Signature generating device, signature generating method, and non-transitory computer-readable medium storing program

Abstract

A signature generating device () includes a collecting unit () configured to collect threat information, an extracting unit () configured to extract attack data from the threat information collected by the collecting unit (), and a generating unit () configured to generate a signature on the basis of the attack data extracted by the extracting unit (). When plural pieces of attack data having a common character string are extracted by the extracting unit (), the generating unit () tentatively generates a signature including the common character string, evaluates whether a tentatively generated signature includes a character string used in non-attack data, and when the tentatively generated signature includes the character string used in the non-attack data, removes the character string from the tentatively generated signature to generate a signature.