Information processing apparatus, method for determining unauthorized activity and computer-readable medium
AssigneePfu Limited
InventorsKazuhiro Koide, Keiji Michine
Life of this patent
Estimating the term…
Abstract
An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluation value indicating an extent to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluation value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluation value for each of the phases.
Claims14
An information processing apparatus, comprising:
- a processor configured with:
- a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance;
- a specification unit that specifies an evaluated value indicating a degree to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase indicating a transitional state of unauthorized activity in the terminal from among plural phases of unauthorized activity, in accordance with a comparison result of comparison by the comparison unit;
- a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on a maximum value of the evaluated value for each of the phases;
- an evaluation value acquisition unit that acquires, as the evaluated value, a value pre-established in respect of a pattern which is matching or similar to the communication, as the comparison result;
- and
- a correction unit that corrects the acquired evaluated values, wherein the specification unit specifies the value corrected by the correction unit, as the evaluated value;
- and
- a memory that holds the maximum value of the evaluated value, for each of the phases, and for each terminal.
A method for determining unauthorized activity, to be executed by a computer, comprising the steps of:
- comparing a communication by a terminal connected to a network with a pattern held in advance;
- specifying an evaluated value indicating a degree to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase indicating a transitional state of unauthorized activity in the terminal from among plural phases of unauthorized activity, in accordance with a comparison result of the comparing;
- holding a maximum value of the evaluated value, for each of the phases, and for each terminal;
- determining whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluated value for each of the phases;
- acquiring, as the evaluated value, a value pre-established in respect of a pattern which is matching or similar to the communication, as the comparison result;
- and
- correcting the acquired evaluated values, wherein the specifying step specifies the value corrected, as the evaluated value.
A non-transitory computer-readable medium on which is recorded a program for determining unauthorized activity, the program causing a computer to:
- compare a communication by a terminal connected to a network with a pattern held in advance;
- specify an evaluated value indicating a degree to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase indicating a transitional state of unauthorized activity in the terminal from among plural phases of unauthorized activity, in accordance with a comparison result of the comparison;
- hold a maximum value of the evaluated value, for each of the phases, and for each terminal;
- determine whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluated value for each of the phases;
- acquire, as the evaluated value, a value pre-established in respect of a pattern which is matching or similar to the communication, as the comparison result;
- and
- correct the acquired evaluated values, wherein the specifying specifies the value corrected, as the evaluated value.
Dependencies are inferred from the claim text.