Abstract: To detect a communication by a predetermined type of software, which disguises normal communication, an information processing apparatus includes: a communication data acquiring unit 21 configured to acquire communication data generated by a terminal connected to a network; a distribution calculating unit 24 configured to calculate distribution of attribute information of a plurality of communications with a same communication destination, based on the acquired communication data; and an estimating unit 25 configured to estimate whether a detected communication is a communication by a predetermined type of software by determining whether the calculated distribution satisfies a predetermined criterion.

Abstract: An information processing apparatus specifies the phase of activity of a terminal connected to a network by comparing a communication by the terminal with a previously held pattern, specifies the type of behavior of the terminal in relation to a first communication and a second communication, by correlation analysis between a first phase specified based on the first communication of the terminal and a second phase specified based on the second communication which is conducted before or after the first communication, and classifies the unauthorized activity of the terminal based on the specified type of behavior when determination is made that the terminal is used to conduct unauthorized activity.

Abstract: To detect a communication by a predetermined type of software, which disguises normal communication, an information processing apparatus includes: a communication data acquiring unit 21 configured to acquire communication data generated by a terminal connected to a network; a distribution calculating unit 24 configured to calculate distribution of attribute information of a plurality of communications with a same communication destination, based on the acquired communication data; and an estimating unit 25 configured to estimate whether a detected communication is a communication by a predetermined type of software by determining whether the calculated distribution satisfies a predetermined criterion.

Abstract: A network monitoring device including: a communication acquiring unit which acquires communication before the communication reaches an opposite party's terminal; a protocol analyzing unit which identifies a message for session establishment by analyzing a protocol of the acquired communication, the message being included in the communication and including a digital certificate of a communication partner in a session to be kept confidential; a certificate extracting unit which extracts a digital certificate from the identified message for session establishment; and an inspecting unit which inspects the extracted digital certificate.

Abstract: An information processing device includes: a first analyzing unit which estimates whether or not a protocol related to a communication flow is a first protocol set in advance by analyzing, each time data is received, the data in accordance with characteristics of the first protocol; and a second analyzing unit which estimates whether or not the protocol related to the communication flow is a second protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis by the first analyzing unit.

Abstract: An information processing apparatus specifies the phase of activity of a terminal connected to a network by comparing a communication by the terminal with a previously held pattern, specifies the type of behavior of the terminal in relation to a first communication and a second communication, by correlation analysis between a first phase specified based on the first communication of the terminal and a second phase specified based on the second communication which is conducted before or after the first communication, and classifies the unauthorized activity of the terminal based on the specified type of behavior when determination is made that the terminal is used to conduct unauthorized activity.

Abstract: In order to control communication in an IPv6 environment, a network monitoring apparatus includes a communication data acquisition unit that acquires communication data in a network, a target terminal determination unit that determines whether a terminal included in a source or a destination of the acquired communication data is a target terminal meeting a predetermined condition, and a communication guiding unit that, by notifying the target terminal of a physical address of a predetermined terminal as a physical address of a terminal other than the target terminal, guides the communication data sent from the target terminal, to the predetermined terminal.

Abstract: A network monitoring device including: a communication acquiring unit which acquires communication before the communication reaches an opposite party's terminal; a protocol analyzing unit which identifies a message for session establishment by analyzing a protocol of the acquired communication, the message being included in the communication and including a digital certificate of a communication partner in a session to be kept confidential; a certificate extracting unit which extracts a digital certificate from the identified message for session establishment; and an inspecting unit which inspects the extracted digital certificate.

Abstract: An information processing apparatus includes: a specification unit that specifies a phase of activity of terminals by comparing communication between terminals with a pattern held in advance; and a correlation analysis unit that determines whether or not a first terminal and a second terminal are carrying out activity cooperatively, by performing a correlation analysis of communication by the first terminal and communication by the second terminal, when the phase specified currently or in the past in respect of the first terminal and the phase specified currently or in the past in respect of the second terminal are the same.

Abstract: An information processing device includes: a first analyzing unit which estimates whether or not a protocol related to a communication flow is a first protocol set in advance by analyzing, each time data is received, the data in accordance with characteristics of the first protocol; and a second analyzing unit which estimates whether or not the protocol related to the communication flow is a second protocol set in advance by analyzing, each time data belonging to the communication flow is received, the data in accordance with characteristics of the second protocol regardless of a result of analysis by the first analyzing unit.