Flow information collection apparatus and method of generating flow information

A method for generating flow information to be executed by a flow information collection apparatus,

• the flow information collection apparatus including an arithmetic device, a storage device coupled to the arithmetic device, and a network interface coupled to the arithmetic device and being configured to couple to an analyzer to be able to communicate with the analyzer, and
• the method for generating flow information including:
• a first step of generating, by the arithmetic device, flow information by aggregating a plurality of packets having common communication attributes in units of a first time period;
• a second step of generating, by the arithmetic device, short-term analysis information indicating short-term characteristics of a flow by repeatedly analyzing the plurality of packets used to generate the flow information with respect to short-term characteristics of the flow in a second time period shorter than the first time period, and adding the generated short-term analysis information to the flow information;
• a third step of generating, by the arithmetic device, a packet including the flow information adding the short-term analysis information;
• and
• a fourth step of transmitting, by the arithmetic device, the packet to the analyzer.