Estimation device, estimation method, and recording medium

An estimation method, executed by a computer, the method comprising:

• a first measuring step for measuring a number of DNS requests for each domain name, based on DNS responses observed in a network;
• a second measuring step for measuring, with respect to flows observed in the network, for each unit of the flows having a common IP address, a sum of a number of the flows, and a sum of amounts of data;
• a generation step for generating a graph in which a node represents a domain name or an IP address included in the DNS response, and an edge represents a correspondence relationship between the domain name and the IP address;
• a matrix estimation step for estimating a transformation matrix representing a relationship between the amount of data measured by the second measuring step for each IP address corresponding to the node of the graph, and the number of DNS requests measured by the first measuring step for each domain name corresponding to the node other than an intermediate node of the graph;
• and
• a calculation step for, based on a relationship in which a value obtained by multiplying the number of requests for each of the domain names by the amount of data for each flow of each of the domain names, is equivalent to a value obtained by multiplying the transformation matrix by the amount of data for each of the IP addresses,
• obtaining the amount of data for each flow of each of the domain names, and multiplying the amount of data by the number of the DNS requests for each of the domain names, so as to calculate an estimate of the amount of data for each of the domain names.

An estimation method, executed by a computer, the method comprising:

• a first measuring step for measuring a number of DNS requests for each domain name, based on DNS responses observed in a network;
• a second measuring step for measuring, with respect to flows observed in the network, for each unit of the flows having a common IP address, a sum of a number of the flows, and a sum of amounts of data;
• a calculation step for, based on a relationship in which a value obtained by multiplying the number of requests for each of the domain names by the amount of data for each flow of each of the domain names, is equivalent to the amount of data for each of the IP addresses,
• obtaining the amount of data for each flow of each of the domain names, and multiplying the amount of data by the number of the DNS requests for each of the domain names, so as to calculate an estimate of the amount of data for each of the domain names.