Abstract: A threat coping system (10) is provided with a threat coping device (300) that copes with a coping target (30) and a control device (200) that controls the threat coping device. The control device (200) is provided with a no-coping area setting means (514) and a coping instruction means (526). The no-coping area setting means (514) sets a no-coping area (12) based on information of a no-coping target that is not to cope with. The coping instruction means (526) generates an instruction signal, that instructs the threat coping device to cope a coping target, based on the no-coping area.

Abstract: A classification apparatus 10 acquires a communication log including a plurality of pieces of traffic data, and extracts different types of feature values from the plurality of pieces of traffic data. Subsequently, the classification apparatus 10 classifies the traffic data on a per IP address basis based on the extracted different types of feature values, and uses a plurality of classification results to count the number of times of appearance of a pattern having the same combination of the classification results.

Abstract: An extraction device includes processing circuitry configured to generate a first feature vector that shows a feature of traffic data for each target from a plurality of traffic data pieces aggregated for each predetermined target, sample traffic data from the traffic data for each target a plurality of times, and generate a second feature vector that shows a feature of the sampled traffic data for each sample set obtained.

Abstract: An analysis device includes processing circuitry configured to generate a graph in which each IP host indicated in communication information is set as a node and communication between the each IP host is set as an edge on a basis of the communication information of a network, calculate a degree of relevance between a predetermined IP host and each IP host on the graph using the generated graph, correct the graph by adding or deleting an edge connecting each IP host on the graph on a basis of a degree of relevance between a predetermined IP host and each IP host on the graph, calculate a degree of relevance between the predetermined IP host and each IP host using the corrected graph, and output a degree of relevance between the predetermined IP host and each IP host.

Abstract: A generation apparatus includes processing circuitry configured to aggregate a plurality of traffic data for every predetermined target, sample target traffic data in which a number of traffic data aggregated exceeds a threshold, and generate a feature vector representing a feature of aggregated traffic data for a target that is not sampled, and generate a feature vector representing a feature of sampled traffic data for the target sampled.

Abstract: A country estimation device includes processing circuitry configured to collect path information for each IP address, extract attribute information assigned to the collected path information, and estimate a country where the IP address is located by referring to attribute information indicating a country at a link destination of a path of the path information among the extracted attribute information.

Abstract: A passive acquisition data analysis unit (11) analyzes data observed in a communication network. An active acquisition data analysis unit (12) analyzes data obtained by searching the communication network. A data output unit (14) outputs data for specifying an IP address to be searched for based on an analysis result from the passive acquisition data analysis unit (11) and an analysis result from the active acquisition data analysis unit (12).

Abstract: A generation unit is configured to generate a graph representing inter-node communication using information on communication between nodes on a network. A selection unit is configured to select a node satisfying a predetermined condition among nodes in the generated graph. A calculation unit is configured to calculate a feature value in the graph for the selected node by a predetermined learning method. An estimation unit is configured to estimate a feature value for a node other than the selected nodes by combining feature values estimated for sequentially adjacent nodes in the graph.

Abstract: A detection device includes processing circuitry configured to collect communication information in a network including clients and servers, generate a matrix representing states of access from the clients to the servers using the communication information collected, aggregate a plurality of the clients accessing a target server and generate statistical information of similarities between the aggregated clients in the matrix as a feature amount of the target server, learn, with regard to the target server which is a server for which it is known whether the server is a malicious server, a model for determining whether a server is a malicious server using the feature amount generated, and determine, with regard to the target server which is a server for which it is unknown whether the server is a malicious server, whether the target server is a malicious server using the feature amount generated and the model.

Abstract: A detection device includes processing circuitry configured to identify candidate bots using flow data, use the flow data to count a number of the candidate bots communicating with servers, for each of the servers, and determine servers communicating with a predetermined number or more of the candidate bots among the servers to be malicious servers, and detect candidate bots communicating with the malicious servers that are determined among the candidate bots to be malicious bots.

Abstract: A search apparatus includes processing circuitry configured to extract fingerprints that are combinations of first communication data corresponding to requests and second communication data corresponding to responses to the requests, from communication data obtained by executing known malware, give degrees of priority corresponding to degrees of maliciousness of the malware, to the fingerprints, generate probes that are requests based on the first communication data included in the fingerprints and signatures based on the second communication data included in the fingerprints, decide, based on information about communication of sending-out destinations, search-target sending-out destinations from among the sending-out destinations, send out the probes generated to the search-target sending-out destinations decided in order according to the degrees of priority given, and determine whether the search-target sending-out destinations are malicious or not, based on whether responses to the probes sent out match th

Abstract: An aggregation unit (15a) aggregates an input pulse train signal including a time-series pulse corresponding to a predetermined observation time into pulses for respective unit times. A calculation unit (15b) calculates a time shift amount of an autocorrelation function using the aggregated pulse train signal. A detection unit (15c) calculates an autocorrelation value and a threshold with respect to each of time shift amounts selected in ascending order from the calculated time shift amount and detects the time shift amount as a period of the aggregated pulse train signal when the autocorrelation value exceeds the threshold. A conversion unit (15d) converts the detected period to a period of the input pulse train signal using the unit time. An exclusion unit (15e) excludes the pulse train signal having the converted period from the input pulse train signal.

Abstract: A classification device includes processing circuitry configured to determine whether or not an input URL or domain is an existing benign URL or domain, output pseudo data determined not to be an existing benign URL or domain by the annotator unit among pseudo data of benign URLs or domains generated by a generator, add the pseudo data output by the data generation unit to learning data of a malicious URL or domain, and learn a classifier for classifying the input URL or domain as being malicious or benign using the learning data of the malicious URL or domain to which the pseudo data has been added.

Abstract: An identifying device (10) includes a preprocessing (11) that extracts a communication connection pattern including a set of a communication source identifier and a communication destination identifier from traffic data, a comparing unit (131) that adds an ID to a communication connection pattern group including a new communication connection pattern not included in a whitelist when the new communication connection pattern is present in the communication connection pattern group, a graph feature amount generating unit (14) that generates a graph feature amount of the communication connection pattern group to which the ID has been added and adds this ID to the graph feature amount, an abnormality determining unit (16) that determines whether the generated graph feature amount is normal using a model (161) having learned the graph feature amount, and an identifying unit (132) that retrieves a new communication.

Abstract: An identifier generation device includes identifier generation circuitry configured to acquire flow data of an application, calculate first feature vectors from the flow data, convert the first feature vectors into second feature vectors to which feature vectors of an identical type of application are similar, cluster the second feature vectors and add a pseudo-label to the clustered second feature vectors, generate a learning data set from the second feature vectors to which the pseudo-label is added, supply the learning data set to an identifier, and update a setting of the identifier to which the learning data set is supplied.

Abstract: A traffic characteristic information extracting device includes a memory, and processing circuitry coupled to the memory and configured to acquire traffic information satisfying a predetermined condition from network traffic data, extract characteristic information from the acquired traffic information, classify the traffic information based on the extracted characteristic information, analyze a classification result obtained at the classifying and generate signatures, and output a signature satisfying a predetermined condition among the generated signatures.

Abstract: A signature generation unit (132) generates a signature in which header information of packet data included in traffic data is correlated with a label representing a category for an application corresponding to the packet data. A flow data generation unit (131) generates flow data from the packet data. An assigning unit (134) assigns the label to the flow data on the basis of the signature and the header information of the flow data. A calculation unit (135) calculates a feature amount of the flow data. A learning unit (136) learns a model for predicting a label from the feature amount using the label and the feature amount of the flow data to which the label is assigned.

Abstract: A discrimination method to be executed by a discrimination device that discriminates an application, includes collecting packet data and first flow data that satisfy a predetermined rule, analyzing the packet data and generating a signature that associates the application and an IP address with each other, generating second flow data from the packet data, calculating first feature amount information that is a statistical feature amount for each IP address for the first flow data, and calculating second feature amount information that is a statistical feature amount for each IP address for the second flow data, attaching a label to the second feature amount information with use of the signature, and causing a discriminator to learn discrimination of the application by using the first feature amount information and the second feature amount information as learning data.

Abstract: A score calculation unit (123) calculates a score for each of one or more pieces of data that are each known to be a negative example or a positive example by using a score function for calculating the score from features of the data according to parameters. Further, an index calculation unit (124) calculates, in a result of classification from a classification performed based on the score calculated by the score calculation unit (123), an index that increases as a true positive rate for a false positive rate being within a predetermined section increases, the index increasing as a ratio of positive example data to data whose score is equal to a predetermined value increases. Further, an update unit (125) updates the parameter so that the index calculated by the index calculation unit (124) is optimized.

Abstract: A country estimation device includes processing circuitry configured to collect path information for each IP address, extract attribute information assigned to the collected path information, and estimate a country where the IP address is located by referring to attribute information indicating a country at a link destination of a path of the path information among the extracted attribute information.