# US 2019/0173897 A1 · Malicious communication log detection device, malicious communication log detection method, and malicious communication log detection program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2019/0173897 A1
- Document ID: US20190173897A1
- Status: Published application
- Kind: A1
- Application number: 16/307,290
- Filed: 2017-06-01
- Published: 2019-06-06
- Earliest claimed: 2016-06-20
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Yasushi OKANO
- Web page: https://patentgrep.com/patent/US20190173897A1

## CPC

- H04L 63/1416: {Event detection, e.g. attack signature detection}
- G06F 16/313: {Selection or weighting of terms for indexing}
- G06F 16/353: into predefined classes
- G06F 21/55: Detecting local intrusion or implementing counter-measures
- G06F 21/552: {involving long-term monitoring or reporting}
- G06N 3/08: Learning methods
- G06N 5/01: Dynamic search techniques; Heuristics; Dynamic trees; Branch-and-bound
- G06N 20/10: using kernel methods, e.g. support vector machines [SVM]
- H03M 7/30: Compression (speech analysis-synthesis for redundancy reduction G10L19/00; for image communication H04N); Expansion; Suppression of unnecessary data, e.g. redundancy reduction
- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1433: {Vulnerability analysis}
- H03M 7/3084: {using adaptive string matching, e.g. the Lempel-Ziv method}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H03M: CODING; DECODING; CODE CONVERSION IN GENERAL (using fluidic means F15C4/00; optical analogue/digital converters G02F7/00; coding, decoding or code conversion, specially adapted for particular applications, see the relevant subclasses, e.g. G01D, G01R, G06F, G06T, G09G, G10L, G11B, G11C, H04B, H04L, H04M, H04N; ciphering or deciphering for cryptography or other purposes involving the need for secrecy G09C)

## Abstract

A malicious communication log detection device compresses first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a target communication log. The malicious communication log detection device calculates a score for determining whether the target communication log is malicious or benign based on a data size of the compressed first character strings and a data size of the compressed second character strings. The malicious communication log detection device determines whether the target communication log is malicious or benign based on the calculated score and a predetermined parameter.

## Claims

### Claim 1

A malicious communication log detection device comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
compressing, using a predetermined algorithm, first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a communication log as a classification target;
calculating a score for determining whether the communication log as a classification target is malicious or benign based on a data size of the first character strings compressed by the compressing and a data size of the second character strings compressed by the compressing; and
determine whether the communication log as a classification target is malicious or benign based on the score calculated by the calculating and a predetermined parameter.

### Claim 2 (depends on 1)

The malicious communication log detection device according to claim 1, wherein the process further comprising:
deleting, from the first character strings, a character string that satisfies a predetermined condition and is determined to be redundant, wherein
the compressing compresses the first character strings from which the character string determined to be redundant has been deleted by the deletion unit deleting, and the second character strings.

### Claim 3 (depends on 2)

The malicious communication log detection device according to claim 2, wherein, in a case in which the character strings representing the characteristic include a plurality of duplicate character strings, the deleting deletes a predetermined number of character strings from the duplicate character strings.

### Claim 4 (depends on 2)

The malicious communication log detection device according to claim 2, wherein the deleting deletes, from the character strings representing characteristics of a communication log that is known to be malicious, a character string having similarity equal to or larger than a predetermined value, the similarity indicating a similarity to a character string included in the character strings representing characteristics of a communication log that is known to be benign.

### Claim 5 (depends on 1)

The malicious communication log detection device according to claim 1, wherein the process further comprising adjusting the predetermined parameter based on a determination result obtained by the determining.

### Claim 6 (depends on 1)

The malicious communication log detection device according to claim 1, wherein
the compressing divides the first character strings into a plurality of strings and compresses the divided strings, and
the calculating calculates the score for each of the divided first character strings.

### Claim 7 (depends on 1)

The malicious communication log detection device according to claim 1, wherein
the calculating calculates a malicious score representing a degree that the communication log as a classification target is malicious, and a benign score representing a degree that the communication log as a classification target is benign, and when both of the malicious score and the benign score are smaller than a first value, or when both of the malicious score and the benign score are larger than a second value, the determining determines that the communication log as a classification target is malicious.

### Claim 8 (depends on 1)

The malicious communication log detection device according to claim 1, wherein the calculation unit calculating calculates a score representing any one of a degree that the communication log as a classification target is malicious and a degree that the communication log as a classification target is benign, and
when the score is smaller than a third value, or when the score is larger than a fourth value, the determining determines that the communication log as a classification target is malicious.

### Claim 9 (depends on 1)

The malicious communication log detection device according to claim 1, wherein the determining determines whether the communication log as a classification target is malicious or benign based on the score calculated by the calculating, the predetermined parameter, and a characteristic amount extracted from a character string representing a characteristic of the communication log, the character string having an attribute different from an attribute of the first character strings.

### Claim 10

A malicious communication log detection method executed by a malicious communication log detection device, the method comprising:
compressing, using a predetermined algorithm, first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a communication log as a classification target;
calculating a score for determining whether the communication log as a classification target is malicious or benign based on a data size of the first character strings compressed at the step compressing and a data size of the second character strings compressed at the compressing; and
determining whether the communication log as a classification target is malicious or benign based on the score calculated at the calculating and a predetermined parameter.

### Claim at position 11

11 A non-transitory computer-readable recording medium including a stored program for malicious communication log detection program that causes a computer to execute a process comprising:
compressing, using a predetermined algorithm, first character strings representing characteristics of a communication log that is known to be malicious or benign, and second character strings obtained by coupling the first character strings with a character string representing a characteristic of a communication log as a classification target;
calculating a score for determining whether the communication log as a classification target is malicious or benign based on a data size of the first character strings compressed at the compressing and a data size of the second character strings compressed at the compressing; and
determining whether the communication log as a classification target is malicious or benign based on the score calculated at the calculating and a predetermined parameter.