Nippon Telegraph and Telephone Corporation

Shohei Araki

Kazunori Kamiya

Bo Hu

Masaki Tanikawa

Shun Tobiyama

A classification apparatusacquires a communication log including a plurality of pieces of traffic data, and extracts different types of feature values from the plurality of pieces of traffic data. Subsequently, the classification apparatusclassifies the traffic data on a per IP address basis based on the extracted different types of feature values, and uses a plurality of classification results to count the number of times of appearance of a pattern having the same combination of the classification results.

Classification device and classification method

A detection device includes processing circuitry configured to collect communication information in a network including clients and servers, generate a matrix representing states of access from the clients to the servers using the communication information collected, aggregate a plurality of the clients accessing a target server and generate statistical information of similarities between the aggregated clients in the matrix as a feature amount of the target server, learn, with regard to the target server which is a server for which it is known whether the server is a malicious server, a model for determining whether a server is a malicious server using the feature amount generated, and determine, with regard to the target server which is a server for which it is unknown whether the server is a malicious server, whether the target server is a malicious server using the feature amount generated and the model.

Detection device, detection method, and detection program

A detection device includes processing circuitry configured to identify candidate bots using flow data, use the flow data to count a number of the candidate bots communicating with servers, for each of the servers, and determine servers communicating with a predetermined number or more of the candidate bots among the servers to be malicious servers, and detect candidate bots communicating with the malicious servers that are determined among the candidate bots to be malicious bots.

A signature generation unit () generates a signature in which header information of packet data included in traffic data is correlated with a label representing a category for an application corresponding to the packet data. A flow data generation unit () generates flow data from the packet data. An assigning unit () assigns the label to the flow data on the basis of the signature and the header information of the flow data. A calculation unit () calculates a feature amount of the flow data. A learning unit () learns a model for predicting a label from the feature amount using the label and the feature amount of the flow data to which the label is assigned.

Growing community of inventors

Musashino, Japan

Shohei Araki