Information processing apparatus and abnormality diagnosis method

1. A non-transitory computer-readable recording medium having stored therein a program that causes a computer to execute a process, the process comprising:

acquiring message data that indicate a message size and a response time of each response message identified from an encrypted packet group which is transmitted and received within a predetermined period;

identifying, based on the acquired message data, first peak sizes that satisfy a first condition from a first size distribution that is a frequency distribution of the message size of each response message;

determining based on the acquired message data, when it is determined that the first peak sizes include a second peak size different from third peak sizes, whether a first time distribution satisfies a second condition, the third peak sizes being peak sizes of the message size of each response message in a normal state and being stored in advance, the first time distribution being a frequency distribution of the response time of each response message having the second peak size; and

determining that a service is abnormal, when it is determined that the first time distribution satisfies the second condition.

2. The non-transitory computer-readable recording medium according to claim 1 , the process further comprising:

comparing the first time distribution with a second time distribution stored in advance, the second time distribution being a frequency distribution of the response time of each response message in the normal state; and

determining that the second condition is satisfied, when it is determined that there is a fluctuation in response time based on a result of the comparison.

3. The non-transitory computer-readable recording medium according to claim 1 , the process further comprising:

calculating based on the message data, for each of classes divided by a predetermined size width, a frequency of response messages having a message size that belongs to each of the classes; and

identifying, based on a result of the calculation, message sizes each corresponding to a class that is different in frequency of response messages from an adjacent class by a predetermined threshold value or more, as the first peak sizes.

4. The non-transitory computer-readable recording medium according to claim 1 , the process further comprising:

identifying the first peak sizes based on message data that indicate a message size and a response time of each response message having a message size equal to or less than a predetermined size among the acquired message data.

5. The non-transitory computer-readable recording medium according to claim 1 , the process further comprising:

determining that the service is normal when it is determined that the first peak sizes include no second peak size different from the third peak sizes or when it is determined that the first time distribution does not satisfy the second condition.

6. The non-transitory computer-readable recording medium according to claim 1 , the process further comprising:

outputting a determination result indicating that the service is abnormal.

7. The non-transitory computer-readable recording medium according to claim 1 , wherein

the encrypted packet group is transmitted and received for the service within the predetermined period.

8. The non-transitory computer-readable recording medium according to claim 1 , the process further comprising:

determining whether the first time distribution satisfies the second condition based on message data that indicate a message size and a response time of each response message having a response time equal to or less than a predetermined time among the acquired message data.

9. An abnormality diagnosis method, comprising:

acquiring, by a computer, message data that indicate a message size and a response time of each response message identified from an encrypted packet group which is transmitted and received within a predetermined period;

identifying, based on the acquired message data, first peak sizes that satisfy a first condition from a first size distribution that is a frequency distribution of the message size of each response message;

determining based on the acquired message data, when it is determined that the first peak sizes include a second peak size different from third peak sizes, whether a first time distribution satisfies a second condition, the third peak sizes being peak sizes of the message size of each response message in a normal state and being stored in advance, the first time distribution being a frequency distribution of the response time of each response message having the second peak size; and

determining that a service is abnormal, when it is determined that the first time distribution satisfies the second condition.

10. An information processing apparatus, comprising:

a memory; and

a processor coupled to the memory and the processor configured to:

acquire message data that indicate a message size and a response time of each response message identified from an encrypted packet group which is transmitted and received within a predetermined period;

identify, based on the acquired message data, first peak sizes that satisfy a first condition from a first size distribution that is a frequency distribution of the message size of each response message;

determine based on the acquired message data, when it is determined that the first peak sizes include a second peak size different from third peak sizes, whether a first time distribution satisfies a second condition, the third peak sizes being peak sizes of the message size of each response message in a normal state and being stored in the memory, the first time distribution being a frequency distribution of the response time of each response message having the second peak size; and

determine that a service is abnormal, when it is determined that the first time distribution satisfies the second condition.