Relay device, method and non-transitory computer-readable storage medium

A method using a relay device coupled to a network including a plurality of information processing devices, the relay device including a port coupled to any one of the plurality of information processing devices, the method comprising:

• specifying a first number which is a number of packets of a first communication protocol transmitted from the port;
• specifying a second number which is a number of packets of the first communication protocol received at the port;
• determining, based on comparison of a ratio of the first number and the second number and a threshold corresponding to a third number which is a number of the plurality of information processing devices included in the network, whether an attack by at least one information processing device of the plurality of information processing devices occurs;
• and
• specifying, based on a statistical amount of the ratio, the threshold,
• the threshold includes a first threshold and a second threshold smaller than the first threshold,
• the packet received at the port is discarded when the ratio is greater than the first threshold and closes the port when the ratio is less than the second threshold.

A non-transitory computer-readable storage medium storing a program that causes an information processing apparatus to execute a process, the process comprising:

• specifying a first number which is a number of packets of a first communication protocol transmitted from a port of a relay device which is coupled to a network including a plurality of information processing devices, the relay device including a port coupled to any one of the plurality of information processing devices;
• specifying a second number which is a number of packets of the first communication protocol received at the port;
• determining, based on comparison of a ratio of the first number and the second number and a threshold corresponding to a third number which is a number of the plurality of information processing devices included in the network, whether an attack by at least one information processing device of the plurality of information processing devices occurs;
• and
• specifying, based on a statistical amount of the ratio, the threshold,
• the threshold includes a first threshold and a second threshold smaller than the first threshold,
• the packet received at the port is discarded when the ratio is greater than the first threshold and closes the port when the ratio is less than the second threshold.