Patent ID: 11863416
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 0:
1. An impartation device comprising one or more processors configured to:
acquire statistical value data on 5-tuple flows in a certain time period;
calculate a degree centrality of a node including an indegree, which is a total sum of a weight of each edge flowing into the node, and an outdegree, which is a total sum of a weight of each edge flowing out of the node, based on the statistical value data on the 5-tuple flows in the certain time period;
impart the degree centrality, as a feature related to the statistical value data on the 5-tuple flows in the certain time period;
compare i) the degree centrality of the node in the certain time period with ii) a baseline degree centrality in the certain time period at a normal time, that includes a baseline indegree and a baseline outdegree; and
based on the comparing, detect abnormality at the node comprising:
in response to determining that the indegree is high comparing to a baseline indegree of the baseline degree centrality, determine that the node is a victim, and
in response to determining that the outdegree is high comparing to a baseline outdegree of the baseline degree centrality, determine that the node is an attacker or an infected node.