# US 2018/0026862 A1 · Estimation device, estimation method, and recording medium > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2018/0026862 A1 - Document ID: US20180026862A1 - Status: Published application - Kind: A1 - Application number: 15/550,966 - Filed: 2016-02-16 - Published: 2018-01-25 - Earliest claimed: 2015-02-17 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Akihiro SHIMODA; Keisuke ISHIBASHI; Takeru INOUE; Kazumichi SATO; Tatsuya MORI; Shigeki GOTO - Web page: https://patentgrep.com/patent/US20180026862A1 ## CPC - H04L 43/045: for graphical visualisation of monitoring data - H04L 43/026: using flow identification - H04L 61/4511: using domain name system [DNS] - H04L 61/5007: Internet protocol [IP] addresses - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract An estimation device measures a number of DNS requests for each domain name and for each IP address in observed flows, measures a total number of the flows, and total amounts of data; estimates a relationship between the amount of data for each IP address corresponding to a node, and the number of DNS requests for each domain name corresponding to a non-intermediate node; and based on a value obtained by multiplying the number of requests for each domain name by the amount of data for each flow of each domain name, obtains the amount of data for each flow of each domain name, and to multiply the amount of data by the number of the DNS requests for each domain name, so as to calculate an estimate of the amount of data for each domain name. ## Claims ### Claim 1 An estimation device, comprising: a first measuring unit configured to measure a number of DNS requests for each domain name, based on DNS responses observed in a network; a second measuring unit configured, with respect to flows observed in the network, for each unit of the flows having a common IP address, to measure a sum of a number of the flows, and a sum of amounts of data; a generation unit configured to generate a graph in which a node represents a domain name or an IP address included in the DNS response, and an edge represents a correspondence relationship between the domain name and the IP address; a matrix estimation unit configured to estimate a transformation matrix representing a relationship between the amount of data measured by the second measuring unit for each IP address corresponding to the node of the graph, and the number of DNS requests measured by the first measuring unit for each domain name corresponding to the node other than an intermediate node of the graph; and a calculation unit configured, based on a relationship in which a value obtained by multiplying the number of requests for each of the domain names by the amount of data for each flow of each of the domain names, is equivalent to a value obtained by multiplying the transformation matrix by the amount of data for each of the IP addresses, to obtain the amount of data for each flow of each of the domain names, and to multiply the amount of data by the number of the DNS requests for each of the domain names, so as to calculate an estimate of the amount of data for each of the domain names. ### Claim 2 (depends on 1) The estimation device as claimed in claim 1, wherein the matrix estimation unit converts the graph into an adjacency matrix, exponentiates the adjacency matrix to a number corresponding to a maximum hop length of the adjacency matrix, extracts from the exponentiated adjacency matrix each component corresponding to a combination of the node of the domain name, other than the intermediate node, and the node of the IP address, as a component of an initial value of the transformation matrix, and estimates the transformation matrix, based on the extracted initial value, the amount of data measured by the second measuring unit for each of the IP addresses corresponding to the nodes of the graph, and the number of the DNS requests measured by the first measuring unit for the domain names corresponding to the nodes other than the intermediate nodes of the graph, wherein in the adjacency matrix, a diagonal component corresponding to a node whose indegree is 0 is set to have a value of 1, and a component corresponding to an edge coming into a node whose indegree is greater than or equal to 1 is set to have a value obtained by dividing 1 by the indegree. ### Claim 3 (depends on 1) The estimation device as claimed in claim 1, wherein the generation unit generates one or more connected graphs, in each of which a node represents a domain name or an IP address included in the DNS response, and an edge represents a correspondence relationship between the domain name and the IP address, wherein the matrix estimation unit estimates the transformation matrix for each of the connected graphs, wherein the calculation unit calculates the estimate for each of the domain names corresponding to the nodes other than the intermediate nodes, for each of the connected graphs. ### Claim 4 An estimation device, comprising: a first measuring unit configured to measure a number of DNS requests for each domain name, based on DNS responses observed in a network; a second measuring unit configured, with respect to flows observed in the network, for each unit of the flows having a common IP address, to measure a sum of a number of the flows, and a sum of amounts of data; a calculation unit configured, based on a relationship in which a value obtained by multiplying the number of requests for each of the domain names by the amount of data for each flow of each of the domain names, is equivalent to the amount of data for each of the IP addresses, to obtain the amount of data for each flow of each of the domain names, and to multiply the amount of data by the number of the DNS requests for each of the domain names, so as to calculate an estimate of the amount of data for each of the domain names. ### Claim 5 An estimation method, executed by a computer, the method comprising: a first measuring step for measuring a number of DNS requests for each domain name, based on DNS responses observed in a network; a second measuring step for measuring, with respect to flows observed in the network, for each unit of the flows having a common IP address, a sum of a number of the flows, and a sum of amounts of data; a generation step for generating a graph in which a node represents a domain name or an IP address included in the DNS response, and an edge represents a correspondence relationship between the domain name and the IP address; a matrix estimation step for estimating a transformation matrix representing a relationship between the amount of data measured by the second measuring step for each IP address corresponding to the node of the graph, and the number of DNS requests measured by the first measuring step for each domain name corresponding to the node other than an intermediate node of the graph; and a calculation step for, based on a relationship in which a value obtained by multiplying the number of requests for each of the domain names by the amount of data for each flow of each of the domain names, is equivalent to a value obtained by multiplying the transformation matrix by the amount of data for each of the IP addresses, obtaining the amount of data for each flow of each of the domain names, and multiplying the amount of data by the number of the DNS requests for each of the domain names, so as to calculate an estimate of the amount of data for each of the domain names. ### Claim 6 An estimation method, executed by a computer, the method comprising: a first measuring step for measuring a number of DNS requests for each domain name, based on DNS responses observed in a network; a second measuring step for measuring, with respect to flows observed in the network, for each unit of the flows having a common IP address, a sum of a number of the flows, and a sum of amounts of data; a calculation step for, based on a relationship in which a value obtained by multiplying the number of requests for each of the domain names by the amount of data for each flow of each of the domain names, is equivalent to the amount of data for each of the IP addresses, obtaining the amount of data for each flow of each of the domain names, and multiplying the amount of data by the number of the DNS requests for each of the domain names, so as to calculate an estimate of the amount of data for each of the domain names. ### Claim 7 (depends on 1) A computer-readable recording medium having a program stored therein for causing a computer to function as the units as claimed in claim 1.