Estimation system, estimation method, and estimation program

Patent metadata

Field	Value
Publication number	US-12081564-B2
Application number	US-202017793657-A
Country	US
Kind code	B2
Filing date	Oct 26, 2020
Priority date	Jan 20, 2020
Publication date	Sep 3, 2024
Grant date	Sep 3, 2024

Abstract

An estimation unit retrieves a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from a query inserted into a Web request. In addition, the estimation unit presents information for specifying the type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained by the retrieval of the retrieval unit.

First claim

The invention claimed is:

1. An estimation system comprising:
retrieval circuitry configured to retrieve a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from the query which is inserted into a Web request;
presentation circuitry configured to present information for specifying a type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained by the retrieval circuitry in the retrieval;
extraction circuitry configured to extract the query inserted into the Web request that is detected to be the attack;
creating circuitry configured to create the syntax tree from the query extracted by the extraction circuitry in accordance with a rule defined in advance;
impartation circuitry configured to impart a label to the subtree that is a part of the syntax tree based on a result obtained in a case where the query corresponding to the subtree has been executed; and
identification circuitry configured to identify the type of damage of the attack according to the Web request based on the label imparted by the impartation circuitry,
wherein:
the retrieval circuitry retrieves the subtree that matches the query to be estimated, from subtrees included in the syntax tree created by the creating circuitry, and
the presentation circuitry presents information for specifying the type of damage of the attack and the attack target, based on the subtree obtained by the retrieval circuitry in the retrieval and the label imparted to the subtree.

2. The estimation system according to claim 1 , wherein:
the presentation circuitry presents a table name as information for specifying the attack target.

3. An estimation method at an estimation system, the estimation method comprising:
retrieving a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from the query which is inserted into a Web request;
presenting information for specifying a type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained in the retrieving;
extracting the query inserted into the Web request that is detected to be the attack;
creating the syntax tree from the query extracted by the extracting in accordance with a rule defined in advance;
imparting a label to the subtree that is a part of the syntax tree based on a result obtained in a case where the query corresponding to the subtree has been executed; and
identifying the type of damage of the attack according to the Web request based on the label imparted by the imparting,
wherein:
the retrieving retrieves the subtree that matches the query to be estimated, from subtrees included in the syntax tree created by the creating, and
the presenting presents information for specifying the type of damage of the attack and the attack target, based on the subtree obtained by the retrieving in the retrieval and the label imparted to the subtree.

4. A non-transitory computer readable medium including an estimation program which when executed causes a computer to:
retrieve a subtree that matches a query to be estimated, from subtrees included in a syntax tree created from the query which is inserted into a Web request;
present information for specifying a type of damage of an attack and an attack target, the information being associated in advance with the subtree obtained in the retrieving;
extract the query inserted into the Web request that is detected to be the attack;
create the syntax tree from the query extracted by the extracting in accordance with a rule defined in advance;
impart a label to the subtree that is a part of the syntax tree based on a result obtained in a case where the query corresponding to the subtree has been executed; and
identify the type of damage of the attack according to the Web request based on the label imparted by the imparting,
wherein:
the retrieving retrieves the subtree that matches the query to be estimated, from subtrees included in the syntax tree created by the creating, and
the presenting presents information for specifying the type of damage of the attack and the attack target, based on the subtree obtained by the retrieving in the retrieval and the label imparted to the subtree.

5. The estimation method according to claim 3 , wherein:
the presenting presents a table name as information for specifying the attack target.

6. The non-transitory computer readable medium estimation system according to claim 4 , wherein:
the presenting presents a table name as information for specifying the attack target.

Assignees

• Nippon Telegraph & Telephone

Inventors

• Kuroki Kotomi
• Kanemoto Yo
• Aoki Kazufumi

Classifications

• G06F16/9538

  Presentation of query results · CPC title

• G06F16/9027

  Trees · CPC title

• G06F16/95

  Retrieval from the web · CPC title

• G06F21/55

  Detecting local intrusion or implementing counter-measures · CPC title

• H04L63/1416 Primary

  Event detection, e.g. attack signature detection · CPC title