Patent Description:
Systems for analyzing communication packets to identify device types and device names by signature matching, and systems such as a firewall for controlling communication using a blacklist have been proposed. These systems often execute processing based on external information such as signatures and blacklists and thus, may not be able to achieve securing of information sources, rapid response, safety of analysis, and low cost.

Therefore, a method has been proposed in which only devices whose communication pattern is limited, such as Internet of Things (IoT) devices are targeted, and the communication is learned at a gateway (GW) of a network to identify abnormal communication (for example, see Non Patent Literature <NUM>).

Non Patent Literature <NUM>, <NPL> refers to a master SDN controller to handle security threats to IoT devices. Abnormal behaviour and attacks are detected at an early stage by the controller. The controller has knowledge of patterns and events from cluster controllers and can look for similarity in events from different clusters.

However, because the method is implemented at the GW, the control target is limited to IoT devices that communicate directly with the GW such as Wi-Fi. Accordingly, this method fails to control IoT devices that use, as GWs, applications on smart phones (hereinafter referred to as "applications") that currently occupy most of the markets.

In addition, although a firewall on the OS is contemplated as a method for controlling communication of each application on the smart phone, the firewall only uses existing implementations and thus, hardly satisfies the safety of analysis.

There is also a method of generating a filter condition by analyzing communication for each application. However, smart phone applications are different from existing IoT devices and the like, and in many cases, their targets of transmission are not limited. This is due to the presence of application advertisements and content delivery networks supporting them. Consequently, a communication filter using communication patterns during a learning period frequently causes over-detection that determines normal communication to be abnormal.

Further, because communication of the application changes depending on the analysis period, the environment, and the operation of the user, it is difficult to learn all the ideal communication patterns, increasing a risk that a biased control condition is generated. In this case, when unknown normal communication occurs due to the operation of the user or the like after the control condition has been determined, over-detection that determines normal communication to be abnormal occurs, and communication control is performed. When such over-detection frequently occurs, the reliability of communication approval and the system may lower, thereby decreasing the safety and convenience in operation.

The disclosed embodiment has been devised in view of the foregoing, and an object is to appropriately control communication of an application on a communication terminal apparatus.

The problems mentioned above are solved and the above object is achieved by the subject matter of the independent claims. Advantageous embodiments are disclosed by the dependent claims. A communication terminal apparatus according to an example includes a collection control unit configured to collect communication of an application and control the communication of the application based on a first control condition, an analysis unit configured to analyze the communication collected by the collection control unit to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and a coordination unit configured to transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

The present invention can appropriately control the communication of the application on the communication terminal apparatus.

The present invention is not limited to the embodiment. Further, in description of the drawings, the same parts are denoted by the same reference signs.

Embodiment In the present embodiment, communication of a connected IoT device using an application on an terminal apparatus as a GW is controlled. Because there are many types of applications on the terminal apparatus, communication of all the applications are not detection targets in the present embodiment. Applications that are communication control targets are classified, and abnormal communication of the classified applications is detected. Further, in the present embodiment, for the applications that are communication control targets, a normal communication pattern is identified to detect abnormal communication, and the detection accuracy of abnormal communication is improved by coordination with other terminal apparatuses.

Example of Configuration of Communication System A communication system according to the embodiment will be described below. <FIG> is a diagram illustrating an example of a configuration of a communication system <NUM> according to the embodiment. The communication system <NUM> according to the embodiment includes a terminal apparatus <NUM> (communication terminal apparatus). The terminal apparatus <NUM> is connected to other terminal apparatuses 11A, 11B,. and a server <NUM> via an external network NW-A. The terminal apparatus <NUM> is connected to IoT devices 40A, 40B,. via a network NW-B that is different from the external network NW-A.

The terminal apparatus <NUM> is, for example, a smart phone. The terminal apparatus <NUM> controls communication between the IoT devices 40A and 40B connected via the network NW-B and external devices connected via the external network NW-A. The terminal apparatus <NUM> controls communication of each connected IoT device <NUM> using an application on the terminal apparatus <NUM> as a GW according to a predetermined communication control condition.

The terminal apparatus <NUM> classifies applications that are communication control targets, identifies control conditions corresponding to normal communication ranges of the applications that are the communication control targets, and applies the identified control conditions to control communication of the applications. Processing of controlling communication of the application includes detecting application abnormality, blocking communication of the application that causes abnormal communication, and notifying a user and the server <NUM> of the occurrence of the abnormal communication.

In addition, the terminal apparatus <NUM> autonomously coordinates with the other terminal apparatuses 11A, 11B,. to share information without being controlled by a higher-level device (for example, the server <NUM>). For example, the terminal apparatus <NUM> shares information without any server by using a block chain or the like, in addition to sharing of information via the server through a database or file uploading. The terminal apparatus <NUM> shares, with the other terminal apparatuses 11A, 11B,. , information about the application that is the communication control target, control conditions for communication of the application, learning contents in analyzing the communication of the application, and the like.

The terminal apparatuses 11A, 11B,. are devices having the same function and configuration as those of the terminal apparatus <NUM>. The terminal apparatuses 11A, 11B,. control IoT devices other than the IoT devices 40A, 40B,. controlled by the terminal apparatus <NUM>. Note that while <FIG> illustrates the two terminal apparatuses 11A and 11B, the number of other terminal apparatuses connected to the terminal apparatus <NUM> via the external network NW-A is not particularly limited. Hereinafter, when there is no need to distinguish the terminal apparatuses 11A, 11B,. , they are collectively described as the terminal apparatuses <NUM>.

The server <NUM> is an information processor managed by a service provider that provides the terminal apparatus <NUM>. The configuration of the server <NUM> is not particularly limited. The server <NUM> may, for example, be one physical server or a virtual server virtually built across a plurality of servers.

The IoT devices 40A, 40B,. are devices to be controlled by the terminal apparatus <NUM>. For example, the IoT devices 40A, 40B,. each are a sensor such as a temperature sensor, an illuminance sensor, a human sense sensor, and an open/close sensor, which is arranged in a predetermined space and position. For example, the IoT devices 40A, 40B,. each are an information processor controlled in terms of power consumption by a corresponding IoT service. For example, the IoT devices 40A, 40B,. each are an imaging device that captures an image of a predetermined space and transmits the image to the terminal apparatus <NUM>. Note that while <FIG> illustrates the two IoT devices, the number of IoT devices connected to the terminal apparatus <NUM> is not particularly limited. Hereinafter, when there is no need to distinguish the IoT devices 40A, 40B,. , they are collectively described as the IoT devices <NUM>.

The external network NW-A is a communication network that communicatively connects the terminal apparatus <NUM> to the external devices. The external network NW-A is, for example, the Internet, an intranet, a local area network (LAN), a wide area network (WAN), or the like. The external network NW-A may be a wired network, a wireless network or a combination thereof.

The network NW-B is a communication network that communicatively connects the terminal apparatus <NUM> to the IoT devices 40A, 40B,. The type of the network NW-B is not particularly limited. The network NW-B may be, for example, the Internet, an intranet, a local area network (LAN), a wide area network (WAN), or the like, or a wired network, a wireless network, or a combination thereof.

Configuration of Terminal Apparatus <NUM> An example of the configuration and functions of the terminal apparatus <NUM> will be described with reference to <FIG>. The terminal apparatus <NUM> includes a control unit <NUM> and a storage unit <NUM>.

The control unit <NUM> controls communication control processing of the terminal apparatus <NUM>. An electronic circuit such as a central processing unit (CPU) or a micro processing unit (MPU) or an integrated circuit such as an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA) may be used as the control unit <NUM>. The control unit <NUM> includes a storage unit for storing programs and control data that define processing procedures and the like of the terminal apparatus <NUM>. The control unit <NUM> functions as various processing units by operating various programs.

The storage unit <NUM> is a storage device that stores various types of data. The storage unit <NUM> may be a semiconductor memory capable of rewriting data such as a random access memory (RAM), a flash memory, or the like. The device used as the storage unit <NUM> is not particularly limited.

Description of Various Types of Information First, information used in the communication system <NUM> according to the present embodiment will be described. A "control condition" is information indicating a normal communication range of each application. The normal communication range is extracted by causing the terminal apparatus <NUM> to statistically analyze or learn communication of each application from multiple perspectives such as the number of targets of transmission and packet size. In the present embodiment, the "control condition" functions as a so-called whitelist in communication. The "control condition" may also be referred to as a filter condition.

Communication that does not satisfy the "control condition" will be hereinafter referred to as "abnormal communication". In addition, normal communication in a case where communication control based on the "control condition" is not performed is referred to as "steady communication". The "steady communication" can also be referred to as a "normal communication condition", which is a condition for normal communication.

For example, when the number of targets of transmission of an application D to be analyzed (learned) during a predetermined period in which the application D performs the "steady communication" is "<NUM>," the control condition "the number of targets of transmission of the application D = <NUM>" is obtained. In this case, when the application D attempts to communicate with a plurality of targets of transmission after the terminal apparatus <NUM> starts control, the terminal apparatus <NUM> determines that "abnormal communication" of the application D has occurred. In addition, it is assumed that a communication time of an application E to be analyzed (learned) during a predetermined period in which the application E performs the "steady communication" is only a set time set in advance. In this case, the control condition "the communication time of the application E = the set time" is obtained. In this case, when the application E attempts to perform communication outside the set time after the communication system <NUM> starts control, the terminal apparatus <NUM> determines that "abnormal communication" of the application E has occurred.

Information Stored in Storage Unit <NUM> The storage unit <NUM> includes a control target information storage unit <NUM>, a control condition storage unit <NUM>, and a shared information storage unit <NUM>.

The control target information storage unit <NUM> stores control target information obtained by associating identification information about each application with information indicating whether or not the application is the communication control target. <FIG> is a diagram illustrating an example of the control target information.

As illustrated in <FIG>, in the control target information, application name and version information is associated with information regarding whether a corresponding application version is the communication control target. "True" indicates that the application version is the communication control target, and "False" indicates that the application version is not the communication control target.

For example, for an application A, the values of "A: v1. <NUM>" and "A: v1. <NUM>" are "True". Moreover, for an application C, the value of "C: v1" is "False". The control target information is used in a user interface (UI) unit <NUM> (described below) for visualization, a collection control unit <NUM> (described below) for communication control, and a coordination unit <NUM> (described below) for autonomous coordination between terminal apparatuses.

The control condition storage unit <NUM> stores the control condition for each application. <FIG> is a diagram illustrating an example of the control conditions. As illustrated in <FIG>, each control condition is associated with the application name and version information.

For example, for both "A: v1. <NUM>" and "A: v1. <NUM>" of the application A, the control condition "packet size {<NUM> kB ± <NUM>%}, <NUM> kbyte/packet ± <NUM>%, protocol= {HTTPS}, Duration: {curve y = x<NUM>+ Sx + <NUM>}" are stored. This indicates that communication of the application A is considered to fall within the normal communication range when the packet having a size of <NUM> kB ± <NUM>% is transmitted. This also indicates that communication of the application A is considered to fall within the normal communication range when each packet has a size of <NUM> ± <NUM>% kilobytes. This also indicates that communication of the application A is considered to fall within the normal communication range when HTTPS is used as a protocol.

In the example of <FIG>, for the two versions "v1. <NUM>" and "v1. <NUM>" of the application A, the same control conditions are associated and stored. Furthermore, because applications C and Z are not control targets, for example, communication patterns cannot be identified due to the user operation. Thus, the applications have no control conditions. The control conditions are used in the UI unit <NUM> (described below) for visualization, the collection control unit <NUM> (described below) for communication control, and the coordination unit <NUM> (described below) for autonomous coordination between the terminal apparatuses.

The shared information storage unit <NUM> stores shared information that the terminal apparatus <NUM> shares with the other terminal apparatuses <NUM>. The shared information includes "application name: version" as "Key". The shared information includes, for example, "normal communication conditions (≠ a list of normal communications)" as "Value".

<FIG> is a diagram illustrating an example of the shared information. <FIG> illustrates an example of the shared information provided to the other terminal apparatuses <NUM> by the terminal apparatus <NUM>. The shared information storage unit <NUM> also stores shared information provided from the other terminal apparatuses <NUM>. As illustrated in <FIG>, the shared information has items of "application name: version," "control target or not", "steady communication (= normal communication condition)", and "optional field".

The item "control target or not" indicates whether or not a corresponding application is the communication control target on the terminal apparatus. "True" indicates that the corresponding application is the communication control target, and "False" indicates that the corresponding application is not the communication control target.

The "steady communication" indicates the normal communication condition in the terminal apparatus <NUM> that provides the shared information. For contents of the "steady communication", the granularity of the shared information is changed depending on each terminal apparatus <NUM> to which the shared information is provided. For example, in the case of information sharing to a secure MSS, the accuracy of service can be improved by sharing information necessary for reproducing communication analysis as the contents of the "steady communication" to the maximum extent according to service provisions or the like.

In addition, in the case of server-less sharing or sharing to the public system, only the statistical feature is shared as the contents of the "steady communication", and the specific targets of transmission are concealed. For example, in <FIG>, no specific protocol name of the application A is indicated, but only the number of protocols is indicated.

The "optional field" includes a value α indicating the difficulty of communication control based on the application information, a value β indicating the easiness of communication control based on the similarity of a learning result of another terminal apparatus, and a value γ indicating whether the application is the control target based on the user operation and recognition. The "optional field" includes device information about the connected IoT devices <NUM> using the application as the GW. The "optional field" includes the analysis period for the application. In the example of <FIG>, the analysis period for both "A: v1. <NUM>" and "A: v1. <NUM>" of the application A is "<NUM> day".

Using the "application name: version" as a search key, the values of the shared information may include the analysis result, the learning condition in analyzing the communication of the application, and the user determination with respect to an alert, in addition to the "normal communication condition".

Note that the timing when the control target information, the control condition, and the shared information are stored and the aspects thereof are not particularly limited. Further, when the user rejects connection and communication for a predetermined application, the storage unit <NUM> stores information about the fact. When acquiring the shared information from the other terminal apparatuses <NUM>, the storage unit <NUM> may store, in addition to the information illustrated in <FIG>, information identifying each terminal apparatus <NUM> that transmits the shared information. The storage unit <NUM> may store the lengths of the learning periods of the terminal apparatuses <NUM> and <NUM> in setting the control target information and the control conditions in association with the control conditions.

Example of Function and Configuration of Each Unit of Control Unit <NUM> The control unit <NUM> includes a communication unit <NUM>, a collection control unit <NUM>, an analysis unit <NUM>, a coordination unit <NUM>, and a UI unit <NUM>. The communication unit <NUM>, the collection control unit <NUM>, the analysis unit <NUM>, the coordination unit <NUM>, and the UI unit <NUM> are installed into the terminal apparatus <NUM> as communication analysis applications. Communication of an application is not set by the function of the OS, and information about the application is also provided via the communication analysis applications.

The communication unit <NUM> is a communication interface for achieving communication via the external network NW-A of the terminal apparatus <NUM>. The network communication on the terminal apparatus <NUM> is made through the communication unit <NUM> using VPN and Proxy. The communication unit <NUM> receives information transmitted from the external network NW-A, and, according to predetermined setting, transmits the received information to each of the functional units of the collection control unit <NUM>, the analysis unit <NUM>, the coordination unit <NUM>, and the UI unit <NUM>. According to the predetermined setting, the communication unit <NUM> transmits, to the outside, the information received from each of the functional units of the collection control unit <NUM>, the analysis unit <NUM>, the coordination unit <NUM>, and the UI unit <NUM>.

The collection control unit <NUM> collects information about communication of the applications with the IoT devices <NUM> via the network NW-B. When an application that is not stored in the storage unit <NUM> is added to the terminal apparatus <NUM>, the collection control unit <NUM> causes the added application to perform steady communication for a predetermined period, and collects information on the communication. The collection control unit <NUM> transmits the collected information of the communication along with an instruction to analyze the added application to the analysis unit <NUM>.

The collection control unit <NUM> controls communication of the application according to a control condition (first condition) set based on a processing result of the analysis unit <NUM>. For example, the collection control unit <NUM> blocks application communication that does not satisfy the predetermined control condition. For example, the collection control unit <NUM> detects the application communication that does not satisfy the predetermined control condition and transmits an alert to the user. For example, when the communication that does not satisfy the predetermined control condition occurs, the collection control unit <NUM> instructs the analysis unit <NUM> to re-analyze (relearn) the communication of the application generating such communication. In this manner, in the terminal apparatus <NUM>, in order to lower a barrier when the user installs an application, the communication analysis applications analyze and monitor communication of other applications, thereby detecting and controlling fraudulent communication.

The analysis unit <NUM> receives the application communication collected by the collection control unit <NUM> from the collection control unit <NUM>. The analysis unit <NUM> analyzes the received communication to determine whether or not the communicating application is a communication control target. The analysis unit <NUM> determines whether or not the application is the communication control target based on the application information, the shared information with the other terminal apparatuses <NUM>, which is received by the coordination unit <NUM> (described below), and a user's answer about whether the application is the communication control target. In addition, the analysis unit <NUM> determines that an application that increases the number of targets of transmission or an application that changes the communication protocol in response to an operation of the user is not the communication control target because the normal communication condition cannot be generated, and determines that the other applications are the communication control targets.

Then, the analysis unit <NUM> generates a control condition (first condition) for the application to be analyzed based on the normal communication range of the application that is the communication control target. The analysis unit <NUM> identifies the normal communication range of the application that is the communication control target by using a statistical technique or machine learning. The set control condition and learning condition are stored in the storage unit <NUM>.

Based on an instruction from the collection control unit <NUM>, the analysis unit <NUM> re-analyzes (relearns) the communication of the application causing the communication that does not satisfy the control condition. The analysis unit <NUM> receives the application communication that does not satisfy the control condition from the collection control unit <NUM>, and performs re-analysis to set the control condition. Note that in setting and re-analyzing the control condition, the analysis unit <NUM> can refer to the shared information generated by the terminal apparatus <NUM> and the shared information acquired from the other terminal apparatuses <NUM>. The control condition set by the analysis unit <NUM> is stored in the storage unit <NUM> according to the setting and transmitted to each of the functional units.

The coordination unit <NUM> shares the application control condition set based on the analysis result of the analysis unit <NUM> with the other terminal apparatuses <NUM>. In addition, the coordination unit <NUM> shares the application control condition set on the other terminal apparatuses <NUM> with the other terminal apparatuses <NUM>. In other words, the coordination unit <NUM> receives at least a part of second shared information including identification information about an application on the other terminal apparatuses <NUM>, information indicating whether or not the application is the communication control target, a control condition (second control condition) corresponding to the normal communication condition of the application, and the analysis result for the application. The second shared information is set in the other terminal apparatuses <NUM>.

Here, the term "share" means that the terminal apparatus <NUM> can refer to application information including information regarding whether the application is the control target in other terminal apparatuses <NUM>, the control condition, and the like, and the other terminal apparatuses <NUM> can refer to application information including information regarding whether the application is the control target in the terminal apparatus <NUM>, the control condition, and the like.

Note that the analysis unit <NUM> can also refer to the normal communication condition and the optional field of the shared information received by the coordination unit <NUM> from the other terminal apparatuses <NUM> by using the identification information about the application as a key. The analysis unit <NUM> presents, to the user, the contents of the acquired normal communication range or the referred contents of the normal communication condition and the optional field in the other terminal apparatuses <NUM>, and adjusts the analysis contents and control condition for the application to be analyzed based on the user's answer.

The coordination unit <NUM> generates shared information from information such as identification information about an application for which the control condition is set on the terminal apparatus <NUM>, and control conditions thereof. The coordination unit <NUM> changes, according to a sharing condition of the shared information with the other terminal apparatuses <NUM>, the granularity of information about the sharing condition. In addition, the coordination unit <NUM> selects information to be included in the shared information according to the sharing condition of the shared information with the terminal apparatuses <NUM>.

For example, the coordination unit <NUM> shares information via a server through DB or file uploading. The sharing via the server is used when an operation of an MSS or information correction support is needed. In the case of information sharing with the secure MSS, information necessary for reproducing communication analysis may be shared as contents of the control condition to the maximum extent according to service provisions and the like. In other words, the coordination unit <NUM> increases the granularity of information to be shared according to the security condition of the service provider.

In addition, in the case of server-less sharing such as a blockchain or sharing to the public system, the coordination unit <NUM> shares only the statistical feature as the contents of the control condition, and conceals the specific target of transmission. For example, assuming that server-less sharing is also used to avoid centralized control (such as governmental communication regulations), a measure of not sharing highly confidential information such as a destination address is taken in the coordination unit <NUM>.

Then, the coordination unit <NUM> transmits part or all of the shared information to the other terminal apparatuses <NUM>. The coordination unit <NUM> also receives part or all of the shared information from the other terminal apparatuses <NUM>. The sharing mode is not particularly limited. For example, the shared information may be transmitted to the other terminal apparatuses <NUM> each time a part of the shared information is identified on the terminal apparatus <NUM>, or in response to a request from the other terminal apparatuses <NUM>. Furthermore, all or a part of the shared information may be transmitted.

The UI unit <NUM> provides various types of information to the user and receives an input from the user. The UI unit <NUM> may include, for example, a liquid crystal screen, a touch panel, a speaker, a microphone, or the like.

The UI unit <NUM> presents, to the user, the application information and the shared information about the application, which is provided from the other terminal apparatuses <NUM> and receives the user's answer regarding whether the application to be analyzed is the communication control target. For example, the UI unit <NUM> displays, to the user, analysis contents of the application on the own terminal apparatus by the analysis unit <NUM> and analysis contents of the applications in the other terminal apparatuses <NUM> so as to compare the contents with each other.

The UI unit <NUM> also notifies the user of information about the application causing communication that deviates from the control condition. When the communication deviating from the control condition occurs, the UI unit <NUM> transmits a notification indicating the fact to the user, and displays a screen requesting the user to confirm whether or not it is over-detection.

Procedure of Communication Control Processing <FIG> is a flowchart of an example of processing in the communication system <NUM> according to the embodiment. In the communication system <NUM>, when a new application is added to the terminal apparatus <NUM> (Step S1), the collection control unit <NUM> causes the new application to try steady communication, intermediates the communication, collects communication information (Step S2), and requests the analysis unit <NUM> to analyze the communication.

The analysis unit <NUM> determines whether or not the added application is the communication control target (Step S3). The analysis unit <NUM> determines whether the added application is the control target based on application information such as application name. The analysis unit <NUM> determines whether the added application is the control target based on the analysis result of the shared information with the other terminal apparatuses <NUM>, which is acquired by the coordination unit <NUM>. Then, the analysis unit <NUM> determines whether the added application is the control target based on the user's answer regarding whether the added application is the communication control target. The analysis unit <NUM> calculates a predetermined determination formula to which the application information, the shared information, and the answer of the user are applied.

When the added application is not the communication control target and the determination calculation result is less than a certain value (Step S4: Yes), the control unit <NUM> determines that the added application is not the communication control target and terminates the processing.

In addition, when the added application is the communication control target or the determination calculation result is the certain value or more (Step S4: No), the analysis unit <NUM> uses a statistical technique or machine learning to perform normal communication analysis for determining the normal communication range of the application that is the communication control target (Step S5). The analysis unit <NUM> uses confidence interval, counting, principal component analysis (PCA), or the like as the statistical technique to identify a communication pattern, and when the number of the patterns does not increase with an increase in time, defines the pattern as the normal communication condition.

When the normal communication range is identified (Step S6: Yes), the analysis unit <NUM> generates the control condition for the application based on the normal communication range (Step S7). The analysis unit <NUM> outputs the analysis result, the normal communication range, and the control condition to the storage unit.

Then, the analysis unit <NUM> sets the generated control condition in the collection control unit <NUM> as the control condition for the added application (Step S8). This causes the collection control unit <NUM> to control the communication of the added application according to the set control condition. The collection control unit <NUM> takes statistics of the communication using the same technique as the generation of the control condition, and determines communication other than the normal communication range to be abnormal. For example, the collection control unit <NUM> blocks application communication that does not satisfy the predetermined control condition.

When the normal communication range is not identified (Step S6: No) or after the processing in Step S8, the coordination unit <NUM> transmits the normal communication condition identified by the analysis unit <NUM> to the other terminal apparatuses <NUM> and shares the normal communication condition with the other terminal apparatuses (Step S9).

Then, when detecting communication of the application that does not satisfy the predetermined control condition, the collection control unit <NUM> displays an alert to the user to visualize the control condition and handling (Step S10).

Determination of Communication Control Target Next, processing of determining the communication control target by the analysis unit <NUM> will be described. <FIG> is a flowchart of processing of determining the communication control target according to the embodiment.

As illustrated in <FIG>, the analysis unit <NUM> analyzes application communication collected by the collection control unit <NUM> to collect application information (Step S21).

<FIG> is a diagram illustrating the application information collected by the analysis unit <NUM>. As illustrated in <FIG>, the analysis unit <NUM> collects the presence or absence of application advertisement, the presence or absence of background communication, and the presence or absence of notification, which are the application information, as conditions for giving points, gives points when each condition is satisfied, and calculates a total point. For example, in the example of <FIG>, in the application to be analyzed, all conditions regarding the application advertisement, the background communication, and the notification are satisfied, and points corresponding to each condition are given. As a result, the total point is determined to be <NUM>. Based on this total point, the analysis unit <NUM> derives a coefficient α indicating the difficulty in communication control based on the application information (Step S22).

The analysis unit <NUM> executes Steps S23 and <NUM> in parallel with Steps S21 and <NUM>. The analysis unit <NUM> collects the shared information with the other terminal apparatuses <NUM> by autonomous coordination (Step S23).

<FIG> is a diagram illustrating the shared information with the other terminal apparatuses <NUM> collected by the analysis unit <NUM>. As illustrated in <FIG>, the analysis unit <NUM> acquires, as the shared information, identification information about the connected device using the application to be analyzed as the GW, information regarding whether the device is the control target, and the target of transmission in the normal range, and acquires a learning result of the other terminal apparatuses <NUM>. Then, the analysis unit <NUM> derives a coefficient β indicating the easiness of communication control based on the similarity of the learning result in the other terminal apparatuses <NUM> (Step S24). The similarity takes values from <NUM> to <NUM> by a vector space method or the like.

The analysis unit <NUM> causes the UI unit <NUM> to present, to the user, the application information and the shared information about the application, which is provided from the other terminal apparatuses <NUM> and requests the user to input determination regarding whether the application to be analyzed is the communication control target (Step S25).

<FIG> is a diagram illustrating an example of an output screen of the UI unit <NUM>. As illustrated in <FIG>, the screen displays the determination difficulty based on the application information, which is determined using the coefficient α, determination in the autonomous coordination using the coefficient β, and user determination. In this case, a ground to determine whether the application is the communication control target and messages to the user are displayed in remarks. The user selects whether or not the application to be analyzed is the communication control target, and inputs an answer to the UI unit <NUM>.

When the user does not answer even after an elapse of a certain time after the processing in Step S25 (Step S26: Yes), the analysis unit <NUM> determines that there is no answer of the user, and outputs γ = <NUM> as a result γ of determining whether the application is the communication control target based on the user's operation and recognition (Step S27).

In addition, when the user answers before an elapse of a certain time (Step S26: No), the analysis unit <NUM> acquires the information about the user's determination regarding whether the application is the communication control target (Step S28). Then, in response to the answer of the user, the analysis unit <NUM> outputs a value of γ (Step S29). When the user determines that the application to be analyzed is the communication control target, the analysis unit <NUM> outputs γ = <NUM>. When the user determines that the application to be analyzed is not the communication control target, the analysis unit <NUM> outputs γ = <NUM>.

Then, the values of α, β, and γ are applied to a determination formula defined by the user, and calculation is performed (Step S30). The analysis unit <NUM> may assign weights to α, β, and γ and then apply the weighted values to the determination formula. The weighting to α, β, and γ and determination formula vary depending on usage scenes such as official use, private use, and usage rules and thus, are set by the service provider. The determination formula is also modified as appropriate according to the given points in collecting the application information, the granularity of information in autonomous coordination, the rate and accuracy of answer of the user. For example, when "(-<NUM>. 01α + β) γ" is used as the determination formula and the calculation result is a certain value (e.g. <NUM>) or more, it is determined that the application is the communication control target.

When the calculation result in Step S30 is the certain value or more (Step S31: Yes), the analysis unit <NUM> determines that the application to be analyzed is the communication control target (Step S32). When the calculation result in Step S30 is less than the certain value (Step S31: No), it is determined that the application to be analyzed is not the communication control target (Step S33). The analysis unit <NUM> outputs the determination result along with the calculation result of the determination formula (Step S34).

Analysis of Normal Communication Next, processing of analyzing normal communication by the control unit <NUM> will be described. <FIG> is a flowchart of processing of analyzing the normal communication according to the embodiment.

As illustrated in <FIG>, assuming that there is regularity (pattern) in communication for each application, the analysis unit <NUM> analyzes the application communication pattern (Step S41). It is known that the IoT devices <NUM> often perform communication only in a certain communication pattern. In the case where the application on the terminal apparatus <NUM> functions as the GW of the IoT, it is expected that the communication patterns of the application can be narrowed. In the case of general applications used for certain use, abnormal communication can be also detected based on the communication pattern. In particular, when the application on the terminal apparatus is fraudulently operated, for example, by a remote attack, there is a high possibility that an abnormal communication pattern occurs.

Thus, in Step S41, the analysis unit <NUM> collects communication characteristics to perform statistical analysis or machine learning from multiple perspectives such as the number of targets of transmission, packet size, and the number of times of communication, thereby analyzing the communication pattern of the application.

Then, the analysis unit <NUM> determines whether or not the analyzed communication pattern has converged (Step S42). The analysis unit <NUM> fits a change in cumulative value of the communication pattern to a curve using time or communication amount as variables, and calculates a convergence ratio at a time or a communication amount based on the calculated parameter. Then, when the calculated convergence ratio is a predetermined value or more, the analysis unit <NUM> determines that the communication pattern has converged. In addition, when the calculated convergence ratio is less than the predetermined value, the analysis unit <NUM> determines that the communication pattern has not converged. For the application in which the communication pattern has not converged, the terminal apparatus <NUM> classifies the application as the non-communication control target by executing processing described below, thereby preventing unnecessary statistics or learning and reducing calculation costs.

When the communication pattern has converged (Step S42: Yes), the analysis unit <NUM> determines whether the number of identified patterns is less than a predetermined number (Step S43). The identified pattern indicates a pattern identified in terms of the target of transmission, the number of targets of transmission, the range (size) of communication, the period, and the like. Then, the predetermined number in Step S43 is set according to the load of the CPU.

When determining that the number of identified patterns is less than the predetermined value (Step S43: less than the predetermined value), the analysis unit <NUM> classifies the application as the communication-controllable application (Step S44), and creates a filter condition (control condition) based on the communication pattern (Step S45).

The coordination unit <NUM> creates shared information about the own apparatus based on the information about the application classified as the non-communication control target, and the statistical result, the machine learning result, the filter condition, and the like of the application, which are acquired by the analysis unit <NUM>. Then, after adjusting the sharing condition according to the security condition, the coordination unit <NUM> provides the shared information to the other terminal apparatuses <NUM> for autonomous coordination of the application information (Step S46).

The collection control unit <NUM> controls the communication of the application according to the filter condition (Step S47) and determines whether or not the communication is the normal communication (Step S48). When detecting abnormal communication (Step S48: No), the collection control unit <NUM> causes the UI unit <NUM> to display a screen requesting the user to confirm whether or not the abnormality detection is over-detection, and acquires a user confirmation result related to the over-detection (Step S49). When the user confirms that the abnormality detection is over-detection (Step S50: Yes), the collection control unit <NUM> extends an analysis period (Step S51), and requests the analysis unit <NUM> to re-analyze the communication of the application.

On the contrary, when the user confirms that the abnormality detection is not over-detection (Step S50: No), the collection control unit <NUM> blocks the communication of the application and notifies the occurrence of abnormal communication, and returns to Step S47. When the communication is normal communication (Step S48: Yes), the collection control unit <NUM> returns to Step S47.

When determining that the number of identified patterns is the predetermined number or more (Step S43: the predetermined number or more), the analysis unit <NUM> causes the UI unit <NUM> to present, to the user, information that the application to be analyzed may have influence on performance and has a risk due to insufficient identification of the communication pattern (Step S52). Then, the analysis unit <NUM> acquires the shared information of the other terminal apparatuses <NUM> for autonomous coordination of the application information via the coordination unit <NUM> (Step S53). The analysis unit <NUM> causes the UI unit <NUM> to display the analysis conditions and analysis results in the other terminal apparatuses <NUM> such that the user can compare the analysis contents regarding the application in the other terminal apparatuses <NUM> with the analysis contents regarding the application in the own apparatus. The analysis unit causes the UI unit to display a result regarding whether the application is the communication control target.

The analysis unit <NUM> causes the UI unit <NUM> to display a screen requesting the user to input information regarding whether the application to be analyzed is the communication control target, and acquires a user confirmation result about whether the application to be analyzed is the communication control target (Step S54).

When the user allows the application to be analyzed as the communication control target (Step S55: Yes), the analysis unit <NUM> creates a filter condition (control condition) based on the communication pattern of the application (Step S45).

When the user does not allow the application to be analyzed as the communication control target (Step S55: No), the analysis unit <NUM> classifies the application as the application that is not the communication control target (Step S56). For autonomous coordination of the application information, the coordination unit <NUM> creates, in the other terminal apparatuses <NUM>, shared information about the application classified as the non-communication control target in the own terminal apparatus and provides the shared information to the other terminal apparatuses <NUM> (Step S57).

On the contrary, when the communication pattern has not converged (Step S42: No), the analysis unit <NUM> determines whether or not a longest analysis period has been exceeded (Step S58). When the longest analysis period has not been exceeded (Step S58: No), the analysis unit <NUM> extends the analysis period (Step S51) and continues to analyze the communication of the application.

When the longest analysis period has exceeded (Step S58: Yes), the analysis unit <NUM> classifies the application to be analyzed as the application that is not the communication control target (Step S59). Then, the analysis unit <NUM> acquires the shared information with the other terminal apparatuses <NUM> via the coordination unit <NUM> (Step S60). Then, in order to cause the user to check the difference between the analysis contents of the other terminal apparatuses <NUM> and the analysis contents of the own apparatus, the analysis unit <NUM> causes the UI unit <NUM> to display the acquired shared information. For example, the UI unit <NUM> displays information indicating whether or not the other terminal apparatuses <NUM> have completed analysis of the communication of the application, or an analysis period of the communication of the application in the other terminal apparatuses <NUM>. In this way, the terminal apparatus <NUM> does not use an external whitelist as it is and proceeds processing after the confirmation by the user. Thus, more appropriate control condition can be set in the terminal apparatus <NUM>.

The analysis unit <NUM> causes the UI unit <NUM> to display a screen requesting the user to enter information regarding whether the application to be analyzed is the communication control target, and acquires a user confirmation result about whether the application to be analyzed is the communication control target (Step S61).

When the user allows the application to be analyzed as the communication control target (Step S62: Yes), the analysis unit <NUM> extends the longest analysis period (Step S63) and returns to Step S58. When the user does not allow the application to be analyzed as the communication control target (Step S62: No), the analysis unit <NUM> classifies the application as the application that is not the communication control target (Step S56). For autonomous coordination of the application information, the coordination unit <NUM> creates, in the other terminal apparatuses <NUM>, shared information about the application classified as the non-communication control target in the own terminal apparatus and provides the shared information to the other terminal apparatuses <NUM> (Step S57).

Effect of Embodiment In this way, the terminal apparatus <NUM> according to the embodiment collects the communication of the application and controls the communication of the application based on the first control condition. The terminal apparatus <NUM> analyzes the collected communication to determine whether the application is the communication control target, and generates the first control condition based on the normal communication range of the application that is the communication control target. The terminal apparatus <NUM> transmits at least a part of first shared information including the application identification information and the first control condition to the other communication terminal apparatuses.

Thus, the terminal apparatus <NUM> according to the embodiment can achieve control based on the communication status of each application without relying on external information. Accordingly, even when abnormal communication occurs in the present embodiment due to fraudulent operation of the application on the terminal apparatus <NUM>, the abnormal communication can be detected and handled. In other words, the present embodiment enables appropriate control of the communication of the application on the terminal apparatus <NUM>. In this embodiment, the collection control unit <NUM>, the analysis unit <NUM>, the coordination unit <NUM>, and the UI unit <NUM> can function as the communication analysis applications to analyze and monitor the communication of other applications, and to detect and control fraudulent communication, thereby lowering a barrier when the user installs the application.

Further, the terminal apparatus <NUM> according to the embodiment changes, according to the sharing condition of the shared information with the other terminal apparatuses <NUM>, the granularity of the shared information. In addition, the coordination unit <NUM> selects information to be included in the shared information according to the sharing condition of the shared information with the other communication terminal apparatuses. In other words, in the present embodiment, the shared information is protected by adjusting the granularity of the shared information and not sharing highly confidential information according to the security condition of the service provider.

The terminal apparatus <NUM> according to the embodiment receives at least a part of the second shared information including identification information about an application on the other communication terminal apparatuses, information indicating whether or not the application is the communication control target, a second control condition corresponding to the normal communication condition of the application, and a analysis result for the application. The second shared information is set in the other terminal apparatuses <NUM>. The terminal apparatus <NUM> according to the embodiment causes the UI unit <NUM> to present, to the user, the application information, the analysis result by the analysis unit, or the second shared information about the application, and receives the user's answer regarding whether the application is the communication control target.

The terminal apparatus <NUM> determines whether or not the application is the communication control target based on the application information, the analysis result by the analysis unit, the second shared information received by the coordination unit, and the user's answer.

Accordingly, the terminal apparatus <NUM> performs classification, determining whether the application is the communication control target in a semi-automatic manner. The terminal apparatus <NUM> allows the user to compare the analysis contents in the own terminal apparatus with the analysis contents in the other terminal apparatuses <NUM>, and determine processing for the application to be analyzed.

In addition, since the terminal apparatus <NUM> visualizes the communication occurring in the application and presents the visualized communication to the user, the user can confirm the communication control of the application. In particular, in the present embodiment, when the application on the terminal apparatus is fraudulently operated by a remote attack or the like, it is possible to visualize an unknown abnormal communication pattern, present the visualized communication pattern to the user, and appropriately control the communication according to the user's answer.

Further, the terminal apparatus <NUM> according to the embodiment uses a statistical technique or machine learning to collect communication patterns of the applications that are the communication control targets, and classifies the application whose communication pattern has not converged as the application that is not the communication control target.

In this manner, the terminal apparatus <NUM> removes the application whose communication pattern has not converged due to an operation of the user via a browser or the like, from the communication control target, to achieve efficient communication control. Further, the terminal apparatus <NUM> classifies the application whose communication pattern has converged as the application that is the communication control target to identify the normal communication range. In this manner, the terminal apparatus <NUM> can classify the application whose communication pattern has converged as the communication control target to identify the normal communication pattern, thereby appropriately identifying the normal communication range. Thus, it is possible to increase the accuracy of the control condition for detecting abnormality.

As described above, the embodiment enables visualization of communication occurring in the application and control of fraudulent communication. Furthermore, the present embodiment can share the control logic with the other terminal apparatuses <NUM>, increasing the accuracy of detection and control.

System Configuration, or the Like The respective components of the respective devices illustrated are functional and conceptual components, and are not necessarily physically configured as illustrated. That is, a specific form of distribution and integration of the respective devices is not limited to the illustrated form, and all or a portion thereof can be configured to be functionally or physically distributed and integrated in any units according to various loads, use situations, and the like. Further, all or some of processing functions performed by each device may be implemented by a CPU and a program that is analyzed and executed by the CPU, or may be implemented as hardware based on a wired logic.

All or some of processes described as being performed automatically among the processes described in the embodiments may be performed manually or all or some of processes described as being performed manually may be performed automatically according to a known method. In addition, information including the processing procedures, control procedures, specific names, and various types of data or parameters described above or illustrated in the drawings can be freely changed unless otherwise specified.

ProgramFig. <NUM> is a diagram illustrating an example of a computer that achieves the terminal apparatuses <NUM> and <NUM> by executing a program. A computer <NUM> includes, for example, a memory <NUM> and a CPU <NUM>. Further, the computer <NUM> includes a hard disk drive interface <NUM>, a disk drive interface <NUM>, a serial port interface <NUM>, a video adapter <NUM>, and a network interface <NUM>. These units are connected by a bus <NUM>.

The memory <NUM> includes a ROM <NUM> and a RAM <NUM>. The ROM <NUM> stores, for example, a boot program such as a basic input output system (BIOS). The hard disk drive interface <NUM> is connected to a hard disk drive <NUM>. The disk drive interface <NUM> is connected to a disk drive <NUM>. A detachable storage medium such as a magnetic disk or optical disk, for example, is inserted into the disk drive <NUM>. The serial port interface <NUM> is connected to, for example, a mouse <NUM> and a keyboard <NUM>. The video adapter <NUM> is connected to a display <NUM>, for example.

The hard disk drive <NUM> stores, for example, an operating system (OS) <NUM>, an application program <NUM>, a program module <NUM>, and program data <NUM>. That is, a program defining each processing operation of the terminal apparatuses <NUM> and <NUM> is implemented as the program module <NUM> in which a computer-executable code is written. The program module <NUM> is stored in, for example, the hard disk drive <NUM>. For example, the program module <NUM> for executing the same processing as the functional configuration in the terminal apparatuses <NUM> and <NUM> is stored in the hard disk drive <NUM>. The hard disk drive <NUM> may be replaced with a solid state drive (SSD).

Further, setting data used in the process of the embodiment described above is stored as the program data <NUM> in the memory <NUM> or the hard disk drive <NUM>, for example. The CPU <NUM> reads the program module <NUM> or the program data <NUM> stored in the memory <NUM> or the hard disk drive <NUM> into the RAM <NUM> as necessary, and executes the program module <NUM> or the program data <NUM>.

The program module <NUM> or the program data <NUM> is not limited to being stored in the hard disk drive <NUM>, and may be stored, for example, in a detachable storage medium and read by the CPU <NUM> via the disk drive <NUM> or the like. Alternatively, the program module <NUM> and the program data <NUM> may be stored in another computer connected via a network (LAN, a wide area network (WAN), or the like). The program module <NUM> and the program data <NUM> may be read from another computer via the network interface <NUM> by the CPU <NUM>.

Claim 1:
A communication terminal apparatus (<NUM>) comprising:
a collection control unit (<NUM>) configured to collect communication of an application;
an analysis unit (<NUM>) configured to analyze the communication collected by the collection control unit by a statistical technique or machine learning to collect communication patterns of the application and to use identification information about the application, to classify, by fitting a change in a cumulative value of the communication pattern to a curve, the application whose communication pattern has not converged as an application that is not the communication control target, and classify the application whose communication pattern has converged as an application that is the communication control target and to identify a normal communication range of the application that is the communication control target, and configured to generate a first control condition based on the normal communication range of the application that is the communication control target, wherein the first control condition at least indicates a packet size and a number of targets of transmission and wherein communication that satisfies the first control condition is referred to as normal communication and communication that does not satisfy the first control condition is referred to as abnormal communication; and
a coordination unit (<NUM>) configured to transmit first shared information including identification information about the application and the first control condition to a second communication terminal apparatus (<NUM>) that is different from the communication terminal apparatus;
wherein the coordination unit (<NUM>) is configured to receive second shared information including identification information about the application on the second communication terminal apparatus, information indicating whether the application is the communication control target, a second control condition corresponding to a normal communication of the application, the second shared information being set by the second communication terminal apparatus; and
wherein the analysis unit (<NUM>) is further configured to, when communication that does not satisfy the first control condition occurs, to perform re-analysis to set the first control condition by referring to the first shared information and the second shared information and to re-analyze the communication of the application generating such communication.