Patent ID: 8345575

Claim:
A traffic analysis apparatus, for analyzing traffic consisting of packets that flow via a network, comprising: a packet transmitter/receiver that transmits and receives packets that flow via the network, each of the packets having a plurality of items; a packet aggregating unit that counts the number of packets having predetermined values in respective items of a first item group, the first item group being selected from said plurality of items; a variety aggregating unit that counts the number of different values in at least one item selected from said plurality of items, but not included in the first item group; an analysis information storage unit that stores results obtained by analyzing the packets, the results including: an item set value that identifies a flow type; a total value of packets aggregated by the packet aggregating unit; and the number of different values counted by the variety aggregating unit; and a packet estimation unit that, when a total number of the packets counted by said packet aggregating unit exceeds a threshold value, estimates characteristics for an item set, the item set including a specific combination of packets, wherein said packet estimation unit estimates the characteristics for the item set based on the number of packets, the values of said respective items included in the first item group, and the number of different values counted by the variety aggregating unit, wherein said respective items include a transmission source address, and wherein said packet estimation unit determines the flow type based on the item set value for which the total number of the packets counted by said packet aggregating unit exceeds the threshold value, wherein said packet estimation unit determines that the flow type is a P2P (peer-to-peer) file exchange flow when the number of packets having the same value for the item of said transmission source address exceeds a predetermined threshold value, and when the ratio of the number of different values counted by said variety aggregating unit for items of a destination IP (Internet Protocol) address, a transmission source port number, and a destination port number, which are not included in said first item group, matches a predetermined ratio.