Abstract: An information processing device according to the present invention includes: a memory; and at least one processor coupled to the memory. The processor performs operations. The operations includes: extracting, based on a first data extraction policy being a policy for extracting first processing data to be used for counting a first frequency related to a transmission source from communication data, the first processing data from the communication data; counting, based on a first counting policy being a policy for counting the first frequency relating to the transmission source in the first processing data, the first frequency related to the transmission source in the first processing data; and extracting, based on a first transmission-source extraction policy being a policy for extracting the transmission source and the first frequency, the transmission source.

Abstract: A communication analysis apparatus (10) includes a communication control unit (110) that causes each of a plurality of first nodes to transmit a same communication request to a second node to be analyzed, a response result acquisition unit (120) that acquires a response result by the first node being, which is transmitted from the second node to each of the plurality of first nodes in response to the communication request from each of the first nodes, a response result analysis unit (130) that analyzes a response result by the first node, and an output unit (140) that outputs a result of the analysis to an output apparatus.

Abstract: The present invention includes an acquisition unit (110) that acquires, for communication observed by a sensor apparatus on a network, communication information including behavior information indicating behavior of the communication and transmission source information indicating a transmission source of the communication, a classification unit (120) that classifies the acquired communication information, based on the behavior information, and an output unit (130) that outputs a classification result of the communication information based on the behavior information, together with the transmission source information.

Abstract: An information processing device according to the present invention includes: a memory; and at least one processor coupled to the memory. The processor performs operations. The operations includes: extracting, based on a first data extraction policy being a policy for extracting first processing data to be used for counting a first frequency related to a transmission source from communication data, the first processing data from the communication data; counting, based on a first counting policy being a policy for counting the first frequency relating to the transmission source in the first processing data, the first frequency related to the transmission source in the first processing data; and extracting, based on a first transmission-source extraction policy being a policy for extracting the transmission source and the first frequency, the transmission source.