Nippon Telegraph and Telephone Corporation

Yohsuke Shimada

Shingo Orihara

Tohru Sato

Yang Zhong

Yuta Iwaki

A log analysis apparatus extracts a parameter from an access log under analysis, acquires a similarity by comparing the parameter with the parameter included in the profile stored in a profile storage unit, and determines an access in the access log under analysis as an attack when the similarity is lower than a threshold. The log analysis apparatus takes a tally of the number of different requesting user terminals, for each parameter, among the access logs under analysis including a parameter not found in the profile, or having a similarity lower than the threshold, and determines, when there is any parameter for which the number of such different user terminals is equal to or higher than a threshold, to re-learn the parameter.

Log analysis apparatus, log analysis method, and log analysis program

A global profile generation unit acquires a profile including, as an entry, information on parameter values for a combination of path parts and parameter names included in a normal HTTP request to a web server. When entries, in which the path parts are different but the parameter names are the same, are present in the acquired profile, the global profile generation unit generates a global profile in which the entries of the parameter names are aggregated in the acquired profile.

Profile generation device, attack detection device, profile generation method, and profile generation computer program

An attack pattern extraction device includes an extraction unit and an attack pattern generation unit. The extraction unit extracts a common character string of parameters included in an access log of communication that is determined as an attack. The attack pattern generation unit generates an attack pattern on the basis of a character string with a string length being equal to or longer than a predetermined length among extracted consecutive character strings.

Attack pattern extraction device, attack pattern extraction method, and attack pattern extraction program

An extraction unit-extracts a specific request from among requests that do not match with a profile on the basis of a similarity to a request to a server, where the profile determines whether the request is an attack. Further, a determination unit determines whether the specific request extracted by the extraction unit meets a predetermined condition indicating that the specific request is continuously transmitted from a certain number or more of transmission sources. Furthermore, a control unit relearns the profile if the determination unit determines that the specific request meets the predetermined condition.

Growing community of inventors

Musashino, Japan

Yohsuke Shimada