Patent ID: 8347383
Filing Date: 2013-01-01
Classification: H04L,H04M

Abstract:
1. A network monitoring apparatus, connected to a network to which a plurality of devices are connected, for detecting an abnormal traffic that attacks a network system, the network system being configured so that the network and a plurality of other networks configured in the same manner as the network are interconnected, the network monitoring apparatus comprising: a network-information storage unit that stores therein network information for identifying a plurality of networks making up the network system, the network information being associated with the respective networks; an administrator-information storage unit that stores therein administrator information on administrators who manage the respective networks stored in the network-information storage unit, the administrator information being associated with the respective networks; an attack-source-network identifying unit that monitors traffics flowing through the network, the attack-source-network identifying unit identifying, when an abnormal traffic is detected, an attack source network which is outside the network and which is a source of an attack, from the network information stored in the network-information storage unit on the basis of attack source information indicating a source device from which the abnormal traffic is transmitted and which is specified by an analysis of the abnormal traffic; an attack-destination-network identifying unit that identifies, when the abnormal traffic is detected, an attack destination network which is outside the network and which is a destination of the attack, from the network information stored in the network-information storage unit on the basis of attack destination information indicating a destination device to which the abnormal traffic is to be transmitted and which is specified by the analysis of the abnormal traffic; and an attack notifying unit that acquires, from the administrator-information storage unit, administrator information corresponding to the attack source network identified by the attack-source-network identifying unit, and notifies the attack source information with use of the acquired administrator information, the attack notifying unit acquiring, from the administrator-information storage unit, administrator information corresponding to the attack destination network identified by the attack-destination-network identifying unit, and notifying the attack destination information with use of the acquired administrator information.