Abstract: A search apparatus includes processing circuitry configured to extract fingerprints that are combinations of first communication data corresponding to requests and second communication data corresponding to responses to the requests, from communication data obtained by executing known malware, give degrees of priority corresponding to degrees of maliciousness of the malware, to the fingerprints, generate probes that are requests based on the first communication data included in the fingerprints and signatures based on the second communication data included in the fingerprints, decide, based on information about communication of sending-out destinations, search-target sending-out destinations from among the sending-out destinations, send out the probes generated to the search-target sending-out destinations decided in order according to the degrees of priority given, and determine whether the search-target sending-out destinations are malicious or not, based on whether responses to the probes sent out match th

Abstract: An aggregation unit (15a) aggregates an input pulse train signal including a time-series pulse corresponding to a predetermined observation time into pulses for respective unit times. A calculation unit (15b) calculates a time shift amount of an autocorrelation function using the aggregated pulse train signal. A detection unit (15c) calculates an autocorrelation value and a threshold with respect to each of time shift amounts selected in ascending order from the calculated time shift amount and detects the time shift amount as a period of the aggregated pulse train signal when the autocorrelation value exceeds the threshold. A conversion unit (15d) converts the detected period to a period of the input pulse train signal using the unit time. An exclusion unit (15e) excludes the pulse train signal having the converted period from the input pulse train signal.

Abstract: A classification device includes processing circuitry configured to determine whether or not an input URL or domain is an existing benign URL or domain, output pseudo data determined not to be an existing benign URL or domain by the annotator unit among pseudo data of benign URLs or domains generated by a generator, add the pseudo data output by the data generation unit to learning data of a malicious URL or domain, and learn a classifier for classifying the input URL or domain as being malicious or benign using the learning data of the malicious URL or domain to which the pseudo data has been added.

Abstract: An identifying device (10) includes a preprocessing (11) that extracts a communication connection pattern including a set of a communication source identifier and a communication destination identifier from traffic data, a comparing unit (131) that adds an ID to a communication connection pattern group including a new communication connection pattern not included in a whitelist when the new communication connection pattern is present in the communication connection pattern group, a graph feature amount generating unit (14) that generates a graph feature amount of the communication connection pattern group to which the ID has been added and adds this ID to the graph feature amount, an abnormality determining unit (16) that determines whether the generated graph feature amount is normal using a model (161) having learned the graph feature amount, and an identifying unit (132) that retrieves a new communication.

Abstract: An identifier generation device includes identifier generation circuitry configured to acquire flow data of an application, calculate first feature vectors from the flow data, convert the first feature vectors into second feature vectors to which feature vectors of an identical type of application are similar, cluster the second feature vectors and add a pseudo-label to the clustered second feature vectors, generate a learning data set from the second feature vectors to which the pseudo-label is added, supply the learning data set to an identifier, and update a setting of the identifier to which the learning data set is supplied.

Abstract: A traffic characteristic information extracting device includes a memory, and processing circuitry coupled to the memory and configured to acquire traffic information satisfying a predetermined condition from network traffic data, extract characteristic information from the acquired traffic information, classify the traffic information based on the extracted characteristic information, analyze a classification result obtained at the classifying and generate signatures, and output a signature satisfying a predetermined condition among the generated signatures.

Abstract: A signature generation unit (132) generates a signature in which header information of packet data included in traffic data is correlated with a label representing a category for an application corresponding to the packet data. A flow data generation unit (131) generates flow data from the packet data. An assigning unit (134) assigns the label to the flow data on the basis of the signature and the header information of the flow data. A calculation unit (135) calculates a feature amount of the flow data. A learning unit (136) learns a model for predicting a label from the feature amount using the label and the feature amount of the flow data to which the label is assigned.

Abstract: A discrimination method to be executed by a discrimination device that discriminates an application, includes collecting packet data and first flow data that satisfy a predetermined rule, analyzing the packet data and generating a signature that associates the application and an IP address with each other, generating second flow data from the packet data, calculating first feature amount information that is a statistical feature amount for each IP address for the first flow data, and calculating second feature amount information that is a statistical feature amount for each IP address for the second flow data, attaching a label to the second feature amount information with use of the signature, and causing a discriminator to learn discrimination of the application by using the first feature amount information and the second feature amount information as learning data.

Abstract: A score calculation unit (123) calculates a score for each of one or more pieces of data that are each known to be a negative example or a positive example by using a score function for calculating the score from features of the data according to parameters. Further, an index calculation unit (124) calculates, in a result of classification from a classification performed based on the score calculated by the score calculation unit (123), an index that increases as a true positive rate for a false positive rate being within a predetermined section increases, the index increasing as a ratio of positive example data to data whose score is equal to a predetermined value increases. Further, an update unit (125) updates the parameter so that the index calculated by the index calculation unit (124) is optimized.

Abstract: A country estimation device includes processing circuitry configured to collect path information for each IP address, extract attribute information assigned to the collected path information, and estimate a country where the IP address is located by referring to attribute information indicating a country at a link destination of a path of the path information among the extracted attribute information.

Abstract: A detection device includes processing circuitry configured to collect communication information in a network including clients and servers, generate a matrix representing states of access from the clients to the servers using the communication information collected, aggregate a plurality of the clients accessing a target server and generate statistical information of similiarities between the aggregated clients in the matrix as a feature amount of the target server, learn, with regard to the target server which is a server for which it is known whether the server is a malicious server, a model for determining whether a server is a malicious server using the feature amount generated, and determine, with regard to the target server which is a server for which it is unknown whether the server is a malicious server, whether the target server is a malicious server using the feature amount generated and the model.

Abstract: A generation apparatus includes processing circuitry configured to aggregate a plurality of traffic data for every predetermined target, sample target traffic data in which a number of traffic data aggregated exceeds a threshold, and generate a feature vector representing a feature of aggregated traffic data for a target that is not sampled, and generate a feature vector representing a feature of sampled traffic data for the target sampled.

Abstract: An extraction device includes processing circuitry configured to generate a first feature vector that shows a feature of traffic data for each target from a plurality of traffic data pieces aggregated for each predetermined target, sample traffic data from the traffic data for each target a plurality of times, and generate a second feature vector that shows a feature of the sampled traffic data for each sample set obtained.

Abstract: A detection device includes processing circuitry configured to identify candidate bots using flow data, use the flow data to count a number of the candidate bots communicating with servers, for each of the servers, and determine servers communicating with a predetermined number or more of the candidate bots among the servers to be malicious servers, and detect candidate bots communicating with the malicious servers that are determined among the candidate bots to be malicious bots.

Abstract: A signature generation unit (132) generates a signature in which header information of packet data included in traffic data is correlated with a label representing a category for an application corresponding to the packet data. A flow data generation unit (131) generates flow data from the packet data. An assigning unit (134) assigns the label to the flow data on the basis of the signature and the header information of the flow data. A calculation unit (135) calculates a feature amount of the flow data. A learning unit (136) learns a model for predicting a label from the feature amount using the label and the feature amount of the flow data to which the label is assigned.

Abstract: A traffic anomaly sensing system 10 includes a preprocessing unit 11, a local graph feature generation unit 12, a global graph feature generation unit 13, a learning unit 14, and an anomaly determination unit 15. The preprocessing unit 11 generates a communication history graph from traffic data. The local graph feature generation unit 12 generates, from the communication history graph, a local graph feature about a certain vertex. The global graph feature generation unit 13 generates, from the communication history graph, a global graph feature about a vertex. The learning unit 14 generates a feature vector by combining the generated local graph feature and the generated global graph feature and generates a learned model for each host identifier. The anomaly determination unit 15 determines whether the traffic data is anomalous or not by inputting the graph feature to the generated learned model.

Abstract: A detection apparatus includes processing circuitry configured to store attack information including detection time, attack attribute, and communication destination of a DDoS attack, and extract, from a collection of the attack information, a combination of the attack information according to the detection time, the attack attribute, and the communication destination as a coincident attack, an intermittent attack, or an identical target attack.

Abstract: A score calculation unit (15c) calculates, based on the feature value of data and a weight, the score of the data using a score function. An optimization unit (15d) approximates, with respect to an AUC of a partial area of a ROC curve for a classifier that classifies the data into a positive instance or a negative instance based on the calculated score, a nonlinear function portion of an object function using a predetermined method, the object function being represented by approximation of the AUC of the partial area, and learns the weight so that the approximated object function is maximized.

Abstract: An aggregation unit (15a) aggregates an input pulse train signal including a time-series pulse corresponding to a predetermined observation time into pulses for respective unit times. A calculation unit (15b) calculates a time shift amount of an autocorrelation function using the aggregated pulse train signal. A detection unit (15c) calculates an autocorrelation value and a threshold with respect to each of time shift amounts selected in ascending order from the calculated time shift amount and detects the time shift amount as a period of the aggregated pulse train signal when the autocorrelation value exceeds the threshold. A conversion unit (15d) converts the detected period to a period of the input pulse train signal using the unit time. An exclusion unit (15e) excludes the pulse train signal having the converted period from the input pulse train signal.

Abstract: A search apparatus includes processing circuitry configured to extract fingerprints that are combinations of first communication data corresponding to requests and second communication data corresponding to responses to the requests, from communication data obtained by executing known malware, give degrees of priority corresponding to degrees of maliciousness of the malware, to the fingerprints, generate probes that are requests based on the first communication data included in the fingerprints and signatures based on the second communication data included in the fingerprints, decide, based on information about communication of sending-out destinations, search-target sending-out destinations from among the sending-out destinations, send out the probes generated to the search-target sending-out destinations decided in order according to the degrees of priority given, and determine whether the search-target sending-out destinations are malicious or not, based on whether responses to the probes sent out match th