Data aggregation apparatus, data aggregation method, and program

A data aggregation method performed by a computer and comprising:

• performing a plurality of times a first process of:
• obtaining first communication data via a communication network;
• displaying a list of available data aggregation methods to narrow down communication data on which in-packet analysis is to be performed, the available data aggregation methods including:
• a first available method in which the communication data is narrowed down based on a number of packets transmitted on a per-minute basis;
• a second available method in which the communication data is narrowed down based on a number of different source network addresses in the packets on the per-minute basis;
• a third available method in which the communication data is narrowed down based on a specified number of destination port numbers for which there are a greatest number of packets;
• a fourth available method in which the communication data is narrowed down based on a specified number of the destination port numbers for which there are a smallest number of packets;
• receiving user selection of a first data aggregation method from the displayed list of the available data aggregation methods;
• narrowing down the first communication data by performing the first data aggregation method;
• displaying, as an aggregation result, the narrowed-down first communication data;
• performing the in-packet analysis on the narrowed-down first communication data;
• and
• incrementing a number of times the first data aggregation method has been selected by the user;
• after the first process has been performed the plurality of times, performing a second process of:
• obtaining second communication data via the communication network;
• selecting, as a second data aggregation method, the available data aggregation method that has been selected as the first data aggregation method in the plurality of times the first process was performed;
• narrowing down the second communication data by performing the second data aggregation method to narrow down the second communication data;
• performing the in-packet analysis on the narrowed-down second communication data;
• and
• identifying, based on a result of the in-packet analysis that has been performed, whether or not the narrowed-down second communication data includes malicious data.

A non-transitory computer readable recording medium storing a program for causing a processor to perform processing comprising:

• performing a plurality of times a first process of:
• obtaining first communication data via a communication network;
• displaying a list of available data aggregation methods to narrow down communication data on which in-packet analysis is to be performed, the available data aggregation methods including:
• a first available method in which the communication data is narrowed down based on a number of packets transmitted on a per-minute basis;
• a second available method in which the communication data is narrowed down based on a number of different source network addresses in the packets on the per-minute basis;
• a third available method in which the communication data is narrowed down based on a specified number of destination port numbers for which there are a greatest number of packets;
• a fourth available method in which the communication data is narrowed down based on a specified number of the destination port numbers for which there are a smallest number of packets;
• receiving user selection of a first data aggregation method from the displayed list of the available data aggregation methods;
• narrowing down the first communication data by performing the first data aggregation method;
• displaying, as an aggregation result, the narrowed-down first communication data;
• performing the in-packet analysis on the narrowed-down first communication data;
• and
• incrementing a number of times the first data aggregation method has been selected by the user;
• after the first process has been performed the plurality of times, performing a second process of:
• obtaining second communication data via the communication network;
• selecting, as a second data aggregation method, the available data aggregation method that has been selected as the first data aggregation method in the plurality of times the first process was performed;
• narrowing down the second communication data by performing the second data aggregation method to narrow down the second communication data;
• performing the in-packet analysis on the narrowed-down second communication data;
• and
• identifying, based on a result of the in-packet analysis that has been performed, whether or not the narrowed-down second communication data includes malicious data.