Patent ID: 11870794
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 14:
15. A computer-readable non-transitory recording medium storing computer-executable instructions that when executed by a processor cause a computer system to:
receive traffic data;
determine a plurality of communication connection patterns, wherein each communication connection pattern includes a set of:
a communication source identifier for identifying a communication source, and
a communication destination identifier for identifying a communication destination;

compare a whitelist with the plurality of communication connection patterns, wherein the whitelist includes a communication connection pattern of traffic data under a normal communication;
assign, based on the compared plurality of communication connection patterns, an identifier to the plurality of communication connection patterns, wherein the compared communication connection patterns include a new communication connection pattern from the plurality of communication connection pattern not on the white list;
generate, based on the plurality of communication connection patterns with the assigned identifier, a graph feature amount;
assign the identifier of the plurality of communication connection patterns to the generated graph feature amount;
determine normalcy of the generated graph feature amount using a trained model on graph feature amount based on the communication connection patterns; and
retrieve, from the plurality of communication connection patterns including a new communication connection pattern, the new communication connection pattern corresponding to an identifier of graph feature amount that has been determined as anomaly in communication; and
determine the retrieved new communication connection pattern as a communication causing anomaly.