| 摘要 |
PROBLEM TO BE SOLVED: To enable the spying work of an attacker to be detected.SOLUTION: A monitoring method for a network monitoring device includes: storing external communication data if communication data relates to external communication from the outside to the inside; when the communication data corresponds to the start of a service, extracting external communication data related to the start of the service, and storing service start data in relation to the external communication data; when the communication data corresponds to the completion of an operation, storing operation completion data; when the communication data relates to communication from the inside to the outside, extracting related operation completion data; and determining whether to satisfy a condition that external communication data related to the communication data is stored in association with the service start data related to the extracted operation completion data. |
