Firewall control device, method and firewall device

A method using a control device configured to control a plurality of firewall devices provided between a core network and a plurality of sub-networks respectively, the plurality of firewall devices being configured to discard received data based on discarding flow entries defining discarding of data, the method comprising:

• receiving, by the control device, from the plurality of firewall devices, data amount information indicating an amount of the data discarded in the plurality of firewall devices, based on the discarding flow entries, respectively and node information indicating a transmission source node of the discarded data;
• identifying, by the control device, based on the data amount information and the node information, data flows including the discarded data which are transmitted from an information processing device indicated by the node information as a single source device of the data flows and of which total sum of the amount of the data discarded at the plurality of firewall devices respectively exceeds a threshold value;
• and
• setting, by the control device, in a first firewall device which is included in the plurality of firewall devices and which is provided between the core network and the information processing device, a first discarding flow entry defining discarding of data of the identified data flows.