Application classification method, network anomaly detection method, application classification program, network anomaly detection program, application classification device, network anomaly detection equipment

摘要

PROBLEM TO BE SOLVED: To classify the sorts of applications used on a network by less calculation volume while sufficiently reflecting an actual traffic state of the network.;SOLUTION: An application classification method comprises: a receiving step for receiving a packet flowing through an IP network; a data collection step for storing statistical information concerned with at least a TCP flag and a TCP packet size of the packet received by the receiving step in a storage means; a first classification step for classifying applications used on the network into two sorts by using a prescribed operation expression on the basis of the statistical information of the TCP flag stored in the storage means; and a second classification step for classifying the applications used on the network into two sorts by using a prescribed operation expression on the basis of the statistical information of the TCP packet size stored in the storage means.;COPYRIGHT: (C)2008,JPO&INPIT