PROTOCOL IDENTIFYING APPARATUS, PROTOCOL IDENTIFYING METHOD AND PROGRAM

A protocol identification device retrieves multiple communication data items related to multiple communications from certain source IP addresses to certain destination IP addresses; extracts, based on the multiple communication data items, multiple communications from a single transmission source port to multiple destination ports, as candidates for a first communication based on a first protocol using multiple destination ports, excludes, from among the candidates for the first communication based on the first protocol using the multiple destination ports, a second communication based on a second protocol using a single destination port, and identifies a remaining communication as the first communication based on the first protocol using the multiple destination ports.