# US 11,907,365 B2 · Information processing device and information processing program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 11,907,365 B2
- Document ID: US11907365B2
- Status: Granted
- Kind: B2
- Application number: 17/283,552
- Filed: 2019-05-20
- Published: 2021-12-16
- Granted: 2024-02-20
- Earliest claimed: 2018-10-10
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Nariyoshi Chida; Yo Kanemoto; Kazufumi Aoki
- Web page: https://patentgrep.com/patent/US11907365B2

## CPC

- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/552: {involving long-term monitoring or reporting}
- G06F 40/205: Parsing
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- G06F 2221/034: Test or assess a computer or a system
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

An information processing device includes an element extraction unit that extracts elements relating to actions of an attacker from each input log, a generation unit that generates a parser based on definition information defining the actions of the attacker in a formal grammar, the parser detecting, from a log, a log string having a feature corresponding to an action defined by the definition information, a parsing unit that detects, from a log consisting of the elements extracted by the element extraction unit, log strings having features corresponding to the actions defined by the definition information by using the parser, and a reconstruction unit that reconstructs the log strings detected by the parsing unit, adds a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputs the labeled log strings as a log corresponding to a series of actions of the attacker.

## Claims

### Claim 1

An information processing device comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
extracting elements relating to actions of an attacker from each input log;
generating a parser based on definition information that defines the actions of the attacker in a formal grammar, the parser being configured to detect, from a log, a log string having a feature corresponding to an action defined by the definition information;
detecting, from a log consisting of the elements extracted by the extracting, log strings having features corresponding to the actions defined by the definition information by using the parser; and
reconstructing the log strings detected by the detecting, add a label indicating an action defined by the definition information to each of the reconstructed log strings, and output the labeled log strings as a log corresponding to a series of actions of the attacker.

### Claim 2 (depends on 1)

The information processing device of claim 1, wherein the definition information is described in a formal grammar dealing with an element as a terminal symbol.

### Claim 3 (depends on 1)

The information processing device of claim 1, wherein
the definition information includes information indicating an order of the actions of the attacker, and
the reconstructing disposes the labeled log strings in the order indicated by the definition information and outputs the log as a log corresponding to a series of actions of the attacker.

### Claim 4

A non-transitory computer-readable recording medium having stored therein an analysis program for causing a computer to execute a process comprising:
a step of extracting elements relating to actions of an attacker from each input log;
a step of generating a parser based on definition information that defines the actions of the attacker in a formal grammar, the parser being configured to detect, from a log, a log string having a feature corresponding to an action defined by the definition information;
a step of detecting, from a log consisting of the elements extracted at the step of extracting the elements, log strings having features corresponding to the actions defined by the definition information by using the parser; and
a step of reconstructing the log strings detected at the step of detecting the log strings, adding a label indicating an action defined by the definition information to each of the reconstructed log strings, and outputting the labeled log strings as a log corresponding to a series of actions of the attacker.