Back to results
US 10,652,259 B2Granted
Information processing apparatus, method and medium for classifying unauthorized activity
AssigneePfu Limited
InventorsSeigo Terada, Keiji Michine
Life of this patent
Estimating the term…
Abstract
An information processing apparatus specifies the phase of activity of a terminal connected to a network by comparing a communication by the terminal with a previously held pattern, specifies the type of behavior of the terminal in relation to a first communication and a second communication, by correlation analysis between a first phase specified based on the first communication of the terminal and a second phase specified based on the second communication which is conducted before or after the first communication, and classifies the unauthorized activity of the terminal based on the specified type of behavior when determination is made that the terminal is used to conduct unauthorized activity.
Claims14
An information processing apparatus, comprising:
- a memory;
- and
- a processor coupled to the memory, the processor being configured to execute:
- comparing a communication by a terminal connected to a network with a pattern held in advance;
- specifying a phase of activity of the terminal, in accordance with a result of the comparing;
- determining whether or not the terminal is used to conduct unauthorized activity;
- when correlation analysis between a first phase and a second phase is performed and a behavior of traffic observed with the phase transition between the first phase and the second phase at the terminal satisfies a previously established correlation condition, specifying the correlation condition as a type of behavior of the terminal in relation to a first communication and a second communication and storing the correlation condition in association with an identification information of the terminal, the first phase being specified with respect to the first communication of the terminal and the second phase being specified with respect to the second communication of the terminal carried out before or after the first communication;
- and
- classification which involves classifying unauthorized activity of the terminal by referring to information that indicates correspondences between classifications of unauthorized activity and one or a plurality of the correlation conditions related to the unauthorized activity based on the correlation condition which is satisfied by the correlation analysis between phases in the same terminal and stored with respect to the terminal, when determination is made in the determining that the terminal is used to conduct unauthorized activity.
6 more elements
A method for classifying unauthorized activity, the method causing a computer to execute:
- comparing a communication by a terminal connected to a network with a pattern held in advance;
- specifying a phase of activity of the terminal, in accordance with a result of the comparing;
- determining whether or not the terminal is used to conduct unauthorized activity;
- when correlation analysis between a first phase and a second phase is performed and a behavior of traffic observed with the phase transition between the first phase and the second phase at the terminal satisfies a previously established correlation condition, specifying a type of behavior of the terminal in relation to a first communication and a second communication and storing the correlation condition in association with an identification information of the terminal, the first phase being specified with respect to the first communication of the terminal and the second phase being specified with respect to the second communication of the terminal carried out before or after the first communication;
- and
- classification which involves classifying unauthorized activity of the terminal by referring to information that indicates correspondences between classifications of unauthorized activity and one or a plurality of the correlation conditions related to the unauthorized activity based on the correlation condition which is satisfied by the correlation analysis between phases in the same terminal and stored with respect to the terminal, when determination is made in the determining that the terminal is used to conduct unauthorized activity.
3 more elements
A computer-readable non-transitory medium on which is recorded a program for classifying unauthorized activity,
- the program causing a computer to execute:
- comparing a communication by a terminal connected to a network with a pattern held in advance;
- specifying a phase of activity of the terminal, in accordance with a result of the comparing;
- determining whether or not the terminal is used to conduct unauthorized activity;
- when correlation analysis between a first phase and a second phase is performed and a behavior of traffic observed with the phase transition between the first phase and the second phase at the terminal satisfies a previously established correlation condition, specifying the correlation condition as a type of behavior of the terminal in relation to a first communication and a second communication and storing the correlation condition in association with an identification information of the terminal, the first phase being specified with respect to the first communication of the terminal and the second phase being specified with respect to the second communication of the terminal carried out before or after the first communication;
- and
- classification which involves classifying unauthorized activity of the terminal by referring to information that indicates correspondences between classifications of unauthorized activity and one or a plurality of the correlation conditions related to the unauthorized activity based on the correlation condition which is satisfied by the correlation analysis between phases in the same terminal and stored with respect to the terminal, when determination is made in the determining that the terminal is used to conduct unauthorized activity.
4 more elements
Dependencies are inferred from the claim text.