Monitoring propagation in a network

摘要

A non-transitory computer-readable recording medium stores therein a program for causing a computer to execute a process. The process includes obtaining, for each predetermined time period, from packets transmitted in a system, a packet set with a combination of a transmission source and a transmission destination different from a predetermined combination of a transmission source and a transmission destination; extracting, for the each predetermined time period, from the packets transmitted in the system, a related packet related to the obtained packet; generating, based on the extracted related packet, information indicating a degree of propagation; and outputting the generated information.

主权项

1. A non-transitory computer-readable recording medium having stored therein a program for causing a computer to execute a process, the process comprising:
obtaining, for each predetermined time period, from packets transmitted in a system, an obtained packet set with a combination of a transmission source and a transmission destination different from a predetermined combination of a transmission source and a transmission destination; identifying, for each predetermined time period, a communication characteristic of the obtained packet set; determining that the obtained packet set is related to an unknown pattern and extracting, for the each predetermined time period, from the packets transmitted in the system, a related packet related to the obtained packet set, wherein the extracting includes, when propagation of the unknown pattern has occurred, performing searching retroactively for an interval in which a communication including the propagation has occurred, and extracting the related packet that includes the communication characteristic and that is destined for the transmission source in which the propagation has occurred; generating, based on the extracted related packet, information indicating a degree of propagation of the unknown pattern; and wherein the transmission source and the transmission destination are registered in a storage unit when the transmission source and the transmission destination have an interval for obtaining a packet for the obtained packet set equal to or greater than a predetermined interval.