# US 12,192,219 B2 · Data aggregation apparatus, data aggregation method, and program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,192,219 B2 - Document ID: US12192219B2 - Status: Granted - Kind: B2 - Application number: 17/767,145 - Filed: 2020-10-28 - Published: 2022-12-01 - Granted: 2025-01-07 - Earliest claimed: 2019-11-01 - Assignees: NEC Corporation - Applicants: NEC Corporation - Inventors: Yuki Ashino - Web page: https://patentgrep.com/patent/US12192219B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract In order to perform data aggregation using an appropriate data aggregation method among a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from communication data, a data aggregation apparatus 100 includes: an obtaining unit 101 configured to obtain communication data via a communication network; a selecting unit 103 configured to select one or more first data aggregation methods based on user operation, from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data; an aggregating unit 107 configured to perform data aggregation of the communication data, based on the one or more first data aggregation methods; and a display processing unit 109 configured to display, on a screen, an aggregated value related to the data aggregation. ## Claims ### Claim 1 A data aggregation apparatus comprising: a memory storing instructions; and one or more processors configured to execute the instructions to: perform a plurality of times a first process of: obtaining first communication data via a communication network; displaying a list of available data aggregation methods to narrow down communication data on which in-packet analysis is to be performed, the available data aggregation methods including: a first available method in which the communication data is narrowed down based on a number of packets transmitted on a per-minute basis; a second available method in which the communication data is narrowed down based on a number of different source network addresses in the packets on the per-minute basis; a third available method in which the communication data is narrowed down based on a specified number of destination port numbers for which there are a greatest number of packets; a fourth available method in which the communication data is narrowed down based on a specified number of the destination port numbers for which there are a smallest number of packets; receiving user selection of a first data aggregation method from the displayed list of the available data aggregation methods; narrowing down the first communication data by performing the first data aggregation method; displaying, as an aggregation result, the narrowed-down first communication data; performing the in-packet analysis on the narrowed-down first communication data; and incrementing a number of times the first data aggregation method has been selected by the user; after the first process has been performed the plurality of times, perform a second process of: obtaining second communication data via the communication network; selecting, as a second data aggregation method, the available data aggregation method that has been selected as the first data aggregation method in the plurality of times the first process was performed; narrowing down the second communication data by performing the second data aggregation method to narrow down the second communication data; performing the in-packet analysis on the narrowed-down second communication data; and identifying, based on a result of the in-packet analysis that has been performed, whether or not the narrowed-down second communication data includes malicious data. ### Claim 2 (depends on 1) The data aggregation apparatus according to claim 1, wherein the one or more processors are configured to execute the instructions to use a coordinate transformation function associated with the first data aggregation method, to transform coordinates on a screen to coordinates of the narrowed-down first communication data. ### Claim 3 (depends on 1) The data aggregation apparatus according to claim 1, wherein the one or more processors are configured to execute the instructions to display a screen for encouraging the user selection of the first data aggregation method to narrow down the first communication data to an aggregated value range including candidate data for the in-packet analysis. ### Claim 4 A data aggregation method performed by a computer and comprising: performing a plurality of times a first process of: obtaining first communication data via a communication network; displaying a list of available data aggregation methods to narrow down communication data on which in-packet analysis is to be performed, the available data aggregation methods including: a first available method in which the communication data is narrowed down based on a number of packets transmitted on a per-minute basis; a second available method in which the communication data is narrowed down based on a number of different source network addresses in the packets on the per-minute basis; a third available method in which the communication data is narrowed down based on a specified number of destination port numbers for which there are a greatest number of packets; a fourth available method in which the communication data is narrowed down based on a specified number of the destination port numbers for which there are a smallest number of packets; receiving user selection of a first data aggregation method from the displayed list of the available data aggregation methods; narrowing down the first communication data by performing the first data aggregation method; displaying, as an aggregation result, the narrowed-down first communication data; performing the in-packet analysis on the narrowed-down first communication data; and incrementing a number of times the first data aggregation method has been selected by the user; after the first process has been performed the plurality of times, performing a second process of: obtaining second communication data via the communication network; selecting, as a second data aggregation method, the available data aggregation method that has been selected as the first data aggregation method in the plurality of times the first process was performed; narrowing down the second communication data by performing the second data aggregation method to narrow down the second communication data; performing the in-packet analysis on the narrowed-down second communication data; and identifying, based on a result of the in-packet analysis that has been performed, whether or not the narrowed-down second communication data includes malicious data. ### Claim 5 A non-transitory computer readable recording medium storing a program for causing a processor to perform processing comprising: performing a plurality of times a first process of: obtaining first communication data via a communication network; displaying a list of available data aggregation methods to narrow down communication data on which in-packet analysis is to be performed, the available data aggregation methods including: a first available method in which the communication data is narrowed down based on a number of packets transmitted on a per-minute basis; a second available method in which the communication data is narrowed down based on a number of different source network addresses in the packets on the per-minute basis; a third available method in which the communication data is narrowed down based on a specified number of destination port numbers for which there are a greatest number of packets; a fourth available method in which the communication data is narrowed down based on a specified number of the destination port numbers for which there are a smallest number of packets; receiving user selection of a first data aggregation method from the displayed list of the available data aggregation methods; narrowing down the first communication data by performing the first data aggregation method; displaying, as an aggregation result, the narrowed-down first communication data; performing the in-packet analysis on the narrowed-down first communication data; and incrementing a number of times the first data aggregation method has been selected by the user; after the first process has been performed the plurality of times, performing a second process of: obtaining second communication data via the communication network; selecting, as a second data aggregation method, the available data aggregation method that has been selected as the first data aggregation method in the plurality of times the first process was performed; narrowing down the second communication data by performing the second data aggregation method to narrow down the second communication data; performing the in-packet analysis on the narrowed-down second communication data; and identifying, based on a result of the in-packet analysis that has been performed, whether or not the narrowed-down second communication data includes malicious data.