ANOMALY DETECTION DEVICE, ANOMALY DETECTION METHOD, AND ANOMALY DETECTION PROGRAM
An abnormality detection device includes processing circuitry configured to create a group for each of predetermined communication features for alerts indicating that communication has been detected as abnormal communication that is different in pattern from normal communication and identify for each of the created groups of alerts, a cause of notification of the alerts.
1 . An abnormality detection device comprising:
processing circuitry configured to:
create a group for each of predetermined communication features for alerts indicating that communication has been detected as abnormal communication that is different in pattern from normal communication; and
identify for each of the created groups of alerts, a cause of notification of the alerts.
2 . The abnormality detection device according to claim 1 , wherein the processing circuitry is further configured to create the group in which the same communication source IP address, communication destination IP address, and communication destination port number are used as a predetermined communication feature.
3 . The abnormality detection device according to claim 1 , wherein the processing circuitry is further configured to identify the cause by determining whether communication of the group has been learned in such a way as to allow for output of whether the communication is normal or abnormal.
4 . The abnormality detection device according to claim 3 , wherein the processing circuitry is further configured to in a case where the communication of the group has been learned, identify the cause by determining whether a feature of the communication of the group is similar to a learned feature.
5 . The abnormality detection device according to claim 4 , wherein the processing circuitry is further configured to for the communication of the group, in a case where the feature of the communication of the group is similar to the learned feature, identify the cause by determining a degree of deviation of a value for detection as abnormal communication from a predetermined threshold.
6 . The abnormality detection device according to claim 1 , wherein the processing circuitry is further configured to determine whether there is a periodicity in occurrence times of the alerts for each of the groups.
7 . An abnormality detection method executed by an abnormality detection device, the abnormality detection method comprising:
creating a group for each of predetermined communication features for alerts indicating that communication has been detected as abnormal communication that is different in pattern from normal communication; and
an identification process of identifying, for each of the created groups of alerts, a cause of notification of the alerts.
8 . An A non-transitory computer-readable recording medium storing therein an abnormality detection program that causes computer to execute a process comprising:
creating a group for each of predetermined communication features for alerts indicating that communication has been detected as abnormal communication that is different in pattern from normal communication; and
identifying, for each of the created groups of alerts, a cause of notification of the alerts.