Patent ID: 11902310
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Digital communication (Electrical engineering)
Classification: CPC H | IPC H

Claim 2:
3. A detection method that is performed by a detection device, the detection method comprising:
calculating a feature of header information of a packet by using a number of packets on a per 5-tuple basis and a distribution of values of a predetermined header field; and
classifying the packet as either a normal packet that is not attacked by an attacker or an abnormal packet that is attacked by an attacker by comparing the calculated feature to a threshold value of classification;
adding a label indicating a tool name of a known attack tool to header information of an attacked packet that is attacked using the known attack tool;
using the label added to the attacked packet and the feature calculated for the attacked packet as teach data; and
learning a model for adding labels to packets, wherein the learned model indicates a relationship between each label and the calculated features of a corresponding packet.