| 摘要 |
PURPOSE: A method and an apparatus are provided to early detect unknown internet worms in large-scale network with small operation quantity using the change of randomness generating in the network traffic. CONSTITUTION: A traffic matrix generating unit(120) generates the first, second, third traffic matrix in the first, second, third time domains. A normal traffic remover(130) eliminates matrix components corresponding to the normal flow in the first, second, third time domains, and generates the normal traffic matrix. A ranking calculator(140) calculates the ranking of the normal traffic matrix. A network state determiner(150) decides the state of network based on the ranking. |
