Abstract: To detect a communication by a predetermined type of software, which disguises normal communication, an information processing apparatus includes: a communication data acquiring unit 21 configured to acquire communication data generated by a terminal connected to a network; a distribution calculating unit 24 configured to calculate distribution of attribute information of a plurality of communications with a same communication destination, based on the acquired communication data; and an estimating unit 25 configured to estimate whether a detected communication is a communication by a predetermined type of software by determining whether the calculated distribution satisfies a predetermined criterion.

Abstract: An information processing apparatus specifies the phase of activity of a terminal connected to a network by comparing a communication by the terminal with a previously held pattern, specifies the type of behavior of the terminal in relation to a first communication and a second communication, by correlation analysis between a first phase specified based on the first communication of the terminal and a second phase specified based on the second communication which is conducted before or after the first communication, and classifies the unauthorized activity of the terminal based on the specified type of behavior when determination is made that the terminal is used to conduct unauthorized activity.

Abstract: To detect a communication by a predetermined type of software, which disguises normal communication, an information processing apparatus includes: a communication data acquiring unit 21 configured to acquire communication data generated by a terminal connected to a network; a distribution calculating unit 24 configured to calculate distribution of attribute information of a plurality of communications with a same communication destination, based on the acquired communication data; and an estimating unit 25 configured to estimate whether a detected communication is a communication by a predetermined type of software by determining whether the calculated distribution satisfies a predetermined criterion.

Abstract: An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluated value indicating a degree to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluated value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluated value for each of the phases.

Abstract: An information processing apparatus specifies the phase of activity of a terminal connected to a network by comparing a communication by the terminal with a previously held pattern, specifies the type of behavior of the terminal in relation to a first communication and a second communication, by correlation analysis between a first phase specified based on the first communication of the terminal and a second phase specified based on the second communication which is conducted before or after the first communication, and classifies the unauthorized activity of the terminal based on the specified type of behavior when determination is made that the terminal is used to conduct unauthorized activity.

Abstract: An information processing apparatus includes: a specification unit that specifies a phase of activity of terminals by comparing communication between terminals with a pattern held in advance; and a correlation analysis unit that determines whether or not a first terminal and a second terminal are carrying out activity cooperatively, by performing a correlation analysis of communication by the first terminal and communication by the second terminal, when the phase specified currently or in the past in respect of the first terminal and the phase specified currently or in the past in respect of the second terminal are the same.

Abstract: An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluated value indicating a degree to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluated value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluated value for each of the phases.

Abstract: An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluation value indicating an extent to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluation value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluation value for each of the phases.

Abstract: An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluation value indicating an extent to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluation value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluation value for each of the phases.