SEARCHING DEVICE, SEARCH RANGE DETERMINATION METHOD, AND SEARCH RANGE DETERMINATION PROGRAM
A passive acquisition data analysis unit ( 11 ) analyzes data observed in a communication network. An active acquisition data analysis unit ( 12 ) analyzes data obtained by searching the communication network. A data output unit ( 14 ) outputs data for specifying an IP address to be searched for based on an analysis result from the passive acquisition data analysis unit ( 11 ) and an analysis result from the active acquisition data analysis unit ( 12 ).
1 . A search device comprising a processor configured to execute operations comprising:
generating a passive data analysis result of analyzing data observed in a communication network;
generating an active data analysis result of analyzing data obtained by searching the communication network; and
determining a network address to be searched based on the passive data analysis result and the active data analysis result;
transmitting the network address to an application configured to search the network address to generate a set of suspected network addresses.
2 . The search device according to claim 1 ,
wherein the generating an active data analysis result further comprises analyzing data including a search result indicating whether the network address is malicious or not, and
the determining the network address further comprise outputting data for specifying the network address having a feature similar to a feature of a malicious network address obtained based on the search result.
3 . The search device according to claim 1 , wherein the generating an active data analysis result further comprises obtaining information indicating a degree of malignancy for each network address based on information indicating a tendency of malicious communication information and communication information for each network address obtained by scanning the Internet.
4 . The search device according to claim 1 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
5 . A computer-implemented method for determining a search range, comprising:
generating a passive data analysis result of analyzing data observed in a communication network;
generating an active data analysis result of analyzing data obtained by searching the communication network; and
determining a network address to be searched based on the passive data analysis result and the active data analysis result;
transmitting the network address to an application configured to search the network address to generate a set of suspected network addresses.
6 . A computer-readable non-transitory recording medium storing a computer-executable program instructions that when executed by a processor a computer system to execute operations comprising:
generating a passive data analysis result of analyzing data observed in a communication network;
generating an active data analysis result of analyzing data obtained by searching the communication network; and
determining a network address to be searched based on the passive data analysis result and the active data analysis result;
transmitting the network address to an application configured to search the network address to generate a set of suspected network addresses.
7 . The search device according to claim 2 , wherein the generating an active data analysis result further comprises obtaining information indicating a degree of malignancy for each network address based on information indicating a tendency of malicious communication information and communication information for each network address obtained by scanning the Internet.
8 . The search device according to claim 2 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
9 . The search device according to claim 3 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
10 . The computer-implemented method according to claim 5 ,
wherein the generating an active data analysis result further comprises analyzing data including a search result indicating whether the network address is malicious or not, and
the determining the network address further comprise outputting data for specifying the network address having a feature similar to a feature of a malicious network address obtained based on the search result.
11 . The computer-implemented method according to claim 5 , wherein the generating an active data analysis result further comprises obtaining information indicating a degree of malignancy for each network address based on information indicating a tendency of malicious communication information and communication information for each network address obtained by scanning the Internet.
12 . The computer-implemented method according to claim 5 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
13 . The computer-implemented method according to claim 10 , wherein the generating an active data analysis result further comprises obtaining information indicating a degree of malignancy for each network address based on information indicating a tendency of malicious communication information and communication information for each network address obtained by scanning the Internet.
14 . The computer-implemented method according to claim 10 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
15 . The computer-implemented method according to claim 11 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
16 . The computer-readable non-transitory recording medium according to claim 6 ,
wherein the generating an active data analysis result further comprises analyzing data including a search result indicating whether a network address is malicious or not, and
the determining the network address further comprise outputting data for specifying the network address having a feature similar to a feature of a malicious network address obtained based on the search result.
17 . The computer-readable non-transitory recording medium according to claim 6 , wherein the generating an active data analysis result further comprises obtaining information indicating a degree of malignancy for each network address based on information indicating a tendency of malicious communication information and communication information for each network address obtained by scanning the Internet.
18 . The computer-readable non-transitory recording medium according to claim 6 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.
19 . The computer-readable non-transitory recording medium according to claim 16 , wherein the generating an active data analysis result further comprises obtaining information indicating a degree of malignancy for each network address based on information indicating a tendency of malicious communication information and communication information for each network address obtained by scanning the Internet.
20 . The computer-readable non-transitory recording medium according to claim 16 , wherein the generating an active data analysis result further comprises analyzing at least one of a determination result from a program instruction for determining a malicious network address, a determination date and time, or information on related malware.