Patent Document ID: 9794274
Application ID: 15502969
Patent Status: 1

Claim One:
1. An information processing apparatus collecting a packet a transmission source of which is a protection target apparatus and a packet a transmission destination of which is the protection target apparatus, the information processing apparatus comprising: processing circuitry to: generate packet information by setting an entry for each collected packet and describing attribute data of the packet together with occurrence time of the packet for each entry; store definition information which indicates a plurality of categories of attack and defines an extraction time width and an extraction condition for each category; select, when a packet which corresponds to any category of the plurality of categories is detected from among the packet the transmission source of which is the protection target apparatus and the packet the transmission destination of which is the protection target apparatus, the extraction time width and the extraction condition defined in the definition information as a selection extraction time width and a selection extraction condition with respect to a category of a detection packet detected, and to specify an extraction time range which starts from the occurrence time of the detection packet and whose width is equal to the selection extraction time width; extract from the packet information an entry the occurrence time of which is included in the extraction time range and the attribute data of which coincides with the selection extraction condition; determine presence or absence of an attack to the protection target apparatus based on an extraction result; change at least any of the extraction time width and the extraction condition defined in the definition information in accordance with an instruction of a user of the information processing apparatus; and output an alert when the attack to the protection target apparatus is detected as a result of the determination.