Patent ID: 9645759
Date: 2017-05-09
CPC Classifications: G06F

Claim:
1. A method for monitoring communication, the method comprising: an acquisition process of acquiring a communication packet transmitted according to a protocol employing block access, from a communication network; a determination process of determining whether the acquired communication packet is related to one of a system attribution block, a file attribution block, and a file name block, the system attribution block storing file system attribution data representing an attribution of a file system, the file attribution block storing plural pieces of file attribution data representing an attribution of a file, the file name block storing plural pieces of file name data representing a file; a first calculation process of calculating a block number of the file attribution block, based on a first address assigned to the system attribution block and a second address assigned to the file attribution block, when the acquired communication packet is determined to be related to the file attribution block; a second calculation process of calculating a respective identification number of respective plural pieces of the file attribution data, based on the system attribution data and the calculated block number; a first association process of respectively associating the respective plural pieces of file attribution data stored in the file attribution block with the plural pieces of file name data stored in the file name block, based on the respective calculated identification numbers and respective identification numbers assigned to the plural pieces of file name data; and a second association process of associating the file name data with a command file, based on first time stamps of the plural pieces of file name data associated with the plural pieces of file attribution data, and second time stamps of the command file that has caused the file name data to flow into the communication network.