Data classification device, data classification method, and data classification program
A data classification device includes: a known data input unit that receives an input of known data, the known data being data already classified into a class and a subclass subordinate to the class; a feature extraction unit that extracts, from features included in the known data, a feature that causes classification of the known data belonging to the same class into a subclass using the feature to fail; and a classification unit that classifies classification target data into a class using the feature extracted by the feature extraction unit.
1 . A data classification device, comprising:
a memory; and
a processor coupled to the memory and programmed to execute a process comprising:
receiving an input of known data, the known data being data already classified into a class and a subclass subordinate to the class;
extracting features from the known data, wherein the features which are extracted are features shared between the subclasses in the class;
determining whether classification of the known data belonging to the class into a subclass existing within the subclasses using a feature of the features which are extracted is a success or failure;
outputting the feature if it is determined that the feature causes the classification to fail; and
classifying classification target data into a class indicating malicious or not using the output feature for detecting an attack and notifying a terminal which sent the classification target data of a result of the classifying.
2 . The data classification device according to claim 1 , wherein the extracting extracts, from features included in the known data, a feature that causes classification of the known data belonging to a same class into subclasses similar to one another using the feature to fail.
3 . The data classification device according to claim 1 , wherein the extracting extracts, from features included in the known data, a feature that causes classification of the known data of a same class into a subclass using the feature to fail, and that causes classification of the known data into a class using the feature to succeed.
4 . The data classification device according to claim 1 , wherein the extracting, when known data of a same class is classified into a subclass using a feature, calculates a predictive probability predicting into which subclass the known data is classified, and calculates a value by smoothing the calculated predictive probability between subclasses, and extracts, from features included in the known data, a feature that makes a result of classification of the known data into a subclass using the feature close to a value of the smoothed predictive probability.
5 . The data classification device according to claim 1 , wherein a data group belonging to the same subclass is a malicious data group belonging to a malicious class and created using a same malicious tool.
6 . A data classification method executed by a data classification device, the data classification method comprising:
receiving an input of known data, the known data being data already classified into a class and a subclass subordinate to the class;
extracting, features from the known data, wherein the features which are extracted are features shared between the subclasses in the class:
determining whether classification of the known data belonging to the class into a subclass existing within the subclasses using a feature of the features which are extracted is a success or failure;
outputting the feature if it is determined that the feature causes the classification to fail; and
classifying classification target data into a class indicating malicious or not using the output feature for detecting an attack and notifying a terminal which sent the classification target data of a result of the classifying.
7 . A non-transitory computer-readable recording medium having stored therein data classification program that causes a computer to execute a process comprising:
receiving an input of known data, the known data being data already classified into a class and a subclass subordinate to the class;
extracting features from the known data, wherein the features which are extracted are features shared between the subclasses in the class;
determining whether classification of the known data belonging to the class into a subclass existing within the subclasses using a feature of the features which are extracted is a success or failure;
outputting the feature if it is determined that the feature causes the classification to fail; and
classifying classification target data into a class indicating malicious or not using the output feature for detecting an attack and notifying a terminal which sent the classification target data of a result of the classifying.