# US 2022/0046040 A1 · Detection device, detection method, and detection program

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2022/0046040 A1
- Document ID: US20220046040A1
- Status: Published application
- Kind: A1
- Application number: 17/276,487
- Filed: 2019-09-18
- Published: 2022-02-10
- Earliest claimed: 2018-10-12
- Assignees: Nippon Telegraph and Telephone Corporation
- Applicants: Nippon Telegraph and Telephone Corporation
- Inventors: Kazunori KAMIYA; Hiroshi KURAKAMI
- Web page: https://patentgrep.com/patent/US20220046040A1

## CPC

- H04L 63/1425: {Traffic logging, e.g. anomaly detection}
- H04L 63/1416: {Event detection, e.g. attack signature detection}
- H04L 63/1458: {Denial of Service}
- H04L 63/1491: {using deception as countermeasure, e.g. honeypots, honeynets, decoys or entrapment}
- H04L 2463/121: Timestamp
- H04L 2463/141: Denial of service attacks against endpoints in a network
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A detection apparatus includes processing circuitry configured to store attack information including detection time, attack attribute, and communication destination of a DDoS attack, and extract, from a collection of the attack information, a combination of the attack information according to the detection time, the attack attribute, and the communication destination as a coincident attack, an intermittent attack, or an identical target attack.

## Claims

### Claim 1

A detection apparatus comprising:
processing circuitry configured to:
store attack information including detection time, attack attribute, and communication destination of a DDoS attack; and
extract, from a collection of the attack information, a combination of the attack information according to the detection time, the attack attribute, and the communication destination as a coincident attack, an intermittent attack, or an identical target attack.

### Claim 2 (depends on 1)

The detection apparatus according to claim 1, wherein the processing circuitry is further configured to extract, from the collection of the attack information, a combination of attack information having different attack attributes and a difference between detection times not more than a predetermined period against the identical communication destination, as the coincident attack.

### Claim 3 (depends on 1)

The detection apparatus according to claim 1, wherein the processing circuitry is further configured to extract, from the collection of the attack information, a combination of attack information having different attack attributes and a difference between detection times more than a predetermined period against the identical communication destination, as the intermittent attack.

### Claim 4 (depends on 1)

The detection apparatus according to claim 1, wherein the processing circuitry is further configured to extract, from the collection of the attack information, a combination of attack information having different attack attributes against communication destinations belonging to the identical target as the identical target attack.

### Claim 5 (depends on 1)

The detection apparatus according to claim 1, wherein
the attack information further includes detection technique, attack scale, and duration, and
the processing circuitry is further configured to use the detection technique, the attack scale, or the duration in the attack information to calculate a degree of risk of the extracted combination of attack information.

### Claim 6

A detection method comprising:
referring to a storage configured to store attack information including detection time, attack attribute, and communication destination of a DDoS attack to extract, from a collection of the attack information, a combination of the attack information according to the detection time, the attack attribute, and the communication destination as a coincident attack, an intermittent attack, or an identical target attack, by processing circuitry.

### Claim 7

A non-transitory computer-readable recording medium storing therein a detection program that causes a computer to execute a process comprising:
referring to a storage configured to store attack information including detection time, attack attribute, and communication destination of a DDoS attack to extract, from a collection of the attack information, a combination of the attack information according to the detection time, the attack attribute, and the communication destination as a coincident attack, an intermittent attack, or an identical target attack.