Estimation device, estimation method, and recording medium

An estimation device is provided that measures a number of DNS requests for each of a plurality of domain names and for each IP address in observed flows. The device measures a total number of the flows, and total amounts of data, estimates a relationship between the amount of data for each IP address corresponding to a node, and the number of DNS requests for each domain name corresponding to a non-intermediate node; and based on a value obtained by multiplying the number of requests for each domain name by the amount of data for each flow of each domain name, obtains the amount of data for each flow of each domain name, multiplies the amount of data by the number of the DNS requests for each domain name, so as to calculate an estimate of the amount of data for each domain name.