US 2021/0344697 A1 · DETECTION DEVICE AND DETECTION PROGRAM

Abstract

A regularization unit standardizes similar expressions across a plurality of URIs in access logs of requests made to a plurality of web servers, thereby changing the URIs into regularized URIs. A calculation unit calculates, among the access logs that are from the same source, the relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for the same regularized URI and also corresponding to certain response codes. If the largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, a determination unit determines the regularized URIs to be scanning targets.

Claims11

Dependent claims

A detection method, comprising:

standardizing similar expressions across a plurality of Uniform Resource Identifiers (URIs) in access logs of requests made to a plurality of web servers to change the URIs into regularized URIs;
calculating, among the access logs that are from a same source, a relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for a same one of the regularized URIs and also corresponding to certain response codes;
and
determining, when largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, the regularized URIs to be scanning target URIs.

1 more element

Dependencies are inferred from the claim text.

Detection device and detection program

Life of this patent

Detection device and detection program

Life of this patent

Abstract

Claims11