Detection device and detection method
AssigneeNippon Telegraph and Telephone Corporation
InventorsYuhei Hayashi, Ichiro Kudo, Hiroshi Osawa, Takeaki Nishioka
Life of this patent
Estimating the term…
Abstract
A feature calculation unit calculates a feature of header information of a packet. A classification unit classifies the packet as a normal packet or an abnormal packet by using the calculated feature. An adding unit adds a label indicating a tool name of a known attack tool to header information of a packet attacked using the attack tool. A learning unit learns the addition of the label by using the label and the feature calculated for the packet to which the label has been added as teacher data.
Claims4
A detection device comprising:
- a feature calculation unit, including one or more processors, configured to calculate a feature of header information of a packet by using a number of packets on a per 5-tuple basis and a distribution of values of a predetermined header field;
- a classification unit, including one or more processors, configured to classify the packet as either a normal packet that is not attacked by an attacker or an abnormal packet that is attacked by an attacker by comparing the calculated feature to a threshold value of classification;
- an adding unit, including one or more processors, configured to add a label indicating a tool name of a known attack tool to header information of an attacked packet that is attacked using the known attack tool;
- and
- a learning unit, including one or more processors, configured to:
- use the label added to the attacked packet and the feature calculated for the attacked packet as teach data, and
- learn a model for adding labels to packets, wherein the learned model indicates a relationship between each label and the calculated features of a corresponding packet.
A detection method that is performed by a detection device, the detection method comprising:
- calculating a feature of header information of a packet by using a number of packets on a per 5-tuple basis and a distribution of values of a predetermined header field;
- and
- classifying the packet as either a normal packet that is not attacked by an attacker or an abnormal packet that is attacked by an attacker by comparing the calculated feature to a threshold value of classification;
- adding a label indicating a tool name of a known attack tool to header information of an attacked packet that is attacked using the known attack tool;
- using the label added to the attacked packet and the feature calculated for the attacked packet as teach data;
- and
- learning a model for adding labels to packets, wherein the learned model indicates a relationship between each label and the calculated features of a corresponding packet.
Dependencies are inferred from the claim text.