Monitoring device, monitoring method, and monitoring program
AssigneeNippon Telegraph and Telephone Corporation
InventorHiroshi KURAKAMI
Life of this patent
Estimating the term…
Abstract
An acquiring unit acquires a packet indicating flow information that is output by a network device at a predetermined sampling rate, and a determining unit determines as abnormal, for each of predetermined traffic patterns, when a sampling error rate is equal to or lower than a predetermined upper limit value and the number of packets acquired in a predetermined count period preceding from a current time or an average value of the number of packets per unit time is equal to or higher than a predetermined detection threshold.
Claims5
A monitoring device comprising:
- a memory;
- and
- a processor coupled to the memory and programmed to execute a process comprising:
- acquiring a packet indicating flow information that is output by a network device at a predetermined sampling rate;
- and
- determining as abnormal, for each of predetermined traffic patterns when a sampling error rate is equal to or lower than a predetermined upper limit value and a number of packets acquired in a predetermined period preceding from a current time or an average value of the number of packets per unit time is equal to or larger than a predetermined detection threshold.
A monitoring method that is performed by a monitoring device, comprising:
- acquiring a packet indicating flow information that is output by a network device at a predetermined sampling rate;
- and
- determining as abnormal, for each of predetermined traffic patterns when a sampling error rate is equal to or lower than a predetermined upper limit value and a number of packets acquired in a predetermined period preceding from a current time or an average value of the number of packets per unit time is equal to or larger than a predetermined detection threshold.
A non-transitory computer-readable recording medium storing a monitoring program that causes a computer to execute:
- acquiring a packet indicating flow information that is output by a network device at a predetermined sampling rate;
- and
- determining as abnormal, for each of predetermined traffic patterns when a sampling error rate is equal to or lower than a predetermined upper limit value and a number of packets acquired in a predetermined period preceding from a current time or an average value of the number of packets per unit time is equal to or larger than a predetermined detection threshold.
Dependencies are inferred from the claim text.