Information processing device, information processing method, and computer readable medium
A normal classification unit ( 101 ) extracts a true positive access that is known to be an access aimed to attack and that has been determined by a detection unit ( 102 ) to be an access aimed to attack. A modification unit ( 107 ) modifies a feature of the true positive access by using a feature of a true negative access that is known to be a normal access and that has been determined by the detection unit ( 102 ) to be a normal access.
1. An information processing device comprising:
processing circuitry to:
extract, from a database of true positive accesses, a true positive access,
wherein each of the true positive accesses is an access that is
known prior to being processed by an access detection system to be an access aimed to attack, and
detected by the attack detection system to be an access aimed to attack;
extract, from a database of true negative accesses, a true negative access,
wherein each of the true negative accesses is an access that is
known prior to being processed by the access detection system to be a normal access, and
determined by the attack detection system to be a normal access; and
modify a feature of the extracted true positive access by using a feature of the extracted true negative access to increase the likelihood that the access detection system will determine the modified true positive access to be a normal access,
wherein the processing circuitry modifies the feature of the true positive access by using the feature of the true negative access and data of a corresponding feature of a false positive access,
wherein the false positive access is an access that is
known prior to being processed by an access detection system to be a normal access, and
detected by the attack detection system to be an access aimed to attack.
2. The information processing device according to claim 1 , wherein
the processing circuitry modifies the feature of the true positive access so that a modified true positive access which is the true positive access whose feature has been modified is determined by the attack detection system to be a normal access.
3. The information processing device according to claim 1 , wherein
when the extracted true positive access which is the true positive access whose feature has been modified is determined by the attack detection system to be an access aimed to attack, the processing circuitry further modifies the feature of the modified true positive access by using the feature of the extracted true negative access.
4. The information processing device according to claim 1 , wherein
the processing circuitry extracts from the database of true negative accesses, an access including a feature similar to the particular feature of the true positive access, as the true negative access, and
modifies the data of the particular feature of the true positive access by using the data of the similar corresponding feature of the extracted true negative access.
5. The information processing device according to claim 1 , wherein
the processing circuitry selects as the feature to modify from the plurality of features of the true positive access, a feature that matches with a selection condition, and
modifies the selected feature by using the feature of the true negative access.
6. The information processing device according to claim 5 , wherein
the processing circuitry calculates for each of the plurality of features, an importance degree of a feature which is a degree of distinguishing between the true positive access and the true negative access, and
selects from the plurality of features, a feature whose importance degree matches with the selection condition.
7. The information processing device according to claim 6 , wherein
the processing circuitry calculates an importance degree of each of the plurality of features so that higher importance degree is set to a feature which has higher degree of distinguishing between the true positive access and the true negative access.
8. The information processing device according to claim 1 , wherein
when a modified true positive access which is the true positive access whose particular feature has been modified is determined by the attack detection system to be an access aimed to attack, the processing circuitry further modifies the feature of the modified true positive access by using the feature of the false positive access and the feature of the true negative access.
9. The information processing device according to claim 1 , wherein
the processing circuitry selects the feature of the true positive access to be modified by eliminating as a possible selection a feature corresponding to a feature of the true negative access that overlaps with a corresponding feature of the false positive access.
10. An information processing method comprising:
extracting, from a database of true positive accesses, a true positive access,
wherein each of the true positive accesses is an access that is
known prior to being processed an access detection system to be an access aimed to attack, and
detected by the attack detection system to be an access aimed to attack;
extracting, from a database of true negative accesses, a true negative access,
wherein each of the true negative accesses is an access that is
known prior to being processed by the access detection system to be a normal access, and
determined by the attack detection system to be a normal access; and
modifying a feature of the extracted true positive access by using a feature of the extracted true negative access to increase the likelihood that the attack detection system will determine the modified true positive access to be a normal access,
wherein the modifying step modifies the feature of the true positive access by using the feature of the true negative access and data of a corresponding feature of a false positive access,
wherein the false positive access is an access that is
known prior to being processed by an access detection system to be a normal access, and
detected by the attack detection system to be an access aimed to attack.
11. A non-transitory computer readable medium storing an information processing program for causing a computer to execute:
an extraction process to extract, from a database of true positive accesses, a true positive access,
wherein each of the true positive accesses is an access that is
known prior to being processed by an access detection system to be an access aimed to attack, and
detected by the attack detection system to be an access aimed to attack;
a second extraction process to extract, from a database of true negative accesses, a true negative access,
wherein each of the true negative accesses is an access that is
known before being processed by the access detection system to be a normal access, and
determined by the attack detection system to be a normal access; and
a modification process to modify a feature of the extracted true positive access by using a feature of the extracted true negative access to increase the likelihood that the attack detection system will determine the modified true positive access to be a normal access,
wherein the modification process modifies the feature of the true positive access by using the feature of the true negative access and data of a corresponding feature of a false positive access,
wherein the false positive access is an access that is
known prior to being processed by an access detection system to be a normal access, and
detected by the attack detection system to be an access aimed to attack.