Patent ID: 11956256
Assignee: NEC CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. A priority determination apparatus comprising:
hardware including at least one processor and at least one memory;
a dissimilarity index calculation unit implemented at least by the hardware and configured to calculate, for each of a plurality of first security alerts, a dissimilarity index between a corresponding first performance record related to transmission and reception of a corresponding first traffic flow related to the first security alert at a corresponding first timing due to detection of an attack on an apparatus in a network and a corresponding second performance record related to transmission and reception of a corresponding second traffic flow related to a corresponding second security alert at a second timing prior to the corresponding first timing, wherein
for each first security alert and as a first part of the dissimilarity index, the dissimilarity index calculation unit calculates a distance between the first corresponding performance record and the second corresponding performance record,
for each first security alert and as a second party of the dissimilarity index, the dissimilarity index calculation unit calculates a first distribution for a plurality of first performance records related to transmission and reception of the corresponding first traffic flow and a second distribution for a plurality of second performance records related to transmission and reception of the corresponding second traffic flow, and calculates a degree of a distribution difference between the first and second distributions;

a priority determination unit implemented at least by the hardware and configured to determine, for each first security alert, a priority of the first security alert based on the calculated dissimilarity index, wherein
for each first security alert, the priority determination unit assigns a fourth priority to the first security alert when the distance is larger than a second threshold,
for each first security alert, the priority determination unit assigns a first priority higher than the fourth priority to the first security alert when the distance is equal to or smaller than the second threshold and the degree of the distribution difference is larger than a first threshold, and
for each first security alert, the priority determination unit assigns a second priority lower than the first priority and higher than the fourth priority to the first security alert when the distance is equal to or lower than the second threshold, the degree of the distribution difference is equal to or smaller than the first threshold, and an outlier exists in the plurality of first performance records and the plurality of second performance records, and
for each first security alert, the priority determination unit assigns a third priority lower than the fourth priority to the first security alert when the distance is equal to or lower than the second threshold, the degree of the distribution difference is equal to or smaller than the first threshold, and no outlier exists in the plurality of first performance records and the plurality of second performance records; and

a display control unit implemented at least by the hardware and configured to control display according to the determined priority of each first security alert on a display apparatus by at least one of:
displaying each first security alert in descending priority order irrespective of time-of-occurrence order;
displaying each first security alert for which the determined priority is greater than a threshold corresponding to high priority with a frame width larger than the first security alert for which the determined priority is less than the threshold; and
displaying each first security alert with at least one of a display area color and a letter color according to the determined priority.