Nippon Telegraph and Telephone Corporation

Yang Zhong

Tohru Sato

Shingo Orihara

Yuta Iwaki

Hiroshi Asakura

Yohsuke Shimada

Masaki Tanikawa

Kazunori Kamiya

Kazufumi Aoki

Yoshihito Oshima

Kensuke Nakata

A log analysis apparatus extracts a parameter from an access log under analysis, acquires a similarity by comparing the parameter with the parameter included in the profile stored in a profile storage unit, and determines an access in the access log under analysis as an attack when the similarity is lower than a threshold. The log analysis apparatus takes a tally of the number of different requesting user terminals, for each parameter, among the access logs under analysis including a parameter not found in the profile, or having a similarity lower than the threshold, and determines, when there is any parameter for which the number of such different user terminals is equal to or higher than a threshold, to re-learn the parameter.

Log analysis apparatus, log analysis method, and log analysis program

A request control device, when receiving a request issued from a client to a Web system, causes a sandbox in which an environment of the Web system is reproduced to inspect the request. The request control device transfers the request to the Web system if an inspection result of the request in the sandbox does not indicate detection of an attack. The request control device does not transfer the request to the Web system if the inspection result of the request indicates detection of an attack.

Request control device, request control method, and request control program

A determination apparatus includes a keyword extraction unit that extracts keywords characterizing a vulnerability from known vulnerability information, and a 0-day attack determination unit that compares the keywords characterizing the vulnerability and keywords included in a request used for an attack, and when a value of a score indicating a degree of inclusion of same keywords as the keywords characterizing the vulnerability in the request is smaller than a predetermined threshold, determines that the request is a 0-day attack that is neither a known attack nor an attack similar to the known attack.

Determination apparatus, determination method, and determination program

A global profile generation unit acquires a profile including, as an entry, information on parameter values for a combination of path parts and parameter names included in a normal HTTP request to a web server. When entries, in which the path parts are different but the parameter names are the same, are present in the acquired profile, the global profile generation unit generates a global profile in which the entries of the parameter names are aggregated in the acquired profile.

Profile generation device, attack detection device, profile generation method, and profile generation computer program

An attack pattern extraction device includes an extraction unit and an attack pattern generation unit. The extraction unit extracts a common character string of parameters included in an access log of communication that is determined as an attack. The attack pattern generation unit generates an attack pattern on the basis of a character string with a string length being equal to or longer than a predetermined length among extracted consecutive character strings.

Attack pattern extraction device, attack pattern extraction method, and attack pattern extraction program

An extraction unit-extracts a specific request from among requests that do not match with a profile on the basis of a similarity to a request to a server, where the profile determines whether the request is an attack. Further, a determination unit determines whether the specific request extracted by the extraction unit meets a predetermined condition indicating that the specific request is continuously transmitted from a certain number or more of transmission sources. Furthermore, a control unit relearns the profile if the determination unit determines that the specific request meets the predetermined condition.

Learning device, relearning necessity determination method, and relearning necessity determination program

A device and method to accurately detect list-based attacks without reducing the convenience for authorized users. An acquirer acquires information on accounts used for log-in trials to a plurality of websites. An analyzer calculates the degree of use of each account used in common for log-in trials to different websites in a predetermined period of time out of the accounts acquired by the acquirer and determine the log-in trials using the account to be attacks when the degree of use exceeds a predetermined threshold. A detector detects, as an attack, a log-in trial to the website using the same account as the account used for the log-in trials determined to be attacks by the analyzer.

Detection device, detection method, detection system, and detection program

A detection apparatus extracts an account and a source address of the account from authentication information obtained from an authentication apparatus configured to perform user authentication, groups accounts for each of time slots at predetermined time intervals and each of source addresses in accordance with a timestamp and the source address of the account, and extracts an account group from which duplication of an identical account in an identical group has been excluded. Subsequently, the detection apparatus calculates the number of duplicate accounts among the extracted account groups. The detection apparatus determines that an identical source address is an address of an attacker in a case where the number of account groups of the identical source address in which the number of calculated accounts exceeds a first threshold exceeds a second threshold.

Detection system, detection apparatus, detection method, and detection program

A playback device reads a traffic file which is a dump file of traffic when malicious or benign traffic is generated and generates traffic based on the traffic file on a network having a security instrument that generates an event in accordance with the traffic. In addition, a determination device collects an event generated by the security instrument for the generated traffic and, on the basis of a feature extracted from the collected event, determines whether the event to be determined is for malicious traffic or benign traffic.

Malicious event detection device, malicious event detection method, and malicious event detection program

In order to detect an attack to a web application accurately by accurately correlating different types of events having occurred in the same server, an event acquiring unit acquires a log of events containing a HTTP request to a server, an event correlator creates a set of the request and events relevant to the request as an event block by using process IDs of processes having processed events contained in the log, and an attack detector contrasts the event block that is created from the log of events in which an attack is to be detected with an event block that is created from normal events to calculate a degree of similarity and, when the degree of similarity is equal to or lower than a threshold, detects the event block as an event block containing an event that is abnormal due to an attack.

Analysis method, analysis device and analysis program

An analysis apparatus analyzes access logs including authentication results and authentication information of users, and includes: a calculation unit that calculates a similarity between pieces of authentication information in two consecutive access logs when access logs of the same access source, from the access logs, are chronologically arranged, and presumes that a piece of authentication information of the access logs of the user has been input by a human if the calculated similarity is equal to or greater than a predetermined value; and a risk determination unit that determines that there is a possibility that the access source in the access logs is being an attack source if an authentication result of any of the two access logs is authentication failure and the calculation unit presumes that any piece of authentication information of the two access logs has not been input by a human.

Analysis apparatus, analysis system, analysis method, and analysis program

A device including: a parameter extracting unit that extracts each parameter from an access request, a character-string class converting unit that, with regard to each parameter, compares each part of a parameter value with a previously defined character string class, replaces the part with a longest matching character string class, and conducting conversion for a class sequence that is sequentially arranged in order of replacement, a profile storing unit that stores, as a profile in a storage unit, a class sequence with the appearance frequency of equal to or more than a predetermined value in the above-described group of class sequences with regard to the access request of the normal data as learning data, and a failure detecting unit that determines the presence or absence of an attack in accordance with the degree of similarity between the above-described class sequence and the profile with regard to the access request.

Growing community of inventors

Musashino, Japan

Yang Zhong