Patent ID: 11863584
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 0:
1. An infection-spreading attack detection apparatus configured to detect an occurrence of an infection-spreading attack in a network in which a forwarding device configured to forward packets is provided, the apparatus comprising:
first feature value deriving means for acquiring first traffic information regarding a packet forwarded by the forwarding device, and deriving a first feature value of traffic based on the first traffic information, for each of a plurality of partial address spaces obtained by subdividing an address space of the network;
monitoring target determination means for determining M partial address spaces that are to be monitored, out of the plurality of partial address spaces, based on the first feature value derived by the first feature value deriving means;
second feature value deriving means for acquiring second traffic information regarding a packet forwarded by the forwarding device, a destination or a transmission source of the packet being an address in the M partial address spaces determined by the monitoring target determination means, and deriving a second feature value of the traffic based on the second traffic information, for each address of a terminal located in the network;
clustering means for learning—the second feature value derived by the second feature value deriving means and classifying addresses of terminals into a plurality of clusters, and determining whether or not each of the clusters pertains to an infection-spreading attack, and generating cluster information; and
terminal specification means for specifying whether or not an infection-spreading attack has occurred and an address of a terminal that is an attack source, based on the second feature value derived by the second feature value deriving means and the cluster information generated by the clustering means.