IP METHOD AND TRAFFIC ANALYSIS APPARATUS FOR MANAGING IP INFORMATION OF EACH DOMAIN

摘要

A method for managing IP information for each domain and a traffic analysis apparatus for performing the same are provided. This method is a method of managing IP information for each domain in a traffic analysis device operated by at least one processor, comprising: collecting DNS (Domain Name System, DNS) response messages; extracting, if the second level domain (SLD) of the extracted domain is not a registered domain, determining the extracted domain as a representative domain, and creating a domain object mapping the subnet of the extracted IP address with the extracted domain and storing the extracted domain, if the second higher domain of the extracted domain is a registered domain, determining the extracted domain as a subdomain, mapping the subnet of the extracted IP address and the subdomain, and adding the extracted domain to the domain object. .