Infection-spreading attack detection system and method, and program

An infection-spreading attack detection method of detecting an occurrence of an infection-spreading attack in a network including a transfer device that transfers a packet, the method comprising:

• acquiring, by a first feature amount derivation unit, first traffic information on the packet transferred by the transfer device, and deriving based on the first traffic information a first feature amount of traffic for each of a plurality of partial address spaces formed by subdividing an address space of the packet;
• determining, by a monitoring target determination unit, based on the first feature amount derived by the first feature amount derivation unit M partial address space(s) to be a monitoring target out of the plurality of partial address spaces;
• acquiring, by a second feature amount derivation unit, second traffic information on the packet transferred by the transfer device having as a destination or a source, an address within the M partial address space(s) determined by the monitoring target determination unit, and deriving based on the second traffic information a second feature amount of the traffic for each of the M partial address space(s);
• and
• determining, by a detection unit, whether the second feature amount derived by the second feature amount derivation unit satisfies a predetermined detection condition for each of the M partial address space(s), and, by evaluating M determination results, determining whether an infection-spreading attack has occurred.

A non-transitory computer readable medium storing one or more instructions for detecting an occurrence of an infection-spreading attack in a network including a transfer device that transfers a packet, the one or more instructions causing a computer to execute:

• acquiring, by a first feature amount derivation unit, first traffic information on the packet transferred by the transfer device, and deriving based on the first traffic information a first feature amount of traffic for each of a plurality of partial address spaces formed by subdividing an address space of the packet;
• determining, by a monitoring target determination unit, based on the first feature amount derived by the first feature amount derivation unit M partial address space(s) to be a monitoring target out of the plurality of partial address spaces;
• acquiring, by a second feature amount derivation unit, second traffic information on the packet transferred by the transfer device having as a destination or a source, an address within the M partial address space(s) determined by the monitoring target determination unit, and deriving based on the second traffic information a second feature amount of the traffic for each of the M partial address space(s);
• and
• determining, by a detection unit, whether the second feature amount derived by the second feature amount derivation unit satisfies a predetermined detection condition for each of the M partial address space(s), and, by evaluating M determination results, determining whether an infection-spreading attack has occurred.