IDENTIFYING DEVICE, IDENTIFYING METHOD, IDENTIFYING PROGRAM, MODEL CREATING DEVICE, MODEL CREATING METHOD AND MODEL CREATING PROGRAM

• Main Authors: TRAN HUNG TAO, MURAKAMI KOSUKE, YAMADA AKIRA, SAWATANI YUKIKO, KUBOTA AYUMI, URAKAWA JUMPEI
• Format: Patent
• Language: English; Japanese
• Published: 31.01.2019
• Subjects: CALCULATING; COMPUTER SYSTEMS BASED ON SPECIFIC COMPUTATIONAL MODELS; COMPUTING; COUNTING; ELECTRIC DIGITAL DATA PROCESSING; PHYSICS

To provide devices, methods and programs capable of efficiently identifying the kind of a domain relating to a DBD attack, and devices, methods and programs to create a model for identification.SOLUTION: A model creating device 1 includes: an obtaining unit 101 that obtains, for multiple domains to which a label is given and which include a landing domain and a distribution domain in a DBD attack, registered information on the domain; a calculating unit 102 which extracts a word contained in the registered information and which calculates an index relating to an appearance frequency of the word; and a learning unit 106 that creates an identification model in accordance with a learning with a teacher on the basis of the label with the word and the index for the word being as a first feature quantity.SELECTED DRAWING: Figure 2 【課題】ＤＢＤ攻撃に関するドメインの種類を効率的に識別できる装置、方法及びプログラム、並びに識別するためのモデルを生成する装置、方法及びプログラムを提供する。【解決手段】モデル生成装置１は、ＤＢＤ攻撃におけるランディング・ドメイン、及びディストリビューション・ドメインを含むラベルが付与された複数のドメインについて、当該ドメインの登録情報を取得する取得部１０１と、登録情報に含まれる単語を抽出し、当該単語の出現頻度に関する指標を算出する算出部１０２と、単語、及び当該単語に対する指標を第１の特徴量として、ラベルに基づく教師あり学習により識別モデルを生成する学習部１０６と、を備える。【選択図】図２