LEARNING APPARATUS, DETECTING APPARATUS, LEARNING METHOD, DETECTING METHOD, LEARNING PROGRAM, AND DETECTING PROGRAM
A learning apparatus includes processing circuitry configured to receive an input of information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method, and generate a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the information relating to the web page.
1 . A learning apparatus comprising:
processing circuitry configured to:
receive an input of information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method; and
generate a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the information relating to the web page.
2 . The learning apparatus according to claim 1 , wherein the processing circuitry is further configured to, as the word/phrase-related feature, extract communication destination information and text information from the information relating to the web page and measure a number of times a word or a phrase included in the communication destination information or the text information appears.
3 . The learning apparatus according to claim 1 , wherein the processing circuitry is further configured to, as the image-related feature, extract image information from the information relating to the web page and measure a number of times an image included in the image information appears.
4 . The learning apparatus according to claim 1 , wherein the processing circuitry is further configured to, as the HTML source code-related feature, extract HTML source code information from the information relating to the web page and measure a number of times a link destination appears and structure information, the number of times and the structure information being included in HTML information.
5 . The learning apparatus according to claim 1 , wherein the processing circuitry is further configured to, as the communication log-related feature, extract communication log information from the information relating to the web page and measure a number of times a communication destination included in the communication log information appears.
6 . (canceled)
7 . A learning method comprising:
receiving an input of information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method; and
generating a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the information relating to the web page, by processing circuitry.
8 . (canceled)
9 . A non-transitory computer-readable recording medium storing therein a learning program that causes a computer to execute a process comprising:
receiving an input of information relating to a web page, whether or not the web page is a malicious site being known, the malicious site presenting a false virus removal method; and
a generating a training model using, as training data, any one feature or a plurality of features from among a word/phrase-related feature, an image-related feature, an HTML source code-related feature and a communication log-related feature, the feature or the features being included in the information relating to the web page.
10 . (canceled)