Communication data statistical apparatus, communication data statistical method, and computer program product

A method of taking statistics of multiple different statistical conditions for communication data flowing through a network, the communication data statistical method comprising:

• (a) receiving packets including multiple different identifiers;
• (b) classifying each packet, which is received in the step (a) and has corresponding identifiers identical with at least two preset different identifiers selected from the multiple different identifiers, into a certain aggregate flow, generating and accumulating aggregate statistical information including a number of packets belonging to the certain aggregate flow, and outputting the accumulated aggregate statistical information when the accumulated aggregate statistical information satisfies a preset output condition;
• (c) performing an updating process configured to update, in response to each receipt of the aggregate statistical information, multiple statistical flow tables corresponding to different statistical conditions defined by both a combination of a single identifier and a combination of identifiers that are part of the identifiers included in the aggregation flow, the combination of identifiers including at least two identifiers among an identifier of a source IP address, an identifier of a destination IP address, and an identifier of a source port number, and each of the statistical flow tables including a number of packets and a number of bytes of packets belonging to each statistical condition.

A non-transitory computer readable medium with an executable program stored thereon, wherein the executable program causes an apparatus to take statistics of multiple different statistical conditions for communication data flowing through a network, wherein the program comprises the functions of:

• (a) receiving packets including multiple different identifiers;
• (b) classifying each packet, which is received by the function (a) and has corresponding identifiers identical with at least two preset different identifiers selected among the multiple different identifiers, into a certain aggregate flow, generating and accumulating aggregate statistical information including a number of packets belonging to the certain aggregate flow, and outputting the accumulated aggregate statistical information when the accumulated aggregate statistical information satisfies a preset output condition;
• (c) performing an updating process configured to update, in response to each receipt of the aggregate statistical information, multiple statistical flow tables corresponding to different statistical conditions defined by both a combination of a single identifier and a combination of identifiers that are part of the identifiers included in the aggregation flow, the combination of identifiers including at least two identifiers among an identifier of a source IP address, an identifier of a destination IP address, and an identifier of a source port number, and each of the statistical flow tables including a number of packets and a number of bytes of packets belonging to each statistical condition.