Abstract: A calculation device receives input of a plurality of pieces of training data including a communication destination known to be malignant as data. The calculation device generates a model that calculates a malignant degree of an input communication destination from each piece of the training data. The calculation device gives weight to each of the models, and generates a mixed model using the model and the weight. The calculation device calculates a malignant degree of a communication destination unknown whether the communication destination is malignant using the mixed model.

Abstract: An analysis device includes an input unit that receives input of communication destination information to be analyzed, a conversion unit that converts a partial character string included in the communication destination information into an image, a search unit that obtains a character string that is visually similar to an image converted by the conversion unit and searches for known communication destination information that is visually similar to the communication destination information based on the character string obtained, and an output unit that outputs a combination of the communication destination information and the known communication destination information that is visually similar to the communication destination information.

Abstract: An extraction device includes processing circuitry configured to access an entrance URL described in user-generated content generated by a user in a plurality of services in a predetermined period to extract a feature quantity of the user-generated content, perform training by using the extracted feature quantity of the user-generated content generated by a normal user and a feature quantity of content generated by a malicious user, and determine whether or not the user-generated content has been generated by the malicious user using a trained model.

Abstract: A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Abstract: A determination device includes processing circuitry configured to calculate a characteristic amount of user-generated content generated by a user in a predetermined period, perform learning by using the calculated characteristic amount of the user-generated content generated by a legitimate user and a characteristic amount of content generated by a malicious user, and determine whether the user-generated content is generated by the malicious user using a learned model.

Abstract: A collection device includes processing circuitry configured to acquire user-generated content generated in each service in a predetermined period, generate a search query by using words that appear in the user-generated content for each service, and collect user-generated content generated in a plurality of services by using the generated search query.

Abstract: A detection device includes processing circuitry configured to acquire user generated content generated in each service in a predetermined period, generate a search query using words appearing in the user generated content for each service, collect the user generated content generated in a plurality of services using the generated search query, calculate a feature amount of the collected user generated content of a predetermined service, perform learning using the feature amount of the user generated content generated by a normal user and a feature amount of content generated by a malicious user, determine whether the user generated content is generated by a malicious user based on a learned model, and access an entrance URL described in the user generated content and output a feature of an attack of the user generated content as threat information when the user generated content is determined to be generated by a malicious user.

Abstract: A specifying device receives an input of time-series information indicating an operation form of a domain name up to a predetermined date and time in time series. Then, the specifying device specifies a pattern of a time-series change in operation form of a domain name on the basis of pattern information indicating patterns of time-series change in operation form of the domain name and time-series information of an input domain name. The specifying device specifies candidates for the operation form of the domain name since the predetermined date and time using a result of the specifying. Thereafter, the specifying device determines whether or not the domain name is a target of a re-determination as to whether or not the domain name is a malicious domain name on the basis of the specified candidates for the operation form of the domain name since the predetermined date and time.

Abstract: A learning apparatus includes processing circuitry configured to receive an input of information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method, and generate a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the information relating to the web page.

Abstract: An attack countermeasure determination includes a domain name input unit that receives any domain name as input, and acquires setting information corresponding to the domain name, registration information corresponding to the domain name, and external information corresponding to an internet protocol (IP) address corresponding to the domain name, as feature information on the domain name, an attack countermeasure determination unit that specifies a pre-designated category for the domain name on the basis of the feature information and determines, in a stepwise manner, an attack countermeasure against the domain name in accordance with the specified category, and an attack countermeasure information output unit that outputs attack countermeasure information corresponding to the attack countermeasure.

Abstract: An inference method includes acquiring similarities between a domain name serving as an analysis object and each domain name indicated in a legitimate domain name list as feature amounts, and inferring a degree that the domain name serving as the analysis object is wrongly recognized as a legitimate domain name based on the feature amounts acquired at the acquiring and a training model that outputs, as a response to input of the feature amounts, a degree that the domain name serving as the analysis object is wrongly recognized as the legitimate domain name, by processing circuitry.

Abstract: A feature extraction unit extracts, from an advertising request to view an online advertisement, client information on a client as a transmission source of the advertising request and publisher information on a website of a publisher who displays advertising, and calculates a predetermined feature amount using the client information and the publisher information with respect to a plurality of advertising requests including at least a benign advertising request, and a determiner generation unit generates a determiner that determines whether an advertising request is malignant or not by using the calculated feature amount.

Abstract: A level estimation apparatus includes processing circuitry configured to receive event logs of events detected by a device or software, and calculate degrees of similarity among the events indicated by the event logs with use of the event logs, and estimate a level of a predetermined event based on the calculated degrees of similarity among the events and a level of at least one of the events, wherein in the calculation of the degrees of similarity among the events, when a degree of similarity between events detected by different devices or items of software is calculated, a degree of similarity to a common event is used, the common event being an event that has been detected mutually by the different devices or items of software.

Abstract: A collection apparatus that collects a URL of a Web page that leads to user operation and includes a search query generation unit that generates a search query by combining a digital content name and an associated keyword of the digital content. There is a fitness prediction unit that predicts a degree to which a Web page that leads to user operation is output as a search result when a search is performed by using the generated search query, a determination unit that searches for a Web page by using a search query in a search order that is based on the predicted degree, and determines analysis priority of a URL of a Web page on the basis of the degree and search result information. Further, there is a communication unit that outputs the URL of the retrieved Web page and the analysis priority of the URL.

Abstract: An identification device specifies a boundary which divides rows of IP addresses, which are included in an IP address block and sorted in a predetermined order, into a plurality of parts based on AS numbers, e2LDs, PTR records, etc. of the IP addresses. When the number of the IP addresses included in the part divided by the boundary is equal to or more than a parameter N, which can be arbitrarily set, an identification unit identifies the IP addresses included in the part as dynamic IP addresses.

Abstract: An extraction apparatus includes processing circuitry configured to receive an input of information about a plurality of web pages including a hypertext markup language (HTML) element that is known to reach a malicious web page through browser operation and an HTML element that is known to reach a benign web page through browser operation, classify the plurality of web pages whose input is received into clusters, extract an HTML element that reaches the malicious web page and an HTML element that reaches the benign web page from a web page of each cluster that is classified to extract a first character string included in HTML elements that are extracted, and extract, as a keyword, a second character string that characterizes the HTML element that reaches the malicious web page from the first character string.

Abstract: A learning device includes processing circuitry configured to use a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the web browser until an ending web page is reached, and generate a training model using, as training data, any one or more feature amounts among a feature amount of each web page included in the log information, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page.

Abstract: An analysis apparatus includes a category classification unit that accesses a URL of an analysis target Web page and classifies the analysis target Web page into a category, an operation target detection unit that detects an operation target of user operation from the analysis target Web page in accordance with a detection method that is set in advance for the classified category, an operation execution unit that performs operation on the detected operation target, a function hook unit that detects an operation event that occurs after the operation has been performed on the operation target, and a log output unit that outputs log data in which communication that has occurred due to the operation, the detected operation event, and a Web browser screen that has been changed due to the operation are associated with the URL of the analysis target Web page.

Abstract: An inference method includes acquiring similarities between a domain name serving as an analysis object and each domain name indicated in a legitimate domain name list as feature amounts, and inferring a degree that the domain name serving as the analysis object is wrongly recognized as a legitimate domain name based on the feature amounts acquired at the acquiring and a training model that outputs, as a response to input of the feature amounts, a degree that the domain name serving as the analysis object is wrongly recognized as the legitimate domain name, by processing circuitry.

Abstract: A classification apparatus that classifies sequential data, in which input communication destinations in a plurality of communications are recorded in order of occurrence of the communications, into a class that has a similar feature. There is a numerical vector calculation unit-configured to calculate numerical vectors that represent characteristics of communication destinations for each of the communication destinations, on the basis of sequential data in which the communication destinations in a plurality of communications are recorded in order of occurrence of the communications, and a classification unit-configured to classify the sequential data into a class that has a similar feature, on the basis of order relation of the communication destinations of the numerical vectors.