COMMUNICATION MONITOR DEVICE, COMMUNICATION MONITOR PROGRAM, AND COMMUNICATION MONITOR METHOD

摘要

PROBLEM TO BE SOLVED: To surely detect illegal communication using a protocol permitted for use in communication.

SOLUTION: A unit data acquisition unit 107 divides a head packet in a session into data each consisting of a predetermined number of bytes to obtain unit data. A data number determination unit 108 regards as flag data unit data whose frequency of transmission and reception in the session exceeds a predetermined threshold. A marking unit 111 marks flag data in all head packets in the session. A candidate extraction unit 112 extracts a data pattern of a part where one or more flag data are successive as an illegal signature candidate. An appearance frequency counting unit 113 outputs an illegal signature candidate whose appearance frequency exceeds a predetermined threshold to a data length comparison unit 114. The data length comparison unit 114 compares data lengths of illegal signature candidates and registers an illegal signature candidate having the longest data length as an illegal signature in an illegal signature storage unit 105.

COPYRIGHT: (C)2010,JPO&INPIT