Nippon Telegraph and Telephone Corporation

Yuta Takata

Mitsuaki Akiyama

Takeshi Yagi

Daiki Chiba

Toshiki Shibahara

Fumihiro Kanei

Kazufumi Aoki

Kunio Hato

Takeshi Yada

Hirokazu Kodera

A calculation device receives input of a plurality of pieces of training data including a communication destination known to be malignant as data. The calculation device generates a model that calculates a malignant degree of an input communication destination from each piece of the training data. The calculation device gives weight to each of the models, and generates a mixed model using the model and the weight. The calculation device calculates a malignant degree of a communication destination unknown whether the communication destination is malignant using the mixed model.

Calculation device, calculation method, and calculation program

A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Phishing site detection device, phishing site detection method and phishing site detection program

A feature extraction unit extracts, from an advertising request to view an online advertisement, client information on a client as a transmission source of the advertising request and publisher information on a website of a publisher who displays advertising, and calculates a predetermined feature amount using the client information and the publisher information with respect to a plurality of advertising requests including at least a benign advertising request, and a determiner generation unit generates a determiner that determines whether an advertising request is malignant or not by using the calculated feature amount.

Detector, detection method, and detection program

A classification apparatus includes: a crawler unit that acquires access result data for a website, the access result data including website application information, web server information, and the like that are updated by an administrator of the website; an update history generation unit that generates an update history of the website by making comparison in chronological order between pieces of information included in the access result data for the website; a classifier generation unit that generates a classifier that classifies a website having a possibility of being abused in the future, by using, as a feature value, the update history of the website; and a classification unit that classifies, through the classifier generated, the website having the possibility of being abused in the future.

Classification apparatus, classification method, and classification program

An extracting unit randomly extracts a block from among the blocks of instruction strings constituting the byte code of a first program and, at the time of execution of the first program, extracts the blocks which are invariably executed before the randomly-extracted block. A dividing unit randomly divides, into a plurality of blocks, the instruction strings constituting the byte code of a second program which enables detection of tampering of the first program. An inserting unit inserts the plurality of blocks, which are obtained by division by the dividing unit, at different positions in the block extracted by the extracting unit, while maintaining the execution sequence written in the second program.

Assignment device, assignment method, and assignment program

A classification apparatus that classifies sequential data, in which input communication destinations in a plurality of communications are recorded in order of occurrence of the communications, into a class that has a similar feature. There is a numerical vector calculation unit-configured to calculate numerical vectors that represent characteristics of communication destinations for each of the communication destinations, on the basis of sequential data in which the communication destinations in a plurality of communications are recorded in order of occurrence of the communications, and a classification unit-configured to classify the sequential data into a class that has a similar feature, on the basis of order relation of the communication destinations of the numerical vectors.

An access classification device includes: a processor configured to: construct a plurality of trees in each of which at least a first destination and a second destination are set as nodes, content information corresponding to the nodes is added to the nodes, and an instruction to transfer an access from the first destination to the second destination is set as an edge; associate nodes of the plurality of trees with each other for the plurality of trees constructed, based on similarity between local structures of the trees; calculate similarity between the nodes associated with each other in the plurality of trees, based on the content information added to the nodes, and calculate similarity between the plurality of trees using the calculated similarity between the nodes associated with each other; and classify the access into a set with similar features, based on the similarity calculated.

Access classification device, access classification method, and recording medium

An analysis apparatus has a transfer path matching unit that is provided with a real browser log La and a browser emulator log Lb as input and identifies, as a specific transfer path, a transfer path that is not transferred to a malicious URL on a pseudo-browser where the transfer path is transferred to the malicious URL on a real browser, based on the malicious URL information in a malicious URL database, and an analysis avoidance code identification unit that identifies an analysis avoidance code that avoids analysis by utilizing a browser-specific function or an implementation difference between the real-browser and the pseudo-browser, among script codes that are executed on a website, based on the specific transfer path.

Analysis apparatus, analysis method, and analysis program

A combining apparatus has an acquiring unit that acquires script codes included in a website and having been divided and written at plural locations in the website; and a code combining unit that combines a plurality of the divided script codes written therein, based on a dependency between data in the divided script codes written therein acquired by the acquiring unit, or a dynamic generation relation arising from execution of the divided script codes written therein.

Combining apparatus, combining method, and combining program

A browser emulator manager causes a browser emulator(s) to access a website. The browser emulator traces content interpretation and script execution on a browser that have occurred by access to the website. When detecting transfer, the browser emulator records, in transfer information, a transfer method, a transfer source URL, and a transfer destination URL thereof. When detecting the script execution, the browser emulator records, in the transfer information, an execution method and an execution source script thereof. A graph construction unit constructs a directed graph on the basis of the transfer information. Thereafter, a graph analysis unit specifies places of content and a script causing the transfer by tracing the directed graph.

A static code analysis unit specifies an implementation portion of a Java code in a cooperation mechanism that sends and receives data between an Android application implemented by the Java code and Web content implemented by a JavaScript code and specifies a method in which a return value that can be called by the JavaScript code is set in the cooperation mechanism; a code converting unit inserts, into the Java code, a call code of a simulation function in which the return value of the specified method is inserted into an argument; and a data flow analysis unit analyzes a data flow by observing, by using the argument and the return value of the simulation function and the specified method, the data that is sent and received between the Android application implemented by the Java code and the Web content implemented by the JavaScript code.

Analysis device, analysis method, and analysis program

A browser emulator is caused to emulate a client environment that is arbitrary values of types and versions of an OS, a browser, and a plugin. Further, the browser emulator monitors execution of a script or a plugin. A browser emulator manager then causes the browser emulator to patrol a predetermined Web site, and accumulates, in an analysis information database, results of access to the Web site in association with information on client environments emulated upon the access to the Web site. The browser emulator manager then refers to the accumulated results of access, and identifies a Web site that causes a difference between results of access according to a difference between client environments.

Browser emulator device, construction device, browser emulation method, browser emulation program, construction method, and construction program

An access classifying device includes a tree building unit, a similarity-degree calculating unit, and a classifying unit. The tree building unit generates multiple trees, in which a first server and multiple second servers are nodes and commands for automatically transferring the sequence of accesses from the above-described first server to the above-described second servers are edges. The similarity-degree calculating unit calculates the degree of similarity between the above-described trees in accordance with the degree of matching between partial trees included in each of the above-described trees generated. The classifying unit classifies the above-described access in accordance with the above-described degree of similarity calculated.

Access classifying device, access classifying method, and access classifying program

A program analysis unit of a browser emulator manager exhaustively searches a code by performing syntax analysis of a code included in web content to search a transfer code to another site or a content acquisition code, and specifies at least any of an object and a function and a property of the object used in the code found as a result of the search. Further, the program analysis unit extracts a code having a dependence relationship with the transfer code or the content acquisition code based on at least any of the object and the function and the property of the object thus specified.

Growing community of inventors

Musashino, Japan

Yuta Takata