INFORMATION PROCESSING DEVICE, METHOD, AND MEDIUM

摘要

An information processing device includes: a first analyzing unit which estimates whether or not a protocol related to a communication flow is a first protocol set in advance by analyzing, each time data is received, the data in accordance with characteristics of the first protocol; and a second analyzing unit which estimates whether or not the protocol related to the communication flow is a second protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis by the first analyzing unit.

主权项

1. An information processing device comprising:
a flow managing unit to identify a communication flow to which acquired data belongs; a first analyzing unit to estimate whether or not a protocol related to the communication flow is a first protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the first protocol; and a second analyzing unit to estimate whether or not the protocol related to the communication flow is a second protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis by the first analyzing unit, wherein when a result of analysis of the data belonging to the communication flow satisfies one or any of a plurality of discontinuation conditions, the flow managing unit discontinues analysis of data related to the communication flow performed by the first analyzing unit or the second analyzing unit.