Determining apparatus, determining method, and determining program

1. A determining apparatus for determining whether an attack to a server using an attack code has succeeded or failed, the determining apparatus comprising:

a memory; and

a processor coupled to the memory and programmed to execute a process comprising:

determining an attack type of an attack code included in an attack request that is addressed to the server;

executing emulation of an attack with the attack code to the server based on the determined attack type, and extracting a feature that appears in a response issued by the server when the emulation results in a successful attack to the server; and

determining that the attack with the attack code has succeeded when a response from the server for which a success or failure of the attack is to be determined has the extracted feature.

2. The determining apparatus according to claim 1 , wherein the processor executes a process further comprising:

excluding a feature having a character string length equal to or shorter than a predetermined threshold, or a feature appearing at a frequency equal to or higher than a predetermined threshold in responses to non-attack requests, from features extracted by the extracting to generate resultant features, and

wherein the determining determines that the attack with the attack code has succeeded when a response from the server for which a success or failure of the attack is to be determined has the resultant features.

3. The determining apparatus according to claim 1 , wherein the determining determines an attack type, using a keyword included in the attack code, the attack type of the attack code to be one of an attack type using an operating system (OS) command, an attack type using a program code, an attack type using an SQL command, an attack type using a HyperText Transfer Protocol (HTTP) response, and an attack type using a file operation.

4. The determining apparatus according to claim 1 , wherein the executing executes emulation of an attack using a part of the attack code, and the extracting extracts a feature that appears in a response issued by the server when the emulation executing the part of the attack code results in a successful attack to the server.

5. The determining apparatus according to claim 1 , wherein, when an attack code included in the attack request includes a code for operating an operation time of the server, the extracting sets a value corresponding to request processing time taken from when the server receives the request to when the server transmits the response to the request, as a feature appearing in a response issued by the server when the attack succeeds.

6. The determining apparatus according to claim 1 , wherein when an attack code included in the attack request includes a code for instructing the server to access an external resource, the extracting sets an access from the server to the external resource within a predetermined time from when the attack request is received, as a feature appearing in a response issued by the server when the attack succeeds.

7. A determination method for determining whether an attack to a server using an attack code has succeeded or failed, the determination method by which a determining apparatus executes:

determining an attack type of an attack code included in an attack request that is addressed to the server;

executing emulation of an attack with the attack code to the server based on the determined attack type, and extracting a feature that appears in a response issued by the server when the emulation results in a successful attack to the server; and

determining that the attack with the attack code has succeeded when a response from the server for which a success or failure of the attack is to be determined has the extracted feature.

8. A non-transitory computer readable storage medium having stored therein a determining program for determining whether an attack to a server using an attack code has succeeded or failed, the determining program causing a computer to execute a process comprising:

determining an attack type of an attack code included in an attack request that is addressed to the server;

executing emulation of an attack with the attack code to the server based on the determined attack type, and extracting a feature that appears in a response issued by the server when the emulation results in a successful attack to the server; and

determining that the attack with the attack code has succeeded when a response from the server for which a success or failure of the attack is to be determined has the extracted feature.