Abstract: A first collection unit (15a) stores an association between an IP address of the user terminal, a domain name, and an IP address of a communication destination server corresponding to the domain name in a name resolution information collection DB (14a) of a storage unit (14) using a name resolution packet between a user terminal and a DNS server. A second collection unit (15b) stores a correspondence among an IP address outside a capsule of a user terminal, an IP address inside the capsule, and an IP address of a communication destination server 3 in an inner-outer association DB (14b) of the storage unit (14) using header information outside the capsule of an encapsulated packet between the user terminal and the communication destination server and header information inside the capsule.

Abstract: A conversion device analyzes an input packet and acquires header information included in the packet. Furthermore, the conversion device classifies packets into one of a plurality of groups on the basis of the acquired header information and set grouping conditions. Subsequently, the conversion device generates packets for analysis on the basis of the processing corresponding to the classified groups.

Abstract: when packets are received via any one of the plurality of inflow VRFs provided for respective route patterns, a chaining edge router (10) redirects the packets to a chain VRF corresponding to the inflow VRF. The chaining edge router (10) transfers the packets redirected to the chain VRF to respective functions via a communication path constructed using a VLAN in advance according to a route pattern corresponding to the chain VRF.

Abstract: A conversion device (10) analyzes an input packet and acquires header information included in the packet. Furthermore, the conversion device (10) classifies packets into one of a plurality of groups on the basis of the acquired header information and set grouping conditions. Subsequently, the conversion device (10) generates packets for analysis on the basis of the processing corresponding to the classified groups.

Abstract: A conversion device analyzes information of an input packet using hardware and determines whether to perform predetermined previous stage processing using the hardware. Furthermore, when it is determined to perform the previous stage processing, the conversion device uses the hardware to provide metadata including identification information indicating a group of packets to the packets on the basis of the fixed-length header information of the packets. In addition, the conversion device uses software to generate analysis packets corresponding to the group of packets using the provided metadata.

Abstract: A design apparatus optimizes, with a first granularity (for example, a real number solution), a traffic volume allocated to each of links between adjacent nodes included in a network. In addition, the design apparatus calculates an approximation solution obtained by approximating, with a second granularity (for example, an integer solution), the traffic volume having been optimized with the first granularity. Furthermore, the design apparatus maps logical paths to each of routes constituted by the links in accordance with the approximated traffic volume.

Abstract: An extraction unit extracts predetermined information from an outer header and an inner header of a tunneled packet passing through a network device in which congestion has occurred. An evaluation unit evaluates an order in which fine grain flows in a tunnel subdivided with reference to the extracted predetermined information are subject to TE, based on attribute information of the fine grain flows.

Abstract: A feature calculation unit calculates a feature of header information of a packet. A classification unit classifies the packet as a normal packet or an abnormal packet by using the calculated feature. An adding unit adds a label indicating a tool name of a known attack tool to header information of a packet attacked using the attack tool. A learning unit learns the addition of the label by using the label and the feature calculated for the packet to which the label has been added as teacher data.

Abstract: A detection device includes: a statistic unit that acquires statistical value data on 5-tuple flows in a certain time period; a degree centrality calculation unit that calculates a degree centrality of a node including an indegree, which is a total sum of a weight of each edge flowing into the node, and an outdegree, which is a total sum of a weight of each edge flowing out of the node, based on the statistical value data on the 5-tuple flows in the certain time period; and a degree centrality impartation unit that imparts the degree centrality, as a feature, to the statistical value data on the 5-tuple flows in the certain time period.

Abstract: A continuity checking apparatus generates a continuity checking packet to which a predetermined flag and user attributes are assigned and transmits the generated continuity checking packet to an edge router connected to a service that is an entrance of a service chain. Each service transmits an arrival message with respect to the continuity checking packet to the continuity checking apparatus upon reception of the continuity checking packet to which the predetermined flag is assigned. In addition, each service transfers the continuity checking packet to a next service device of the service chain on the basis of the user attributes assigned to the received continuity checking packet. The continuity checking apparatus identifies a path representing service devices through which the continuity checking packet passes on the basis of the arrival message transmitted from each service, and determines whether the identified path is the same as a path of the service chain that is a continuity checking target.

Abstract: The controller (10) acquires information about the band of the flow within the tunnel and the band of each flow after policing or shaping, calculates the ratio of the traffic volume after policing or shaping to the traffic volume before policing or shaping by using the acquired information about the band, and estimates the traffic volume of the flow to be monitored within the tunnel by using the calculated ratio and the band of each flow after policing or shaping.

Abstract: A detection device (10) includes: a statistic unit (131) that acquires statistical value data on 5-tuple flows in a certain time period; a degree centrality calculation unit (132) that calculates a degree centrality of a node including an indegree, which is a total sum of a weight of each edge flowing into the node, and an outdegree, which is a total sum of a weight of each edge flowing out of the node, based on the statistical value data on the 5-tuple flows in the certain time period; and a degree centrality impartation unit (133) that imparts the degree centrality, as a feature, to the statistical value data on the 5-tuple flows in the certain time period.

Abstract: A conversion device (10) includes a separation unit (11) that separates an inputted encapsulated packet into flow information and sampled headers including outer headers and inner headers, a decapsulation unit (12) that separates the outer headers from the sampled headers, and a conversion unit (13) that obtains statistics about the inner headers on the basis of the sampled headers separated from the outer headers, generates an xFlow packet including at least statistical information indicating the statistics about the inner headers, and outputs the generated xFlow packet to an external device.

Abstract: A handling apparatus (14a) handles a server attack taking place on a network (1Na) or handles a server attack as requested by a security system provided on another network. In accordance with a determination that it is not possible to handle the server attack by the handling apparatus (14a), the control determination apparatus (12a) makes a request to another security system (1Sb) capable of handling the server attack to handle the server attack. A centralized control apparatus (11) determines whether the server attack taking place on the network (1Na) can be handled on another network.

Abstract: A collection device (10) collects traffic from a core network (10N) connected to a plurality of operator networks (20N). Further, an analysis device has a plurality of functions of analyzing traffic. Further, a setting device sets a scenario that designates at least one of the plurality of functions. Further, a pre-processing device converts the traffic collected by the collection device (10) to traffic of a format suitable for the function designated by the scenario. Further, a distribution device distributes the traffic converted by the pre-processing device to a designated function.

Abstract: When receiving packets of a flow from a network device (1), a transmission control device (10) determines, according to processing abilities of flow collectors (20), rates in transmitting information concerning the flow to the collectors 20. The transmission control device (10) selects, based on header information of the received packets, the flow collector (20) to be a transmission destination of the information concerning the flow of the packets. The transmission control device (10) transmits the information concerning the flow at the rate determined for each of the flow collectors (20).

Abstract: The sorting unit (10) has a sorting function unit (13) that acquires a frame and a sorting key, embeds the sorting key in a header of the frame, and sorts the frame into a processing thread based on the value of the sorting key in the header.

Abstract: A registration device (10) includes an extracting unit (131) that extracts inner header information and outer header information of an encapsulated packet, a filter unit (132) that calculates a hash value of the inner header information and the outer header information as an address of a hash table in which arrival information indicating whether a first packet of a series of flow has arrived is registered for each address and causes, based on the hash table, inner header information and outer header information of the first packet of the series of flow to pass, and a registering unit (133) that registers the inner header information and the outer header information of the first packet, which the filter unit (132) has caused to pass, in a database in association with each other.

Abstract: when packets are received via any one of the plurality of inflow VRFs provided for respective route patterns, a chaining edge router (10) redirects the packets to a chain VRF corresponding to the inflow VRF. The chaining edge router (10) transfers the packets redirected to the chain VRF to respective functions via a communication path constructed using a VLAN in advance according to a route pattern corresponding to the chain VRF.

Abstract: A continuity checking apparatus generates a continuity checking packet to which a predetermined flag and user attributes are assigned and transmits the generated continuity checking packet to an edge router connected to a service that is an entrance of a service chain. Each service transmits an arrival message with respect to the continuity checking packet to the continuity checking apparatus upon reception of the continuity checking packet to which the predetermined flag is assigned. In addition, each service transfers the continuity checking packet to a next service device of the service chain on the basis of the user attributes assigned to the received continuity checking packet. The continuity checking apparatus identifies a path representing service devices through which the continuity checking packet passes on the basis of the arrival message transmitted from each service, and determines whether the identified path is the same as a path of the service chain that is a continuity checking target.