Fraud detection apparatus, fraud detection method, and recording medium

A fraud detection apparatus comprising:

• a network information acquisition unit that acquires network information regarding a network including one or more sites;
• a network fraud detection unit that performs fraud detection targeting the network, using the network information acquired by the network information acquisition unit, to acquire a network detection result;
• a site information acquisition unit that acquires site information regarding a site;
• a site fraud detection unit that performs fraud detection targeting the site, using the site information acquired by the site information acquisition unit, to acquire a site detection result;
• an IP address information acquisition unit that acquires IP address information regarding an IP address;
• an IP address fraud detection unit that performs fraud detection targeting the IP address, using the IP address information acquired by the IP address information acquisition unit, to acquire
• an IP address detection result;
• and
• an output unit that outputs the network detection result, the site detection result, and the IP address detection result,
• wherein the network information acquisition unit acquires two or more network attribute values including one or more network attribute values out of:
• the number of application downloads in the network, the number of sites belonging to the network, the number of accesses from user terminals with a non-Japanese language setting, the number of application installations from user terminals with a non-Japanese language setting, the number of accesses from user terminals with non-Japan access origins, the number of application installations from user terminals with non-Japan access origins, the number of operation identifiers corresponding to CV operations, the number of accesses from user terminals of types identified by terminal type identifiers of terminals that satisfy a predetermined condition, and the number of accesses from user terminals equipped with OSs identified by OS type identifiers of OSs that satisfy a predetermined condition, and
• the network fraud detection unit uses the two or more network attribute values to perform the fraud detection targeting the network, thereby acquiring the network detection result,
• wherein the site information acquisition unit acquires site distribution information regarding the distribution of feature values of the site, and
• the site fraud detection unit uses the site distribution information to perform the fraud detection targeting the site, thereby acquiring the site detection result,
• wherein the site distribution information includes any one of:
• information regarding the distribution of CTITs;
• information regarding the distribution of OS version shares, which are the shares of OS versions of user terminals from which the site is accessed;
• information regarding the distribution of user terminal shares, which are the shares of types of user terminals from which the site is accessed;
• information regarding the distribution of provider shares, which are the shares of types of providers from which the site is accessed;
• and information regarding the distribution of regional shares, which are shares of region types from which the site is accessed,
• wherein the IP address information acquisition unit acquires one or more IP address attribute values including type-specific access counts, which are the respective numbers of user terminals accessing the IP address for one or more user terminal types, and
• the IP address fraud detection unit uses the one or more IP address attribute values to perform the fraud detection targeting the IP address, thereby acquiring the IP address detection result.