Patent ID: 11895146
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 6:
7. An infection-spreading attack detection method of detecting an occurrence of an infection-spreading attack in a network including a transfer device that transfers a packet, the method comprising:
acquiring, by a first feature amount derivation unit, first traffic information on the packet transferred by the transfer device, and deriving based on the first traffic information a first feature amount of traffic for each of a plurality of partial address spaces formed by subdividing an address space of the packet;
determining, by a monitoring target determination unit, based on the first feature amount derived by the first feature amount derivation unit M partial address space(s) to be a monitoring target out of the plurality of partial address spaces;
acquiring, by a second feature amount derivation unit, second traffic information on the packet transferred by the transfer device having as a destination or a source, an address within the M partial address space(s) determined by the monitoring target determination unit, and deriving based on the second traffic information a second feature amount of the traffic for each of the M partial address space(s); and
determining, by a detection unit, whether the second feature amount derived by the second feature amount derivation unit satisfies a predetermined detection condition for each of the M partial address space(s), and, by evaluating M determination results, determining whether an infection-spreading attack has occurred.