JP2007228217A - Traffic decision device, traffic decision method, and program therefor - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide a technology for improving an application detection speed as a technology regarding traffic classification based on statistical information of a communication pattern. <P>SOLUTION: The traffic decision device has: a database for sequence reference patterns in which an application is made to correspond to traffic sequence patterns in the application; an analyzing means for analyzing a parameter of packet of received traffic; and a judgment means for determining a sequence pattern of the received traffic on the basis of the analysis result, retrieves the application made to correspond to the sequence pattern from the database and determines the application of the received traffic. <P>COPYRIGHT: (C)2007,JPO&INPIT

Description

  The present invention relates to a technique for determining an application that is a generation source of traffic on a network, and more particularly to a technique for determining an application of the traffic by analyzing a communication pattern of the traffic on the network.

Analysis of traffic flowing on the Internet and control such as filtering, shaping, and routing in accordance with the analyzed traffic are performed in network devices such as firewall devices, bandwidth control devices, and routers. These devices include TCP (Transmission Control Protocol) and UDP (User
A port number used by the Data Protocol) or a specific bit string (signature) included in the payload of the packet is detected and analyzed, and traffic is controlled according to the type (for example, Patent Document 1). .

  On the other hand, in recent years, with the rapid spread of P2P (Peer-to-Peer) applications, network resources are occupied by the traffic of the P2P applications, causing problems such as degradation of communication quality of other applications. ing.

  The P2P application uses a well-known port number reserved for other purposes (for example, the 80th port reserved for HTTP communication) in order to avoid the restrictions of the firewall device. Has also emerged, and the diversification and sophistication of traffic flowing on the Internet is progressing. In the case of traffic in which such a port number is spoofed, the current control device cannot accurately analyze the port number alone. Also, in the case of encrypted traffic, the payload of the packet cannot be analyzed sufficiently, so that it is difficult to detect the signature and the traffic cannot be analyzed.

  In order to analyze such traffic, a technology for statistically analyzing communication patterns of data traffic using parameters that do not depend on header and payload information such as port numbers and signatures, and analyzing traffic for each application has been devised. (For example, Patent Document 1 or Patent Document 2).

  In Non-Patent Document 1, as statistical information of communication patterns, the number of communication destination hosts, the number of communication source ports, and the number of communication destination ports when attention is paid to a certain host is analyzed. A method for determining the type has been proposed.

Non-Patent Document 2 describes traffic parameters for each application by analyzing multiple parameters related to packet size and packet arrival interval when focusing on U-Plane (User-Plane) data of data traffic as statistical information of communication patterns. A technique for analyzing the above has been proposed.
JP-A-7-231317 T.Karagiannis etal, “BLINC: Multilevel Traffic Classification in the Dark,” In ACM SIGCOMM 2005 M. Roughan et al, “Class-of-Service Mapping for QoS: AStatistical Signature-based Approach to IP TrafficClassification”, In ACM SIGCOMM IMC, November 2004

  In the method shown in Non-Patent Document 1, since it is necessary to statistically analyze the communication pattern with respect to traffic received at a certain time, it takes several minutes until the classification result converges, and the application detection speed is slow. There is a problem of becoming. Further, when the noticed host communicates using a plurality of applications at the same time, there is a problem that it becomes difficult to determine the application type.

  In the method shown in Non-Patent Document 2, since it is necessary to statistically analyze the communication pattern for U-Plane data traffic received in a certain time, as in Non-Patent Document 1, until the analysis result converges. It takes a few seconds to several minutes to slow down the application detection speed. Further, for applications with a small number of packets flowing as U-Plane data, there is a problem that the identification accuracy is lowered because sufficient statistical information of the communication pattern cannot be obtained.

  Therefore, in the above-described conventional technology, it takes time until the analysis result converges. Therefore, when performing traffic control such as filtering or shaping that requires real-time processing as much as possible from the viewpoint of effective use of security and network resources. It becomes a problem.

  Therefore, the problem to be solved by the present invention is to solve the above-mentioned problem, and to provide a technique capable of improving the application determination speed in the traffic classification method based on the statistical information of the communication pattern.

  It is another object of the present invention to provide a technique that analyzes traffic using parameters such as port numbers and signatures that do not depend on header or payload information, and can analyze traffic in the case of traffic in which a port number is spoofed or encrypted traffic.

The first invention for solving the above-described problems is
A traffic determination device,
A database of sequence reference patterns in which an application is associated with a sequence pattern of traffic in the application;
An analysis means for analyzing received traffic packet parameters;
Determination means for determining a sequence pattern of the received traffic based on the analysis result, searching an application associated with the sequence pattern from the database, and determining the application of the received traffic. Features.

According to a second invention for solving the above-mentioned problem, in the first invention,
The database is updated based on database update information received via a network.

According to a third invention for solving the above-described problem, in the first or second invention,
The analysis means analyzes the parameters of traffic packets classified for each session using information on the transmission source and destination of the received traffic.

A fourth invention for solving the above-mentioned problems is any one of the first to third inventions,
The analysis unit analyzes at least one of a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag as a packet parameter.

A fifth invention for solving the above-mentioned problems is any one of the first to fourth inventions,
The database is a database generated based on a packet length of traffic in an application, a packet arrival interval, a communication direction, a protocol, and a TCP flag.

A sixth invention for solving the above-described problems is any one of the first to sixth inventions,
Communication control means for controlling communication according to the determined type of application is provided.

The seventh invention for solving the above-mentioned problem is
A traffic determination method,
An analysis step to analyze the parameters of the received traffic packet;
A determination step of determining a sequence pattern of the received traffic based on the analysis result;
A determination step of searching for an application associated with the determined sequence pattern from a database of sequence reference patterns in which an application and a sequence pattern of traffic in the application are associated, and determining an application of the received traffic It is characterized by having.

An eighth invention for solving the above-described problem is the seventh invention, wherein
An update step of updating the database based on the database update information received via the network is provided.

A ninth invention for solving the above-described problems is the seventh or eighth invention,
The analyzing step is characterized in that the parameters of the traffic packets classified for each session are analyzed using the information on the source and destination of the received traffic.

A tenth invention for solving the above-mentioned problems is any one of the seventh to ninth inventions,
In the analyzing step, at least one of a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag is analyzed as a packet parameter.

An eleventh invention for solving the above-mentioned problems is any one of the seventh to tenth inventions,
A communication control step of performing communication control according to the type of application determined in the step is provided.

A twelfth invention for solving the above-described problems is
A program for a traffic determination device, wherein the program determines the traffic determination device,
An analysis means for analyzing received traffic packet parameters;
Based on the analysis result, the sequence pattern of the received traffic is determined, and the application associated with the sequence pattern is determined from the database of the sequence reference pattern in which the application and the traffic sequence pattern in the application are associated. It searches and functions as a determination means for determining an application of the received traffic.

A thirteenth invention for solving the above-mentioned problem is the above-mentioned twelfth invention,
The program uses the traffic determination device,
It is made to function as the update means which updates the said database based on the database update information received via a network.

A fourteenth aspect of the invention for solving the above-described problem is the twelfth or thirteenth aspect of the invention,
The program causes the analysis unit to function as a unit that analyzes a packet parameter of traffic classified for each session using information on a transmission source and a transmission destination of received traffic.

A fifteenth aspect of the invention for solving the above-described problem is the invention according to any one of the twelfth to fourteenth aspects,
The program causes the analyzing means to function as means for analyzing at least one of a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag as a packet parameter.

A sixteenth aspect of the invention for solving the above-mentioned problems is the invention according to any one of the twelfth to fifteenth aspects,
The program causes the traffic determination device to
It is made to function as a communication control means for controlling communication according to the determined type of application.

The seventeenth invention for solving the above-mentioned problems is
A traffic determination device,
The received traffic is classified into session units, a state transition pattern is created from the packets constituting the traffic classified into each session unit, and the state transition reference stored in advance according to the created state transition pattern and traffic type The type of received traffic is determined by comparing the pattern.

An eighteenth invention for solving the above-described problems is
A traffic determination method,
The received traffic is classified into session units, a state transition pattern is created from the packets constituting the traffic classified into each session unit, and the state transition reference stored in advance according to the created state transition pattern and the type of traffic The type of received traffic is determined by comparing the pattern.

  The communication control method of the present invention is a communication control method for analyzing and classifying and controlling the communication pattern of traffic flowing on the network according to the application, and it is possible to communicate without depending on header or payload information such as port number and signature. Classify and control traffic by analyzing transaction patterns between hosts. The communication control method of the present invention is classified into a step of storing a reference pattern related to a transaction between communication hosts in advance for each application, and a step of classifying received traffic into traffic for each session from a transmission / reception IP address and a transmission / reception port number. Analyzing the traffic transaction pattern, comparing the analyzed transaction pattern with the reference pattern, classifying the traffic according to the comparison result, and controlling the individual traffic according to the application Stages.

  The communication control device of the present invention is a communication control device that analyzes a communication pattern of traffic flowing on a network and classifies and controls it according to an application. The communication control device includes a receiving unit that receives traffic from the network, and a received traffic. Classifying means for classifying traffic into session-level traffic, analyzing means for analyzing the transaction pattern of the classified traffic, comparing means for comparing the transaction pattern output by the analyzing means with the reference pattern, and traffic from the comparison result Classification means for classifying according to applications and control means for controlling individual traffic according to applications.

  Using this configuration, traffic flowing on the network is classified into session-based traffic, and the sequence pattern of each traffic is analyzed using parameters that do not depend on the port number or signature, such as packet length and packet arrival interval. By comparing with a reference sequence pattern generated in advance for each application, traffic can be classified according to the application. Therefore, since signaling can be detected for traffic that spoofs a port number or encrypted traffic, the application detection speed can be improved, and thus the object of the present invention can be achieved.

  The present invention analyzes traffic sequence patterns classified in session units, classifies traffic according to applications in comparison with reference sequence patterns held in advance, and traffic that spoofs port numbers or is encrypted. It is also possible to improve the application detection speed of traffic and prevent data exchange / outflow even in the case of traffic.

  The reason for this is that the traffic classified before the session is analyzed using the sequence pattern using parameters that do not depend on the port number and signature such as packet length and packet arrival interval, so that the signaling performed before the U-Plane data traffic flows is analyzed. This is because it can be detected.

  A first embodiment of the present invention will be described.

  As shown in FIG. 1, the present embodiment includes terminals 1a and 1b, networks 2a and 2b, and a communication control device 3.

  The terminal 1 is a terminal that transmits and receives traffic (data) via the network 2 and may be a communication host.

  The communication control device 3 includes a reception unit 11, a traffic classification unit 12, a packet analysis unit 13, an application identification unit 14, an output unit 15, and a transmission unit 16.

  The receiving unit 11 receives traffic transmitted and received between the terminal 1a and the terminal 1b via the network, copies the received traffic, and transfers the copied traffic to the traffic classification unit 12. Further, the traffic that has been copied is forwarded to the transmitter 16.

  The traffic classification unit 12 includes an identification completion traffic list storage unit 12a, a classification unit 12b, and a buffer unit 12c.

  The classification unit 12b of the traffic classification unit 12 traffics the traffic copied by the reception unit 11 for each session (communication path) based on the transmission source IP address or destination IP address and the transmission source port number or destination port number of the traffic. Are stored in the subsequent buffer.

  Further, the classification unit 12b uses the transmission source IP address or destination IP address and the transmission source port number or destination port number of the traffic for which the application determination notified from the application determination unit 14 described later is completed as the identification completion traffic list. The traffic registered in the storage unit 12a is discarded without being stored in the subsequent buffer.

  The packet analysis unit 13 includes a packet length calculation unit 13a, a packet arrival interval calculation unit 13b, a communication direction detection unit 13c, a protocol detection unit 13d, a TCP flag detection unit 13e, a state determination unit 13f, and a state table storage Part 13g.

  The traffic analyzed by the traffic classification unit 12 for each session is input to the packet analysis unit 13. For the packet group constituting this traffic, the packet length calculation unit 13a sequentially sets the packet length, the packet arrival interval calculation unit 13b sets the packet arrival interval, the communication direction detection unit 13c sets the communication direction, and the protocol. The detection unit 13d analyzes the protocol, the TCP flag detection unit 13e analyzes the TCP flag, and notifies the state determination unit 13f of the analysis result of each parameter.

  In the state table storage unit 13g, a packet defined by a packet length (Li), a packet arrival interval (Ti), a communication direction (Di), a packet protocol (Pi), and a TCP flag (Fi) as shown in FIG. A state table of these states is stored in advance.

  Based on the analysis result, the state determination unit 13f searches the state table stored in the state table storage unit 13g for the state Si of the packet, determines the state for each packet, and determines the determination result as a session (traffic transmission source). The application identification unit 14 is notified together with information on the IP address or the destination IP address and the source port number or the destination port number).

  The application identification unit 14 includes a sequence reference pattern storage unit 14a, a sequence pattern comparison unit 14b, and a determination unit 14c.

  As shown in FIG. 4, the sequence reference pattern storage unit 14a stores a sequence reference pattern associated with each application. This sequence reference pattern indicates a change in the state of a packet in traffic generated by each application, and is defined from a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag.

  The sequence pattern comparison unit 14b compares the state determination result of each packet of the traffic notified from the state determination unit 13f with the sequence reference pattern stored in the sequence reference pattern storage unit 14a, and determines which application as the comparison result. It is notified to the determination unit 14c whether the sequence reference pattern corresponding to is matched.

  The determination unit 14c determines an application based on the comparison result notified from the pattern comparison unit 14b, and notifies the output unit 15 of the application determination result together with information on the session. Further, the classification unit 12 is notified of the transmission source IP address or destination IP address and the transmission source port number or destination port number of the traffic that has been identified, and the application identification process for the identification completed traffic is terminated.

  The output unit 15 outputs the application determination result notified from the application identification unit 14 to a monitor or the like. At this time, an application determination result may be output for each type of session.

  The transmission unit 16 transmits the traffic transferred from the reception unit 11 to the terminal 1b.

  Subsequently, the operation of the present embodiment will be described.

  The reception unit 11 receives the traffic flowing between the communication hosts, copies the received traffic (S1 in FIG. 2), and transfers the copied traffic to the traffic classification unit 12. Further, the traffic that has been copied is forwarded to the transmitter 16.

  The received traffic copied by the receiving unit 11 is classified by the classifying unit 12b for each session (communication path) based on the source IP address or destination IP address and the source port number or destination port number of the received traffic. And stored in the subsequent buffer (S2 in FIG. 2).

  On the other hand, the classification unit 12b uses the transmission source IP address or the destination IP address and the transmission source port number or the destination port number of the traffic for which the application determination notified from the application determination unit 14 has been completed as the identification completion traffic. The registered traffic is discarded without being stored in the subsequent buffer (S3 in FIG. 2).

  For the traffic stored in the buffer, the packet length calculation unit 13a, the packet arrival interval calculation unit 13b, the packet arrival interval, the communication direction detection unit 13c, the communication direction The protocol detector 13d analyzes the protocol, and the TCP flag detector 13e analyzes the TCP flag (S4 in FIG. 2). Then, it is determined whether or not the analysis of all parameters has been completed for the Zen packet that constitutes the traffic. If the analysis has been completed, each analysis result is notified to the state determination unit 13f.

  The state determination unit 13f determines the state Si of each packet from the analysis result using the state table stored in the state table storage unit 13g, and notifies the application identification unit 14 of the state determination result for each packet ( S5 in FIG.

  The sequence pattern comparison unit 14b compares the state determination results successively notified from the state determination unit 13f with the sequence reference patterns stored in the sequence reference pattern storage unit 14a, and the sequence corresponding to which application is the comparison result. It is notified to the determination unit 14c whether the reference pattern matches (S6 in FIG. 2).

  The determination unit 14c determines an application based on the comparison result notified from the pattern comparison unit 14b (S7 in FIG. 2).

  The application determination result is notified to the output unit 15. Further, the transmission / reception IP address and transmission / reception port number of the identification completion traffic are notified to the classification unit 12, and the application identification processing for the identification completion traffic is terminated (S8 in FIG. 2).

  The output unit 15 outputs the application determination result notified from the application identification unit 14 to a monitor or the like (S9 in FIG. 2).

  The transmission unit 16 transmits the traffic transferred from the reception unit 11.

  Next, the effect of this embodiment will be described.

  In this embodiment, the sequence pattern between communication hosts is analyzed and registered in advance using a plurality of parameters that do not depend on the port number or signature such as packet length, packet arrival interval, communication direction, protocol, and TCP flag. The application is identified by comparing with the sequence reference pattern for each application. Therefore, since the signaling before the U-Plane data traffic flows can be detected even for traffic in which the port number is spoofed or encrypted traffic, the application detection speed can be improved.

  In the description of the first embodiment, each packet state is defined by using parameters such as packet length, packet arrival interval, communication direction, protocol, and TCP flag in the packet analysis. Parameters to represent can be used.

  Next, the 2nd form and flowchart of this invention are demonstrated in detail with reference to FIG.5 and FIG.6.

  Referring to FIG. 3, the second mode for carrying out the present invention includes terminals 1 a and 1 b, networks 2 a and 2 b, and a communication control device 4.

  The communication control device 4 includes a receiving unit 11, a traffic classification unit 12 including an identification completion traffic list storage unit 12a and a classification unit 12b, a packet length calculation unit 13a, a packet arrival interval calculation unit 13b, a communication direction detection unit 13c, A packet analysis unit 13 having a protocol detection unit 13d, a TCP flag detection unit 13e, a state determination unit 13f, and a state table storage unit 13g, and an application having a sequence reference pattern storage unit 14a, a sequence pattern comparison unit 14b, and a determination unit 14c It has the identification part 14, the output part 15, and the transmission part 16 which has the communication control part 16a.

  The difference between the communication control device 4 of the present embodiment shown in FIG. 5 and the communication control device 3 of the first embodiment shown in FIG. 1 is that the transmission unit 16 has a communication control unit 16a. Based on the application determination result notified from the application identification unit 14, the communication control unit 16a performs communication control such as filtering and shaping according to a preset policy. In addition, the same number is attached | subjected about the structure similar to the said 1st Embodiment, and detailed description is abbreviate | omitted.

  Next, the operation of this embodiment will be described with reference to FIG. In the flowchart in the second embodiment shown in FIG. 6, the operation in the communication control device 4 is the same as S1 to S9 described in the above embodiment, and thus the description thereof is omitted. Operations different from those of the first embodiment shown in FIG. 2 will be described below.

  The application identification unit 14 notifies the transmission unit 16 of the application determination result output from the determination unit 14c together with information regarding the session.

  The communication control unit 16a performs communication control such as filtering and shaping according to a preset policy based on the application determination result notified from the application identification unit 14 and information on the session (S10 in FIG. 6). .

  Next, the effect of this embodiment will be described.

  In this embodiment, the sequence pattern between communication hosts is analyzed and registered in advance using a plurality of parameters that do not depend on the port number or signature such as packet length, packet arrival interval, communication direction, protocol, and TCP flag. The application is identified by comparing it with the sequence reference pattern for each application, and communication control such as appropriate filtering and shaping corresponding to the policy is performed on the identified traffic. Therefore, it is possible to detect the signaling before the U-Plane data traffic flows even for traffic with spoofed port numbers or encrypted traffic, so the application detection speed can be improved and data exchange / outflow can be prevented. It is possible to prevent.

  In the above description, in packet analysis, the packet status is defined using parameters such as packet length, packet arrival interval, communication direction, protocol, and TCP flag. However, parameters for representing the status of other packets should be used. Can do.

  Next, a third embodiment and a flowchart of the present invention will be described with reference to FIGS.

  Referring to FIG. 7, the third embodiment for carrying out the present invention includes terminals 1a and 1b, networks 2a and 2b, and a communication control device 5.

  The communication control device 5 includes a receiving unit 11, a traffic classification unit 12 including an identification completion traffic list storage unit 12a and a classification unit 12b, a packet length calculation unit 13a, a packet arrival interval calculation unit 13b, a communication direction detection unit 13c, and a protocol detection. A packet analysis unit 13 having a unit 13d, a TCP flag detection unit 13e, a state determination unit 13f, and a state table storage unit 13g, a sequence reference pattern storage unit 14a, a sequence pattern comparison unit 14b, and an application identification unit 14 having a determination unit 14c. , An output unit 15, a transmission unit 16 having a communication control unit 16a, and an update unit 17a.

  The difference between the communication control device 4 in the third embodiment shown in FIG. 5 and the communication control device 4 in the second embodiment shown in FIG. 3 is that it has an update unit 17 and the received packet has its own IP address. The traffic classification unit 12 has a function of determining whether the packet is a state table update packet addressed to the destination or a sequence reference pattern update packet addressed to the own IP address. When receiving the state table update packet, the updating unit 17 updates the state table database stored in the state table storage unit 13g included in the sequence analysis unit 13 based on the state table update packet. When receiving the sequence reference pattern update packet, the update unit 17 updates the database of the sequence reference pattern stored in the sequence reference pattern storage unit 14 a included in the application identification unit 14 based on the sequence reference pattern update packet. In addition, the same number is attached | subjected about the structure similar to the said embodiment, and detailed description is abbreviate | omitted.

  Subsequently, the operation of the present embodiment will be described. In the flowchart in the third embodiment shown in FIG. 8, the operation in the communication control device 5 will be described below with respect to the operation different from the second embodiment shown in FIG. 6.

  The traffic classification unit 12 transfers the update packet to the update unit 17 when the packet copied in the reception unit 11 is a state table update packet addressed to its own IP address or a sequence reference pattern update packet addressed to its own IP address. Otherwise, the same operation as in the second embodiment is performed.

  When receiving the state table update packet, the updating unit 17 updates the state table database stored in the state table storage unit 13g included in the sequence analysis unit 13 based on the state table update packet. Further, when receiving the sequence reference pattern update packet, the update unit 17 updates the sequence reference pattern database stored in the sequence reference pattern storage unit 14a included in the application identification unit 14 based on the sequence reference pattern update packet ( S11 in FIG. After the database update, application identification processing is executed based on the updated database.

  Next, the effect of this embodiment will be described.

  With the appearance of new applications or revisions of applications, it is considered that the status table and sequence reference pattern for identifying these applications will change. In the present embodiment, it is possible to update the state table and the sequence reference pattern via the network by providing an update unit in the communication control device.

  In the above description, in packet analysis, the packet status is defined using parameters such as packet length, packet arrival interval, communication direction, protocol, and TCP flag. However, parameters for representing the status of other packets should be used. Can do.

  In the above description, the database update method is shown as a database update method. However, the network administrator may manually perform the database update operation using a recording medium for the communication control apparatus shown in FIG. .

It is a block diagram which shows the structure of the communication monitoring apparatus of the 1st Embodiment of this invention. It is a flowchart which shows the process sequence in the communication monitoring apparatus shown in FIG. It is an example of the state table stored in the state table storage part of the packet analysis part of this invention. It is an example of the sequence reference pattern stored in the sequence reference pattern storage part of the application identification part of this invention. It is a block diagram which shows the structure of the communication control apparatus of the 2nd Embodiment of this invention. It is a flowchart which shows the process sequence in the communication control apparatus shown in FIG. It is a block diagram which shows the structure of the communication control apparatus of the 3rd Embodiment of this invention. It is a flowchart which shows the process sequence in the communication control apparatus shown in FIG.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 Terminal 2 Network 3 Communication monitoring apparatus of 1st Embodiment 4 Communication control apparatus of 2nd Embodiment 5 Communication control apparatus of 3rd Embodiment 11 Receiving part 12 Traffic classification part 12a Identification completion traffic list storage part 12b Classification Unit 13 packet analysis unit 13a packet length calculation unit 13b packet arrival interval calculation unit 13c communication direction detection unit 13d protocol detection unit 13e TCP flag detection unit 13f state determination unit 13g state table storage unit 14 application identification unit 14a sequence reference pattern storage unit 14b Sequence pattern comparison unit 14c determination unit 15 output unit 16 transmission unit 16a communication control unit 17 update unit

Claims (18)

A traffic determination device,
A database of sequence reference patterns in which an application is associated with a sequence pattern of traffic in the application;
An analysis means for analyzing received traffic packet parameters;
Determination means for determining a sequence pattern of the received traffic based on the analysis result, searching an application associated with the sequence pattern from the database, and determining the application of the received traffic. A characteristic traffic judgment device.   The traffic determination apparatus according to claim 1, wherein the database is updated based on database update information received via a network.   The traffic determination according to claim 1, wherein the analysis unit analyzes a parameter of a traffic packet classified for each session using information on a transmission source and a transmission destination of the received traffic. apparatus.   4. The analysis unit according to claim 1, wherein the analysis unit analyzes at least one of a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag as a packet parameter. Traffic judgment device.   The traffic according to any one of claims 1 to 4, wherein the database is a database generated based on a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag of traffic in an application. Judgment device.   The traffic determination device according to claim 1, further comprising a communication control unit configured to control communication according to the determined type of application. A traffic determination method,
An analysis step to analyze the parameters of the received traffic packet;
A determination step of determining a sequence pattern of the received traffic based on the analysis result;
A determination step of searching for an application associated with the determined sequence pattern from a database of sequence reference patterns in which an application and a sequence pattern of traffic in the application are associated, and determining an application of the received traffic And a traffic determination method characterized by comprising:   The traffic determination method according to claim 7, further comprising an update step of updating the database based on database update information received via a network.   9. The traffic determination according to claim 7, wherein the analyzing step analyzes a packet parameter of the traffic classified for each session using information on a transmission source and a transmission destination of the received traffic. Method.   10. The analysis according to claim 7, wherein the analysis step analyzes at least one of a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag as a parameter of the packet. Traffic determination step.   The traffic determination method according to claim 7, further comprising a communication control step of performing communication control according to the type of application determined in the step. A program for a traffic determination device, wherein the program determines the traffic determination device,
An analysis means for analyzing received traffic packet parameters;
Based on the analysis result, the sequence pattern of the received traffic is determined, and the application associated with the sequence pattern is determined from the database of the sequence reference pattern in which the application and the traffic sequence pattern in the application are associated. A program that searches and functions as a determination unit that determines an application of the received traffic. The program uses the traffic determination device,
13. The program according to claim 12, wherein the program functions as an update unit that updates the database based on database update information received via a network.   The program causes the analysis unit to function as a unit that analyzes a packet parameter of traffic classified for each session using information on a transmission source and a transmission destination of received traffic. The program according to claim 13.   13. The program according to claim 12, wherein the program causes the analysis unit to function as a unit that analyzes at least one of a packet length, a packet arrival interval, a communication direction, a protocol, and a TCP flag as a packet parameter. Item 15. The program according to any one of Item 14. The program causes the traffic determination device to
The program according to any one of claims 12 to 15, wherein the program is caused to function as a communication control unit that performs communication control according to the determined type of application. A traffic determination device,
The received traffic is classified into session units, a state transition pattern is created from the packets constituting the traffic classified into each session unit, and the state transition reference stored in advance according to the created state transition pattern and traffic type A traffic determination device characterized by determining a type of received traffic by comparing a pattern. A traffic determination method,
The received traffic is classified into session units, a state transition pattern is created from the packets constituting the traffic classified into each session unit, and the state transition reference stored in advance according to the created state transition pattern and traffic type A traffic determination method characterized by determining a type of received traffic by comparing a pattern.

Images