Method of network monitoring and device

• US 10,560,473 B2
• Filed: 09/25/2017
• Issued: 02/11/2020
• Est. Priority Date: 10/03/2016
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Saito, Satomi, Torii, Satoru, Yoshioka, Katsunari
• Primary Examiner(s): Zhao, Don G
• Application Number:
  US15/713,802
• Publication Number:
  US 20180097833A1
• Time in Patent Office: 869 Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of network monitoring includes, acquiring a log including site information for identifying a web site that is previously accessed by an access source and content information for identifying a content that is requested by the access source, generating a first relationship information that includes site information for identifying the web site which provides the content, generating a second relationship information that includes content information for identifying another content that is requested by the access source requesting the content, generating a third relationship information that includes a second combination of the access source and the web site which provides both the content and the other content for the access source, and determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold, based on the third relationship information.

Claims

1. A method of network monitoring executed by a computer, the method comprising:

acquiring a log including site information for identifying each web site of a plurality of web sites that is previously accessed by each of access sources and content information for identifying each of the contents that is requested to each of the web sites by each of the access sources;

generating first combinations of a first content and a second content from the contents;

generating, for each of the first combinations, second combinations of the access source and the web site which provides both the first content and the second content for the access source;

determining degree of similarity by comparing each of the second combinations corresponding to each of the first combinations; and

determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold.

2. The method of network monitoring according to claim 1, the method further comprising:

graphing the first combination included in the group on a graph.

3. The method of network monitoring according to claim 2, wherein the first content and the second content are connected with a line in the graph, a thickness of the line being based on a number of the second combination.

4. The method of network monitoring according to claim 1, wherein the degree of similarity of the second combination is calculated based on Jaccard coefficient.

5. The method of network monitoring according to claim 1, wherein the access source is identified based on an IP address.

6. A device comprising:

a memory; and

a processor coupled to the memory and the processor configured to,

acquire a log including site information for identifying each web site of a plurality of web sites that is previously accessed by each of access sources and content information for identifying each of the contents that is requested to each of the web sites by each of the access sources;

generate first combinations of a first content and a second content from the contents;

generate, for each of the first combinations, second combinations of the access source and the web site which provides both the first content and the second content for the access source;

determine degree of similarity by comparing each of the second combinations corresponding to each of the first combinations; and

determine a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold.

7. The device according to claim 6, the processor further configured to:

graph the first combination included in the group on a graph.

8. The device according to claim 7, wherein the first content and the second are connected with a line in the graph, a thickness of the line being based on a number of the second combination.

9. The device according to claim 6, wherein the degree of similarity of the second combination is calculated based on Jaccard coefficient.

10. The device according to claim 6, wherein the access source is identified based on an IP address.

11. A non-transitory computer-readable recording medium storing a program that causes a computer to execute a process comprising:

acquiring a log including site information for identifying each web site of a plurality of web sites that is previously accessed by each of access sources and content information for identifying each of the contents that is requested to each of the web sites by each of the access sources;

generating first combinations of a first content and a second content from the contents;

generating, for each of the first combinations, second combinations of the access source and the web site which provides both the first content and the second content for the access source;

determining degree of similarity by comparing each of the second combinations corresponding to each of the first combinations; and

determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold.