# US 2021/0344697 A1 · Detection device and detection program > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 2021/0344697 A1 - Document ID: US20210344697A1 - Status: Published application - Kind: A1 - Application number: 17/283,021 - Filed: 2019-04-23 - Published: 2021-11-04 - Earliest claimed: 2018-10-10 - Assignees: Nippon Telegraph and Telephone Corporation - Applicants: Nippon Telegraph and Telephone Corporation - Inventors: Kotomi KUROKI; Yo KANEMOTO; Kazufumi AOKI - Web page: https://patentgrep.com/patent/US20210344697A1 ## CPC - H04L 63/1408: {by monitoring network traffic (monitoring network traffic per se H04L43/00)} - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1433: {Vulnerability analysis} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A regularization unit standardizes similar expressions across a plurality of URIs in access logs of requests made to a plurality of web servers, thereby changing the URIs into regularized URIs. A calculation unit calculates, among the access logs that are from the same source, the relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for the same regularized URI and also corresponding to certain response codes. If the largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, a determination unit determines the regularized URIs to be scanning targets. ## Claims ### Claim 1 A detection method, comprising: standardizing similar expressions across a plurality of Uniform Resource Identifiers (URIs) in access logs of requests made to a plurality of web servers to change the URIs into regularized URIs; calculating, among the access logs that are from a same source, a relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for a same one of the regularized URIs and also corresponding to certain response codes; and determining, when largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, the regularized URIs to be scanning target URIs. ### Claim 2 (depends on 1) The detection method according to claim 1, further comprising excluding known scanning target URIs from URIs determined to be scanning targets by the determining. ### Claim 3 (depends on 1) The detection method according to claim 1, further comprising outputing, when a URI determined to be a scanning target by the has a known web application name therein, the web application name. ### Claim 4 (depends on 1) The detection method according to claim 1, further comprising outputing, when a URI determined to be a scanning target by the determination unit has a directory structure that is identical to a directory structure for resources of a known web application, a web application name of the web application. ### Claim 5 (depends on 1) The detection method according to claim 1, further comprising placing, with sets each being formed of the regularized URIs in the access logs from a corresponding source, when a degree of similarity between any two of the sets is at least a certain threshold, the different sources corresponding to the sets into a same group, wherein the calculating calculates the relative frequencies while assuming that the sources placed in the same group are one same source. ### Claim 6 (depends on 1) A computer-readable recording medium having stored a detection program configured to cause a computer to perform the method according to 5 claim 1. ### Claim 7 A detection device, comprising: regularization circuitry configured to standardize similar expressions across a plurality of Uniform Resource Identifiers (URIs) in access logs of requests made to a plurality of web servers to change the URIs into regularized URIs; calculation configured to calculate, among the access logs that are from a same source, a relative frequency of certain access logs to all access logs, the certain access logs corresponding to requests made to different destinations for a same one of the regularized URIs and also corresponding to certain response codes; and determination circuitry configured to, when largest of all the relative frequencies calculated for the regularized URIs is at least a certain threshold, determine the regularized URIs to be scanning target URIs. ### Claim 8 (depends on 7) The detection device according to claim 7, further comprising: exclusion circuitry configured to exclude scanning target URIs from URIs determined to be scanning targets by the determination circuitry. ### Claim 9 (depends on 7) The detection device according to claim 7, further comprising: application name verification circuitry configured to, when a URI determined to be a scanning target by the determination circuitry has a known web application name therein, output the web application name. ### Claim 10 (depends on 7) The detection device according to claim 7, further comprising: structure verification circuitry configured to, when a URI determined to be a scanning target by the determination unit has a directory structure that is identical to a directory structure for resources of a known web application, output a web application name of the web application. ### Claim 11 (depends on 7) The detection device according to claim 7, further comprising: source grouping circuitry configured to, with sets each being formed of the regularized URIs in the access logs from a corresponding source, when a degree of similarity between any two of the sets is at least a certain threshold, place the different sources corresponding to the sets into a same group, wherein the calculation circuitry calculates the relative frequencies while assuming that the sources placed in the same group are one same source.