is a block diagram showing the configuration of the main part of a network to which the communication behavior analysis method of the present invention is applied.

  A radio base station BS is installed in each area of the service providing range, and a client (radio mobile terminal MH in this embodiment) in the area is accommodated in each radio base station BS. Each radio base station BS is connected to a radio access network RAN, and the radio access network RAN is connected to a gateway (GW) of the core network. The core network is connected to the Internet at the Internet Exchange (IX).

  Various servers that provide services in response to requests from the MH are connected to the Internet. In the present embodiment, a capture device 1 as a communication quality measuring device is connected to a line L that connects the radio access network RAN and the core network as a line that can aggregate traffic between each MH and each server. .

  FIG. 2 is a functional block diagram showing the configuration of the first embodiment of the capture device 1. Here, the configuration unnecessary for the description of the present invention is omitted. In the present embodiment, the capture device 1 has a function as a communication behavior analysis device.

  The packet capture unit 10 selectively captures IP (TCP, UDP, etc.) packets on the line L. The log information management unit 20 records and manages at least the type of the captured packet, source address information, arrival time, and packet size (data amount) as log information.

  The traffic aggregating unit 30 includes a bulk aggregating unit 301 and a call aggregating unit 302, and aggregates each session of captured traffic for each source address based on the occurrence interval Δτ, as shown in FIG.

  As shown in FIG. 3A, the bulk aggregating unit 301 aggregates sessions having an occurrence interval Δτ equal to or smaller than a predetermined bulk threshold Δτbulk into the same bulk for a session set having the same source address information.

  As shown in FIG. 3 (b), the call aggregating unit 302 sets the end time of the last session aggregated in the #th bulk adjacent in time series and the first session aggregated in the # + 1st bulk. When the time interval ΔT between the two is less than or equal to a predetermined call threshold Δτcall, the bulks are aggregated into the same call, and when they are larger than the call threshold Δτcall, they are aggregated into another (next) call. . The communication quality calculation unit 40 calculates the communication quality of each traffic aggregated in each bulk for each predetermined quality item.

  In the analysis unit 50, the communication quality analysis unit 501 statistically processes the communication quality calculation result to calculate the communication quality characteristic. The aggregation status analysis unit 502 analyzes the bulk aggregation status of each session. The correspondence analysis unit 60 analyzes the correspondence between the session aggregation status and the communication quality of the session in each bulk based on the analysis result of the communication quality and the bulk aggregation status.

  FIG. 4 is a diagram for explaining a communication quality calculation method by the communication quality calculation unit 40. Here, a method for measuring the delay characteristics of a connection that can be captured from a SYN packet of a TCP_3way handshake executed between a client and a server when a TCP connection is established will be described.

  In this case, the difference between the arrival time (connection occurrence time) t1 of the SYN packet first transmitted from the terminal MH to the server and the arrival time t2 of the SYN + ACK packet returned from the server to the terminal MH (t2-t1) Based on the above, the server side RTT (round trip) delay is calculated.

  The client-side RTT delay is calculated based on the difference (t3-t2) between the arrival time t2 of the SYN + ACK packet and the arrival time t3 of the ACK packet last transmitted from the terminal MH to the server.

  Further, the TCP connection delay is calculated based on the difference (t4-t1) between the arrival time t1 of the first SYN packet and the arrival time t4 of the data packet first transmitted from the terminal MH to the server after the 3-way handshake. .

  Furthermore, based on the difference (t5-t1) from the arrival time t1 of the first data transmitted from the terminal MH after the 3-way handshake to the arrival time t5 of the FIN or RST packet, and the amount of transmitted / received data captured within the difference time Thus, the throughput characteristic of the TCP connection is calculated.

  When packet capture is started from the middle of the connection, only possible analysis is selectively performed from the obtained arrival time. That is, if the capture is started from the SYN + ACK packet, only the client-side RTT delay is calculated based on the difference (t3-t2) from the arrival time t2 to the arrival time t3 of the ACK packet.

  Further, the throughput characteristics and TCP connection time required for the TCP connection depend not only on the client side delay but also on the server side delay, so these characteristics calculated when the server side delay is large are Cannot accurately represent the communication quality on the other side. Therefore, when the server-side RTT delay exceeds a predetermined threshold, or when the packet arrival interval such as data or ACK that can represent the server-side delay exceeds a predetermined threshold, TCP characteristics and TCP connection It is desirable to exclude the time required from quality analysis.

  FIG. 5 is a sequence flow for explaining a method for measuring quality characteristics for an HTTP session. An HTTP request (# 1) packet arrival time t1 and an HTTP response (# 1) The time difference (t2−t1) from the arrival time t2 of the packet is regarded as the HTTP response delay.

  Further, the time difference (t3−t1) between the arrival time t1 of the first HTTP request (# 1) packet and the arrival time t3 of the last HTTP response (# 1) packet is set as the HTTP hold time.

  Furthermore, the time difference (t2-t1) between the arrival time t2 of the first HTTP response (# 1) packet and the arrival time t3 of the last HTTP response (# 1) packet is set as the HTTP response hold time and downloaded during that time. The total data amount is the HTTP communication data amount.

  Furthermore, the time difference (t5-t4) between the arrival time t4 of the first HTTP request (# 2) packet and the arrival time t5 of the last HTTP request (# 2) packet is the HTTP request hold time, and the amount of data between them is The amount of HTTP request data.

  In the present embodiment, when the respective quality values are obtained as described above, the communication quality analysis unit 501 performs “1. delay characteristics”, “2. throughput characteristics”, and “3. end (giving) characteristics”. The following statistical values are calculated for the items.

1. Delay characteristics
(1) Server / terminal RTT average, standard deviation, maximum, minimum, X% ile value
(2) Average value, standard deviation, maximum value, minimum value, X% ile value of client / RAN side RTT
(3) TCP connection delay average value, standard deviation, maximum value, minimum value, X% ile value
(4) Average value, standard deviation, maximum value, minimum value, X% ile value of HTTP response delay
(5) Average value, standard deviation, maximum value, minimum value, X% ile value of HTTP hold time

2. Throughput characteristics
(1) Download (Res) throughput
(2) Upload (Req) throughput
(3) Throughput in bulk of HTTP sessions (calculated by totaling HTTP sessions in bulk and total data divided by total hold time. (That is, the real time hold time is calculated)

3. Termination characteristics
(1) Reset occurrence rate (calculated by the total number of TCP Reset (RST) occurrences in the call bulk divided by the total number of TCP connections)
(2) Timeout occurrence rate (calculated as the total number of timeout occurrences in the call bulk divided by the number of aggregated TCP connections)

  FIG. 6 is a diagram illustrating a method of analyzing the bulk aggregation status by the aggregation status analysis unit 502. For a session with the same source address information, “bulk transition continuation”, “bulk continuation count”, “bulk” The duration, the number of call durations, the call duration, etc. are required.

  “Bulk transition continuation” is a flag value determined by whether or not the next bulk is in the same call, with the bulk for each call as a base point. That is, the time between the end time of the session with the latest end time among the sessions aggregated in each bulk in each call and the start time of the session with the earliest start time among the sessions aggregated into the next bulk This is a flag value determined by whether or not the difference ΔT is equal to or less than the call threshold value ΔτCall. In the present embodiment, if the next bulk is in the same call, “continuation is present (= 1)” is set, and if it is not in the same call, “not continued (= 0)” is set.

  “Bulk continuation count” is an ordinal number indicating the order of occurrence of each bulk in each call. For example, when 10 bulks exist in a call, 1 to 10 in time series order for each bulk. Each ordinal number up to is set as the number of bulk continuations.

  “Bulk duration” is the elapsed time in the order of occurrence of each bulk within each call. For example, if there are 10 bulks in a call, the first = the start time of the first bulk The time is the difference from the start time of each bulk generated after the second time. Since the generation order of the bulk is chronological order, the elapsed time corresponding to each bulk order has a monotonically increasing time width.

  Next, the correspondence between the aggregation status of each bulk and the communication quality by the correspondence analysis unit 60 will be described.

  In the present embodiment, the collected communication logs of each session are grouped for each item of communication quality based on the quality value, and each group is associated with an analysis result regarding the bulk aggregation status.

  For example, when attention is paid to download (DL) throughput in Web browsing (HTTP session) as an item of communication quality, all communication logs are grouped in a range of about 10 kbps, focusing on the DL throughput. As a result, for example, each communication log with a throughput of 150 kbps to 160 kbps is grouped into the same group, and each communication log with 160 kbps to 170 kbps is grouped into another same group.

  For example, for a group of 150 kbps to 160 kbps, if the number of logs in the group is 100, of which 85 are “1” and 15 are “0”, the bulk continuation rate Is 0.85, and this is the bulk continuation rate (bulk aggregation status) corresponding to the throughput of 150 kbps to 160 kbps (quality value).

  Then, by repeating the association between the quality value and the bulk aggregation status for each group, the correspondence between the DL throughput and the bulk continuation rate can be obtained as shown in FIG.

  According to FIG. 7, the DL throughput and the bulk continuity rate have a significant correlation, and the bulk continuity rate is drastically decreased at the DL throughput of 190 to 200 kbps. From this, it can be seen that the user responds with DL throughput of 190 to 200 kbps regarding the communication quality at the time of download, and as a result, the bulk continuation rate is reduced.

  Note that the singular point where the correspondence between the session aggregation status in each bulk and the communication quality of the session specifically changes is as follows. It can be detected based on the first and second derivative values of the session aggregation status (bulk continuation rate).

  Therefore, with regard to DL throughput in web browsing, it can be estimated that about 190 to 200 kbps is the threshold value of the allowable communication quality of the user, that is, the limit value of the quality of experience at which dissatisfaction starts. Therefore, it can be seen that it is desirable that the DL throughput is not lower than 190 to 200 kbps when newly establishing or adding a communication facility.

Fig. 8 is a diagram showing the relationship between DL throughput of content and MOS (mean opinion score) in Web browsing. Again, the MOS value is specifically reduced below 200kbps. If the content type is Web browsing content, it can be seen that the bulk continuation rate can represent the subjective experience quality of the user. In other words, from the analysis results of FIGS. 7 and 8 and the similarity of the correlation, the user starts to feel dissatisfied with the communication quality when the DL throughput is reduced to 190 to 200 kbps, which is reflected in the communication behavior of the user, It turns out that it becomes possible to observe objectively as a decrease in the bulk continuation rate.

FIG. 9 is a diagram showing a correspondence relationship between DL throughput and bulk continuation rate in streaming playback of video content , and in the same manner as described above, all communication logs are grouped for each predetermined range based on DL throughput, It is configured by plotting the relationship with the bulk continuation rate for each groove.

According to FIG. 9, the DL throughput and the bulk continuity rate showed a significant correlation, and the DL continuation rate rapidly decreased when the DL throughput was around 450 kbps, and the user began to feel dissatisfied with the communication quality of the download. You can read how you are. Accordingly, it can be estimated that around 450 kbps is the threshold of the allowable communication quality of the user with respect to the DL throughput in streaming playback whose content type is video content .

  FIG. 10 is a diagram showing the relationship between the number of bulk continuations during HTTP Web browser communication (download) and HTTP response delay, and FIG. 11 is the number of bulk continuations during HTTP video distribution (download) and HTTP responses. It is the figure which showed the relationship with a delay. In any of the figures, it can be seen that if the communication quality is not good (HTTP response delay is small), the number of bulk continuations is not statistically increased.

  That is, FIGS. 10 and 11 show that when the communication quality (HTTP response delay) is good, the number of bulk continuations as the user's communication behavior increases, while when the communication quality (HTTP response delay) is poor, It shows that the number of bulk continuations, which is a communication action, does not increase so much, and from these results, it is also possible to analyze the relationship between the number of bulk continuations and the communication quality to change the user's communication behavior. It turns out that the subjective quality of experience of a user can be objectively analyzed.

  FIG. 12 is a diagram showing the relationship between the sum of the TCP connection reset occurrence rate and timeout occurrence rate and HTTP response delay in Web browsing (HTTP). As the HTTP response delay increases, the sum of the reset occurrence rates also increases, so it can be seen that if the quality deteriorates, the “praise” that occurs in the middle of communication also increases. From these results, it can be seen that by analyzing the relationship between compliment characteristics and communication quality, it is possible to objectively analyze the user's subjective experience quality, which is the point at which the user's communication behavior changes. .

  Next, a method for setting the first bulk threshold (sec) in the session aggregation method described with reference to FIG.

  FIG. 13 is a diagram illustrating the relationship between the number of HTTP sessions in the bulk and the distribution function (CDF) for each first bulk threshold Δτbulk1. FIG. 14 is a diagram showing a relationship between the first bulk threshold Δτbulk1 and the average value of the number of HTTP sessions in the bulk. FIG. 15 is a diagram illustrating the relationship between the first bulk threshold and the first and second derivative values of the average value of the number of HTTP sessions in Δτbulk1 bulk.

  FIG. 16 is a diagram showing the relationship between the CDF and the transmission / reception data size per HTTP session in the bulk for each first bulk threshold value Δτbulk1. FIG. 17 is a diagram showing the relationship between the first bulk threshold Δτbulk1 and the average value of the transmission / reception data size per HTTP session in the bulk. FIG. 18 is a diagram illustrating the relationship between the first and second derivative values of the average value of the transmission / reception data size per HTTP session in the bulk with respect to the first bulk threshold Δτbulk1.

  According to FIGS. 13-18, the tendency of the characteristic increase accompanying increase of 1st bulk threshold value (DELTA) (tau) bulk1 has settled linearly around 3-5 seconds, and the range of 3-5 seconds is suitable as 1st bulk threshold value It turns out that it is. However, the first bulk threshold value Δτbulk1 does not necessarily need to be fixedly set. The tendency of an increase in characteristics accompanying the increase in the first bulk threshold value Δτbulk1 is appropriately detected, and the first bulk threshold value Δτbulk1 is within a range showing linearity. It may be set dynamically.

DESCRIPTION OF SYMBOLS 1 ... Capture apparatus, 10 ... Packet capture part, 20 ... Log information management part, 30 ... Traffic aggregation part, 40 ... Communication quality calculation part, 50 ... Analysis part, 60 ... Correspondence analysis part, 301 ... Bulk aggregation part, 302 ... Call aggregation unit, 501 ... Communication quality analysis unit, 502 ... Aggregation status analysis unit

Claims (15)

In a communication behavior analysis device that analyzes the relationship between user communication behavior and communication quality with respect to a communication terminal,
Means for passively capturing traffic of communication terminals on the network;
Based on the captured traffic, means for aggregating each session having the same transmission source into a plurality of bulks in time series based on the occurrence interval;
A means of analyzing session aggregation in each bulk;
A means to analyze the communication quality of each bulk aggregated session;
A means for analyzing the correspondence between session aggregation status and communication quality of each session in each bulk;
A communication behavior analysis apparatus comprising: means for outputting a result of the analysis of the correspondence relationship.   The aggregating means aggregates sessions having the same source address and an occurrence interval within a predetermined bulk threshold into the same bulk, and sequentially aggregates sessions with the occurrence interval exceeding the predetermined bulk threshold into each subsequent bulk. The communication behavior analysis apparatus according to claim 1, wherein:   The communication behavior analysis apparatus according to claim 2, wherein the aggregation means aggregates all sessions that have occurred within the first bulk threshold from the earliest session occurrence time into the same bulk, and repeats this.   The communication behavior analysis apparatus according to claim 3, wherein the first bulk threshold is 3 to 5 seconds.   The communication behavior analysis apparatus according to claim 2, wherein the aggregation unit aggregates all sessions whose occurrence time intervals are within the second bulk threshold with each other and repeats the same.   The means for aggregating includes, for a plurality of bulks that aggregate sessions having the same transmission source, the last end time of the session included in the i-th bulk and the occurrence time of the earliest session included in the i + 1th bulk. The bulks whose difference is within a predetermined call threshold are aggregated into the same call, and the bulks whose occurrence intervals exceed the predetermined call threshold are aggregated sequentially into subsequent calls. 5. The communication behavior analysis device according to any one of 5 above.   The means for analyzing the correspondence relationship associates, for each item of communication quality, a bulk aggregation state in which sessions having communication quality within the quality value range for each predetermined quality value range and the quality value range. The communication behavior analysis apparatus according to claim 1, wherein: 8. The communication according to claim 1, wherein the bulk aggregation status is any of presence / absence of continuation of bulk transition, bulk continuation number, bulk continuation time , call continuation number, and call continuation time. Behavior analysis device. Further comprising means for determining whether each session is from a user;
The communication behavior analysis apparatus according to claim 1, wherein the aggregation unit aggregates only user-derived sessions.   The communication behavior analysis apparatus according to claim 1, wherein the aggregation unit aggregates each session for each application type.   The communication behavior analysis apparatus according to claim 1, wherein the aggregation unit aggregates each session for each content type.   12. The method according to claim 1, further comprising means for detecting a singular point in which a correspondence relationship between a session aggregation state in each bulk and a communication quality of the session changes specifically. Communication behavior analysis device.   The means for detecting the singular point detects the singular point based on at least one of a first derivative value and a second derivative value of a correspondence relationship between the session aggregation status in each bulk and the communication quality of the session. The communication behavior analysis device according to claim 12. In the user experience quality estimation method for analyzing the relationship between the communication behavior of the user with respect to the communication terminal and the communication quality by a computer and estimating the experience quality related to the communication of the user,
Passively capture traffic of communication terminals on the network,
Based on the captured traffic, each session with the same source is aggregated into multiple bulks in time series based on the occurrence interval,
Analyzing the aggregation status of sessions in each bulk,
Analyzing the communication quality of sessions aggregated into each bulk,
Analyzing the correspondence between session aggregation status and communication quality of each session in each bulk,
A user experience quality estimation method characterized by estimating a limit value of the experience quality that a user can accept based on the analysis result of the correspondence relationship.   The user experience quality estimation method according to claim 14, wherein the limit value of the experience quality is estimated based on communication quality at a singular point where a session aggregation state changes specifically.