Patent ID: 11868853
Assignee: NIPPON TELEGRAPH AND TELEPHONE CORPORATION
Field: Computer technology (Electrical engineering)
Classification: CPC G | IPC G

Claim 5:
6. A non-transitory computer-readable recording medium having stored an analysis program that causes a computer to execute a process comprising:
an inputting step of receiving an input of data, as learning purpose data and determination target data, in which requests made to a server by a user are represented in a time series;
a classifying step of classifying, for each user who made the requests, the data received at the inputting step;
a learning step of extracting, from the learning purpose data classified at the classifying step, (i) n consecutive requests in the learning purpose data, which are consecutive requests to web pages in the learning purpose data, n being a first predetermined number (ii) a transition order of the web pages, and (iii) time intervals for the transitions between the web pages, as feature values of the learning purpose data, that performs learning by inputting the feature values of the learning purpose data to a machine learning algorithm;
creating a profile for each user based on the machine learning algorithm performing learning of feature values for each user;
a determination step of extracting, from the determination target data classified by the classifying, (i) n consecutive requests in the determination target data, which are consecutive requests to web pages in the determination target data, (ii) a transition order of the web pages, and (iii) time intervals for the transitions between the web pages, as feature values of the determination target data the extracting including using each request in the determination target data classified by the classifying as a starting point, for each of w consecutive requests in the determination target data, the n consecutive requests as the feature values of the determination target data, where w is a second predetermined number greater than n; and
determining as a determination result, based on the feature values of the determination target data and based on the profiles created by the creating, whether the determination target data is abnormal and outputting the determination result when the determination target data is determined to be abnormal, wherein the determining includes
calculating scores for each of the w consecutive requests based on the feature values of the determination target data and based on the profiles created by the creating,
determining whether the determination target data is abnormal based on an amount of change in the scores in a time series and a threshold, and
further determining that a time point at which the score exceeds the threshold as a time point at which impersonation of a user has occurred.