Information processing apparatus and abnormality diagnosis method

An abnormality diagnosis method, comprising:

• acquiring, by a computer, message data that indicate a message size and a response time of each response message identified from an encrypted packet group which is transmitted and received within a predetermined period;
• identifying, based on the acquired message data, first peak sizes that satisfy a first condition from a first size distribution that is a frequency distribution of the message size of each response message;
• determining based on the acquired message data, when it is determined that the first peak sizes include a second peak size different from third peak sizes, whether a first time distribution satisfies a second condition, the third peak sizes being peak sizes of the message size of each response message in a normal state and being stored in advance, the first time distribution being a frequency distribution of the response time of each response message having the second peak size;
• and
• determining that a service is abnormal, when it is determined that the first time distribution satisfies the second condition.

An information processing apparatus, comprising:

• a memory;
• and
• a processor coupled to the memory and the processor configured to:
• acquire message data that indicate a message size and a response time of each response message identified from an encrypted packet group which is transmitted and received within a predetermined period;
• identify, based on the acquired message data, first peak sizes that satisfy a first condition from a first size distribution that is a frequency distribution of the message size of each response message;
• determine based on the acquired message data, when it is determined that the first peak sizes include a second peak size different from third peak sizes, whether a first time distribution satisfies a second condition, the third peak sizes being peak sizes of the message size of each response message in a normal state and being stored in the memory, the first time distribution being a frequency distribution of the response time of each response message having the second peak size;
• and
• determine that a service is abnormal, when it is determined that the first time distribution satisfies the second condition.