Specifying device, specifying method, and specifying program

Abstract

An identifying device () includes a preprocessing () that extracts a communication connection pattern including a set of a communication source identifier and a communication destination identifier from traffic data, a comparing unit () that adds an ID to a communication connection pattern group including a new communication connection pattern not included in a whitelist when the new communication connection pattern is present in the communication connection pattern group, a graph feature amount generating unit () that generates a graph feature amount of the communication connection pattern group to which the ID has been added and adds this ID to the graph feature amount, an abnormality determining unit () that determines whether the generated graph feature amount is normal using a model () having learned the graph feature amount, and an identifying unit () that retrieves a new communication. connection pattern corresponding to the ID of the graph feature amount determined to have an abnormality from the communication connection pattern group including the new communication connection pattern and identifies the retrieved new communication connection pattern as communication that causes the abnormality.