Generation device, generation method, and generation program

1. A generation apparatus comprising:

processing circuitry configured to:

aggregate a plurality of traffic data for every predetermined target;

sample target traffic data in which a number of traffic data aggregated exceeds a threshold; and

generate a first feature vector representing a feature of aggregated traffic data for a target that is not sampled, and generate a second feature vector representing a feature of sampled traffic data for the target sampled, wherein the first feature vector is different from the second feature vector and are used in identifying whether the plurality of traffic data is malignant.

2. The generation apparatus according to claim 1 , wherein the processing circuitry is further configured to sample a first number of traffic data, wherein the first number is equal to the threshold, or greater than or equal to the threshold and less than the number of traffic data aggregated to the target.

3. The generation apparatus according to claim 1 , wherein the processing circuitry is further configured to sample a predetermined number of traffic data from a starting time of the traffic data sampling and the sampled traffic data is sorted based on a predetermined standard.

4. A generation method comprising:

aggregating a plurality of traffic data for every predetermined target;

sampling target traffic data in which a number of aggregated traffic data at the aggregating exceeds a threshold; and

generating a first feature vector representing a feature of aggregated traffic data for a target that is not sampled at the sampling, and generating a second feature vector representing a feature of sampled traffic data for the target sampled at the sampling, by processing circuitry, wherein the first feature vector is different from the second feature vector and are used in identifying whether the plurality of traffic data is malignant.

5. A non-transitory computer-readable recording medium storing therein a generation program that causes a computer to execute a process comprising:

aggregating a plurality of traffic data for every predetermined target;

sampling target traffic data in which a number of aggregated traffic data at the aggregating exceeds a threshold; and

generating a first feature vector representing a feature of aggregated traffic data for a target that is not sampled at the sampling, and generating a second feature vector representing a feature of sampled traffic data for the target sampled at the sampling, wherein the first feature vector is different from the second feature vector and are used in identifying whether the plurality of traffic data is malignant.