Information identification method, program product, and system

A computer executed information identification program product for detecting an attack carried out using irregular data against a classifier that is configured by means of supervised machine learning, the program product causing a computer to execute the steps of:

• preparing a plurality of pieces of training data each including feature data, a label, and time;
• configuring the classifier by using the plurality of pieces of training data;
• configuring a sub-classifier by using the plurality of pieces of training data while classifying data in classes obtained through classification by the classifier, into subclasses;
• preparing a plurality of pieces of test data each including feature data, a label, and time;
• classifying the plurality of pieces of test data by using the classifier;
• classifying the plurality of pieces of test data that have been classified, into subclasses by using the sub-classifier;
• calculating statistical data representing a relative frequency of the plurality of pieces of test data with respect to the plurality of pieces of training data, the statistical data being calculated for each identical set of the subclasses in a time window having a predetermined width for the time;
• and
• warning of a possibility of occurrence of the attack carried out using the irregular data, in response to a value of the statistical data exceeding a predetermined threshold.

A computer implemented information identification system for detecting an attack carried out using irregular data against a classifier that is configured by means of supervised machine learning, the information identification system comprising:

• storage means;
• a plurality of pieces of training data each including feature data, a label, and time, and being stored in the storage means;
• a classifier configured by using the plurality of pieces of training data;
• a sub-classifier being configured by using the plurality of pieces of training data and being used for classifying data in classes obtained through classification by the classifier, into subclasses;
• data in the subclasses of the plurality of pieces of training data, the data being generated by applying the sub-classifier to the plurality of pieces of training data and being stored in the storage means;
• a plurality of pieces of test data each including feature data, a label, and time, and being stored in the storage means;
• data in subclasses of the plurality of pieces of test data, the data being generated by applying the sub-classifier to the plurality of pieces of test data and being stored in the storage means;
• calculation means for calculating statistical data representing a relative frequency of the plurality of pieces of test data with respect to the plurality of pieces of training data, the statistical data being calculated for each identical set of the subclasses in a time window having a predetermined width for the time;
• and
• warning means for warning of a possibility of occurrence of the attack carried out using the irregular data, in response to a value of the statistical data exceeding a predetermined threshold.