# US 11,115,427 B2 · Monitoring device, monitoring method, and monitoring program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,115,427 B2
- Document ID: US11115427B2
- Status: Granted
- Kind: B2
- Application number: 16/499,871
- Filed: 2018-03-27
- Published: 2020-01-23
- Granted: 2021-09-07
- Earliest claimed: 2017-04-04
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Hiroshi Kurakami
- Web page: https://patentgrep.com/patent/US11115427B2

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 43/022: by sampling
- H04L 43/026: using flow identification
- H04L 43/16: Threshold monitoring
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 12/00: Data switching networks (interconnection of, or transfer of information or other signals between, memories, input/output devices or central processing units G06F13/00)
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An acquiring unit acquires a packet indicating flow information that is output by a network device at a predetermined sampling rate, and a determining unit determines as abnormal, for each of predetermined traffic patterns, when a sampling error rate is equal to or lower than a predetermined upper limit value and the number of packets acquired in a predetermined count period preceding from a current time or an average value of the number of packets per unit time is equal to or higher than a predetermined detection threshold.

## Claims

### Claim 1

A monitoring device comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
acquiring a packet indicating flow information that is output by a network device at a predetermined sampling rate; and
determining as abnormal, for each of predetermined traffic patterns when a sampling error rate is equal to or lower than a predetermined upper limit value and a number of packets acquired in a predetermined period preceding from a current time or an average value of the number of packets per unit time is equal to or larger than a predetermined detection threshold.

### Claim 2 (depends on 1)

The monitoring device according to claim 1, wherein
after determining as abnormal, determining as abnormal termination, for each of the predetermined traffic patterns, when predetermined duration time has passed since a point of time when the number of packets acquired in the period or the average value of the number of packets per unit time becomes lower than a predetermined termination threshold.

### Claim 3 (depends on 1)

The monitoring device according to claim 1, further comprising
notifying a predetermined destination about a determination result by the determining.

### Claim 4

A monitoring method that is performed by a monitoring device, comprising:
acquiring a packet indicating flow information that is output by a network device at a predetermined sampling rate; and
determining as abnormal, for each of predetermined traffic patterns when a sampling error rate is equal to or lower than a predetermined upper limit value and a number of packets acquired in a predetermined period preceding from a current time or an average value of the number of packets per unit time is equal to or larger than a predetermined detection threshold.

### Claim 5

A non-transitory computer-readable recording medium storing a monitoring program that causes a computer to execute:
acquiring a packet indicating flow information that is output by a network device at a predetermined sampling rate; and
determining as abnormal, for each of predetermined traffic patterns when a sampling error rate is equal to or lower than a predetermined upper limit value and a number of packets acquired in a predetermined period preceding from a current time or an average value of the number of packets per unit time is equal to or larger than a predetermined detection threshold.