Patent ID: 8775613
Filing Date: 2014-07-08
Classification: H04L

Abstract:
1. A network monitoring system, the system comprising: a traffic information generating apparatus stored in a memory and executed by a processor for generating traffic information; a security event collecting apparatus stored in the memory and executed by the processor for collecting the traffic information generated by the traffic information generating apparatus by referring to pre-stored traffic information, grouping the collected traffic information, and then extracting service information; and a service abnormal condition detecting apparatus stored in the memory and executed by the processor for detecting a port number of a transport layer of service information extracted from the security event collecting apparatus and the occurrence frequency of the transport layer, determining the continuity of the port number and the uniformity of the occurrence frequency, and displaying a service abnormal condition, wherein, an abnormal condition detection and display unit stored in the memory and executed by the processor displays the source port and the destination port as dot coordinates in a two-dimensional coordinate system, wherein the two-dimensional coordinate system comprises an X-axis defined as the port number, and a Y-axis defined as an occurrence frequency (number of sessions).