| CPC H04L 43/0876 (2013.01) [H04L 43/026 (2013.01); H04L 43/022 (2013.01)] | 18 Claims |

|
1. A traffic monitoring device, the device comprising:
one or more processors; and
a storage device storing a program to be executed by the one or more processors, the program including instructions for:
identifying a flow of each packet of a plurality of packets received from a monitoring target network as a first flow of a first flow group or a second flow of a second flow group different from the first flow group based on a rule table in which a predetermined rule is registered;
aggregating a traffic amount of each of the first flows of the first flow group;
calculating an occurrence probability of each flow based on a result of sampling the flows of the plurality of packets; and
estimating the traffic amount of each of the second flows of the second flow group by multiplying a total value of the traffic amount of the second flow group by the occurrence probability of each of the second flows of the second flow group.
|