Patent ID: 12192219

DESCRIPTION OF THE EXAMPLE EMBODIMENTS

Hereinafter, example embodiments of the present invention will be described in detail with reference to the accompanying drawings. Note that, in the Specification and drawings, elements to which similar descriptions are applicable are denoted by the same reference signs, and overlapping descriptions may hence be omitted.

Descriptions will be given in the following order.1. Overview of Example Embodiments of the Present Invention2. First Example Embodiment2.1. Configuration of Data Aggregation Apparatus1002.2. Operation Example3. Second Example Embodiment3.1. Configuration of Data Aggregation Apparatus2003.2. Operation Example4. Third Example Embodiment4.1. Configuration of Data Aggregation Apparatus5004.2. Operation Example5. Other Example Embodiments

1. Overview of Example Embodiments of the Present Invention

First, an overview of example embodiments of the present invention will be described.

(1) Technical Issues

A major part of communication data received and recorded via a communication network includes no harmful data such as malware and virus. However, there is a possibility that suspicious activities are included in such communication data that seem to be harmless.

Although it is possible to observe such malicious communication corresponding to suspicious activities, it is not possible to predict which part is to be a target of such communication in advance. This is because what is connected to a communication network such as the Internet is expected to receive malicious communication at any timing.

By analyzing in detail (microscopically) data in packets included in communication data, it is possible to judge whether the communication relates to an attack. Performing such “micro analysis” on all packets requires an enormous amount of time and is hence not realistic.

For example, by performing data aggregation of communication data, based on a predetermined aggregation policy, it is possible to narrow down a range to which micro analysis is applied. However, it is not clear, in a case where there exist a plurality of data aggregation methods described above, which data aggregation method is appropriate for finding suspicious activities. In particular, since an aggregation result is different for each data aggregation method, it is difficult to grasp the characteristics of individual data aggregation methods.

In view of these, an example object of the present example embodiments is to perform data aggregation using an appropriate data aggregation method among a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from communication data.

(2) Technical Features

In example embodiments of the present invention, communication data is obtained via a communication network, one or more first data aggregation methods based on user operation are selected from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis, data aggregation of the communication data is performed based on the one or more first data aggregation methods, and an aggregated value related to the data aggregation is displayed on a screen.

With this, it is possible, for example, to perform data aggregation using an appropriate data aggregation method among a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from communication data. Note that the above-described technical features are concrete examples of the example embodiments of the present invention, and the example embodiments of the present invention are, of course, not limited to the above-described technical features.

2. First Example Embodiment

A description will be given of a first example embodiment to which the present invention is applied, with reference toFIGS.1to10.

2.1. Configuration of Data Aggregation Apparatus100

FIG.1is a block diagram illustrating an example of a hardware configuration of a data aggregation apparatus100according to the first example embodiment. With reference toFIG.1, the data aggregation apparatus100includes a communication interface21, an operation input unit22, an arithmetic processing unit23, a main memory24, a storage unit25, and a display apparatus26.

The communication interface21transmits and/or receives data to and/or from an external apparatus. For example, the communication interface21communicates with the external apparatus via a wired communication path.

The operation input unit22is an input interface that performs input processing for an operation request from a user operating the data aggregation apparatus100.

The arithmetic processing unit23is, for example, a central processing unit (CPU), a graphics processing unit (GPU), or the like. The main memory24is, for example, a random access memory (RAM), a read only memory (ROM), or the like. The storage unit25is, for example, a hard disk drive (HDD), a solid state drive (SSD), a memory card, or the like. The storage unit25may be a memory such as a RAM or a ROM.

The display apparatus26is an apparatus, such as a liquid crystal display (LCD), a cathode ray tube (CRT) display, or a monitor, that displays a screen corresponding to drawing data subject to processing by the arithmetic processing unit23.

The data aggregation apparatus100, for example, reads out programs for data aggregation processing stored in the storage unit25, to the main memory24, and executes the programs by the arithmetic processing unit23, to thereby implement the functional units as those illustrated inFIG.2. The data aggregation apparatus100may first read out programs to the main memory24for execution or may execute the programs without reading out the programs to the main memory24. The main memory24and the storage unit25also play roles in storing information and data held by the constituent elements included in the data aggregation apparatus100.

The above-described programs can be stored by using various types of non-transitory computer readable media to be provided to a computer. The non-transitory computer readable media include various types of tangible recording media (tangible storage media). Examples of the non-transitory computer readable media include magnetic recording medium (for example, a flexible disk, a magnetic tape, and a hard disk drive), a magneto-optical recording medium (for example, a magneto-optical disk), a compact disc-ROM (CD-ROM), a CD-recordable (CD-R), a CD-rewritable (CD-R/W), a semiconductor memory (for example, a mask ROM and a programmable ROM (PROM)), an erasable PROM (EPROM), and a flash ROM and RAM. The programs may be provided to a computer by various types of transitory computer readable media. Examples of the transitory computer readable media include an electric signal, an optical signal, and an electromagnetic wage. The transitory computer readable media can provide the programs to a computer through wired communication paths, such as electric wires and optical fibers, or wireless channels.

FIG.2is a block diagram illustrating an example of a functional configuration implemented by the data aggregation apparatus100.

With reference toFIG.2, the data aggregation apparatus100includes an obtaining unit101, a selecting unit103, a data aggregation method table105, an aggregating unit107, a display processing unit109, a range narrowing-down unit111, and an in-packet analysis unit113. Concrete operation and processing of each of these function units will be described later.

2.2. Operation Example

Next, an operation example of the first example embodiment will be described.

According to the first example embodiment, the data aggregation apparatus100(the obtaining unit101) obtains communication data via a communication network. The data aggregation apparatus100(the selecting unit103) selects one or more first data aggregation methods based on user operation from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data. The data aggregation apparatus100(the aggregating unit107) performs data aggregation of the communication data, based on the one or more first data aggregation methods. The data aggregation apparatus100(the display processing unit109) displays, on a screen (the display apparatus26), an aggregated value related to the data aggregation.

(1) Communication Data

FIG.3is a diagram illustrating a concrete example of communication data300obtained by the obtaining unit101. With reference toFIG.3, in a case that the communication data300is received from a communication network (e.g., the Internet or a local network), for example, the obtaining unit101obtains, as detailed information related to the communication data300, information such as a reception time point301, a transmission source IP address303, a destination IP address305, a protocol307, a transmission source port number309, a destination port number311, and a packet size313.

(2) Data Aggregation Method

For example, the selecting unit103selects one or more first data aggregation methods based on user operation with reference to a plurality of data aggregation methods managed in the data aggregation method table105.

FIG.4is a diagram illustrating a concrete example of the plurality of data aggregation methods managed in the data aggregation method table105.

With reference toFIG.4, the data aggregation method table105manages, while associating with each other, an ID401identifying a data aggregation method, an aggregation name403, an aggregation method name405, a description of aggregation processing407, and a coordinate transformation method for transformation from a screen coordinate system to an aggregated value coordinate system409.

For example, the data aggregation method identified by ID “1” is a method for aggregating transition of the number of packets per minute, and displays, as an aggregation result, an image with the vertical axis indicating the number of packets and the horizontal axis indicating time, for example. In the data aggregation method identified by ID “1”, screen coordinates are transformed into aggregated value coordinates by using a coordinate transformation matrix represented by an expression as that presented below.

(max⁡(T)-min⁡(T)00max⁡(Cp))[Math.1]

Here, max(T) denotes the last communication time point of communication data, min(T) denotes the first communication time point of the communication data, and max(Cp) denotes the upper limit of the number of packets possible for an aggregated value.

For example, the data aggregation method identified by ID “2” is a method for aggregating transition of transmission sources per minute, and displays, as an aggregation result, an image with the vertical axis indicating the number of transmission source IP addresses and the horizontal axis indicating time, for example. In the data aggregation method identified by ID “2”, screen coordinates are transformed into aggregated value coordinates by using a coordinate transformation matrix represented by an expression as that presented below.

(max⁡(T)-min⁡(T)00max⁡(Cs))[Math.2]

Here, max(T) denotes the last communication time point of communication data, min(T) denotes the first communication time point of the communication data, and max(Cs) denotes the upper limit of the number of transmission source IP addresses possible for an aggregated value.

For example, the data aggregation method identified by ID “3” is a method for aggregating destination port numbers having the 10 largest numbers of packets, and displays, as an aggregation result, a table including ranking, destination port number, and the number of packets, for example. In the data aggregation method identified by ID “3”, the port number corresponding to the ranking selected based on user operation is displayed.

For example, the data aggregation method identified by ID “4” is a method for aggregating destination port numbers having the 10 smallest numbers of packets, and displays, as an aggregation result, a table including ranking, destination port number, and the number of packets, for example. In the data aggregation method identified by ID “4”, the port number corresponding to the ranking selected based on user operation is displayed.

Concrete Example

Next, a description will be given of a concrete example of a result of aggregation according to the data aggregation method identified by ID “1” among the data aggregation methods illustrated inFIG.4.

FIG.5is a diagram illustrating an example of an aggregation result50obtained by aggregating, by minutes, transition of the number of packets included in communication data. With reference toFIG.5, the aggregation result50is constituted of a column51indicating time points by minutes and a column53indicating the numbers of packets, for example.

To display, on a screen, a graph corresponding to the aggregation result50, the display processing unit109uses a coordinate transformation matrix as that presented below, to transform screen coordinates representing the upper left corner with the origin (0, 0) and the lower right corner with (1.0, 1.0) into graph coordinates.

With reference toFIG.4, the coordinate transformation matrix is given by the following expression.

(max⁡(T)-min⁡(T)00max⁡(Cp))[Math.3]

Here, with reference toFIGS.5and6, a time point 10:10 is input to max(T), a time point 10:05 is input to min(T), and 45,000 is input to max(Cp) as the upper limit of the number of packets possible for a line graph600.

In this way, for example, graph coordinates (aggregated value coordinates) corresponding to (0.5, 0.5), which is the median of the screen coordinates, are transformed to (2.5, 25000) according to the following equation.

(0.50.5)⁢(50045,TagBox[",", "NumberComma", Rule[SyntaxForm, "0"]]000)=(2.522,TagBox[",", "NumberComma", Rule[SyntaxForm, "0"]]500)[Math.4]

The display processing unit109uses a coordinate transformation function associated with the data aggregation method, to transform the screen coordinates to the graph coordinates (coordinates of an aggregated value related to data aggregation). The display processing unit109then maps each of the aggregated values of the aggregation result50into a graph coordinate system to thereby be able to create a line graph with the vertical axis indicating the number of packets and the horizontal axis indicating time.FIG.6is a diagram illustrating an example of the line graph600corresponding to the aggregation result50illustrated inFIG.5.

For example, in a case that a center point615of the screen610as illustrated inFIG.6by user operation, the display processing unit109performs processing for displaying, on a screen610, an image620indicating graph coordinates (10:07:30, 22500), for example. By the image620described above being displayed on the screen610, a user can easily select, while recognizing an aggregation result, a range (aggregated value range) to narrow down candidate data for in-packet analysis from the communication data.

(3) Concrete Flow of Processing

Next, a concrete flow of processing according to the first example embodiment will be described with reference toFIG.7and the like.FIG.7is a flowchart for describing the concrete flow of the processing according to the first example embodiment.

In step S701, the obtaining unit101obtains communication data according to user operation performed by following an operation screen800illustrated inFIG.8, for example.FIG.8is a diagram illustrating a concrete example of the operation screen800for receiving user operation. For example, when storage place information of communication data stored in the storage unit25is input to an image region801according to user operation, the obtaining unit101accesses the storage unit25to thereby obtain the communication data.

In step S703, the display processing unit109displays, for example, on the operation screen800, a method list image803managed in the data aggregation method table105.

In step S705, the aggregating unit107performs data aggregation, based on the data aggregation method selected by the user operation. For example, when a data aggregation method is selected from the method list image803and operation is performed on a confirmation key805, according to the operation screen800illustrated inFIG.8, the aggregating unit107performs data aggregation, based on the selected data aggregation method.

In step S707, the display processing unit109displays information related to an aggregation result obtained by the data aggregation method, as illustrated inFIG.6described above, for example.

According to the processing illustrated inFIG.7described above, for example, an aggregation result based on the first data aggregation method selected according to the user operation is displayed. With this, the user can, while checking the aggregation result, examine to what range to narrow down data, and consider whether or not to perform detailed analysis, i.e., in-packet analysis, on the data thus narrowed down.

(4) Switching Display of Plurality of Aggregation Results

For example, the selecting unit103may select two or more data aggregation methods as the first data aggregation method according to user operation. In this case, for example, the display processing unit109may perform switching display of the aggregated values related to two or more cases of data aggregation based on the two or more data aggregation methods, to display the aggregated value for each of the data aggregation methods in a switching manner.

FIG.9is a diagram illustrating an image example for performing the switching display for each data aggregation method. For example, in an aggregation image900for switching display illustrated inFIG.9, any one of three tabs901,903, and905in an upper part of the screen is selected by user operation, and an aggregated value related to the selected data aggregation method is displayed in a display region910.

(5) Operation of Narrowing Down Aggregation Result

The display processing unit109may display a screen for encouraging user operation of narrowing down aggregated values related to data aggregation, to an aggregated value range including candidate data for in-packet analysis. For example,FIG.10is a diagram illustrating a display example of a screen1000for encouraging user operation of narrowing down an aggregated value range. With reference toFIG.10, for example, when user operation indicates a median1010or therearound in an aggregated value coordinate system, the display processing unit109displays an operation image1020encouraging narrowing down of data to data included in the aggregated value range of communication performed from a time point 10:07:00 to a time point 10:07:59:00 related to the median1010, as candidate data for in-packet analysis.

Subsequently, when user operation according to the above-described operation image1020is performed, the range narrowing-down unit111narrows down communication data to communication data communicated from a time point 10:07:00 to a time point 10:07:59:00, for example. The in-packet analysis unit113then performs in-packet analysis on the packets in the range obtained by narrowing down by the range narrowing-down unit111.

In this way, the data aggregation apparatus100can appropriately narrow down an enormous amount of communication data to communication data on which in-packet analysis is performed, which enables efficient in-packet analysis without imposing excessive processing load on the apparatus.

3. Second Example Embodiment

A description will be given of a second example embodiment to which the present invention is applied, with reference toFIGS.11to14.

3.1. Configuration of Data Aggregation Apparatus200

FIG.11is a block diagram illustrating an example of a hardware configuration of a data aggregation apparatus200according to the second example embodiment. With reference toFIG.11, the data aggregation apparatus200, as the data aggregation apparatus100according to the first example embodiment described above, for example, includes the communication interface21, the operation input unit22, the arithmetic processing unit23, the main memory24, the storage unit25, and the display apparatus26. The constituent elements illustrated inFIG.11, which are similar to those of the hardware configuration of the data aggregation apparatus100illustrated inFIG.1described above, are denoted by similar reference signs to those of the data aggregation apparatus100, and hence have descriptions being omitted.

FIG.12is a block diagram illustrating an example of a functional configuration implemented by the data aggregation apparatus200.

With reference toFIG.12, the data aggregation apparatus200, as the data aggregation apparatus100according to the first example embodiment described above, includes the obtaining unit101, the selecting unit103, the data aggregation method table105, the aggregating unit107, the display processing unit109, the range narrowing-down unit111, and the in-packet analysis unit113. The data aggregation apparatus200further includes a narrowing-down operation number managing unit115and a determining unit117. Concrete operation and processing of each of these function units will be described later.

3.2. Operation Example

Next, an operation example of the second example embodiment will be described.

According to the second example embodiment, the data aggregation apparatus200(the narrowing-down operation number managing unit115) manages the number of operations of narrowing down candidate data for in-packet analysis based on data aggregation in each of a plurality of data aggregation methods. The data aggregation apparatus200(the determining unit117) determines one or more second data aggregation methods based on the number of operations of narrowing down candidate data for in-packet analysis, from among the plurality of data aggregation methods. The data aggregation apparatus200(the aggregating unit107) performs data aggregation of communication data, based on the one or more second data aggregation methods. An aggregated value related to data aggregation is displayed on the screen (the display apparatus26) by the display processing unit109, for example.

(1) Management of Number of Narrowing-Down Operations

FIG.13is a diagram illustrating a concrete example of a narrowing-down operation number management table1300obtained by management by the narrowing-down operation number managing unit115. With reference toFIG.13, the narrowing-down operation number management table1300manages a management number1301managing the type of data aggregation method, detailed information of the data aggregation method1303, and the number of narrowing-down operations1305of narrowing down candidate data for in-packet analysis based on data aggregation in the data aggregation method, in association with each other.

For example, assume a case where, in the data aggregation apparatus200, the data aggregation method of “transition of the number of packets per minute” is selected by user operation, narrowing down is performed on an aggregated value related to data aggregation based on the data aggregation method by user operation, to narrow down an aggregated value range, and in-packet analysis is performed on the aggregated value range. In this case, in the example of the narrowing-down operation number management table1300illustrated inFIG.13, the number of narrowing-down operations1305is updated from 24 to 25.

In this way, the narrowing-down operation number managing unit115can learn a data aggregation method appropriate for data aggregation, based on user operation.

FIG.14is a flowchart illustrating a flow of learning processing for data included in the narrowing-down operation number management table1300.

With reference toFIG.14, in step S1401, the narrowing-down operation number managing unit115configures a management number1301to each data aggregation method to be managed.

In step S1403, the narrowing-down operation number managing unit115receives a result of selection of a first data aggregation method selected by the selecting unit103.

In step S1405, the narrowing-down operation number managing unit115receives, from the in-packet analysis unit113, the number of operations of narrowing down candidate data for in-packet analysis based on data aggregation in the first data aggregation method selected in step S1403.

In step S1407, the narrowing-down operation number managing unit115updates the narrowing-down operation number management table1300, based on the result of the selection of the first data aggregation method and the number of operations of narrowing down candidate data for in-packet analysis, and terminates the processing illustrated inFIG.14.

(User-Based Management)

The narrowing-down operation number managing unit115may manage, for each of two or more users, the number of operations of narrowing down candidate data for in-packet analysis based on each of the plurality of data aggregation methods. This is because a method to be selected, the number of narrowing-down operations, and the like vary for each user.

(Data Size-Based Management)

The narrowing-down operation number managing unit115may manage, for each data size of communication data, the number of operations of narrowing down candidate data for in-packet analysis based on each of the plurality of data aggregation methods. This is because a method to be selected by a user, the number of narrowing-down operations, and the like vary depending on data size.

(Data Characteristics-Based Management)

The narrowing-down operation number managing unit115may manage, for each type of data characteristics of communication data, the number of operations of narrowing down candidate data for in-packet analysis based on each of the plurality of data aggregation methods. This is because a method to be selected by a user, the number of narrowing-down operations, and the like vary depending on data characteristics, for example, the communication data is data obtained from the Internet, data obtained from a local area network, or the like.

(2) Determination of Second Data Aggregation Method Based on Number of Narrowing-Down Operations

The determining unit117uses a learning result illustrated inFIG.14described above, to automatically determine an appropriate data aggregation method without being based on user operation. Concretely, the determining unit117selects, as the second data aggregation method, the data aggregation method having the largest number of operations of narrowing down candidate data for in-packet analysis, from among the plurality of data aggregation methods. Note that the determining unit117may select, as second data aggregation methods, the data aggregation methods having the largest to third largest numbers of narrowing-down operations, for example, without being limited to the data aggregation method having the largest number of operations of narrowing down candidate data for in-packet analysis.

In a case where the narrowing-down operation number managing unit115manages, for each user, the number of operations of narrowing down candidate data for in-packet analysis as described above, the determining unit117may determine, for each user, one or more second data aggregation methods, based on the number of operations of narrowing down candidate data for in-packet analysis, from among the plurality of data aggregation methods.

In a case where the narrowing-down operation number managing unit115manages, for each data size of communication data, the number of operations of narrowing down candidate data for in-packet analysis as described above, the determining unit117may determine, for each data size of communication data, one or more second data aggregation methods, based on the number of operations of narrowing down candidate data for in-packet analysis, from among the plurality of data aggregation methods.

In a case where the narrowing-down operation number managing unit115manages, for each type of data characteristics of communication data, the number of operations of narrowing down candidate data for in-packet analysis as described above, the determining unit117may determine, for each type of data characteristics of communication data, one or more second data aggregation methods, based on the number of operations of narrowing down candidate data for in-packet analysis, from among the plurality of data aggregation methods.

(3) Summary

As described above, according to the second example embodiment, by using a learning result obtained by user operation as that illustrated inFIG.14described above, an appropriate data aggregation method(s) is determined automatically without being based on user operation.

Note that restriction may be imposed on the determination of a data aggregation method by the determining unit117, for example, the determination is performed only when the total number of narrowing-down operations managed in the narrowing-down operation number management table1300reaches a predetermined value or greater.

4. Third Example Embodiment

Next, a description will be given of a third example embodiment of the present invention with reference toFIG.15. The above-described first and second example embodiments are concrete example embodiments, whereas the third example embodiment is a more generalized example embodiment.

4.1. Configuration of Data Aggregation Apparatus500

FIG.15is a block diagram illustrating an example of a schematic configuration of a data aggregation apparatus500according to the third example embodiment. With reference toFIG.15, the data aggregation apparatus500includes an obtaining unit510, a selecting unit520, an aggregating unit530, and a display processing unit540.

The obtaining unit510, the selecting unit520, the aggregating unit530, and the display processing unit540may be implemented with one or more processors, a memory (for example, a nonvolatile memory and/or a volatile memory), and/or a hard disk. The obtaining unit510, the selecting unit520, the aggregating unit530, and the display processing unit540may be implemented with the same processor or may be implemented with separate processors. The memory may be included in the one or more processors or may be provided outside the one or more processors.

4.2. Operation Example

An operation example according to the third example embodiment will be described.

According to the third example embodiment, the data aggregation apparatus500(the obtaining unit510) obtains communication data via a communication network. The data aggregation apparatus500(the selecting unit520) selects one or more first data aggregation methods based on user operation from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data. The data aggregation apparatus500(the aggregating unit530) performs data aggregation of the communication data, based on the one or more first data aggregation methods. The data aggregation apparatus500(the display processing unit540) displays, on a screen, an aggregated value related to the data aggregation.

Relationship with First Example Embodiment

As an example, the obtaining unit510, the selecting unit520, the aggregating unit530, and the display processing unit540of the third example embodiment may perform respective operations of the obtaining unit101, the selecting unit103, the aggregating unit107, and the display processing unit109of the first and second example embodiments. In this case, the descriptions of the first and second example embodiments may also be applicable to the third example embodiment.

Note that the third example embodiment is not limited to this example.

The third example embodiment has been described above. According to the third example embodiment, it is possible, for example, to perform data aggregation using an appropriate data aggregation method among a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from communication data.

5. Other Example Embodiments

Descriptions have been given above of the example embodiments of the present invention. However, the present invention is not limited to these example embodiments. It should be understood by those of ordinary skill in the art that these example embodiments are merely examples and that various alterations are possible without departing from the scope and the spirit of the present invention.

For example, the steps in the processing described in the Specification may not necessarily be executed in time series in the order described in the corresponding sequence diagram. For example, the steps in the processing may be executed in an order different from that described in the corresponding sequence diagram or may be executed in parallel. Some of the steps in the processing may be deleted, or more steps may be added to the processing.

An apparatus including constituent elements (e.g., the obtaining unit, the selecting unit, the aggregating unit, and/or the display processing unit) of the data aggregation apparatus described in the Specification (e.g., one or more apparatuses (or units) among a plurality of apparatuses (or units) constituting the data aggregation apparatus or a module for one of the plurality of apparatuses (or units)) may be provided. Moreover, methods including processing of the constituent elements may be provided, and programs for causing a processor to execute processing of the constituent elements may be provided. Moreover, non-transitory computer readable recording media (non-transitory computer readable media) having recorded thereon the programs may be provided. It is apparent that such apparatuses, modules, methods, programs, and non-transitory computer readable recording media are also included in the present invention.

The whole or part of the example embodiments disclosed above can be described as, but not limited to, the following supplementary notes.

(Supplementary Note 1)

A data aggregation apparatus comprising:an obtaining unit configured to obtain communication data via a communication network;a selecting unit configured to select one or more first data aggregation methods based on user operation, from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data;an aggregating unit configured to perform data aggregation of the communication data, based on the one or more first data aggregation methods; anda display processing unit configured to display, on a screen, an aggregated value related to the data aggregation.
(Supplementary Note 2)

The data aggregation apparatus according to supplementary note 1, wherein the display processing unit is configured to use a coordinate transformation function associated with the one or more first data aggregation methods, to transform coordinates on a screen to coordinates of the aggregated value related to the data aggregation.

(Supplementary Note 3)

The data aggregation apparatus according to supplementary note 1 or 2, whereinthe one or more first data aggregation methods are two or more first data aggregation methods, andthe display processing unit is configured to perform switching display of aggregated values related to two or more cases of data aggregation based on the two or more first data aggregation methods, to display the aggregated value for each of the first data aggregation methods in a switching manner.
(Supplementary Note 4)

The data aggregation apparatus according to any one of supplementary notes 1 to 3, wherein the display processing unit is configured to display a screen for encouraging user operation of narrowing down the aggregated value related to data aggregation, to an aggregated value range including candidate data for in-packet analysis.

(Supplementary Note 5)

The data aggregation apparatus according to any one of supplementary notes 1 to 4, further comprisingan in-packet analysis unit configured to perform in-packet analysis on candidate data for in-packet analysis included in an aggregated value range obtained by narrowing down based on the user operation, of the aggregated value related to the data aggregation.
(Supplementary Note 6)

The data aggregation apparatus according to supplementary note 5, further comprising;a narrowing-down operation number managing unit configured to manage the number of narrowing-down operations of narrowing down candidate data for in-packet analysis based on data aggregation in each of the plurality of data aggregation methods; anda determining unit configured to determine one or more second data aggregation methods, based on the number of narrowing-down operations, from among the plurality of data aggregation methods, whereinthe aggregating unit is configured to perform data aggregation of communication data, based on the one or more second data aggregation methods thus determined.
(Supplementary Note 7)

The data aggregation apparatus according to supplementary note 6, wherein the determining unit is configured to select, as the second data aggregation method, a data aggregation method having the largest number of narrowing-down operations, from among the plurality of data aggregation methods.

(Supplementary Note 8)

The data aggregation apparatus according to supplementary note 6 or 7, whereinthe narrowing-down operation number managing unit is configured to manage, for each of two or more users, the number of narrowing-down operations of narrowing down candidate data for in-packet analysis based on data aggregation in each of the plurality of data aggregation methods, andthe determining unit is configured to determine, for each user, one or more second data aggregation methods, based on the number of narrowing-down operations, from among the plurality of data aggregation methods.
(Supplementary Note 9)

The data aggregation apparatus according to supplementary note 6 or 7, whereinthe narrowing-down operation number managing unit is configured to manage, for each data size of the communication data, the number of narrowing-down operations of narrowing down candidate data for in-packet analysis based on data aggregation in each of the plurality of data aggregation methods, andthe determining unit is configured to determine, for each data size, one or more second data aggregation methods, based on the number of narrowing-down operations, from among the plurality of data aggregation methods.
(Supplementary Note 10)

The data aggregation apparatus according to supplementary note 6 or 7, whereinthe narrowing-down operation number managing unit is configured to manage, for each type of data characteristics of the communication data, the number of narrowing-down operations of narrowing down candidate data for in-packet analysis based on data aggregation in each of the plurality of data aggregation methods, andthe determining unit is configured to determine, for each type of data characteristics, one or more second data aggregation methods, based on the number of narrowing-down operations, from among the plurality of data aggregation methods.
(Supplementary Note 11)

A data aggregation method comprising:obtaining communication data via a communication network;selecting one or more first data aggregation methods based on user operation, from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data;performing data aggregation of the communication data, based on the one or more first data aggregation methods; anddisplaying, on a screen, an aggregated value related to the data aggregation.
(Supplementary Note 12)

A program for causing a processor to perform processing comprising:obtaining communication data via a communication network;selecting one or more first data aggregation methods based on user operation, from a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from the communication data;performing data aggregation of the communication data, based on the one or more first data aggregation methods; anddisplaying, on a screen, an aggregated value related to the data aggregation.

This application claims priority based on JP 2019-199697 filed on Nov. 1, 2019, the entire disclosure of which is incorporated herein.

INDUSTRIAL APPLICABILITY

It is possible to perform data aggregation using an appropriate data aggregation method among a plurality of data aggregation methods used to narrow down candidate data for in-packet analysis from communication data.

REFERENCE SIGNS LIST

100,200,500Data Aggregation Apparatus101,510Obtaining Unit103,520Selecting Unit105Data Aggregation Method Table107,530Aggregating Unit109,540Display Processing Unit111Range Narrowing-down Unit113In-packet Analysis Unit115Narrowing-down Operation Number Managing Unit117Determining Unit