Malicious communication pattern extraction device, malicious communication pattern extraction system, malicious communication pattern extraction method, and malicious communication pattern extraction program

A malicious communication pattern extraction system, comprising:

• a malicious communication pattern extraction device that extracts a malicious communication pattern to detect traffic caused by malware;
• a first network that generates a first traffic log obtained from the traffic caused by malware;
• and
• a second network that generates a second traffic log obtained from traffic in a predetermined communication environment, wherein
• the malicious communication pattern extraction device includes
• a statistical value calculation unit that calculates a statistical value for an appearance frequency of each of a plurality of communication patterns that is a combination of a field and a value, from the first traffic log and the second traffic log;
• an extraction unit that compares between the appearance frequency of the first traffic log and the appearance frequency of the second traffic log for each of the communication patterns, based on the statistical value calculated by the statistical value calculation unit, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold;
• and
• a threshold setting unit that sets a threshold to detect whether the traffic is caused by malware, when the malicious communication pattern extracted by the extraction unit is applied, the threshold being a threshold for number of times the communication pattern is matched with at least one type of the malicious communication pattern, or a threshold for number of types of the malicious communication pattern when the communication pattern is matched with the malicious communication pattern, and the threshold being set so that an erroneous detection rate that is probability of erroneously detecting the traffic caused by malware is equal to or less than a certain value as well as a detection rate that is probability of detecting the traffic caused by malware is equal to or more than a certain value.

A malicious communication pattern extraction method that extracts a malicious communication pattern to detect traffic caused by malware, the malicious communication pattern extraction method, comprising:

• generating first traffic log that generates a first traffic log obtained from the traffic caused by malware;
• generating second traffic log that generates a second traffic log obtained from traffic in a predetermined communication environment;
• calculating statistical value that calculates a statistical value for an appearance frequency of each of a plurality of communication patterns that is a combination of a field and a value, from the first traffic log and the second traffic log;
• extracting that compares between the appearance frequency of the first traffic log and the appearance frequency of the second traffic log for each of the communication patterns, based on the statistical value calculated by the calculating statistical value, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold;
• and
• setting threshold that sets a threshold to detect whether the traffic is caused by malware, when the malicious communication pattern extracted by the extracting is applied, the threshold being a threshold for number of times the communication pattern is matched with at least one type of the malicious communication pattern, or a threshold for number of types of the malicious communication pattern when the communication pattern is matched with the malicious communication pattern, and the threshold being set so that an erroneous detection rate that is probability of erroneously detecting the traffic caused by malware is equal to or less than a certain value as well as a detection rate that is probability of detecting the traffic caused by malware is equal to or more than a certain value.

A non-transitory computer-readable recording medium having stored a malicious communication pattern extraction program that causes a computer to extract a malicious communication pattern to detect traffic caused by malware, the malicious communication pattern extraction program causes a computer to execute a process, comprising:

• a step of calculating statistical value that calculates a statistical value for an appearance frequency of each of a plurality of communication patterns that is a combination of a field and a value, from a first traffic log obtained from the traffic caused by malware and a second traffic log obtained from traffic in a predetermined communication environment;
• a step of extracting that compares between the appearance frequency of the first traffic log and the appearance frequency of the second traffic log for each of the communication patterns, based on the statistical value calculated by the step of calculating statistical value, and extracts the communication pattern as the malicious communication pattern when a difference between both of the appearance frequencies is equal to or more than a predetermined threshold;
• and
• a step of setting threshold that sets a threshold to detect whether the traffic is caused by malware, when the malicious communication pattern extracted by the step of extracting is applied, the threshold being a threshold for number of times the communication pattern is matched with at least one type of the malicious communication pattern, or a threshold for number of types of the malicious communication pattern when the communication pattern is matched with the malicious communication pattern, and the threshold being set so that an erroneous detection rate that is probability of erroneously detecting the traffic caused by malware is equal to or less than a certain value as well as a detection rate that is probability of detecting the traffic caused by malware is equal to or more than a certain value.