Patent Description:
Attackers carrying out cyberattacks on the Internet use communication destinations represented by uniform resource locators (URLs), domain addresses, and Internet protocol (IP) addresses for a process of carrying out the attacks or achievement of goals. For example, an attacker locates malignant software called malware in a server on the Internet, and sets a communication destination represented by a URL, a domain address, and an IP address as an identifier of the server and the software. There are an attack case in which a user accesses the communication destination and has malware infection and an attack case in which a user is made to access the communication destination after malware infection and information leak is generated.

Conventionally, as countermeasures against cyberattacks, an action in which communication destinations (hereinafter, malignant communication destinations) that are represented by URLs, domain addresses, and IP addresses used for attacks are specified, and are monitored and blocked on communication routes has been generally taken. For example, a countermeasure of filtering communication from a user to a malignant communication destination on a cache domain name system (DNS) server located in a local network and an Internet service provider (ISP) and a countermeasure of filtering communication from a user to a malignant communication destination in security appliances represented by an intrusion detection system (IDS), an intrusion prevention system (IPS), and a deep packet inspection (DPI) located in a local network have been taken.

Malignant communication destinations used for these kinds of countermeasures are specified by intentionally generating malware infection with decoy systems represented by a honey pot and by actually operating malware with malware analysis systems represented by a sandbox. In addition, in order to complement malignant communication destinations that cannot be observed and specified with these systems, the following action has been taken: training models are generated with a machine learning method using already specified known malignant communication destinations as training data and the malignant degree of test data formed of new communication destinations is calculated using the generated training models so as to specify new malignant communication destinations (for example, see Patent Literature <NUM>).

Patent Literature <NUM>: <CIT> [0005a] <CIT> refers to detecting phishing websites by rendering and analyzing documents associated with a website that indicated phishing behavior. The scope and functionality associated with a website may be analyzed by executing functions embedded in a DOM object before analyzing the web site for phishing activity. Multiple phishing models may be generated based on website information being associated with multiple websites performing phishing activities. Multiple phishing models may be generated based on different sets of website information and may be used for a single phishing policy.

The conventional technique has, however, the problem that it may be difficult to specify malignant communication destinations with high accuracy when the malignant communication destinations are changed. In this case, attackers may change malignant communication destinations one after another in order to avoid specifying the malignant communication destinations. Every time malignant communication destinations are changed, data of new malignant communication destinations is generated.

For example, according to the technique described in Patent Literature <NUM>, a model in which data of the latest malignant communication destination is defined as training data can be generated. By contrast, in the data of the latest malignant communication destination, a deviation may occur and sufficient information for improving accuracy of the model is unlikely to be included. In such cases, it is considered that the technique described in Patent Literature <NUM> cannot improve accuracy of a model sufficiently.

The problem underlying the invention is solved by the subject matter of the independent claims. Advantageous embodiments are disclosed in the dependent claims. According to an example, a calculation device includes: an input unit that receives input of a plurality of data sets including a communication destination known to be malignant as data; a first generation unit that generates a model calculating a malignant degree of an input communication destination from each of the data sets; and a second generation unit that gives weight to each of the models and generates a mixed model using the model and the weight.

According to the present invention, even when a malignant communication destination is changed, the malignant communication destination can be specified with high accuracy. Brief Description of Drawings.

Embodiments of a calculation device, a calculation method, and a calculation program according to the present application will now be described in detail with reference to the accompanying drawings. It should be noted that the present invention is defined in the independent claims <NUM>, <NUM> and <NUM>.

The configuration of a calculation device according to a first embodiment will be described with reference to <FIG> is a view illustrating an example of the configuration of the calculation device according to the first embodiment. As illustrated in <FIG>, a calculation device <NUM> includes a control unit <NUM> and a storage unit <NUM>.

The control unit <NUM> controls the whole calculation device <NUM>. Examples of the control unit <NUM> include electronic circuits such as a central processing unit (CPU) and a micro processing unit (MPU) and integrated circuits such as an application specific integrated circuit (ASIC) and a field programmable gate array (FPGA). The control unit <NUM> includes an internal memory for storing computer programs that specify various kinds of processing procedures and control data, and executes pieces of processing using the internal memory.

The storage unit <NUM> corresponds to storage devices such as a hard disk drive (HDD), a solid state drive (SSD), and an optical disk. The storage unit <NUM> may be semiconductor memories capable of rewriting data such as a random access memory (RAM), a flash memory, and a nonvolatile static random access memory (NVSRAM). The storage unit <NUM> stores therein an operating system (OS) executed on the calculation device <NUM> and various kinds of computer programs. In addition, the storage unit <NUM> stores therein various kinds of information used for execution of the computer programs.

The control unit <NUM> functions as various kinds of processing units by operation of various kinds of computer programs. For example, the control unit <NUM> includes a training data input unit <NUM>, a selection unit <NUM>, a training model generation unit <NUM>, a target communication destination input unit <NUM>, a mixed training model generation unit <NUM>, and an output unit <NUM>.

The training data input unit <NUM> receives input of training data. Training data is a data set that includes communication destinations known to be malignant as data. <FIG> is a view illustrating an example of training data according to the first embodiment. As illustrated in <FIG>, the training data includes a serial number, a label, a type, and a communication destination. The label indicates whether each communication destination is benign or malignant. Each record of the training data is an example of data included in the data set. Hereinafter, the data included in the data set may be referred to as elements.

For example, the example in <FIG> indicates that a domain name called "foo. com" is a benign communication destination. The example in <FIG> also indicates that a domain name called "bar. net" is a malignant communication destination. As illustrated in <FIG>, a communication destination may be represented by a domain name, and may be represented by a uniform resource locator (URL) and an Internet protocol (IP) address.

Representation of each item in the training data is not limited to the representation indicated in <FIG>. For example, a label for benignancy and a label for malignancy may be represented by "<NUM>" and "<NUM>", respectively. In addition, the training data may include only malignant communication destinations. In that case, a label item may be omitted.

Furthermore, the training data input unit <NUM> receives input of training data at fixed intervals. For example, in the training data input unit <NUM>, at daily intervals, data of malignant communication destinations collected using a sandbox and the like at that day is input as training data.

The selection unit <NUM> selects predetermined elements from the input training data. The selection unit <NUM> may select all elements, may select elements randomly, and may select elements based on a contribution ratio, which will be described later.

The training model generation unit <NUM> generates a model that calculates the malignant degree of the input communication destinations from each of a plurality of pieces of training data. The training model generation unit <NUM> generates a model from data selected by the selection unit <NUM>.

The training model generation unit <NUM> can learn training data and generate a model using the known machine learning method. For example, the training model generation unit <NUM> generates a model using a decision tree, a neural network, a support vector machine, and the like. The training model generation unit <NUM> is an example of a first generation unit. Hereinafter, a model generated by the training model generation unit <NUM> may be referred to as a training model.

The training model generation unit <NUM> generates a training model in units of input of training data. For example, when training data is input at daily intervals as described above, the training model generation unit <NUM> generates a training model corresponding to each day.

The target communication destination input unit <NUM> receives input of a target communication destination list. <FIG> is a view illustrating an example of a target communication destination list according to the first embodiment. As illustrated in <FIG>, the target communication destination list is a list of communication destinations that are unknown whether the communication destinations are malignant. As in the case with the training data, in the target communication destination list, a communication destination is represented by a domain name, a URL, an IP address, and the like. In addition, the communication destination list may include a communication destination included in the training data.

The mixed training model generation unit <NUM> gives weight to each of the training models, and generates a mixed model using the training model and the weight. In this case, the mixed training model generation unit <NUM> can generate a mixed model by a method of ensemble learning. Hereinafter, a model generated by the mixed training model generation unit <NUM> may be referred to as a mixed training model.

For example, the mixed training model generation unit <NUM> generates a mixed training model that calculates a weighted sum of an output value of each of the training models generated by the training model generation unit <NUM>. When the training model generation unit <NUM> generates a training model using a decision tree, the mixed training model generation unit <NUM> can generate a mixed training model using a random forest. The mixed training model generation unit <NUM> is an example of a second generation unit.

For example, as described above, when the training model generation unit <NUM> generates a training model corresponding to each day, the mixed training model generation unit <NUM> can generate a mixed training model mixed with training models corresponding to a plurality of days.

In addition, the mixed training model generation unit <NUM> gives weight corresponding to a statistic related to training data of a generation source to each of the training models. For example, the mixed training model generation unit <NUM> can give larger weight as the number of records included in training data of a generation source becomes larger.

The output unit <NUM> calculates and outputs, using a mixed training model generated by the mixed training model generation unit <NUM>, a malignant degree of each of the communication destinations included in a target communication destination list. <FIG> is a view illustrating an example of the malignant degree of target communication destinations according to the first embodiment. As illustrated in <FIG>, the malignant degree may be represented by a numerical value of <NUM> or more and <NUM> or less. In the example of <FIG>, a malignant degree of a communication destination called "www. com" indicates <NUM>.

The representation method of a malignant degree is not limited to continuous values illustrated in <FIG>. For example, the output unit <NUM> may represent a malignant degree by binary values of "benignancy" and "malignancy". In this case, for example, when a malignant degree calculated as a continuous value is less than <NUM>, the output unit <NUM> may define the malignant degree of binary values as "benignancy", and when the malignant degree calculated as a continuous value is equal to and more than <NUM>, the output unit <NUM> may define the malignant degree of binary values as "malignancy". The output unit <NUM> may also represent a malignant degree by discrete values other than binary values. In addition, the output unit <NUM> may output a malignant degree in a format designed for characteristics of a method used for generating models, and may convert the malignant degree into a format specified by a user and output the converted malignant degree.

With reference to <FIG>, processing for generating a mixed training model by the calculation device <NUM> will be described in detail. <FIG> is a view illustrating the processing for generating a mixed training model according to the first embodiment. As illustrated in <FIG>, the calculation device <NUM> receives input of training data T times. The calculation device <NUM> generates a mixed training model H every time training data is input, and calculates a malignant degree H(x). In H(x), x represents a target communication destination.

For example, when training data is input every day of the week, T is <NUM>. When t = <NUM>, in other words, on the first day of the week, the calculation device <NUM> generates a first training model. When t = <NUM>, in other words, on the second day of the week, the calculation device <NUM> generates a second training model, and mixes the second training model with the first training model generated on the first day. In the same manner, when t = <NUM>, in other words, on the final day of the week, the calculation device <NUM> generates a seventh training model, and mixes the seventh training model with the training models generated up to the sixth day.

A communication destination included in training data is defined as xi∈X, and a label indicating whether xi is malignant is defined as yi∈{-<NUM>, <NUM>}. Training data for T times input into the calculation device <NUM> are defined as (x<NUM>, y<NUM>), ···, and (xn, yn). In this case, when the size of training data of the t time(s), in other words, the number of elements is defined as Nt, training data up to the T times is represented as in Expression (<NUM>).

If t = <NUM>, Nt = N<NUM>. If not, Nt = Nt-<NUM> + K. In this case, K is the size of training data added on the t times. The training model generation unit <NUM> generates a training model ht using Nt piece(s) of training data for each value of t as indicated in Expression (<NUM>).

The mixed training model generation unit <NUM> calculates weight αt of the training model ht as in Expression (<NUM>).

In Expression (<NUM>), Dt is a model dimension of the training model ht. The model dimension is an index indicating complexity of a model. For example, when the training model ht uses a decision tree, the model dimension is the number of branches of the decision tree.

The mixed training model generation unit <NUM> generates a mixed training model H indicated in Expression (<NUM>) using the training model ht and the weight αt. The output unit <NUM> inputs a target communication destination x into the mixed training model H, and calculates the malignant degree H(x).

In the present embodiment, the selection unit <NUM> selects all elements of training data or M elements that are randomly selected. Note that M is a constant number independent of t. In addition, overlapped elements may be included in the M elements.

With reference to <FIG>, a flow of processing of the calculation device <NUM> will be described. <FIG> is a flowchart illustrating the flow of processing of the calculation device according to the first embodiment. In the flowchart, current training data is defined as training data up to the t - <NUM> time(s). New training data is defined as training data of the t time(s). A current training model is defined as ht-<NUM>. A new training model is defined as ht. A mixed training model corresponds to the mixed training model H generated after training data of the t time(s) is input.

As illustrated in <FIG>, the calculation device <NUM> receives input of current training data (step S101) and new training data (step S102). At step S101, the current training data may be training data received in advance and stored in the storage unit <NUM>.

Subsequently, the calculation device <NUM> generates a current training model (step S103). The calculation device <NUM> also generates a new training model (step S104). At step S103, the current training data may be generated in advance and may be stored in the storage unit <NUM>.

The calculation device <NUM> mixes, after selecting and giving weight to generated training models, the training models (step S105), and generates a mixed training model (step S106).

Furthermore, the calculation device <NUM> inputs a target communication destination into the mixed training model (step S107), calculates a malignant degree of the target communication destination (step S108), and outputs the calculated malignant degree (step S109).

The calculation device <NUM> receives input of a plurality of pieces of training data including communication destinations known to be malignant as data. In addition, the calculation device <NUM> generates a model that calculates the malignant degree of the input communication destinations from each piece of the training data. Furthermore, the calculation device <NUM> gives weight to each of the models, and generates a mixed model using the model and the weight.

In the conventional method for calculating a malignant degree using supervised machine learning, after new training data was obtained, a current training model was discarded and a new training model was generated using the new training data. In this manner, when the new training data lacked a communication destination related to a target communication destination and a communication destination acting as noise of a training model was mixed, there was a case where a new training model could not correctly calculate a malignant degree of a communication destination that the current training model was able to correctly calculate. Thus, in the conventional method for calculating a malignant degree, when a malignant communication destination is changed, accuracy is reduced.

By contrast, when new training data is added, the calculation device <NUM> of the present embodiment gives weight as appropriate and mixes a current training model with the new training model without discarding the current training model. In this manner, the calculation device <NUM> can specify a malignant communication destination with high accuracy even when the malignant communication destination is changed.

The calculation device <NUM> gives weight corresponding to a statistic related to training data of a generation source to each of the models. For example, it is considered that accuracy of a generated model is improved as the size of training data used for training is larger. Thus, the calculation device <NUM> reflects a statistic of the data size and the like in weight, so as to allow, in a mixed training model, a model with higher accuracy to have a larger effect.

A second embodiment will be described. The basic configuration and processing of the calculation device <NUM> according to the second embodiment are the same as the configuration and processing of the calculation device <NUM> according to the first embodiment. Hereinafter, in the configuration and processing of the calculation device <NUM> according to the second embodiment, explanation of the configuration and processing that are the same as those of the calculation device <NUM> according to the first embodiment is omitted as appropriate.

In the first embodiment, the calculation device <NUM> gives weight to each training model. By contrast, in the second embodiment, the calculation device <NUM> gives weight to not only each training model but also each element of training data of a generation source.

The calculation device <NUM> can give weight to each element of training data corresponding to a contribution ratio to calculation of a malignant degree. In this case, the selection unit <NUM> selects, from data included in a plurality of pieces of training data, a given number of data in descending order of a contribution ratio to calculation of a malignant degree using a model.

With reference to <FIG>, processing for generating a mixed training model by the calculation device <NUM> will be described in detail. <FIG> is a view illustrating processing for generating a mixed model according to the second embodiment. Unlike the example in <FIG>, in the example in <FIG>, weight Dt(k) is set to each training data. In Dt(k), k indicates an index identifying elements of training data.

The calculation device <NUM> may receive input of training data up to t time(s) or up to T times at once, and may sequentially receive input of the training data for each t. In the second embodiment, the calculation device <NUM> is made to sequentially receive input of training data.

In this case, the training data input unit <NUM> sequentially receives input of training data. Every time the training data input unit <NUM> receives input of training data, the selection unit <NUM> selects, about each data included in the input training data, a given number of data in descending order of a contribution ratio to calculation of a malignant degree when a model having been generated by the training model generation unit <NUM> is used. Every time the selection unit <NUM> selects data, the training model generation unit <NUM> generates a model based on the selected data. Every time the training model generation unit <NUM> generates a model, the mixed training model generation unit <NUM> mixes, after giving weight to the generated model so that the generated model becomes larger as an error function becomes smaller, the generated model with a model that has been generated.

The training model generation unit <NUM> calculates the weight D<NUM>(k) when t = <NUM> as in Expression (<NUM>).

The training model generation unit <NUM> calculates an error function εt used when a training model of the t time(s) is generated as in Expression (<NUM>). In Expression (<NUM>), Z indicates an element that allows εt to be <NUM> or more and <NUM> or less. For example, Z = <NUM>/n.

In this manner, αt is larger as an error function is smaller and is smaller as the error function is larger. Thus, the calculation device <NUM> can allow, in a mixed training model, a model with higher accuracy to have a larger effect.

The training model generation unit <NUM> calculates the weight Dt(k) when t = <NUM> as in Expression (<NUM>). In Expression (<NUM>), when Nt-<NUM><k≤Nt, in other words, when k corresponds to new training data, which element has a larger contribution ratio is unknown. Thus, weight of each element becomes equal. In Expression (<NUM>), Zt is an element for normalizing an error function so that a total value of Dt(k) is Nt-<NUM>/Nt when <NUM>≤k≤Nt-<NUM>.

By contrast, when <NUM>≤k≤Nt-<NUM>, in other words, when k corresponds to the current training data, the weight Dt(k) is affected by a contribution ratio of each element in the current training model. Specifically, as a contribution ratio of the element k in the current training model ht-<NUM> generated at the time of inputting training data on the t - <NUM> time(s) is larger, the weight Dt(k) is larger.

The selection unit <NUM> selects M elements based on the weight Dt(k). For example, the selection unit <NUM> can select M elements in descending order of the Dt(k). The training model generation unit <NUM> generates, after giving the weight Dt(k) to each element selected by the selection unit <NUM> for each value of t, the training model ht using Nt pieces of training data as indicated in Expression (<NUM>).

The mixed training model generation unit <NUM> generates the mixed training model H indicated in Expression (<NUM>) using the training model ht and the weight αt. The output unit <NUM> inputs a target communication destination x into the mixed training model H, and calculates the malignant degree H(x).

With reference to <FIG>, a flow of processing of the calculation device <NUM> will be described. <FIG> is a flowchart illustrating the flow of processing of the calculation device according to the second embodiment. As illustrated in <FIG>, the calculation device <NUM> receives input of current training data (step S201) and new training data (step S202).

The calculation device <NUM> calculates weight of each element of the new training data and the current training data, and selects and gives weight to an element included in each data (step S202a).

Subsequently, the calculation device <NUM> generates a current training model (step S203). The calculation device <NUM> also generates a new training model (step S204). At steps S203 and S204, the calculation device <NUM> generates the current training model and the new training model using the elements selected and gave weight to at step S202a.

The calculation device <NUM> mixes, after selecting and giving weight to the generated training models, the training models (step S205), and generates a mixed training model (step S206).

Furthermore, the calculation device <NUM> inputs a target communication destination into the mixed training model (step S207), calculates a malignant degree of the target communication destination (step S208), and outputs the calculated malignant degree (step S209).

The selection unit <NUM> selects, from data included in a plurality of pieces of training data, a given number of data in descending order of a contribution ratio to calculation of a malignant degree using a model. In this manner, the calculation device <NUM> can propagate information useful in the past or in the present and can use the information for generation of the latest training model. In addition, the calculation device <NUM> can generate a model with higher accuracy each time generation is repeated.

In this manner, the calculation device <NUM> can calculate, even though how many times training data is input at a maximum is unknown, weight based on the sequentially input training data.

Components in each of the illustrated devices are functionally conceptual, and are not necessarily configured physically as illustrated. In other words, a specific embodiment of distributing/integrating each of the devices is not limited to the illustrated ones, and all of or a part of the devices can be configured to be functionally or physically distributed/integrated in a certain unit depending on various kinds of loads, use situations, and the like. In addition, all of or a certain part of the processing functions executed by each of the devices may be implemented by a central processing unit (CPU) and a computer program analyzed and executed by the CPU, or may be implemented as hardware of the wired logic.

Out of the pieces of processing described in the present embodiment, all of or a part of the pieces of processing described as automatically performed processing can be performed manually, or all of or a part of the pieces of processing described as manually performed processing can be performed automatically by a publicly known method. Except as otherwise specifically described, any modifications can be made on processing procedures, control procedures, specific names, and information including various kinds of data and parameters illustrated in the specifications and drawings.

As one embodiment, the calculation device <NUM> can be implemented by installing a calculation program that executes the model generation and malignant degree calculation as packaged software and online software into a desired computer. For example, by causing an information-processing device to execute the calculation program, the information-processing device can function as the calculation device <NUM>. The information-processing device mentioned here includes a desktop or a laptop personal computer. Besides, mobile communication terminals such as a smartphone, a mobile phone, and a personal handyphone system (PHS), slate terminals such as a personal digital assistant (PDA), and the like are in the category of the information-processing device.

The calculation device <NUM> defines a terminal device used by a user as a client, and can be implemented as a calculation server device that provides a service related to the model generation and malignant degree calculation to the client. For example, the calculation server device is implemented as a server device that provides a calculation service in which training data is defined as input and a mixed training model is defined as output. In this case, the calculation server device may be implemented as a Web server, and may be implemented as a cloud that provides a service related to the model generation and malignant degree calculation by outsourcing.

<FIG> is a view illustrating an example of a computer that executes a calculation program. A computer <NUM> includes, for example, a memory <NUM> and a CPU <NUM>. The computer <NUM> also includes a hard disk drive interface <NUM>, a disk drive interface <NUM>, a serial port interface <NUM>, a video adapter <NUM>, and a network interface <NUM>. Each of the units is connected to each other by a bus <NUM>.

The memory <NUM> includes a read only memory (ROM) <NUM> and a RAM <NUM>. The ROM <NUM> stores therein, for example, a boot program of a basic input output system (BIOS) and the like. The hard disk drive interface <NUM> is connected to a hard disk drive <NUM>. The disk drive interface <NUM> is connected to a disk drive <NUM>. For example, attachable/detachable storage media such as a magnetic disk and an optical disk are inserted into the disk drive <NUM>. The serial port interface <NUM> is connected to, for example, a mouse <NUM> and a keyboard <NUM>. The video adapter <NUM> is connected to, for example, a display <NUM>.

The hard disk drive <NUM> stores therein, for example, an OS <NUM>, an application program <NUM>, a program module <NUM>, and program data <NUM>. In other words, a computer program specifying pieces of processing of the calculation device <NUM> is implemented as the program module <NUM> in which a computer-executable code is described. The program module <NUM> is stored in, for example, the hard disk drive <NUM>. For example, the program module <NUM> for executing processing the same as the function configuration in the calculation device <NUM> is stored in the hard disk drive <NUM>. The hard disk drive <NUM> may be replaced by an SSD.

Setting data used in processing of the embodiments described above is stored as the program data <NUM> in, for example, the memory <NUM> and the hard disk drive <NUM>. The CPU <NUM> reads the program module <NUM> and the program data <NUM> stored in the memory <NUM> and the hard disk drive <NUM> into the RAM <NUM> as needed, and executes processing of the embodiments described above.

Claim 1:
A calculation device comprising:
an input unit (<NUM>) configured to receive input of a plurality of data sets, each including communication destinations known to be malignant as data;
a first generation unit (<NUM>) configured to generate a model from one or more data sets of the plurality of data sets for calculating a malignant degree of an input communication destination;
a second generation unit (<NUM>) configured to give a weight to each of the models and to generate a mixed model that calculates a weighted sum of a malignant degree calculated by each of the models;
a target communication destination input unit (<NUM>) configured to receive input of a target communication destination list, wherein the target communication destination list is a list of communication destinations that are unknown whether they are malignant; and
an output unit (<NUM>) configured calculate and output a malignant degree of each of the communication destinations included in the target communication destination list using the mixed model,
wherein the input unit (<NUM>) is configured to sequentially receive input of the plurality of data sets,
the first generation unit (<NUM>) is configured to generate, every time the input unit (<NUM>) receives a data set of the plurality of data sets, the model based on the received data set and the previously received data sets, and
the second generation unit (<NUM>) is configured to mix, every time the first generation unit (<NUM>) generates the model, after giving weight to the generated model, the generated model with all models that have been generated previously.