ABNORMAL TRAFFIC DETECTION DEVICE, ABNORMAL TRAFFIC DETECTION METHOD, AND ABNORMAL TRAFFIC DETECTION PROGRAM

摘要

An abnormal traffic detection device detects an abnormal traffic to a communication device by using information on a traffic passing through a switch. The device includes: destination IP address count units (C1 to C4); a traffic separation unit (21; and abnormal traffic judgment units (J1 to J4). The destination IP address count units (C1 to C4) store the traffic amount information as an amount information table for each of communication devices. Each time traffic having a new destination IP address passes through the switch, the traffic separation unit (21) registers the amount information on the new destination IP address in an amount information table corresponding to the destination IP address and causes an amount information table for each communication device to store the amount information. The abnormal traffic judgment units (J1 to J4) detect an abnormal state of the traffic amount flowing in the switch according to the amount information in the amount information table.