Information processing device and information processing method

Patent metadata

Field	Value
Publication number	US-9824157-B2
Application number	US-201514609948-A
Country	US
Kind code	B2
Filing date	Jan 30, 2015
Priority date	Mar 17, 2014
Publication date	Nov 21, 2017
Grant date	Nov 21, 2017

Abstract

An information processing device including: a storage unit configured to store a first record set including variables of multiple types, and a second record set different from the first record set and including variables of the multiple types; and a processing unit configured to calculate an expected value at which a first variable set representing a combination of variables formed by selecting one variable for each type in the first record set is expected to appear in the second record set, extract the first variable set based on the expected value and the number of records including the first variable set in the second record set, and output at least one of the extracted first variable set and a second variable set, the second variable set representing a combination of variables formed by selecting one or more variables for each type in the second record set.

First claim

What is claimed is:

1. An information processing device configured to be coupled to a server device, the information processing device comprising:
a storage device; and
a processor coupled to the storage device and configured to:
obtain, from the server device, a first record set including a plurality of variables, the variables indicating a source and a destination of access to the server device from a plurality of terminal devices through a network,
store the first record set in the storage device,
count, for each of variable values of each of the variables, first appearance numbers in the first record sets,
determine, for each of the variable values of each of the variables in the first record sets, a first appearance ratio by dividing the first appearance number by a first total records number included in the first record set,
specify a plurality of sets of the variable values each of which is included in each of the plurality of variables, respectively,
determine, for each of the plurality of sets of the variable values, a second appearance ratio by multiplying the first appearance ratio of each of the variable values included in each of the plurality of sets, respectively,
determine, for each of the plurality of sets of the variable values, an expected appearance number by multiplying the second appearance ratio and a second total record number included in the second record set, respectively,
after obtaining the first record set, obtain, from the server device, a second record set different from the first record set and including the plurality of variables,
store the second record set in the storage device,
count, for each of the plurality of sets of the variable values in the second record, a second appearance number, respectively,
determine, for each of the plurality of sets of the variable values, a difference between the expected appearance number and the second appearance number, respectively,
specify, from the plurality of sets of the variable values, one or more sets of which the difference is over a first threshold value determined for each of the plurality of sets of the variable values, as an error set,
select, from each of the plurality of variables, one or more the variable values, and specify combination patterns of the selected one or more the variable values,
determine a total pattern number of the specified combination patterns of the selected one or more the variable values, and
when a value obtained by dividing a number of the sets of the variable values specified as an error set and included in the specified combination patterns by the total pattern number is over a second threshold value, output at least one of first information and second information as an indicator indicating a probability of improper access to the server device, the first information indicating the sets of the variable values which are specified as an error set and included in the specified combination patterns, and the second information indicating the specified combination patterns of the selected one or more the variable values.

2. The information processing device according to claim 1 , wherein the source of the access indicates an address of a terminal device of the plurality of terminal devices.

3. The information processing device according to claim 2 , wherein the destination of the access indicates a URL accessed by a terminal device of the plurality of terminal devices.

4. The information processing device according to claim 3 , wherein the first information indicates mal access to the URL.

5. A non-transitory computer-readable storage medium that stores a program, the program configured to cause a computer to:
obtain, from a server device, a first record set including a plurality of variables, the variables indicating a source and a destination of access to the server device from a plurality of terminal devices through a network,
store the first record set in a storage device,
count, for each of variable values of each of the variables, first appearance numbers in the first record sets,
determine, for each of the variable values of each of the variables in the first record sets, a first appearance ratio by dividing the first appearance number by a first total records number included in the first record set,
specify a plurality of sets of the variable values each of which is included in each of the plurality of variables, respectively,
determine, for each of the plurality of sets of the variable values, a second appearance ratio by multiplying the first appearance ratio of each of the variable values included in each of the plurality of sets, respectively,
determine, for each of the plurality of sets of the variable values, an expected appearance number by multiplying the second appearance ratio and a second total record number included in the second record set, respectively,
after obtaining the first record set, obtain, from the server device, a second record set different from the first record set and including the plurality of variables,
store the second record set in the storage device,
count, for each of the plurality of sets of the variable values in the second record, a second appearance number, respectively,
determine, for each of the plurality of sets of the variable values, a difference between the expected appearance number and the second appearance number, respectively,
specify, from the plurality of sets of the variable values, one or more sets of which the difference is over a first threshold value determined for each of the plurality of sets of the variable values, as an error set,
select, from each of the plurality of variables, one or more the variable values, and specify combination patterns of the selected one or more the variable values,
determine a total pattern number of the specified combination patterns of the selected one or more the variable values, and
when a value obtained by dividing a number of the sets of the variable values specified as an error set and included in the specified combination patterns by the total pattern number is over a second threshold value, output at least one of first information and second information as an indicator indicating a probability of improper access to the server device, the first information indicating the sets of the variable values which are specified as an error set and included in the specified combination patterns, and the second information indicating the specify combination patterns of the selected one or more the variable values.

6. The non-transitory computer-readable storage medium according to claim 5 , wherein the source of the access indicates an address of a terminal device of the plurality of terminal devices.

7. The non-transitory computer-readable storage medium according to claim 6 , wherein the destination of the access indicates a URL accessed by a terminal device of the plurality of terminal devices.

8. The non-transitory computer-readable storage medium according to claim 7 , wherein the first information indicates mal access to the URL.

9. An information processing method comprising:
obtaining, from a server device, a first record set including a plurality of variables, the variables indicating a source and a destination of access to the server device from a plurality of terminal devices through a network;
storing the first record set in a storage device;
counting, for each of variable values of each of the variables, first appearance numbers in the first record sets;
determining, for each of the variable values of each of the variables in the first record sets, a first appearance ratio by dividing the first appearance number by a first total records number included in the first record set;
specifying a pl

Assignees

• Fujitsu Ltd

Inventors

• Maruhashi Koji
• Yugami Nobuhiro

Classifications

• G06F16/958 Primary

  Organisation or management of web site content, e.g. publishing, maintaining pages or automatic linking · CPC title

• G06F16/24

  Querying · CPC title

• G06F16/24578

  using ranking · CPC title

• G06F16/951

  Indexing; Web crawling techniques · CPC title

• G06F17/3053

  Physics · mapped topic