US 11,729,103 B2
Estimation method, estimation device, and estimation program
Hiroshi Suzuki, Tokyo (JP); Yuhei Hayashi, Tokyo (JP); Yuki Miyoshi, Tokyo (JP); Takeaki Nishioka, Tokyo (JP); Hiroshi Osawa, Tokyo (JP); and Ichiro Kudo, Tokyo (JP)
Assigned to NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Tokyo (JP)
Appl. No. 17/270,345
Filed by NIPPON TELEGRAPH AND TELEPHONE CORPORATION, Tokyo (JP)
PCT Filed Aug. 16, 2019, PCT No. PCT/JP2019/032172
§ 371(c)(1), (2) Date Feb. 22, 2021,
PCT Pub. No. WO2020/040060, PCT Pub. Date Feb. 27, 2020.
Claims priority of application No. 2018-157459 (JP), filed on Aug. 24, 2018.
Prior Publication US 2021/0328932 A1, Oct. 21, 2021
Int. Cl. H04L 47/20 (2022.01); H04L 41/0213 (2022.01); H04L 43/0894 (2022.01); H04L 47/22 (2022.01); H04L 9/40 (2022.01)
CPC H04L 47/20 (2013.01) [H04L 41/0213 (2013.01); H04L 43/0894 (2013.01); H04L 47/225 (2013.01); H04L 63/1408 (2013.01)] 20 Claims
OG exemplary drawing
 
1. An estimation method for controlling a bandwidth of a data flow performed by an estimation apparatus, the estimation method comprising:
acquiring first information about an aggregated band associated with a plurality of flows of data within a tunnel before shaping, wherein the tunnel allows transmission of the plurality of flows of data in packets between routers within the tunnel;
generating, based on a combination including copying and shaping the plurality of flows of data within the tunnel, a plurality of shaped flows of data;
acquiring, based on the plurality of shaped flows of data, second information about an aggregated band associated with the plurality of shaped flows of data;
acquiring, a traffic volume associated with a shaped flow of the plurality of shaped flows of data;
calculating a ratio between a first aggregated traffic volume based on the first information associated with the aggregated band of the plurality of flows of data within the tunnel and a second aggregated traffic volume based on the second information associated with the aggregated band of the plurality of shaped flows;
estimating, based on a combination including the ratio and the traffic volume associated with the shaped flow of the plurality of shaped flows of data, a traffic volume of a flow of the plurality of flows of data within the tunnel; and
determining, based at least on the estimated traffic volume of the flow of the plurality of flows of data within the tunnel and a predetermined threshold, data representing an attack in a data traffic associated with the flow of the plurality of flows of data within the tunnel.