# US 10,484,408 B2 · Malicious communication pattern extraction apparatus, malicious communication pattern extraction method, and malicious communication pattern extraction program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,484,408 B2 - Document ID: US10484408B2 - Status: Granted - Kind: B2 - Application number: 15/520,194 - Filed: 2015-11-09 - Published: 2017-10-26 - Granted: 2019-11-19 - Earliest claimed: 2014-11-18 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Kazunori Kamiya; Kazufumi Aoki - Web page: https://patentgrep.com/patent/US10484408B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 16/285: {Clustering or classification} - G06F 21/56: Computer malware detection or handling, e.g. anti-virus arrangements - G06F 21/561: {Virus type analysis} - G06F 21/565: {by checking file integrity} - G06F 2221/2147: Locking files - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A malicious communication pattern extraction apparatus extracts communication patterns of traffic group of malwares, and replaces the values of predetermined field with variation in a traffic group with a wild card. Further, the malicious communication pattern extraction apparatus classifies pieces of malware having similar communication patterns in the traffic group into the same cluster, and for each cluster, extracts, as a malicious communication pattern, a communication pattern group having an appearance rate in a traffic group of respective pieces of malware in the cluster, the appearance rate being equal to or larger than a predetermined value. Thereafter, the malicious communication pattern extraction apparatus eliminates, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value. ## Claims ### Claim 1 A malicious communication pattern extraction apparatus, comprising: processing circuitry configured to receive input of a traffic group of one or more pieces of malware, each item in the input traffic group has a same set of fields which each define different values that characterize a communication of the item; extract communication patterns from the input traffic group, each of the communication patterns being defined by one or more values in one or more respective fields having a same value, and extract, when extracting communication patterns from the input traffic group, any traffic group of the input traffic group containing a variation of values of a predetermined field among the one or more respective fields, and replacing the variation of values with a wild card and including the wild card corresponding to the predetermined field within the communication patterns; classify pieces of malware with the extracted communication patterns similar to each other, into the same cluster; extract, for each of the clusters, a communication pattern group as a malicious communication pattern, the communication pattern group having an appearance rate in traffic of respective pieces malware belonging to that cluster, the appearance rate being equal to or larger than a predetermined value; and eliminate, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value. ### Claim 2 (depends on 1) The malicious communication pattern extraction apparatus according to claim 1, wherein the processing circuitry classifies pieces of malware into the same cluster, the pieces of malware having their communication patterns or pieces of traffic information of their traffic that are similar to each other, the pieces of malware being from the one or more pieces of malware. ### Claim 3 (depends on 1) The malicious communication pattern extraction apparatus according to claim 1, wherein the processing circuitry performs matching processing for a traffic group to be subjected to detection, with the malicious communication pattern, and detects, as abnormal traffic, any traffic having a rate of the number of communications matching communication patterns included in the malicious communication pattern, the rate being equal to or larger than a predetermined value. ### Claim 4 (depends on 3) The malicious communication pattern extraction apparatus according to claim 3, wherein in a case where the malicious communication pattern includes a communication pattern, for which values in the predetermined field have been replaced with a wild card, the processing circuitry determines that the communication pattern matches when a predetermined number or more of the communication patterns are present in the traffic group to be subjected to detection. ### Claim 5 (depends on 1) The malicious communication pattern extraction apparatus according to claim 1, wherein in a case where the malicious communication pattern includes a communication pattern, for which values in the predetermined field have been replaced with a wild card, the processing circuitry determines that the communication pattern matches the traffic group not infected with malware and calculates the conformance rate, when a predetermined number or more of the communication patterns are present in the traffic group infected with malware. ### Claim 6 A malicious communication pattern extraction method, including: receiving input of a traffic group of one or more pieces of malware, each item in the input traffic group has a same set of fields which each define different values that characterize a communication of the item; extracting communication patterns from the input traffic group, each of the communication patterns being defined by one or more values in one or more respective fields having a same value, extracting, when extracting communication patterns from the input traffic group, any traffic group of the input traffic group containing a variation of values of a predetermined field among the one or more respective fields, and replacing the variation of values with a wild card and including the wild card corresponding to the predetermined field within the communication patterns; classifying pieces of malware with the extracted communication patterns similar to each other, into the same cluster; extracting, for each of the clusters, a communication pattern group as a malicious communication pattern, the communication pattern group having an appearance rate in respective traffic of pieces of malware belonging to that cluster, the appearance rate being equal to or larger than a predetermined value; and eliminating, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value. ### Claim 7 A non-transitory computer readable storage medium having stored therein a malicious communication pattern extraction program that causes a computer to execute a process comprising: receiving input of a traffic group of one or more pieces of malware, each item in the input traffic group has a same set of fields which each define different values that characterize a communication of the item; extracting communication patterns from the input traffic group, each of the communication patterns being defined by one or more values in one or more respective fields having a same value, extracting, when extracting communication patterns from the input traffic group, any traffic group of the input traffic group containing a variation of values of a predetermined field among the one or more respective fields, and replacing the variation of values with a wild card and including the wild card corresponding to the predetermined field within the communication patterns; classifying pieces of malware with the extracted communication patterns similar to each other, into the same cluster; extracting, for each of the clusters, a communication pattern group as a malicious communication pattern, the communication pattern group having an appearance rate in respective traffic of pieces of malware belonging to that cluster, the appearance rate being equal to or larger than a predetermined value; and eliminating, from the extracted malicious communication patterns, any malicious communication pattern having a conformance rate to a traffic group not infected with malware, the conformance rate being equal to or larger than a predetermined value.