Nippon Telegraph and Telephone Corporation

Hiroshi Kurakami

Kazunori Kamiya

Hiroyuki Nooka

Daigo Natsume

A testing device () acquires session information to configure a session with a server (), which is a to-be-tested device, protected by a security device () performing authentication of a packet. Then, the testing device () generates a test packet with the session information acquired, generates a test session according to a predetermined scenario when transmitting the test packet to the server (), and transmits to the server () a test packet that increases processing load.

Testing device, testing method, and testing program

A testing device () transmits a test packet that increases processing load to a device protected by a security system, the security system performing authentication of a packet transmitted to a to-be-protected device and a packet limit per source IP address. In addition, the testing device () generates a test session according to a scenario when transmitting the test packet and configures a packet so that the test packet uses a plurality of source IP addresses. In addition, the testing device () responds to a response request up to a predetermined stage of authentication among a plurality of stages of authentication performed by the security system so that the security system authenticates the test packet to be valid. In addition, the testing device () monitors, at a predetermined stage, packet filtering situation and processing load of the security system to which the test packet is transmitted.

Test device

An acquiring unit acquires a packet indicating flow information that is output by a network device at a predetermined sampling rate, and a determining unit determines as abnormal, for each of predetermined traffic patterns, when a sampling error rate is equal to or lower than a predetermined upper limit value and the number of packets acquired in a predetermined count period preceding from a current time or an average value of the number of packets per unit time is equal to or higher than a predetermined detection threshold.

Monitoring device, monitoring method, and monitoring program

A flow information analysis apparatus receives flow information containing a header sample, determines whether the header sample of the flow information matches any of templates that are based on tunneling protocols, and when determining that the header sample matches any of the templates, extract information on a header of the IP packet from the header sample on the basis of the matched template. Further, when determining that the header sample does not match any of the templates, the flow information analysis apparatus extracts information on the header of the IP packet from the header sample on the basis of a result of a search through the header sample for a byte sequence that matches search data in which a value that is set in a specific field of the tunnel header and a value that is set in a specific field of the IP packet are combined.

Flow information analysis apparatus, flow information analysis method, and flow information analysis program

A connection control apparatus is configured such that a connection count calculator calculates a TCP connection count, which is the number of TCP connections established between a server and one or more clients on a network, of each of servers on the network. The connection control apparatus is configured such that, when a determiner determines that the calculated count is larger than or equal to a predetermined threshold value, an anomalous connection detector detects anomalous connection, and a packet controller controls packet transmission and reception over the anomalous connection.

Connection control apparatus, connection control method, and connection control program

A log information collecting unit that collects log information and traffic information output from a plurality of communication devices included in a network; a normalization processing unit that normalizes the log information and traffic information collected by the log information collecting unit; a log information analysis processing unit that extracts, and analyzes according to a predetermined rule, relative log information and traffic information from the normalized log information and traffic information, and determines whether or not there is unauthorized access; and an event information notifying unit that outputs event information including information indicating importance based on a result of the determination by the log information analysis processing unit, are included.

Growing community of inventors

Musashino, Japan

Hiroshi Kurakami