Unauthorized communication detection method

• US 20090055919A1
• Filed: 08/01/2008
• Published: 02/26/2009
• Est. Priority Date: 08/10/2007
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: Mitomo, Masashi, Komura, Masahiro
• Granted Patent: US 8,490,173 B2
• Time in Patent Office: Days
• US Class Current: 726/11
• CPC Class Codes: H04L 63/1408 by monitoring network traffic monitoring network traffic per se H04L43/00

Abstract

According to an aspect of an embodiment, a method for controlling an apparatus for transferring data from a plurality of first devices to a second device via a network, the data being transferred by using a packet, comprises the steps of: extracting type information identifying type of software conveyed by a packet and destination information identifying destination of the packet transmitted from one of the first devices; counting the number of kinds of the type information extracted from packets associated with the same destination information, respectively; and determining an unauthorized communication when the number of kinds of the type information is less than a predetermined value.

Claims

1. A method for controlling an apparatus for transferring data from a plurality of first devices to a second device via a network, said data being transferred by using a packet, the method comprising the steps of:

extracting type information identifying type of software conveyed by a packet and destination information identifying destination of the packet transmitted from one of said first devices, the software being used by said one of said first devices;

counting the number of kinds of said type information extracted from packets associated with the same destination information, respectively; and

determining an unauthorized communication when the number of kinds of said type information is less than a predetermined value.

2. The method according to claim 1, wherein said data is transferred by hypertext transfer protocol, and said extracting step extracts user agent information as said type information.

3. The method according to claim 1, wherein said data is transferred by hypertext transfer protocol, and said extracting step extracts uniform resource locator information as said destination information.

4. A method for controlling an apparatus for transferring data from a plurality of first devices to a second device via a network, said data being transferred by using a packet, the method comprising the steps of:

extracting type information identifying type of software conveyed by a packet and destination information identifying destination of the packet transmitted from one of said first devices, the software being used by said one of said first devices;

counting the number of kinds of said destination information extracted from packets associated with the same type information, respectively; and

determining an unauthorized communication when the number of kinds of said destination information is less than a predetermined value.

5. The method according to claim 4, wherein said data is transferred by hypertext transfer protocol, and the extracting step extracts user agent information as said type information.

6. The method according to claim 4, wherein said data is transferred by hypertext transfer protocol, and the extracting step extracts uniform resource locator information as said destination information.

7. An apparatus for transferring data from a plurality of first devices to a second device via a network, said data is transferred by using a packet, comprising:

a processor for executing a process comprising;

extracting type information identifying type of software conveyed by a packet and destination information identifying destination of the packet transmitted from one of said first devices, the software being used by said one of said first devices;

counting the number of kinds of said type information;

extracted from packets associated with the same destination information, respectively; and

determining an unauthorized communication when the number of kinds of said type information is less than predetermined value.

8. The apparatus according to claim 7, wherein said data is transferred by hypertext transfer protocol, and the extracting of said process extracts user agent information as said type information.

9. The apparatus according to claim 7, wherein said data is transferred by hypertext transfer protocol, and the extracting of said process extracts uniform resource locator information as said destination information.