# US 2016/0366171 A1 · Extraction criterion determination method, communication monitoring system, extraction criterion determination apparatus and extraction criterion determination program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2016/0366171 A1 - Document ID: US20160366171A1 - Status: Published application - Kind: A1 - Application number: 15/120,970 - Filed: 2015-03-16 - Published: 2016-12-15 - Earliest claimed: 2014-03-19 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Takeshi YAGI; Daiki CHIBA; Kazunori KAMIYA; Tohru SATO; Kensuke NAKATA - Web page: https://patentgrep.com/patent/US20160366171A1 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - G06F 21/563: {by source code analysis} - H04L 12/6418: {Hybrid transport} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/145: {the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms} - H04L 63/1458: {Denial of Service} - G06F 2221/2101: Auditing as a secondary aspect - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract An extraction criterion determination method performed by an extraction criterion determination apparatus includes collecting a log information entry that is in a predetermined period of time and determined to be a specific communication, extracting a communication satisfying a criterion used to extract the specific communication from log information entries from the collected log information entries with reference to a storage unit storing an extraction criterion in which the criterion is defined, determining to adopt the extraction criterion when the ratio of the specific communications to the extracted communications is larger than or equal to a threshold, and performing a control to output the adopted extraction criterion. ## Claims ### Claim 1 An extraction criterion determination method performed by an extraction criterion determination apparatus, the method comprising: collecting a log information entry of a communication performed in a predetermined period of time, the log information entry being determined to be a specific communication; extracting a communication satisfying a criterion from the collected log information entries with reference to a storage unit storing an extraction criterion, the criterion being used to extract the specific communication from the log information entries, the criterion being defined in the extraction criterion; determining to adopt the extraction criterion when a ratio of the specific communications to the extracted communications is larger than or equal to a threshold; and performing a control to output the adopted extraction criterion. ### Claim 2 (depends on 1) The extraction criterion determination method according to claim 1, wherein the storage unit stores an extraction criterion defining a plurality of criteria, and a communication satisfying the criteria is extracted from the log information entries in the extraction. ### Claim 3 (depends on 2) The extraction criterion determination method according to claim 2, wherein the storage unit stores an extraction criterion in which the criteria are defined in predetermined order, and a communication satisfying the criteria in the predetermined order is extracted from the log information entries in the extraction. ### Claim 4 (depends on 1) The extraction criterion determination method according to claim 1, wherein an undetermined log information entry that has not been determined to be the specific communication is collected as the log information entry in the collection, a communication satisfying the criterion is extracted from the undetermined log information entries in the extraction, and characteristic information indicating a characteristic of the communication extracted from the undetermined log information entries is output to a communication monitoring device monitoring communications in a network in the output control so that the communication monitoring device detects a communication matching the characteristic information. ### Claim 5 A communication monitoring system comprising: a communication monitoring device that monitors communications in a network; and an extraction criterion determination apparatus, the extraction criterion determination apparatus including: a storage unit that stores an extraction criterion in which a criterion used to extract a specific communication from log information entries of the communications is defined; a collection unit that collects a log information entry from the communication monitoring device, the log information entry being log information of a communication in a predetermined period of time, the log information entry being determined to be the specific communication; an extraction unit that extracts a communication satisfying the criterion from the collected log information entries with reference to the storage unit; a determination unit that determines to adopt the extraction criterion when a ratio of the specific communications to the extracted communications is larger than or equal to a threshold; and an output control unit that performs a control to output the adopted extraction criterion. ### Claim 6 (depends on 5) The communication monitoring system according to claim 5, wherein the collection unit collects an undetermined log information entry that has not been determined to be the specific communication as the log information entry, the extraction unit extracts a communication satisfying the criterion from the undetermined log information entries, the output control unit outputs characteristic information indicating a characteristic of the communication extracted from the undetermined log information entries to the communication monitoring device, and the communication monitoring device detects a communication matching the output characteristic information from the communications in the network. ### Claim 7 An extraction criterion determination apparatus comprising: a storage unit that stores an extraction criterion in which a criterion used to extract a specific communication from log information entries of communications is defined; a collection unit that collects a log information entry, the log information entry being log information of a communication in a predetermined period of time, the log information entry being determined to be the specific communication; an extraction unit that extracts a communication satisfying the criterion from the collected log information entries with reference to the storage unit; a determination unit that determines to adopt the extraction criterion when a ratio of the specific communications to the extracted communications is larger than or equal to a threshold; and an output control unit that performs a control to output the adopted extraction criterion. ### Claim 8 A non-transitory computer-readable recording medium having stored an extraction criterion determination program for causing a computer to execute a process comprising: a step of collecting a log information entry, the log information entry being log information of a communication in a predetermined period of time, the log information entry being determined to be a specific communication; a step of extracting a communication satisfying a criterion from the collected log information entries with reference to a storage unit storing an extraction criterion, the criterion being used to extract the specific communication from the log information entries, the criterion being defined in the extraction criterion; a step of determining to adopt the extraction criterion when a ratio of the specific communications to the extracted communications is larger than or equal to a threshold; and a step of performing a control to output the adopted extraction criterion.