Communication monitoring apparatus, communication monitoring method, and computer-readable non-transitory storage medium

A monitoring method by a monitoring apparatus configured to monitor communication in a network separated by a proxy server into a first network and a second network,

• the proxy server being configured to relay communication between an apparatus included in the second network and an apparatus included in the first network in accordance with a request from the apparatus in the second network, and
• the monitoring apparatus holds extracted information including:
• extracted data extracted from monitoring target data used for predetermined kinds of communication in first communication between the proxy server and an apparatus in the first network and second communication between the proxy server and an apparatus in the second network;
• and
• times of reception of the monitoring target data from which the extracted data is extracted,
• wherein the extracted data includes the kinds of communication for which the monitoring target data is used, the sources and the destinations of the monitoring target data in the first communication, and the sources in the second network and the destinations in the first network after the monitoring target data is relayed by the proxy server of the monitoring target data in the second communication, and
• the monitoring method is configured to:
• by the monitoring apparatus, determine whether the extracted information includes first extracted data extracted from monitoring target data used for first kind of communication in the first communication;
• by the monitoring apparatus, acquire second extracted data extracted from monitoring target data in the second communication whose time of reception is within a predetermined time difference from the time of reception of the first extracted data with reference to the extracted information, in a case of determining that the extracted information includes the first extracted data;
• and
• by the monitoring apparatus, determine whether communication using the monitoring target data from which the acquired second extracted data is extracted is included in a series of end-to-end communication, based on the source and the destination indicated by the first extracted data and the destination in the first network indicated by the acquired second extracted data.

A computer-readable non-transitory storage medium having stored thereon a program for causing a monitoring apparatus to monitor communication in a network separated by a proxy server into a first network and a second network,

• the proxy server being configured to relay communication between an apparatus included in the second network and an apparatus included in the first network in accordance with a request from the apparatus in the second network, and
• the monitoring apparatus holds extracted information including:
• extracted data extracted from monitoring target data used for predetermined kinds of communication in first communication between the proxy server and an apparatus in the first network and second communication between the proxy server and an apparatus in the second network;
• and
• times of reception of the monitoring target data from which the extracted data is extracted,
• wherein the extracted data includes the kinds of communication for which the monitoring target data is used, the sources and the destinations of the monitoring target data in the first communication, and the sources in the second network and the destinations in the first network after the monitoring target data is relayed by the proxy server of the monitoring target data in the second communication, and
• the program causing the monitoring apparatus to execute:
• determining whether the extracted information includes first extracted data extracted from monitoring target data used for first kind of communication in the first communication;
• acquiring second extracted data extracted from monitoring target data in the second communication whose time of reception is within a predetermined time difference from the time of reception of the first extracted data with reference to the extracted information, in a case of determining that the extracted information includes the first extracted data;
• and
• determining whether communication using the monitoring target data from which the acquired second extracted data is extracted is included in a series of end-to-end communication, based on the source and the destination indicated by the first extracted data and the destination in the first network indicated by the acquired second extracted data.