Learning method, learning device, and learning program

Patent metadata

Field	Value
Publication number	US-12028352-B2
Application number	US-201917056432-A
Country	US
Kind code	B2
Filing date	Apr 16, 2019
Priority date	May 21, 2018
Publication date	Jul 2, 2024
Grant date	Jul 2, 2024

Abstract

A learning device generates a character class series abstracting a structure of a predetermined character string included in each of requests to the server which have been generated in a predetermined period. Also, for each of the combinations of the predetermined identification information and the character class series included in the requests, the learning device calculates a score for update which becomes higher as the number of times of appearance of the combination is increased and becomes higher as the appearance of the combination is continued. Based on the score for update, the learning device updates the profile of each combination for determining whether the request is an attack or not.

First claim

The invention claimed is:

1. A learning method executed by a computer, the learning method comprising:
generating a character class series, which is a series of each class of character string included in a request to a server generated in a predetermined period;
calculating, for each combination of identification information and the character class series included in the request, a score for update so that the score is increased as a number of times of appearance of the combination is increased and that the score is increased corresponding to a duration of appearance of the combination; and
updating a profile based on the score, the profile including the number of times of appearance of each combination, and the profile is for use in determining whether the request is an attack or not, wherein
the updating includes:
when a value obtained by adding the score to the number of times of appearance included in the profile is equal to or higher than a threshold value, gradually raising a status included in the profile,
when the status is equal to or less than a predetermined level, changing the number of times of appearance to be 0, and
when the combination of the identification information and the character class series is included in a list set in advance, invalidating the profile.

2. The learning method according to claim 1 , wherein in the calculating, the score is calculated to increase according to the appearance of the combination in the predetermined period.

3. The learning method according to claim 1 , wherein in the calculating, the score is calculated to increase according to the number of a period in which the combination appears.

4. The learning method according to claim 1 , wherein in the updating, when a last update time and a date of the profile has passed by a threshold amount of time, the profile is invalidated.

5. A learning device, comprising:
a memory; and
a processor coupled to the memory and configured to:
generate a character class series, which is a series of each class of character string included in a request to a server generated in a predetermined period;
calculate, for each combination of identification information and the character class series included in the request, a score for update so that the score is increased as a number of times of appearance of the combination is increased and that the score is increased corresponding to a duration of appearance of the combination; and
update a profile based on the score, the profile including the number of times of appearance of each combination, and the profile is for use in determining whether the request is an attack or not, wherein

to update the profile, the processor is configured to:
when a value obtained by adding the score to the number of times of appearance included in the profile is equal to or higher than a threshold value, gradually raise a status included in the profile,
when the status is equal to or less than a predetermined level, change the number of times of appearance to be 0, and
when the combination of the identification information and the character class series is included in a list set in advance, invalidate the profile.

6. A non-transitory computer-readable recording medium having stored therein a program, for learning, that causes a computer to execute a process comprising:
generating a character class series, which is a series of each class of character string included in a request to a server generated in a predetermined period;
calculating, for each combination of identification information and the character class series included in the request, a score for update so that the score is increased as a number of times of appearance of the combination is increased and that the score is increased corresponding to a duration of appearance of the combination; and
updating a profile based on the score, the profile including the number of times of appearance of each combination, and the profile is for use in determining whether the request is an attack or not, wherein
the updating includes:
when a value obtained by adding the score to the number of times of appearance included in the profile is equal to or higher than a threshold value, gradually raising a status included in the profile,
when the status is equal to or less than a predetermined level, changing the number of times of appearance to be 0, and
when the combination of the identification information and the character class series is included in a list set in advance, invalidating the profile.

Assignees

• Nippon Telegraph & Telephone

Inventors

• Iwaki Yuta
• Orihara Shingo
• Miyamoto Kunio
• Kanemoto Yo
• Murata Yuichi

Classifications

• G06N20/00

  Machine learning · CPC title

• G06F21/554

  involving event detection and direct action · CPC title

• G06F21/552

  involving long-term monitoring or reporting · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title