Information processing device, method, and medium

A method causing a computer to execute:

• identifying a communication flow to which acquired data belongs;
• first analyzing to estimate whether or not a protocol related to the communication flow is a first protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the first protocol;
• second analyzing to estimate whether or not the protocol related to the communication flow is a second protocol which is set in advance and different from the first protocol by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis in the first analyzing;
• first inspecting to inspect the data according to inspection items determined in accordance with the first protocol, when the protocol related to the communication flow is determined to be the first protocol by the first analyzing;
• and
• second inspecting to inspect the data according to inspection items determined in accordance with the second protocol, when the protocol related to the communication flow is determined to be the second protocol by the second analyzing, wherein
• when a result of analysis or an inspection of the data belonging to the communication flow satisfies one or any of a plurality of discontinuation conditions, analysis of data related to the communication flow in the first analyzing or the second analyzing is discontinued in the identifying even before the first analyzing or the second analyzing completes analysis of data related to the communication flow in the identifying,
• the one or any of the plurality of discontinuation conditions for discontinuing analysis by the first analyzing includes at least any of completion of inspections with respect to all inspection items related to the first protocol in the communication flow, an end of the first protocol in the communication flow, and a failure of an interpretation as the first protocol of the communication flow,
• the one or any of the plurality of discontinuation conditions for discontinuing analysis by the second analyzing includes at least any of completion of inspections with respect to all inspection items related to the second protocol in the communication flow, an end of the second protocol in the communication flow, and a failure of an interpretation as the second protocol of the communication flow, and
• the result of the inspection of the data belonging to the communication includes an inspection item, a not inspection item, and a pending item, the pending item indicating that the completion of inspection is not reached with data received up to the present point.

A computer-readable non-transitory medium on which is recorded a program causing a computer to execute:

• flow managing to identify a communication flow to which acquired data belongs;
• first analyzing to estimate whether or not a protocol related to the communication flow is a first protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the first protocol;
• second analyzing to estimate whether or not the protocol related to the communication flow is a second protocol which is set in advance and different from the first protocol by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis by the first analyzing;
• first inspecting to inspect the data according to inspection items determined in accordance with the first protocol, when the protocol related to the communication flow is determined to be the first protocol by the first analyzing;
• and
• second inspecting to inspect the data according to inspection items determined in accordance with the second protocol, when the protocol related to the communication flow is determined to be the second protocol by the second analyzing, wherein
• when a result of analysis or an inspection of the data belonging to the communication flow satisfies one or any of a plurality of discontinuation conditions, the flow managing discontinues analysis of data related to the communication flow performed by the first analyzing or the second analyzing even before the first analyzing or the second analyzing completes analysis of data related to the communication flow identified by the flow managing,
• the one or any of the plurality of discontinuation conditions for discontinuing analysis by the first analyzing includes at least any of completion of inspections with respect to all inspection items related to the first protocol in the communication flow, an end of the first protocol in the communication flow, and a failure of an interpretation as the first protocol of the communication flow,
• the one or any of the plurality of discontinuation conditions for discontinuing analysis by the second analyzing includes at least any of completion of inspections with respect to all inspection items related to the second protocol in the communication flow, an end of the second protocol in the communication flow, and a failure of an interpretation as the second protocol of the communication flow, and
• the result of the inspection of the data belonging to the communication includes an inspection item, a not inspection item, and a pending item, the pending item indicating that the completion of inspection is not reached with data received up to the present point.