# US 2020/0401608 A1 · Classification device and classification method

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2020/0401608 A1
- Document ID: US20200401608A1
- Status: Published application
- Kind: A1
- Application number: 16/975,687
- Filed: 2019-02-22
- Published: 2020-12-24
- Earliest claimed: 2018-02-27
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Shohei ARAKI; Bo HU; Kazunori KAMIYA; Masaki TANIKAWA
- Web page: https://patentgrep.com/patent/US20200401608A1

## CPC

- G06F 16/285: {Clustering or classification}
- G06N 5/025: Extracting rules from data
- G06F 16/26: Visual data mining; Browsing structured data
- G06N 20/00: Machine learning
- H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)}
- H04L 69/324: in the data link layer [OSI layer 2], e.g. HDLC
- H04L 69/326: in the transport layer [OSI layer 4] (H04L69/16 takes precedence)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- G06N: COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A classification apparatus 10 acquires a communication log including a plurality of pieces of traffic data, and extracts different types of feature values from the plurality of pieces of traffic data. Subsequently, the classification apparatus 10 classifies the traffic data on a per IP address basis based on the extracted different types of feature values, and uses a plurality of classification results to count the number of times of appearance of a pattern having the same combination of the classification results.

## Claims

### Claim at position 1

-7. (canceled)

### Claim 8

A computer-implemented method for determining aspects of data, the method comprising:
receiving a plurality of data as input;
extracting, based on a plurality of predetermined distinct feature types, one or more feature values for respective predetermined distinct feature types from the plurality of data;
generating, based on the extracted one or more feature values using a predetermined unit, a plurality of classes of data, wherein each class includes one or more of the plurality of data; and
generating, based on the generated plurality of classes of data, one or more scores representing a number of appearances of a pattern of data where a combination of the one or more of the plurality of data among the plurality of classes is identical.

### Claim 9 (depends on 8)

The computer-implemented method of claim 8, the method further comprising:
providing the pattern of data where the combination of the one or more of the plurality of data among the plurality of classes is identical.

### Claim 10 (depends on 8)

The computer-implemented method of claim 8, the method further comprising:
receiving a communication log as the plurality of data, wherein the communication log includes a plurality of traffic data; and
extracting one or more feature values for each of the plurality of predetermined distinct feature types, wherein the plurality of predetermined distinct feature types relates to one or more of:
a number of bytes of transmitted data in traffic data,
a number of bytes of received data in the traffic data,
a transmission flag of the traffic data,
a reception flag of the traffic data,
a port number of a destination of the traffic data, and
a port number of a sender of the traffic data.

### Claim 11 (depends on 8)

The computer-implemented method of claim 8, wherein the generating the plurality of classes of data uses a process of an unsupervised machine learning.

### Claim 12 (depends on 8)

The computer-implemented method of claim 8, wherein the generating the one or more scores uses a process of a frequent pattern mining.

### Claim 13 (depends on 8)

The computer-implemented method of claim 8, the method further comprising:
generating a set of select data from the plurality of data, the select data satisfying one or more predetermined conditions; and
replacing the plurality of data with the set of select data for further processing of the plurality of data.

### Claim 14 (depends on 8)

The computer-implemented method of claim 8, wherein the plurality of classes of data relate to TCP flags and packet sizes for determining the one or more scores associated with data transmission to the darknet.

### Claim 15

A system for determining aspects of data, the system comprises:
a processor; and
a memory storing computer-executable instructions that when executed by the processor cause the system to:
receive a plurality of data as input;
extract, based on a plurality of predetermined distinct feature types, one or more feature values for respective predetermined distinct feature types from the plurality of data;
generate, based on the extracted one or more feature values using a predetermined unit, a plurality of classes of data, wherein each class includes one or more of the plurality of data; and
generate, based on the generated plurality of classes of data, one or more scores representing a number of appearances of a pattern of data where a combination of the one or more of the plurality of data among the plurality of classes is identical.

### Claim 16 (depends on 15)

The system of claim 15, the computer-executable instructions when executed further causing the system to:
provide the pattern of data where the combination of the one or more of the plurality of data among the plurality of classes is identical.

### Claim 17 (depends on 15)

The system of claim 15, the computer-executable instructions when executed further causing the system to:
receive a communication log as the plurality of data, wherein the communication log includes a plurality of traffic data; and
extract one or more feature values for each of the plurality of predetermined distinct feature types, wherein the plurality of predetermined distinct feature types relates to one or more of:
a number of bytes of transmitted data in traffic data,
a number of bytes of received data in the traffic data,
a transmission flag of the traffic data,
a reception flag of the traffic data,
a port number of a destination of the traffic data, and
a port number of a sender of the traffic data.

### Claim 18 (depends on 15)

The system of claim 15, wherein the generating the plurality of classes of data uses a process of an unsupervised machine learning.

### Claim 19 (depends on 15)

The system of claim 15, wherein the generating the one or more scores uses a process of a frequent pattern mining.

### Claim 20 (depends on 15)

The system of claim 15, the computer-executable instructions when executed further causing the system to:
generate a set of select data from the plurality of data, the select data satisfying one or more predetermined conditions; and
replace the plurality of data with the set of select data for further processing of the plurality of data.

### Claim 21 (depends on 15)

The system of claim 15, wherein the plurality of classes of data relate to TCP flags and packet sizes for determining the one or more scores associated with data transmission to the darknet.

### Claim 22

A computer-readable non-transitory recording medium storing computer-executable instructions that when executed by a processor cause a computer system to:
receive a plurality of data as input;
extract, based on a plurality of predetermined distinct feature types, one or more feature values for respective predetermined distinct feature types from the plurality of data;
generate, based on the extracted one or more feature values using a predetermined unit, a plurality of classes of data, wherein each class includes one or more of the plurality of data; and
generate, based on the generated plurality of classes of data, one or more scores representing a number of appearances of a pattern of data where a combination of the one or more of the plurality of data among the plurality of classes is identical.

### Claim 23 (depends on 22)

The computer-readable non-transitory recording medium of claim 22, the computer-executable instructions when executed further causing the system to:
provide the pattern of data where the combination of the one or more of the plurality of data among the plurality of classes is identical.

### Claim 24 (depends on 22)

The computer-readable non-transitory recording medium of claim 22, the computer-executable instructions when executed further causing the system to:
receive a communication log as the plurality of data, wherein the communication log includes a plurality of traffic data; and
extract one or more feature values for each of the plurality of predetermined distinct feature types, wherein the plurality of predetermined distinct feature types relates to one or more of:
a number of bytes of transmitted data in traffic data,
a number of bytes of received data in the traffic data,
a transmission flag of the traffic data,
a reception flag of the traffic data,
a port number of a destination of the traffic data, and
a port number of a sender of the traffic data.

### Claim 25 (depends on 22)

The computer-readable non-transitory recording medium of claim 22, wherein the generating the plurality of classes of data uses a process of an unsupervised machine learning.

### Claim 26 (depends on 22)

The computer-readable non-transitory recording medium of claim 22, the computer-executable instructions when executed further causing the system to:
generate a set of select data from the plurality of data, the select data satisfying one or more predetermined conditions; and
replace the plurality of data with the set of select data for further processing of the plurality of data.

### Claim 27 (depends on 22)

The computer-readable non-transitory recording medium of claim 22, wherein the plurality of classes of data relate to TCP flags and packet sizes for determining the one or more scores associated with data transmission to the darknet.