METHOD OF NETWORK MONITORING AND DEVICE

• US 20180097833A1
• Filed: 09/25/2017
• Published: 04/05/2018
• Est. Priority Date: 10/03/2016
• Status: Active Grant

• Current Assignee: Fujitsu Limited
• Original Assignee: Fujitsu Limited
• Inventors: SAITO, SATOMI, Torii, Satoru, Yoshioka, Katsunari
• Granted Patent: US 10,560,473 B2
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/1441 Countermeasures against malicious traffic countermeasures against attacks on cryptographic mechanisms H04L9/002
• CPC Class Codes: H04L 63/20 for managing network security; network security policies in general filtering policies H04L63/0227

Abstract

A method of network monitoring includes, acquiring a log including site information for identifying a web site that is previously accessed by an access source and content information for identifying a content that is requested by the access source, generating a first relationship information that includes site information for identifying the web site which provides the content, generating a second relationship information that includes content information for identifying another content that is requested by the access source requesting the content, generating a third relationship information that includes a second combination of the access source and the web site which provides both the content and the other content for the access source, and determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold, based on the third relationship information.

Claims

1. A method of network monitoring executed by a computer, the method comprising:

acquiring a log including site information for identifying a web site that is previously accessed by an access source and content information for identifying a content that is requested by the access source, for each access source;

generating, for each content, first relationship information that includes site information for identifying the web site which provides the content, based on the log;

generating, for each content, second relationship information that includes content information for identifying another content that is requested by the access source requesting the content, based on the log and the first relationship information;

generating, for each first combination of the content and the other content, third relationship information that includes a second combination of the access source and the web site which provides both the content and the other content for the access source, based on the second relationship information; and

determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold, based on the third relationship information.

2. The method of network monitoring according to claim 1, the method further comprising:

graphing the first combination included in the group on a graph.

3. The method of network monitoring according to claim 2, wherein the content and the other content are connected with a line in the graph, a thickness of the line being based on the a number of the second combination.

4. The method of network monitoring according to claim 1, wherein the degree of similarity of the second combination is calculated based on Jaccard coefficient.

5. The method of network monitoring according to claim 1, wherein the access source is identified based on an IP address.

6. A device comprising:

a memory; and

a processor coupled to the memory and the processor configured to,

acquire a log including site information for identifying a web site that is previously accessed by an access source and content information for identifying a content that is requested by the access source, for each access source;

generate, for each content, first relationship information that includes site information for identifying the web site which provides the content, based on the log;

generate, for each content, second relationship information that includes content information for identifying another content that is requested by the access source requesting the content, based on the log and the first relationship information;

generate, for each first combination of the content and the other content, third relationship information that includes a second combination of the access source and the web site which provides both the content and the other content for the access source, based on the second relationship information; and

determine a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold, based on the third relationship information.

7. The device according to claim 6, the processor further configured to:

graph the first combination included in the group on a graph.

8. The device according to claim 7, wherein the content and the other content are connected with a line in the graph, a thickness of the line being based on a number of the second combination.

9. The device according to claim 6, wherein the degree of similarity of the second combination is calculated based on Jaccard coefficient.

10. The device according to claim 6, wherein the access source is identified based on an IP address.

11. A non-transitory computer-readable recording medium storing a program that causes a computer to execute a process comprising:

acquiring a log including site information for identifying a web site that is previously accessed by an access source and content information for identifying a content that is requested by the access source, for each access source;

generating, for each content, first relationship information that includes site information for identifying the web site which provides the content, based on the log;

generating, for each content, second relationship information that includes content information for identifying another content that is requested by the access source requesting the content, based on the log and the first relationship information;

generating, for each first combination of the content and the other content, third relationship information that includes a second combination of the access source and the web site which provides both the content and the other content for the access source, based on the second relationship information; and

determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold, based on the third relationship information.