Connection destination malignancy determination system, connection destination malignancy determination program, and connection destination malignancy determination method

A connection destination malignancy determination program applied to a connection destination malignancy determination system connected to the Internet via a network, the program causing a computer to implement:

• a connection destination observation function for observing a connection destination using observation agents located in multiple geographic regions;
• a connection destination malignancy determination function for determining a malignancy indicating a degree of maliciousness of the connection destination;
• and
• a countermeasure priority determination function for determining a countermeasure priority indicating a degree of preferential countermeasure required based on the malignancy, regional differences in observation results from the multiple geographic regions, and an observation result of the connection destination,
• wherein the connection destination observation function observes connection destinations by instructing multiple observation agents to access URLs and receive observation results including status codes, content files, and file formats,
• wherein the connection destination malignancy determination function determines malignancy by executing machine learning algorithms that analyze downloaded executable files, detect malicious scripts in web pages, compare time-series response changes, and evaluate regional response differences, and
• wherein the countermeasure priority determination function calculates priority values using automated algorithms that process malignancy data and observation results to generate blocking lists for network security devices.

A connection destination malignancy determination method applied to a connection destination malignancy determination system connected to the Internet via a network, the method comprising:

• a connection destination observation step for observing a connection destination using observation agents located in multiple geographic regions;
• a connection destination malignancy determination step for determining a malignancy indicating a degree of maliciousness of the connection destination;
• and
• a countermeasure priority determination step for determining a countermeasure priority indicating a degree of preferential countermeasure required based on the malignancy, regional differences in observation results from the multiple geographic regions, and an observation result of the connection destination,
• wherein the connection destination observation step observes connection destinations by instructing multiple observation agents to access URLs and receive observation results including status codes, content files, and file formats,
• wherein the connection destination malignancy determination step determines malignancy by executing machine learning algorithms that analyze downloaded executable files, detect malicious scripts in web pages, compare time-series response changes, and evaluate regional response differences, and
• wherein the countermeasure priority determination step calculates priority values using automated algorithms that process malignancy data and observation results to generate blocking lists for network security devices.