Malicious event detection device, malicious event detection method, and malicious event detection program
AssigneeNippon Telegraph and Telephone Corporation
InventorsKazunori KAMIYA, Yang ZHONG, Tohru SATO, Kensuke NAKATA
Life of this patent
Estimating the term…
Abstract
A playback device reads a traffic file which is a dump file of traffic when malicious or benign traffic is generated and generates traffic based on the traffic file on a network having a security instrument that generates an event in accordance with the traffic. In addition, a determination device collects an event generated by the security instrument for the generated traffic and. on the basis of a feature extracted from the collected event, determines whether the event to be determined is for malicious traffic or benign traffic.
Claims8
A malicious event detection device comprising:
- a memory;
- and
- a processor coupled to the memory and programmed to execute a process comprising:
- reading a traffic file which is a dump file of traffic when malicious or benign traffic is generated;
- generating traffic based on the traffic file on a network having a security instrument that generates an event in accordance with the traffic;
- collecting an event generated by the security instrument for the generated traffic;
- extracting a feature from the event collected by the collecting;
- and
- determining whether the event to be determined is for malicious traffic or benign traffic, on the basis of the feature extracted by the extracting.
A malicious event detection method executed in a malicious event detection system, the malicious event detection method comprising:
- reading a traffic file which is a dump file of traffic when malicious or benign traffic is generated;
- generating traffic based on the traffic file on a network having a security instrument that generates an event in accordance with the traffic;
- collecting an event generated by the security instrument for the generated traffic;
- extracting a feature from the event collected by the collecting;
- and
- of determining whether the event to be determined is for malicious traffic or benign traffic, on the basis of the feature extracted by the extracting.
A non-transitory computer-readable recording medium having stored a program for malicious event detection program that causes a computer to execute a processing comprising:
- reading a traffic file which is a dump file of traffic when malicious or benign traffic is generated;
- generating traffic based on the traffic file on a network having a security instrument that generates an event in accordance with the traffic;
- collecting an event generated by the security instrument for the generated traffic;
- extracting a feature from the event collected by the collecting;
- and
- determining whether the event to be determined is for malicious traffic or benign traffic, on the basis of the feature extracted by the extracting.
Dependencies are inferred from the claim text.