Nippon Telegraph and Telephone Corporation

Akihiro Shimoda

Tatsuya Mori

Keisuke Ishibashi

Takeru Inoue

Kazumichi Sato

Shigeki Goto

A name identification device includes a generation unit configured to generate graph information in which each node represents one of names and IP addresses included in A records and CNAME records included in a DNS response observed in a network, and each edge represents a correspondence relationship between one and another of the names and the IP addresses in the A records and the CNAME records, and to associate the generated graph information with a client corresponding to the DNS response; and an identifying unit configured to identify a name related to a leaf node that is reachable from a node corresponding to the IP address of a server by tracing the edges in the graph information having been associated with the client, for a packet between the client and the server that is observed in the network.

Name identification device, name identification method, and recording medium

An estimation device is provided that measures a number of DNS requests for each of a plurality of domain names and for each IP address in observed flows. The device measures a total number of the flows, and total amounts of data, estimates a relationship between the amount of data for each IP address corresponding to a node, and the number of DNS requests for each domain name corresponding to a non-intermediate node; and based on a value obtained by multiplying the number of requests for each domain name by the amount of data for each flow of each domain name, obtains the amount of data for each flow of each domain name, multiplies the amount of data by the number of the DNS requests for each domain name, so as to calculate an estimate of the amount of data for each domain name.

Growing community of inventors

Musashino, Japan

Akihiro Shimoda