# US 2016/0366159 A1 · Traffic feature information extraction method, traffic feature information extraction device, and traffic feature information extraction program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366159 A1 - Document ID: US20160366159A1 - Status: Published application - Kind: A1 - Application number: 15/120,933 - Filed: 2015-03-12 - Published: 2016-12-15 - Earliest claimed: 2014-03-19 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Daiki CHIBA; Takeshi YAGI; Tohru SATO; Kazunori KAMIYA; Kensuke NAKATA - Web page: https://patentgrep.com/patent/US20160366159A1 ## CPC - H04L 63/1416: {Event detection, e.g. attack signature detection} - G06F 21/55: Detecting local intrusion or implementing counter-measures - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1458: {Denial of Service} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract A traffic feature information extraction method including a regular expression process, a clustering process, and a feature information extraction process. The regular expression process extracts an item set in advance from a traffic log and represents a partial character string included in the item in a regular expression based on a predetermined rule. The clustering process clusters an entry of the traffic log represented in the regular expression. The feature information extraction process extracts, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the clustered traffic logs. ## Claims ### Claim 1 A traffic feature information extraction method to be executed in a traffic feature information extraction device, the method comprising: a regular expression step of extracting an item set in advance from a traffic log and representing a partial character string included in the item in a regular expression based on a predetermined rule; a clustering step of clustering an entry of the traffic log represented in the regular expression; and a feature information extraction step of extracting, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the traffic logs clustered in the clustering step. ### Claim 2 (depends on 1) The traffic feature information extraction method according to claim 1, wherein the regular expression step determines whether a word set forth in a word list is present in the partial character string included in the extracted item and when the word is present in the partial character string, this partial character string is not represented in the regular expression; when the word is not present in the partial character string, this partial character string is represented in the regular expression based on a predetermined rule. ### Claim 3 (depends on 2) The traffic feature information extraction method according to claim 2, wherein the word list is generated by calculating a statistic value for items used in a protocol stack for communication in the traffic log generated by malware and then extracting a certain character string included in the item having the calculated statistic value equal to or larger than a threshold. ### Claim 4 (depends on 1) The traffic feature information extraction method according to claim 1, wherein the clustering process uses at least one of an approach that uses destination information indicating a destination of communication to cluster the traffic log and an approach that uses a protocol for communication to cluster the traffic log. ### Claim 5 (depends on 1) The traffic feature information extraction method according to claim 1, further comprising a refinement step of calculating a statistic value within the traffic logs using these traffic logs represented in the regular expression in accordance with an indicator set in advance and refining the feature information based on the feature information extracted from the traffic logs clustered in the clustering step and the statistic value. ### Claim 6 (depends on 5) The traffic feature information extraction method according to claim 5, further comprising an identification step of comparing the feature information refined in the refinement process and a certain traffic log on a network to be protected to calculate a score using an indicator set in advance and identifying an entry having the score equal to or larger than a threshold within the traffic logs. ### Claim 7 A traffic feature information extraction device, comprising: a regular expression unit that extracts an item set in advance from a traffic log and represents a partial character string included in the item in a regular expression based on a predetermined rule; a clustering unit that clusters an entry of the traffic log represented in the regular expression; and a feature information extraction unit that extracts, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the traffic logs clustered by the clustering unit. ### Claim 8 A non-transitory computer-readable recording medium having stored therein a traffic feature information extraction program that causes a computer to execute a process comprising: a regular expression procedure of extracting an item set in advance from a traffic log and represents a partial character string included in the item in a regular expression based on a predetermined rule; a clustering procedure of clustering an entry of the traffic log represented in the regular expression; and a feature information extraction procedure of extracting, as traffic feature information of each of clusters, an entry having a minimum total sum of distances among entries included in the traffic logs clustered in the clustering procedure.