Abstract: A system provides definitions of network states, and identifies a cause for the anomaly upon detection. A traffic measuring portion (characteristic quantity generating portion) counts the number of packets/time slot classified by traffic type with respect to network traffic, generating a characteristic quantity; a memory portion stores information about the characteristic quantity; a portion calculates correlation coefficients between each pair of characteristic quantities classified by traffic type; a portion generates a histogram from correlation coefficients; a portion for determining the severity of an anomaly based on the histogram; a portion evaluates the similarity of an anomaly of interest to a reference anomaly using the occurrence probabilities of correlation coefficients; and a portion assigns a color to each pixel according to its occurrence probability value, generating an n×n picture.

Abstract: A system provides definitions of network states, and identifies a cause for the anomaly upon detection. A traffic measuring portion (characteristic quantity generating portion) counts the number of packets/time slot classified by traffic type with respect to network traffic, generating a characteristic quantity; a memory portion stores information about the characteristic quantity; a portion calculates correlation coefficients between each pair of characteristic quantities classified by traffic type; a portion generates a histogram from correlation coefficients; a portion for determining the severity of an anomaly based on the histogram; a portion evaluates the similarity of an anomaly of interest to a reference anomaly using the occurrence probabilities of correlation coefficients; and a portion assigns a color to each pixel according to its occurrence probability value, generating an n×n picture.