Malicious communication pattern extraction apparatus, malicious communication pattern extraction method, and malicious communication pattern extraction program

A malicious communication pattern extraction method, including:

• receiving input of a traffic group of one or more pieces of malware, each item in the input traffic group has a same set of fields which each define different values that characterize a communication of the item;
• extracting communication patterns from the input traffic group, each of the communication patterns being defined by one or more values in one or more respective fields having a same value,
• extracting, when extracting communication patterns from the input traffic group, any traffic group of the input traffic group containing a variation of values of a predetermined field among the one or more respective fields, and replacing the variation of values with a wild card and including the wild card corresponding to the predetermined field within the communication patterns;
• classifying pieces of malware with the extracted communication patterns similar to each other, into the same cluster;
• extracting, for each of the clusters, a communication pattern group as a malicious communication pattern, the communication pattern group having an appearance rate in respective traffic of pieces of malware belonging to that cluster, the appearance rate being equal to or larger than a predetermined value;
• and
• eliminating, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value.

A non-transitory computer readable storage medium having stored therein a malicious communication pattern extraction program that causes a computer to execute a process comprising:

• receiving input of a traffic group of one or more pieces of malware, each item in the input traffic group has a same set of fields which each define different values that characterize a communication of the item;
• extracting communication patterns from the input traffic group, each of the communication patterns being defined by one or more values in one or more respective fields having a same value,
• extracting, when extracting communication patterns from the input traffic group, any traffic group of the input traffic group containing a variation of values of a predetermined field among the one or more respective fields, and replacing the variation of values with a wild card and including the wild card corresponding to the predetermined field within the communication patterns;
• classifying pieces of malware with the extracted communication patterns similar to each other, into the same cluster;
• extracting, for each of the clusters, a communication pattern group as a malicious communication pattern, the communication pattern group having an appearance rate in respective traffic of pieces of malware belonging to that cluster, the appearance rate being equal to or larger than a predetermined value;
• and
• eliminating, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value.