Patent Description:
Conventionally, cyber attackers prepare web pages for distributing malware, which is a collective term of malicious software, and for stealing personal information. On the web pages, drive-by download (DBD) attacks, which are attacks targeting vulnerabilities of web browsers or plug-ins, are performed. Social engineering (SE) attacks that psychologically lead accessing users to download malware or to input personal information, sometimes occur.

There is a method of using a web client type honeypot that is a decoy system including vulnerabilities in order to analyze web pages causing DBD attacks. The web client type honeypot accesses a web page, determines occurrence of a DBD attack, and sets communication destination information typified by the URL (Uniform Resource Locator), the domain name, and the IP address of the web page, in a blacklist. A security device typified by a firewall and an intrusion detection system prevents users' malware infection by blocking web accesses to the blacklist.

The SE attack provides users with false information typified by false malware infection or false prize winning, and psychologically leads them to access a web page, thereby succeeding in the attack. Methods of determining a web page causing an SE attack include a method that extracts visual information on a web page or information on an external communication request that the web page reads, and compares the information with information on web pages used for known SE attacks. There is a method of blocking users' web access with reference to communication destination information as a blacklist in case a web page is determined as one causing an SE attack, in a manner similar to that of the measures against DBD attacks.

Existing methods of determining SE attacks include, for example, a method of automatically operating a web browser to crawl web pages, extracting feature amounts from a single web page that is a determination target, and performing malicious determination (for example, Non-Patent Literatures <NUM> and <NUM>). These methods are specialized in crawling and detecting that target technical support scams and survey scams, which are attack types encompassed by SE attacks. That is, crawling destinations are determined and attacks are detected, using features specific to each attack type.

<CIT> describes a computer-implemented method which comprises: a) automatically gathering URI data items; and b) automatically analysing said URI data items as follows: b1) testing candidate malicious binary files in a monitored sandboxing environment of a computing entity connected to a communications network, and, based on their behaviour, classifying them into non-malicious binary files and different types of malicious binary files; b2) monitoring the network activity associated to said computing entity when said malicious binary files are being tested therein, to identify connections of the computing entity with one or more malicious servers, and obtain the URIs associated to said identified connections; and b3) analysing said URIs obtained at sub-step b2) and further URIs obtained directly from step a), to classify them at least into malicious and non-malicious URIs.

The existing method of determining SE attacks described above uses a web browser to crawl web pages, extracts a feature amount from a single web page that is a determination target, and performs malicious determination. Unfortunately, these methods have two problems. The first problem is in that since the existing method performs determination using features specific to a particular attack type that is a type of SE attacks, which include technical support scams and survey attacks, the determination target attack type is limited. The second problem is in that since the existing method uses only information extracted from a single web page that is a determination target without considering information on web pages accessed before the web page is reached and information specific to SE attacks, such as browser operations on the path and events occurring in the web browser, an erroneous detection sometimes occurs.

The present invention has been made in view of the above description, and has an object to use log information on the web page using the web browser to determine SE attacks that are not restricted by attack types, and further reduce erroneous detections.

The above problem is solved by the subject matter of the independent claims. Examples and technical descriptions of apparatuses, products and/or methods in the description and/or drawings which are not covered by the claims are presented not as embodiments of the invention but as background art or examples useful for understanding the invention.

According to the present invention, according to the present invention, advantageous effects are exerted where log information obtained when web pages are crawled through use of a web page is used to allow a web page causing an SE attack to be accurately determined without limitation to individual attack types of SE attacks.

Hereinafter, referring to the drawings, an embodiment of the present invention is described in detail. Note that the present invention is not limited by this embodiment. In the illustration in the drawings, the same parts are indicated by being assigned the same symbols.

[Embodiment] The embodiment of the present invention is described. <FIG> shows an example of a configuration of a determination system according to the embodiment.

As shown in <FIG>, the determination system <NUM> according to the embodiment includes a learning device <NUM>, and a determination device <NUM>. The learning device <NUM> and the determination device <NUM> are connected to each other via a network N. The learning device <NUM> and the determination device <NUM> may be connected to an external device (not shown) via the network N.

The learning device <NUM> generates a training model for determining whether a web page is malicious. Specifically, the learning device <NUM> uses a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the Web browser until an ending web page is reached. The learning device <NUM> then generates a training model using, as training data, any one or more feature amounts among a feature amount of each web page included in the log information, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page.

The determination device <NUM> receives the training model generated by the learning device <NUM>, and determines whether the web page is malicious using the training model. Specifically, the determination device <NUM> uses a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the web browser until an ending web page is reached. The determination device <NUM> then inputs any one or more feature amounts among a feature amount of each web page included in the log information, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page, as input data, into a pre-trained training model, and determines whether the ending web page is malicious according to an output result of the training model.

[Configurations of learning device and determination device] Next, the configuration of the learning device <NUM> is described. <FIG> shows an example of the configuration of the learning device <NUM> shown in <FIG>. The learning device <NUM> shown in <FIG> is achieved such that a predetermined program is read by a computer or the like including a ROM (Read Only Memory), a RAM (Random Access Memory) and a CPU (Central Processing Unit), and the CPU executes the predetermined program. The learning device <NUM> may also include an NIC (Network Interface Card) or the like, and can communicate with another device via an electric communication line, such as a LAN (Local Area Network) or the Internet.

The learning device <NUM> includes a log information input unit <NUM>, an image feature amount extraction unit <NUM>, a document feature amount extraction unit <NUM>, a structural feature amount extraction unit <NUM>, a web browser operational feature amount extraction unit <NUM>, a web browser event feature amount extraction unit <NUM>, a learning unit <NUM>, and a storage unit <NUM>.

Next, the configuration of the determination device <NUM> is described. <FIG> shows an example of the configuration of the determination device <NUM> shown in <FIG>. The determination device <NUM> shown in <FIG> is achieved such that a predetermined program is read by a computer or the like including a ROM a RAM and a CPU, and the CPU executes the predetermined program. The determination device <NUM> may also include an NIC or the like, and can communicate with another device via an electric communication line, such as a LAN or the Internet.

The determination device <NUM> includes a log information input unit <NUM>, an image feature amount extraction unit <NUM>, a document feature amount extraction unit <NUM>, a structural feature amount extraction unit <NUM>, a web browser operational feature amount extraction unit <NUM>, a web browser event feature amount extraction unit <NUM>, a determination unit <NUM>, an output unit <NUM> and a storage unit <NUM>.

Hereinafter, each unit of the learning device <NUM> is described. The log information input unit <NUM> uses a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the web browser until an ending web page is reached.

For example, the log information input unit <NUM> receives, as an input, known benign data, and known malicious data. The known malicious data is data extracted from known malicious log information on facts that malware has been downloaded and attacks, such as personal information theft, have been performed from finally reached web pages. The known benign data is data extracted from known benign log information on facts that no attack has been performed across all the transitioning web pages.

The log information is on a log that can be obtained from a web browser when web pages are accessed by the web browser. As shown in <FIG>, a web page is accessed and a browser operation is performed, and resultantly transition is made to a new web page in some cases.

The log information obtained by the log information input unit <NUM> holds one or more web pages, and a sequence of transition of the web pages, and constitutes items shown in <FIG> shows an example of items constituting the log information. Examples of items of the log information include screen shot images of web pages, HTML source code, and communication logs, browser operation logs, and browser event logs during transition of web pages by browser operations for web pages.

<FIG> shows an example of a communication log. The communication log is on communication occurring at web page reading and web page transition. At web page transition from a certain web page, a web page is instantaneously transferred by a command from a web server in some cases (web page redirect). When web page redirect occurs, the number of occurrences and communication destinations are obtained.

<FIG> shows an example of the browser operation log. The browser operation log is on browser operations that are causes of web page transition. Mouse left/right button clicks, browser back button clicks, mouse coordinates (X, Y) when clicked, sizes of click target HTML elements (height, width), and HTML tag types are extracted.

<FIG> shows an example of the browser event log. A browser event is an event of a browser caused by a browser operation. File download occurrences, alert dialog appearances, browser extension function installation screen appearances, pop up window appearances and the like are treated as browser events, and presence or absence of their occurrence, communication content, and message content are extracted.

The log information is recorded when a user manually operates the web browser in a certain case; the information is recorded by automatic control by a browser operation automatic tool or the like in another case. The log information can be obtained using a browser extension function installed on the web browser, a debug tool for a web browser developer or the like.

The image feature amount extraction unit <NUM> extracts, as the feature amount of each web page included in the log information, image data on the screen of the web page drawn by the web browser, and converts the image data into image information based on feature points and a color distribution. For example, the image feature amount extraction unit <NUM> extracts the image feature amount from a screen shot image of a web page included in the log information. <FIG> shows an example of image features. The image feature extraction method is not limited to the method described below. Any method capable of converting image data into vector information can be used instead. The number of dimensions of data shown in <FIG> may be freely set in a case of a method that can freely set the number of dimensions of data to be output.

A distribution data obtained by measuring the number of appearances (frequency) of pixels having a certain pixel value (light and dark) in a target image, with respect to each pixel value, is called a histogram. The image feature amount extraction unit <NUM> measures, for an image color histogram, a histogram of frequencies of <NUM>-type pixel values with respect to red, green and blue of an input image, and extracts <NUM>-dimensional data on a color-by-color basis.

The image feature amount extraction unit <NUM> analyzes images using a local feature amount extraction algorithm typified by ORB, KAZE and AKAZE. The local feature amount extraction algorithm is known as a method of recognizing an object in an image, and can convert image data into vector information having a freely selected dimension (the number of feature points) by detecting feature points residing in a certain image.

When the image feature amount extraction unit <NUM> converts images into vectors using the local feature amount extraction algorithm, multiple feature points used for detection are required to be preset. For example, screen shot images of multiple web pages are preliminarily collected, and feature points common to the images are extracted.

The document feature amount extraction unit <NUM> extracts character string information described on the web page as the feature amount of the web page, and converts the character string information into document information based on meaning of a document, a topic, and a word configuration.

For example, the document feature amount extraction unit <NUM> extracts, as document data, character strings that are to be actually displayed on a web page, from HTML source code of the web page included in the log information, and converts the document data into vector information. <FIG> shows an example of document features. The document feature extraction method is not limited to the method described below. Any method capable of converting document data into vector information can be used instead. The number of dimensions of data shown in <FIG> may be freely set in a case of a method that can freely set the number of dimensions of data to be output.

For example, to extract character strings to be displayed on a web page, the document feature amount extraction unit <NUM> removes HTML tag portions from HTML source code, and extracts the remaining character strings as document data. The method of extracting character strings to be displayed on a web page is not limited to the removal of the HTML tag portions. Any method can be used instead. The document feature amount extraction unit <NUM> uses an existing topic model method and statistical document processing method, as a method of converting the document data into vector information.

The topic model method, which is typified by Doc2Vec and Latent Dirichlet Allocation (LDA), is a method of estimating latent meaning of a document and converting character string data into vector information. The statistical document processing method, which is typified by bag-of-words and tf-idf, is a method of measuring the appearance frequency of words and converting the document into vector information.

To convert the document data extracted from the web page into vector information using the topic model method, the document feature amount extraction unit <NUM> requires preliminary creation of a learning model for conversion. For example, the document feature amount extraction unit <NUM> preliminarily collects document data extracted from multiple web pages, and creates the learning model using the document data.

To convert the document data extracted from the web page into vector information using the statistical document processing method, the document feature amount extraction unit <NUM> requires preliminary setting of words for conversion.

For example, the document feature amount extraction unit <NUM> preliminarily collects document data extracted from multiple web pages, extracts words from the document data, and sets them as words for conversion.

The structural feature amount extraction unit <NUM> extracts a source code file of each web page as the feature amount of the web page, and converts the source code file into HTML structure information based on the structure and statistical information. For example, the structural feature amount extraction unit <NUM> converts, into the vector information, the HTML source code of the web pages included in the log information.

<FIG> shows an example of structural features. The structural feature extraction method is not limited to the method described below. Any method capable of converting HTML source code into vector information can be used instead. The structural feature amount extraction unit <NUM> measures the number of appearances for each preset HTML tag from target HTML source code, as the number of HTML tag appearances. For example, the structural feature amount extraction unit <NUM> preliminarily extracts HTML source code from multiple web pages, preliminarily extracts HTML tags frequently appearing in the HTML source code, and sets the tags as HTML tags for measurement. The structural feature amount extraction unit <NUM> extracts the data size of the HTML source code, as the HTML source code data size.

The web browser operational feature amount extraction unit <NUM> extracts, as the feature amounts about the operation, information on operation content performed on the web browser on a path reaching the ending web page from the originating web page, and information at a target web page location where the operation has been performed.

For example, the web browser operational feature amount extraction unit <NUM> extracts the web browser operation log as vector information. An example in <FIG> is an example of the browser operation feature amount. For example, the web browser operational feature amount extraction unit <NUM> converts items of the browser operation log other than numerical value data, into numerical value data, using one-hot representation. For example, in a case where there are three types of tags including "a" tag, "div" tag and "iframe" tag as click target HTML and the "a" tag is actually clicked, the web browser operational feature amount extraction unit <NUM> sets the "a" tag to one while setting the remaining tags to zero.

The web browser event feature amount extraction unit <NUM> extracts, as the feature amount about the event, the event having occurred on the web browser on a path reaching the ending web page from the originating web page. The web browser event feature amount extraction unit <NUM> extracts the web browser event log and the communication log, as vector information. An example in <FIG> is an example of the web browser event feature amount. The number of occurrences and the number of appearances in the items of the browser event log and the communication log are measured.

The learning unit <NUM> generates a training model using, as training data, any one or more feature amounts among a feature amount of each web page, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page. Specifically, the learning unit <NUM> generates a training model using, as training data, any one or more feature amounts among feature amounts extracted by the image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM> and the web browser event feature amount extraction unit <NUM>.

For example, the learning unit <NUM> generates learning target data by integrating pieces of vector information on feature amounts extracted by the image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM> and the web browser event feature amount extraction unit <NUM>, generates a training model using a supervised machine learning method capable of executing binary classification, and records the training model in the storage unit <NUM>.

<FIG> shows an example of learning target data where the image feature amounts of web pages <NUM> to <NUM>, the document feature amounts of web pages <NUM> to <NUM>, the structural feature amounts of web pages <NUM> to <NUM>, the browser operation feature amount between web pages <NUM> and <NUM>, the browser operation feature amount between web pages <NUM> and <NUM>, the browser event feature amount between web pages <NUM> and <NUM>, and the browser event feature amount between web pages <NUM> and <NUM> are integrated. Note that the combination of feature amounts is not limited thereto. Any combination may be set according to the number of web page transitions in the input log information, and the supervised machine learning method to be applied.

<FIG> shows an example of a determination result according to the training model generated by the learning unit <NUM>. In this example, determination target data extracted from log information including two web page transitions among three web pages is input into the training model, and is classified in a binary manner into malicious or benign ones.

The learning unit <NUM> may be a support vector machine and random forests, which are examples of supervised machine learning methods capable of executing binary classification. However, the unit is not limited thereto. As described above, the learning device <NUM> extracts the feature amounts from the known benign and malicious pieces of log information, creates the training data, and generates the training model using the supervised machine learning method.

The storage unit <NUM> is a storage device, such as an HDD (Hard Disk Drive), an SSD (Solid State Drive), and an optical disk. Note that the storage unit <NUM> may be a data-rewritable semiconductor memory, such as a RAM (Random Access Memory), a flash memory, or an NVSR_AM (Non Volatile Static Random Access Memory). The storage unit <NUM> stores the training model generated by the learning unit <NUM>.

Next, each unit of the determination device <NUM> is described. The log information input unit <NUM> uses a web browser to crawl one or more web pages from an originating web page, and to accept input of log information obtained from the web browser until an ending web page is reached. For example, the log information input unit <NUM> receives, as an input, log information that is on web page transitions by web browser operations and has been recorded when web pages are accessed by the web browser. The log information is on a log that can be obtained from a web browser when web pages are accessed by the web browser.

The image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM>, and the web browser event feature amount extraction unit <NUM> in the determination device <NUM> perform processes similar to those of the image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM>, and the web browser event feature amount extraction unit <NUM> in the learning device <NUM>. Accordingly, description thereof is herein omitted.

The determination unit <NUM> inputs any one or more feature amounts among a feature amount of crawled web pages, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page, as input data, into a pre-trained training model, and determines whether the ending web page is malicious according to an output result of the training model.

For example, the determination unit <NUM> generates determination target data by integrating pieces of vector information of a feature amount extracted by the image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM> and the web browser event feature amount extraction unit <NUM>, and performs malicious determination using the training model in the storage unit <NUM>.

<FIG> shows an example of determination target data where the image feature amounts of web pages <NUM> to <NUM>, the document feature amounts of web pages <NUM> to <NUM>, the structural feature amounts of web pages <NUM> to <NUM>, the browser operation feature amount between web pages <NUM> and <NUM>, the browser operation feature amount between web pages <NUM> and <NUM>, the browser event feature amount between web pages <NUM> and <NUM>, and the browser event feature amount between web pages <NUM> and <NUM> are integrated. Note that the combination of feature amounts is not limited thereto. Any combination may be set according to the number of web page transitions in the input log information, and the supervised machine learning method to be applied.

<FIG> shows the determination result according to the training model. In this example, the determination unit <NUM> inputs determination target data extracted from log information including two web page transitions among three web pages, into the training model, outputs a malicious or benign determination result, and determines whether the ending web page is malicious. As described above, the determination device <NUM> extracts the feature amounts from the determination target log information, generates test data, and performs determination using the trained training model.

The output unit <NUM> outputs the determination result determined by the determination unit <NUM>. The storage unit <NUM> is a storage device, such as an HDD, an SSD, and an optical disk. Note that the storage unit <NUM> may be a data-rewritable semiconductor memory, such as an RAM, a flash memory, or an NVSRAM. The storage unit <NUM> stores the training model generated by the learning device <NUM>.

[Processing procedures of learning process and determination process] Next, processing procedures of the learning process and the determination process according to the embodiment are described. <FIG> shows a flowchart of a training model generating process. <FIG> shows a flowchart of the determination process.

As exemplified in <FIG>, the log information input unit <NUM> of the learning device <NUM> receives, as an input, known malicious /benign log information (step S101). The image feature amount extraction unit <NUM> then extracts the image feature amount from a screen shot image of a web page included in the log information (step S102).

Subsequently, the document feature amount extraction unit <NUM> extracts the meaning and structure of the document from character strings described in the web page, as the document feature amount (step S103). The structural feature amount extraction unit <NUM> then extracts the structural feature amount from the source code of the web page (step S104).

Subsequently, the web browser operational feature amount extraction unit <NUM> extracts the web browser operational feature amount that is the feature amount of information on operations performed for the web browser until the ending web page is reached (step S105). The web browser event feature amount extraction unit <NUM> then extracts the web browser event feature amount that is the feature amount of information on web browser events occurring until the web page is reached (step S106).

The learning unit <NUM> then integrates the feature amounts extracted by the image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM>, and the web browser event feature amount extraction unit <NUM> (step S107). The learning unit <NUM> then generates the training model by the supervised machine learning algorithm (step S108).

As exemplified in <FIG>, the log information input unit <NUM> of the determination device <NUM> receives, as an input, determination target log information (step S201). The image feature amount extraction unit <NUM> then extracts the image feature amount from a screen shot image of a web page included in the log information (step S202).

Subsequently, the document feature amount extraction unit <NUM> extracts the meaning and structure of the document from character strings described in the web page, as the document feature amount (step S203). The structural feature amount extraction unit <NUM> then extracts the structural feature amount from the source code of the web page (step S204).

Subsequently, the web browser operational feature amount extraction unit <NUM> extracts the web browser operational feature amount that is the feature amount of information on operations performed for the web browser until the ending web page is reached (step S205). The web browser event feature amount extraction unit <NUM> then extracts the web browser event feature amount that is the feature amount of information on web browser events occurring until the web page is reached (step S206).

The determination unit <NUM> then integrates the feature amounts extracted by the image feature amount extraction unit <NUM>, the document feature amount extraction unit <NUM>, the structural feature amount extraction unit <NUM>, the web browser operational feature amount extraction unit <NUM>, and the web browser event feature amount extraction unit <NUM> (step S207). The determination unit <NUM> then inputs the integrated data into the trained training model, thereby performing a process of determining whether the ending web page is malicious or not according to the training model (step S208).

[Effects of embodiment] As described above, the learning device <NUM> according to the embodiment uses the web browser to crawl one or more web pages from the originating web page, and to accept input of log information obtained until the ending web page is reached. The learning device <NUM> then generates a training model using, as training data, any one or more feature amounts among the feature amount of the crawled web pages, the feature amount about an operation performed on the web browser on a path reaching the ending web page, and the feature amount about an event occurring on the path reaching the ending web page.

The determination device <NUM> according to the embodiment uses the web browser to crawl one or more web pages from the originating web page, and to accept input of log information obtained from the web browser until the ending web page is reached. The determination device <NUM> inputs any one or more feature amounts among a feature amount of crawled web pages, a feature amount about an operation performed on the web browser on a path reaching the ending web page, and a feature amount about an event occurring on the path reaching the ending web page, as input data, into a pre-trained training model, and determines whether the ending web page is malicious according to an output result of the training model.

Thus, the determination system <NUM> according to the embodiment can use log information obtained when web pages are crawled through use of a web browser to allow a web page causing an SE attack to be accurately determined without any limitation due to individual attack types of SE attacks.

[System configuration etc.] Each configuration element of each device is a functional concept, and is not required to be physically configured as shown in the diagram. That is, the specific mode of distribution and integration of the devices is not limited to what is illustrated. The entire or a part of the mode can be functionally or physically distributed or integrated in freely selected configuration units to support various loads, use situations and the like, thus achieving the configuration. Furthermore, all or some of individual processing functions executed in the respective devices can be achieved by the CPU and a program analyzed and executed by the CPU, or can be achieved as hardware made of wired logics.

Among the processes described in this embodiment, all or some of processes described to be performed automatically may be performed manually. Additionally or alternatively, all or some of processes described to be performed manually may be performed automatically by a known method. Furthermore, the processing procedures, control procedures, specific names, and information including various data items and parameters illustrated in the aforementioned document and drawings can be freely changed if not otherwise specified.

[Program] <FIG> shows an example of a computer that executes a program to thereby achieve the learning device <NUM> or the determination device <NUM>. The computer <NUM> includes, for example, a memory <NUM>, and a CPU <NUM>. The computer <NUM> includes a hard disk drive interface <NUM>, a disk drive interface <NUM>, a serial port interface <NUM>, a video adapter <NUM>, and a network interface <NUM>. These components are connected to each other via a bus <NUM>.

The memory <NUM> includes a ROM (Read Only Memory) <NUM>, and a RAM <NUM>. The ROM <NUM> stores, for example, a boot program, such as BIOS (Basic Input Output System). The hard disk drive interface <NUM> is connected to a hard disk drive <NUM>. The disk drive interface <NUM> is connected to a disk drive <NUM>. For example, a detachable storage medium, such as a magnetic disk or an optical disk, is inserted into the disk drive <NUM>. The serial port interface <NUM> is connected to a mouse <NUM> and a keyboard <NUM>, for example. The video adapter <NUM> is connected to a display <NUM>, for example.

The hard disk drive <NUM> stores, for example, an OS (Operating System) <NUM>, an application program <NUM>, a program module <NUM>, and program data <NUM>. That is, a program that defines each process of the learning device <NUM> or the determination device <NUM> is implemented as a program module <NUM> in which code executable by a computer is described. The program module <NUM> is stored in the hard disk drive <NUM>, for example. For example, the program module <NUM> for executing processes similar to those of the functional configuration of the learning device <NUM> or the determination device <NUM> is stored in the hard disk drive <NUM>. Note that the hard disk drive <NUM> may be replaced with an SSD (Solid State Drive).

The setting data used in the processes in the embodiment described above is stored, as the program data <NUM>, in the memory <NUM> or the hard disk drive <NUM>, for example. The CPU <NUM> then reads the program module <NUM> or the program data <NUM> stored in the memory <NUM> or the hard disk drive <NUM>, into the RAM <NUM> as required and executes them.

Note that the program module <NUM> and the program data <NUM> are not limited to those in the case of being stored in the hard disk drive <NUM>. Alternatively, for example, the module and data may be stored in a detachable storage medium, and read by the CPU <NUM> through the disk drive <NUM> or the like. Alternatively, the program module <NUM> and the program data <NUM> may be stored in another computer connected via a network (LAN, WAN (Wide Area Network), etc.). The program module <NUM> and the program data <NUM> may then be read by the CPU <NUM> from the other computer via the network interface <NUM>.

Claim 1:
A learning device (<NUM>) comprising:
an input unit (<NUM>) configured to use a web browser to crawl one or more web pages from an originating web page, and to accept input of known benign and known malicious log information obtained from the web browser until an ending web page is reached, the log information including screen shot images of the one or more web pages;
an image feature amount extraction unit (<NUM>) configured to extract, as a feature amount of each web page included in the log information, image data on the screen shot image of the web page drawn by the web browser, and convert the image data into vector information having a dimension according to a number of feature points by detecting feature points residing in a certain screen shot image and extracting feature points common to the screen shot images ; and
a learning unit (<NUM>) configured to generate a training model using, as training data, the feature amount of each web page included in the log information by integrating pieces of the vector information and using a supervised machine learning method capable of executing binary classification into malicious and benign log information.