Patent ID: 11863584
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G  H | IPC G  H

Claim 6:
7. A method with which an infection-spreading attack detection apparatus that is configured to detect an occurrence of an infection-spreading attack in a network in which a forwarding device configured to forward packets is provided and that is configured to specify a terminal that is an attack source of an infection-spreading attack, the method comprising:
acquiring first traffic information regarding a packet forwarded by the forwarding device;
deriving a first feature value of traffic based on the first traffic information, for each of a plurality of partial address spaces obtained by subdividing an address space of the network;
determining M partial address spaces to be monitored, out of the plurality of partial address spaces, based on the derived first feature value;
acquiring second traffic information regarding a packet forwarded by the forwarding device, a destination or a transmission source of the packet being an address in the M partial address spaces deriving a second feature value of the traffic based on the second traffic information, for each address of a terminal located in the network;
learning the second feature value;
classifying addresses of terminals into a plurality of clusters;
determining whether or not each of the clusters pertains to an infection-spreading attack and generating cluster information; and
specifying whether or not an infection-spreading attack has occurred and an address of a terminal that is an attack source, based on the second feature value and the cluster information.