Patent ID: 11895146
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H  G | IPC H

Claim 0:
1. An infection-spreading attack detection system for detecting an occurrence of an infection-spreading attack in a network including a transfer device that transfers a packet, the infection-spreading attack detection system comprising:
a first feature amount derivation unit, including one or more hardware processors, configured to acquire first traffic information on the packet transferred by the transfer device, and to derive based on the first traffic information a first feature amount of traffic for each of a plurality of partial address spaces formed by subdividing an address space of the packet;
a monitoring target determination unit, including one or more hardware processors, configured to determine based on the first feature amount derived by the first feature amount derivation unit M partial address space(s) to be a monitoring target out of the partial address spaces;
a second feature amount derivation unit, including one or more hardware processors, configured to acquire second traffic information on the packet transferred by the transfer device having, as a destination or a source, an address within the M partial address space(s) determined by the monitoring target determination unit, and to derive based on the second traffic information a second feature amount of the traffic for each of the M partial address space(s); and
a detection unit, including one or more hardware processors, configured to determine whether the second feature amount derived by the second feature amount derivation unit satisfies a predetermined detection condition for each of the M partial address space(s), and, by evaluating M determination results to determine whether an infection-spreading attack has occurred.