| 摘要 |
PROBLEM TO BE SOLVED: To associate an organization with an IP address included in flow data to grasp a traffic state for each site.SOLUTION: In the present invention, DNS traffic data is collected, a destination IP address and flow data including the destination IP address, number of packets, flow size, and flow acquisition start time are collected, a DNS information database is created in which an inquiry transmission source domain name included in the DNS traffic data is determined as a first element, an IP address corresponding to the domain name is determined as a second element, an inquiry transmission source IP address is determined as a third element, inquiry time is determined as a fourth element, and the number of inquiry for the domain name is determined as a fifth element, and a flow database is generated on the basis of the acquired flow data. The DNS information database and the flow database are compared with each other, and a domain name is given to the destination IP address which appears in the flow database. |
