| 摘要 |
<p><P>PROBLEM TO BE SOLVED: To specify an abnormal flow (abnormal communication) by a network monitoring system with a small computational quantity. <P>SOLUTION: A flow information processing section 110 inputs each piece of gathered flow information to one or a plurality of specific abnormality detection sections 120 corresponding to a flow ID of the flow information. Each abnormality detection section 120 determines whether the input flow information includes flow information on an abnormal flow, and outputs "1" when the flow information is included or "0" when not. An abnormal flow specification section 130 specifies the flow ID of the abnormal flow by arranging outputs of the abnormality detection sections 120. An abnormal flow notification section 140 notifies an administrator 220 of the abnormality flow based upon the specified flow ID. <P>COPYRIGHT: (C)2010,JPO&INPIT</p> |
