JP4028532B2 - Communication network traffic analysis apparatus, system, and analysis method - Google Patents

Description

  The present invention relates to a communication network traffic analysis system and an analysis method useful for detecting abnormal traffic such as congestion and attacks in a communication network.

  In order to detect anomalous traffic such as attacks in a communication network, the traffic information acquired by a router, gateway, communication device, or traffic information measuring device is transferred to the traffic analyzer, and the traffic analyzer receives the received traffic information. A method of analyzing and performing abnormal traffic determination is used.

  A traffic analysis device that uses RMON MIB held by a router, gateway, communication device, or traffic information measurement device as traffic information periodically collects the RMON MIB information and analyzes changes in traffic volume over time. As the RMON MIB information, the number of packets flowing through the designated line and the traffic volume, the number of outgoing / incoming packets at the designated address, the traffic volume, and the like are used. Non-patent document 1 and non-patent document 2 are examples of this type of traffic analysis apparatus.

A traffic analyzer that uses packet information obtained by a packet logging function or a packet sampling function of a router, gateway, communication device or traffic information measuring device as traffic information is provided for the router, gateway, communication device, or traffic information measuring device. By setting the packet information held by the device to be forwarded to the traffic analysis device in advance, the traffic analysis device collects information on the packets flowing through the communication network and changes the traffic pattern over time. analyse. As the packet information, a source IP address, a destination IP address, a protocol, and the like are used. Non-patent document 3 is an example of this type of traffic analysis apparatus.
Tobias Oetiker et al., “MRTG”, [Online], [Search July 15, 2004], Internet http://people.ee.ethz.ch/~oqtiker/webtools/mrtg/ nTOP materials, [Online], [Search July 15, 2004], Internet http://www.ntop.org/ntop.html InMon, "InMon Traffic Server", [Online], [Search July 15, 2004], Internet http://www.inmon.com/products/trafficserver.php

  As a function required for a traffic analysis system, in a communication line where communication traffic between multiple communication hosts is multiplexed, a service denial (DoS, Distributed Denial Service) attack or a distributed service denial (DDoS, Distributed Denial Service) attack is performed. There is a real-time detection function for a situation where traffic addressed to a specific communication host or originated from a specific communication host occupies most of the communication line bandwidth.

  In the conventional method, when the attack detection is performed using a traffic analysis device using RMON MIB, the router, gateway, communication device or traffic information measurement device and the traffic analysis device are preliminarily inspected for the communication host to be monitored. It is necessary to register the network address. For this reason, when analyzing a backbone communication line in which traffic between an unspecified number of communication hosts is multiplexed, the number of network addresses to be registered becomes very large, resulting in a bottleneck in the processing.

  In addition, among the conventional methods, when the attack detection is performed using a traffic analysis device using a packet logging function or a packet sampling function, a large part of the communication line bandwidth is occupied by analyzing received packet information. It is necessary to identify the communication host that is present. For this reason, when performing a traffic analysis of a backbone communication line in which traffic between a large number of unspecified communication hosts is multiplexed, since there is a great deal of information on the source IP address and destination IP address received by the device, the received packet information A bottleneck occurs in the process of analyzing the above.

  An object of the present invention is to provide a communication network traffic analysis device, system, and analysis method aiming at eliminating bottlenecks in the conventional method.

In order to achieve the above object, a traffic analysis apparatus of the present invention is a traffic analysis apparatus in a communication network traffic analysis system that monitors traffic flowing through a communication network and detects abnormal traffic,
Traffic information collection means for collecting packet information, traffic volume information for each packet identifier, and traffic volume information for each line;
The packet information collected by the traffic information collecting means is analyzed for each packet identifier, and the packets of the specified number of communication hosts are ordered in descending order of the amount of transmitted / received traffic as suspected communication hosts transmitting / receiving abnormal traffic. Anomalous traffic suspected packet identifier value extracting means for extracting an identifier value;
Instructs a router, a gateway, a communication device, or a traffic information measurement device to perform traffic volume measurement on a packet having a packet identifier value obtained by the abnormal traffic suspected packet identifier value extraction means. A traffic amount measurement target packet identifier value indicating means;
In response to the traffic amount information for each packet identifier collected by the traffic information collecting means limited to the packet identifier instructed by the traffic amount measurement target packet identifier value instructing means, abnormal traffic is transmitted and received for each packet identifier. Each packet identifier abnormal traffic determining means for determining whether or not,
Abnormal traffic packet identifier value output means for outputting the value of the packet identifier obtained by the abnormal traffic determination means for each packet identifier;
The traffic amount information as a result of accumulating the traffic amount information for each packet identifier value collected by the traffic information collecting means limited to the packet identifier instructed by the traffic amount measurement target packet identifier value instructing means, Traffic volume information comparing means for comparing the traffic volume information collected by the traffic information collecting means for each line;
Based on the comparison result by the traffic volume information comparison unit, the packet information collected by the traffic information collection unit is analyzed for each packet identifier, and the packet identifier value of the suspected communication host that is sending and receiving abnormal traffic An abnormal traffic suspicious packet identifier value re-extraction determination means for determining whether to re-extract
Have
Further, the communication network traffic analysis system of the present invention is a communication network traffic analysis system for monitoring traffic flowing through a communication network and detecting abnormal traffic,
Traffic volume measuring means that measures and accumulates traffic volume for each monitored communication line and monitored packet identifier value, and acquires and stores all or sampled packet information that flows through the monitored communication line A router, a gateway, a communication device, or a traffic information measuring device, including: a packet logging unit that performs the traffic amount measurement unit and a traffic information transfer unit that transfers the traffic information accumulated by the packet logging unit to another device;
Packet information, traffic information for each packet identifier, traffic information collecting means for collecting traffic information for each line, and packet information collected by the traffic information collecting means is analyzed for each packet identifier to detect abnormal traffic. Abnormal traffic suspected packet identifier value extracting means for extracting packet identifier values of a specified number of communication hosts in descending order of the amount of transmitted / received traffic as suspected communication hosts that are transmitting and receiving, and the abnormal traffic suspected packet identifier value Traffic amount measurement target packet identifier value instructing the router, gateway, communication device, or traffic information measurement device to perform traffic amount measurement with a packet having the packet identifier value obtained by the extraction means as a monitoring target and instruction means, said Torahi' To traffic information of the amount measured packet identifier value is limited to the indicated packet identifier with an instruction means each packet identifier collected by the traffic information collecting unit, whether the sending and receiving abnormal traffic for each packet identifier Anomaly traffic determination means for each packet identifier for judging, an anomaly traffic packet identifier value output means for outputting the value of the packet identifier obtained by the anomaly traffic judgment means for each packet identifier, and a packet identifier value indicating means for measuring traffic amount The traffic amount information obtained as a result of accumulating the traffic amount information for each packet identifier value collected by the traffic information collecting means limited to the packet identifier instructed in the above, and the line unit collected by the traffic information collecting means Traffic volume information Based on the comparison result by the traffic volume information comparison means and the traffic volume information comparison means, the packet information collected by the traffic information collection means is analyzed for each packet identifier, and there is a suspicion that abnormal traffic is transmitted / received. A traffic analysis apparatus including abnormal traffic suspected packet identifier value re-extraction determination means for determining whether or not to re-extract a packet identifier value of a certain communication host;
Have

Communication network traffic analysis methods of the present invention, a traffic analyzer, routers, gateways, the communication device or communication network traffic analysis system and a traffic information measuring device,
The router, gateway, to the communication device, or the traffic information measuring apparatus, comprising the steps of starting a packet logging function to store to get all through a communication line to be monitored or sampled packet information,
In the traffic analysis device, the received packet information is analyzed for each packet identifier, and the packet identifiers of a specified number of communication hosts are listed in descending order of the amount of traffic to be transmitted / received as suspected communication hosts transmitting / receiving abnormal traffic. Extracting the value of
Instructing the router, gateway, communication device, or traffic information measuring device to perform traffic volume measurement with a packet having a value of the obtained packet identifier as a monitoring target;
The packet identifier specified in the step of instructing the router, gateway, communication device, or traffic information measuring device to perform the traffic amount measurement using the packet having the obtained packet identifier value as a monitoring target. limited to, a traffic information as a result of accumulating traffic information for each received packet identifier value, and performing regular processing for comparing the traffic information of the line units received,
Analyzing the received packet information for each packet identifier based on the comparison result and determining whether to re-extract the value of the packet identifier of the communication host suspected of transmitting / receiving abnormal traffic;
A step of extracting the value of the packet identifier when it is determined to be re-extracted, and a packet having the value of the obtained packet identifier for the router, gateway, communication device, or traffic information measuring device to be monitored Re-executing the step of instructing to perform traffic volume measurement as
If it is determined not to re-extract, the step of determining whether or not abnormal traffic is transmitted / received for each packet identifier with respect to the traffic amount information for each received packet identifier, and determining that abnormal traffic is being transmitted / received Outputting a packet identifier value of the communication host;
Have

  The present invention analyzes packet information to identify a suspected communication host that is sending and receiving abnormal traffic such as DoS and DDoS attacks, and provides a router, gateway, communication device, or traffic information measuring device and traffic analysis device. On the other hand, a packet identifier such as a network address of the communication host is registered as a monitoring target communication host, and the monitoring target communication host is compared by comparing the accumulated traffic amount information of the monitoring target communication host with the traffic amount information of the entire line. It is determined whether or not re-registration is necessary, and only when it is determined that re-registration is necessary, the packet information is analyzed again and the monitored communication host is re-registered.

  For this reason, once a packet identifier to be monitored is set for a router, gateway, communication device, or traffic information measurement device, it is received again while it is determined that re-registration of the monitored communication host is unnecessary. There is no need to analyze the packet information and identify a suspect communication host that is sending or receiving abnormal traffic. Therefore, even when there are very many types of packet identifier values such as network address values of packets flowing through the monitored line, abnormal traffic determination can be performed in real time.

  The present invention has the following effects.

  1) By reducing the amount of communication between the traffic information measuring device and the traffic analyzing device, the processing load on the traffic analyzing device and the traffic information measuring device can be reduced.

  2) By implementing the traffic information measuring device using the existing function of the router, gateway or communication device, a communication network traffic analysis system can be realized economically.

  Next, embodiments of the present invention will be described in detail with reference to the drawings.

  Referring to FIG. 1, a communication network traffic analysis system according to an embodiment of the present invention includes traffic information measurement devices 1, 2, and 3, a traffic analysis device 4, an IP network N1, and user LANs 11, N12, and N13. Has been.

  The traffic information measuring devices 1, 2, and 3 are arranged on communication paths that connect the user LANs 1, 2, and 3, and the IP network N1, respectively. The traffic analysis device 4 is connected to the IP network N1.

  FIG. 2 is a flowchart showing an abnormal traffic detection processing procedure by the system of FIG.

  As a determination of abnormal traffic, a process for determining whether or not the traffic destined for a single host occupies 70% or more of the entire line bandwidth is performed as an example.

  The traffic analysis device 4 instructs the traffic information measuring devices 1, 2, and 3 to execute packet logging (step 101). The traffic information measuring apparatuses 1, 2, and 3 receive the packet logging execution instruction (step 102) and execute the packet logging (step 103). The traffic information measuring devices 1, 2, and 3 transfer the packet information accumulated by packet logging to the traffic analysis device 4 (step 104). The traffic analysis device 4 receives the packet information (step 105), waits for a predetermined time, for example, 1 second (step 106), and instructs the traffic information measurement devices 1, 2, and 3 to stop execution of packet logging. (Step 107). The traffic information measuring apparatuses 1, 2, and 3 receive the packet logging execution stop instruction (step 108), and stop the packet logging execution (step 109). The traffic analysis device 4 analyzes the received packet information for each packet identifier, and determines the packet identifiers of the specified number of communication hosts in descending order of transmission / reception traffic as suspected communication hosts transmitting / receiving abnormal traffic. Is extracted (step 110), and the traffic information measuring apparatuses 1, 2, and 3 are instructed to perform traffic volume measurement using the monitored communication line unit and the obtained packet identifier value as the monitoring target. (Step 111). The traffic information measuring devices 1, 2, and 3 receive a traffic amount measurement execution instruction for the monitored communication line unit and the obtained packet identifier value as a monitoring target (step 112), and the monitored communication line The traffic information measurement of the unit and the received packet identifier value unit is executed (step 113). The traffic analyzer 4 waits for a predetermined time after step 111, for example, 1 second (step 114), and instructs the traffic information measuring devices 1, 2, and 3 to transfer the traffic volume information (step 115). The traffic information measuring devices 1, 2, and 3 receive the traffic amount information transfer instruction (step 116), and transfer the traffic amount information accumulated by the traffic information measurement to the traffic analyzing device 4 (step 117). The traffic analyzer 4 receives the traffic information (step 118), and compares the traffic amount information obtained by accumulating the traffic amount information for each received packet identifier value with the traffic amount information for each line (step 119). Then, it is determined whether the accumulated traffic information amount is 70% or more of the received traffic amount information for each line (step 120). If the determination result is not 70% or more, step 101 and subsequent steps are repeated, and the determination result is 7 In the case of more than the percentage, the traffic analysis device 4 determines whether or not the abnormal traffic is transmitted / received for each packet identifier, and the traffic information amount for each packet identifier becomes 70% or more of the traffic amount information for each line. Processing for determining whether or not a packet identifier exists (step 121), and the corresponding packet When there is no identifier (step 122), the process is repeated from step 114, and when the corresponding packet identifier is found, the packet identifier value for which the traffic information amount for each packet identifier is 70% or more of the traffic amount information for each line. Is output (step 123), and the process is repeated from step 114.

  Referring to FIG. 3, traffic information measuring apparatuses 1 to 3 include communication ports 1001 and 1002, a packet transmission / reception / copy unit 1003, a traffic amount measurement unit 1004, a packet logging processing unit 1005, and a traffic information transfer unit 1006. The packet identifier value registration table 1007 and the traffic information database 1008 are configured.

  The communication port 1001 is a communication port connected to any of the user LANs N11, N12, and N13 in FIG. The communication port 1002 is a communication port connected to the IP network N1 in FIG.

  The packet transmission / reception / copy unit 1003 resolves the destination of the packet received from the communication port 1001, and transmits the packet from the communication port 1002 if the packet is to be transmitted from the communication port 1002 as a result of the destination resolution. If the packet is copied, the copied packet is passed to the traffic amount measuring unit 1004 and the packet logging unit 1005, and if the packet is to be processed by the packet identifier value setting unit 1007 as a result of destination resolution, the packet is set to the packet identifier value setting unit 1007. If the packet is to be transmitted from the communication port 1001 as a result of the destination resolution, the packet is transmitted from the communication port 1001 and the packet is copied. Traffic the copied packet If the packet is to be processed by the packet identifier value setting unit 1007 as a result of destination resolution, the packet is passed to the packet identifier value setting unit 1007 and received from the traffic information transfer unit 1006 If the packet is a packet to be transmitted from the communication port 1001 as a result of the destination resolution, the packet is to be transmitted from the communication port 1001 and sent from the communication port 1002 as a result of the destination resolution. In this case, the data is transmitted from the communication port 1002.

  The traffic amount measurement unit 1004 measures the traffic amount in units of packet identifier values registered in the packet identifier value registration table 1008 and in units of communication lines that are received from the communication port 1001 or communication port 1002. The measurement result is stored in the traffic information database 1009.

  The packet logging unit 1005 acquires packet information received from the communication port 1001 and the communication port 1002, and stores the acquisition result in the traffic information database 1009.

  The traffic information transfer unit 1006 periodically passes the traffic information stored in the traffic information database 1009 to the packet transmission / reception / copy unit 1003.

  The packet identifier value setting unit 1007 adds, changes, and deletes packet identifier values to the packet identifier value registration table 1008 based on the received packet data.

  Referring to FIG. 4, the traffic analysis device 4 includes a communication port 2001, a packet transmission / reception unit 2002, a traffic information collection unit 2003, an abnormal traffic suspected packet identifier value extraction unit 2004, a traffic amount measurement target packet identifier value instruction unit 2005, a traffic. An amount information comparison unit 2006, an abnormal traffic determination unit 2007 for each packet identifier, an abnormal traffic packet identifier value output unit 2008, an abnormal traffic suspected packet identifier value re-extraction determination unit 2009, a packet identifier value registration table 2010, and a traffic information database 2011 Has been.

  A communication port 2001 is a communication port connected to the IP network N1 of FIG.

  The packet transmitting / receiving unit 2002 passes the packet received from the communication port 2001 to the traffic information collecting unit 2003, and transmits the packet received from the traffic amount measurement target packet identifier value indicating unit 2005 from the communication port 2001.

  The traffic information collection unit 2003 collects the traffic information received from the packet transmission / reception unit 2002 and stores it in the traffic information database 2011.

  The abnormal traffic suspected packet identifier value extraction unit 2004 analyzes the packet information accumulated in the traffic information database 2011 for each packet identifier, and as a communication host suspected of transmitting / receiving abnormal traffic, the transmission / reception traffic amount increases in descending order. The packet identifier values of the designated number of communication hosts are extracted and registered in the packet identifier value registration table 2010.

  The traffic amount measurement target packet identifier value instruction unit 2005 monitors a packet having a packet identifier value registered in the packet identifier value registration table 2010 when there is an instruction from the abnormal traffic suspected packet identifier value extraction unit 2004. An instruction packet for instructing the router, gateway, communication device, or traffic information measuring device is passed to the packet transmitting / receiving unit 2002 so as to measure the traffic volume as a target.

  The abnormal traffic determination unit 2007 for each packet identifier has a packet identifier whose traffic information amount for each packet identifier is 70% or more of the traffic amount information for each line with respect to the traffic amount information for each packet identifier stored in the traffic information database 2011. Determine if it exists.

The abnormal traffic packet identifier value output unit 2008 outputs the value of the packet identifier obtained by the abnormal traffic determination unit 2007 for each packet identifier to an external output device or the like.
The traffic volume information comparison unit 2006 includes the traffic volume information obtained as a result of accumulating the traffic volume information stored in the traffic information database 2011 in units of packet identifier values, the traffic volume information stored in the traffic information database 2009, and the traffic volume information stored in the traffic information database 2009. Compare

  The abnormal traffic suspected packet identifier value re-extraction determination unit 2009 determines whether the accumulated traffic information amount is 70% or more of the traffic information amount per line as a comparison result by the traffic amount information comparison unit 2006. Is analyzed for each packet identifier, and it is determined whether or not to extract the value of the packet identifier of the communication host suspected of transmitting / receiving abnormal traffic. When the comparison result is not 70% or more, an instruction is given to the abnormal traffic suspected packet identifier value extraction unit 2004.

  The traffic information measuring device and the traffic analyzing device are recorded on a computer-readable recording medium, and the program for realizing the function is recorded on the recording medium in addition to those realized by dedicated hardware. The program may be read by a computer system and executed. The computer-readable recording medium refers to a recording medium such as a floppy disk, a magneto-optical disk, a CD-ROM, or a storage device such as a hard disk device built in the computer system. Furthermore, a computer-readable recording medium is a server that dynamically holds a program (transmission medium or transmission wave) for a short period of time, as in the case of transmitting a program via the Internet, and a server in that case. Some of them hold programs for a certain period of time, such as volatile memory inside computer systems.

It is a block diagram of the communication network traffic analysis system by one Embodiment of this invention. It is a flowchart which shows the process sequence of the communication network traffic analysis system of FIG. It is a figure which shows the structural example of a traffic information measuring device. It is a figure which shows the structural example of a traffic analyzer.

Explanation of symbols

1, 2, 3 Traffic information measurement device 4 Traffic analysis device N1 IP network N11, N12, N13 User LAN
101 to 122 Steps 1001 and 1002 Communication port 1003 Packet transmission / reception / copy unit 1004 Traffic volume measurement unit 1005 Packet logging unit 1006 Traffic information transfer unit 1007 Packet identifier value setting unit 1008 Packet identifier value registration table 1009 Traffic information database 2001 Communication port 2002 Packet Transmission / reception unit 2003 Traffic information collection unit 2004 Abnormal traffic suspected packet identifier value extraction unit 2005 Traffic amount measurement target packet identifier value instruction unit 2006 Traffic amount information comparison unit 2007 Abnormal traffic determination unit for each packet identifier 2008 Abnormal traffic packet identifier value output unit 2009 Abnormal Traffic suspected packet identifier value re-extraction determination unit 2010 packet identifier value registration table 2 11 traffic information database

Claims (3)

A traffic analysis device in a communication network traffic analysis system that monitors traffic flowing through a communication network and detects abnormal traffic,
Traffic information collection means for collecting packet information, traffic volume information for each packet identifier, and traffic volume information for each line;
The packet information collected by the traffic information collecting means is analyzed for each packet identifier, and the packets of the specified number of communication hosts are ordered in descending order of the amount of transmitted / received traffic as suspected communication hosts transmitting / receiving abnormal traffic. Anomaly traffic suspected packet identifier value extracting means for extracting an identifier value;
Instructs a router, a gateway, a communication device, or a traffic information measurement device to perform traffic volume measurement on a packet having a packet identifier value obtained by the abnormal traffic suspected packet identifier value extraction means. A traffic volume measurement target packet identifier value indicating means;
In response to the traffic amount information for each packet identifier collected by the traffic information collecting means limited to the packet identifier instructed by the traffic amount measurement target packet identifier value instructing means , abnormal traffic is transmitted and received for each packet identifier. An abnormal traffic determination means for each packet identifier for determining whether or not,
Abnormal traffic packet identifier value output means for outputting the value of the packet identifier obtained by the abnormal traffic determination means for each packet identifier;
The traffic amount information as a result of accumulating the traffic amount information for each packet identifier value collected by the traffic information collecting means limited to the packet identifier instructed by the traffic amount measurement target packet identifier value instructing means , Traffic volume information comparing means for comparing the traffic volume information collected by the traffic information collecting means for each line;
Based on the comparison result by the traffic volume information comparison unit, the packet information collected by the traffic information collection unit is analyzed for each packet identifier, and the packet identifier value of the suspected communication host that is sending and receiving abnormal traffic An abnormal traffic suspected packet identifier value re-extraction determining means for determining whether to re-extract
A traffic analyzer. A communication network traffic analysis system that monitors traffic flowing through a communication network and detects abnormal traffic,
Traffic volume measuring means that measures and accumulates traffic volume for each monitored communication line and monitored packet identifier value, and acquires and stores all or sampled packet information that flows through the monitored communication line A router, a gateway, a communication device, or a traffic information measuring device, including: a packet logging unit that performs the traffic amount measurement unit and a traffic information transfer unit that transfers the traffic information accumulated by the packet logging unit to another device;
Packet information, traffic information for each packet identifier, traffic information collecting means for collecting traffic information for each line, packet information collected by the traffic information collecting means is analyzed for each packet identifier , and abnormal traffic is transmitted and received An abnormal traffic suspected packet identifier value extracting means for extracting packet identifier values of a specified number of communication hosts in descending order of the amount of transmission / reception traffic as the suspected communication host , and the abnormal traffic suspected packet identifier value extraction The traffic amount measurement target packet identifier value instruction that instructs the router, gateway, communication device, or traffic information measurement device to perform the traffic amount measurement by monitoring the packet having the packet identifier value obtained by the means. and means, said traffic To traffic volume information of the measurement target packet identifier value is limited to the indicated packet identifier with an instruction means each packet identifier collected by the traffic information collecting unit, whether the sending and receiving abnormal traffic for each packet identifier An abnormal traffic determination unit for each packet identifier to be determined, an abnormal traffic packet identifier value output unit for outputting a value of the packet identifier obtained by the abnormal traffic determination unit for each packet identifier, and a packet identifier value indicating unit for measuring traffic amount Traffic amount information as a result of accumulating the traffic amount information for each packet identifier value collected by the traffic information collecting means limited to the packet identifier specified in the above, and the unit of line collected by the traffic information collecting means Compare with traffic volume information Based on the comparison result by the traffic amount information comparing means and the traffic amount information comparing means, the packet information collected by the traffic information collecting means is analyzed for each packet identifier, and there is a suspicion that abnormal traffic is transmitted / received. A traffic analysis apparatus including abnormal traffic suspected packet identifier value re-extraction determining means for determining whether or not to re-extract a packet identifier value of a certain communication host;
A communication network traffic analysis system. In a communication network traffic analysis system having a traffic analysis device and a router, gateway, communication device, or traffic information measurement device,
Activating a packet logging function for acquiring and accumulating all or sampled packet information flowing through a monitored communication line for the router, gateway, communication device, or traffic information measuring device;
In the traffic analysis device, the received packet information is analyzed for each packet identifier, and as the communication host suspected of transmitting / receiving abnormal traffic, the packet identifiers of the specified number of communication hosts in descending order of the amount of transmitted / received traffic Extracting a value ;
Instructing the router, gateway, communication device, or traffic information measuring device to perform traffic volume measurement with a packet having a value of the obtained packet identifier as a monitoring target;
The packet identifier specified in the step of instructing the router, gateway, communication device, or traffic information measuring device to perform traffic volume measurement with a packet having the obtained packet identifier value as a monitoring target. limited to, a traffic information as a result of accumulating traffic information for each received packet identifier value, and performing regular processing for comparing the traffic information of the line units received,
Analyzing the received packet information for each packet identifier based on the comparison result and determining whether to re-extract the value of the packet identifier of the communication host suspected of transmitting / receiving abnormal traffic;
A step of extracting the value of the packet identifier when it is determined to be re-extracted, and a packet having the obtained value of the packet identifier for the router, gateway, communication device, or traffic information measuring device to be monitored Re-executing the step of instructing to perform traffic volume measurement as
If it is determined not to re-extract, the step of determining whether or not abnormal traffic is transmitted / received for each packet identifier with respect to the traffic amount information for each received packet identifier, and determining that abnormal traffic is being transmitted / received Outputting a packet identifier value of the communication host;
A communication network traffic analysis method comprising:

Images