Suspicious communication detection apparatus, suspicious communication detection method, and suspicious communication detection program

Abstract

An apparatus, method, and program for detecting suspicious communications are described herein. In some implementations, the method includes managing received communications in a database by separating them as encrypted communications and as non-encrypted communications; determining whether each received communication is an encrypted communication or a non-encrypted communication; performing padding on transmission and reception size values and transmission and reception packet numbers of the non-encrypted communication to fill in a difference from the encrypted communication; generating features from the non-encrypted communication obtained after padding and registering the features in the database; training a machine learning model by using features of the non-encrypted communications registered in the database as training data; referring to the database by using information about a received encrypted communication; entering obtained features about the received encrypted communication to the machine learning model; and determining whether the received encrypted communication is a suspicious communication.