Analysis device, analysis method, and analysis program

An analysis method executed by an analysis apparatus, comprising:

• acquiring, from each communication observation device of a plurality of communication observation devices that observe communication in a network, observation information of the communication including a transmission source Internet Protocol (IP) address, a transmission source Media Access Control (MAC) address, a transmission destination IP address, and a transmission destination MAC address in the communication;
• estimating a topology of the network on the basis of the acquired observation information;
• allocating one communication observation device of the plurality of communication observation devices to observe a path of the network, wherein the one communication observation device is on the path of the communication and transmits;
• the observation information of the communication for each piece of communication flowing through the network on the basis of the estimated topology,
• an installation position of the one communication observation device on the path of the network, and
• the observation information of the communication acquired from the communication observation device;
• creating, based on a result of the allocating operation of the one communication observation device, a monitoring list indicating one or more target communications for observation and for transmission by the allocated one communication observation device;
• and
• transmitting the created monitoring list to respective communication observation devices of the plurality of communication observation devices, thereby preventing transmission of a plurality of pieces of observation information of an instance of communication, wherein
• the respective communication observation devices are allocated to transmit the observation information of the communication with the same transmission source IP address and transmission source MAC address.

A non-transitory computer readable storage medium having stored therein an analysis program that causes a computer to execute a process comprising the steps of:

• acquiring, from each communication observation device of a plurality of communication observation devices that observe communication in a network, observation information of the communication including a transmission source Internet Protocol (IP) address, a transmission source Media Access Control (MAC) address, a transmission destination IP address, and a transmission destination MAC address in the communication;
• estimating a topology of the network on the basis of the acquired observation information;
• allocating one communication observation device of the plurality of communication observation devices to observe a path of the network, wherein the one communication observation device is on the path of the communication and transmits:
• the observation information of the communication for each piece of communication flowing through the network on the basis of the estimated topology,
• an installation position of the one communication observation device on the path of the network, and
• the observation information of the communication acquired from the communication observation device;
• creating, based on a result of the allocating operation of the one communication observation device, a monitoring list indicating one or more target communications for observation and for transmission by the allocated one communication observation device;
• and
• transmitting the created monitoring list to respective communication observation devices of the plurality of communication observation devices, thereby preventing transmission of a plurality of pieces of observation information of an instance of communication, wherein
• the respective communication observation devices are allocated transmit the observation information of the communication with the same transmission source IP address and transmission source MAC address.