Information processing apparatus and non-transitory computer readable medium for detecting unauthorized access

Patent metadata

Field	Value
Publication number	US-11729135-B2
Application number	US-202017106165-A
Country	US
Kind code	B2
Filing date	Nov 29, 2020
Priority date	May 29, 2020
Publication date	Aug 15, 2023
Grant date	Aug 15, 2023

Abstract

An information processing apparatus includes a processor configured to detect unauthorized access from a subject terminal to a subject host as a result of inputting subject input data into an autoencoder, an Internet protocol address of the subject terminal and an Internet protocol address of the subject host being used as at least part of the subject input data, the autoencoder having performed learning by using learning data, an Internet protocol address of a terminal and an Internet protocol address of a host to which the terminal has connected being used as at least part of the learning data.

First claim

What is claimed is:

1. An information processing apparatus comprising:
a processor configured to
detect unauthorized access from a subject terminal to a subject host as a result of inputting subject input data into an autoencoder, an Internet protocol address of the subject terminal and an Internet protocol address of the subject host being used as at least part of the subject input data, the autoencoder having performed learning by using learning data, an Internet protocol address of a terminal and an Internet protocol address of a host to which the terminal has connected being used as at least part of the learning data, wherein the processor is further configured to:
detect unauthorized access from the subject terminal based on an error score, the error score being calculated from an overall difference between the subject input data and subject output data, the subject output data representing output from the autoencoder in response to the subject input data; and
calculate the error score so that the overall difference between the subject input data and the subject output data becomes greater when a difference is found between a higher segment of the Internet protocol address of the subject terminal indicated by the subject input data and the higher segment of the Internet protocol address of the subject terminal indicated by the subject output data than when the same difference is found between a lower segment of the Internet protocol address of the subject terminal indicated by the subject input data and the lower segment of the Internet protocol address of the subject terminal indicated by the subject output data or so that the overall difference between the subject input data and the subject output data becomes greater when a difference is found between a higher segment of the Internet protocol address of the subject host indicated by the subject input data and the higher segment of the Internet protocol address of the subject host indicated by the subject output data than when the same difference is found between a lower segment of the Internet protocol address of the subject host indicated by the subject input data and the lower segment of the Internet protocol address of the subject host indicated by the subject output data.

2. The information processing apparatus according to claim 1 , wherein:
information indicating a time zone in which the terminal has connected the host is also used as the learning data for the autoencoder to perform learning; and
the processor is configured also to input the information indicating the time zone into the autoencoder as part of the subject input data.

3. The information processing apparatus according to claim 1 , wherein:
information indicating an assignee country of the Internet protocol address of the host is also used as the learning data for the autoencoder to perform learning; and
the processor is configured also to input the information indicating the assignee country of the Internet protocol address of the host into the autoencoder as part of the subject input data.

4. The information processing apparatus according to claim 2 , wherein:
information indicating an assignee country of the Internet protocol address of the host is also used as the learning data for the autoencoder to perform learning; and
the processor is configured also to input the information indicating the assignee country of the Internet protocol address of the host into the autoencoder as part of the subject input data.

5. A non-transitory computer readable medium storing a program causing a computer to execute a process, the process comprising:
detecting unauthorized access from a subject terminal to a subject host as a result of inputting subject input data into an autoencoder, an Internet protocol address of the subject terminal and an Internet protocol address of the subject host being used as at least part of the subject input data, the autoencoder having performed learning by using learning data, an Internet protocol address of a terminal and an Internet protocol address of a host to which the terminal has connected being used as at least part of the learning data, wherein the process further comprising:
detecting unauthorized access from the subject terminal based on an error score, the error score being calculated from an overall difference between the subject input data and subject output data, the subject output data representing output from the autoencoder in response to the subject input data; and
calculating the error score so that the overall difference between the subject input data and the subject output data becomes greater when a difference is found between a higher segment of the Internet protocol address of the subject terminal indicated by the subject input data and the higher segment of the Internet protocol address of the subject terminal indicated by the subject output data than when the same difference is found between a lower segment of the Internet protocol address of the subject terminal indicated by the subject input data and the lower segment of the Internet protocol address of the subject terminal indicated by the subject output data or so that the overall difference between the subject input data and the subject output data becomes greater when a difference is found between a higher segment of the Internet protocol address of the subject host indicated by the subject input data and the higher segment of the Internet protocol address of the subject host indicated by the subject output data than when the same difference is found between a lower segment of the Internet protocol address of the subject host indicated by the subject input data and the lower segment of the Internet protocol address of the subject host indicated by the subject output data.

6. An information processing method comprising:
detecting unauthorized access from a subject terminal to a subject host as a result of inputting subject input data into an autoencoder, an Internet protocol address of the subject terminal and an Internet protocol address of the subject host being used as at least part of the subject input data, the autoencoder having performed learning by using learning data, an Internet protocol address of a terminal and an Internet protocol address of a host to which the terminal has connected being used as at least part of the learning data, wherein the method further comprising:
detecting unauthorized access from the subject terminal based on an error score, the error score being calculated from an overall difference between the subject input data and subject output data, the subject output data representing output from the autoencoder in response to the subject input data; and
calculating the error score so that the overall difference between the subject input data and the subject output data becomes greater when a difference is found between a higher segment of the Internet protocol address of the subject terminal indicated by the subject input data and the higher segment of the Internet protocol address of the subject terminal indicated by the subject output data than when the same difference is found between a lower segment of the Internet protocol address of the subject terminal indicated by the subject input data and the lower segment of the Internet protocol address of the subject terminal indicated by the subject output data or so that the overall difference between the subject input data and the subject output data becomes greater when a difference is found between a higher segment of the Internet protocol address of the subject host indicated by the subject input data and the higher segment of the Internet protocol address of the subject host indicated by the subject output data than when the same difference is found between a lower segment of the Internet

Assignees

• Fujifilm Business Innovation Corp

Inventors

• Sun Ye
• Suzuki Tatsuo

Classifications

• G06N3/0895

  Weakly supervised learning, e.g. semi-supervised or self-supervised learning · CPC title

• G06N3/0455

  Auto-encoder networks; Encoder-decoder networks · CPC title

• H04L61/4511 Primary

  using domain name system [DNS] · CPC title

• G06F18/214

  Generating training patterns; Bootstrap methods, e.g. bagging or boosting · CPC title

• H04L63/0236

  Filtering by address, protocol, port number or service, e.g. IP-address or URL · CPC title