BLACKLIST GENERATION DEVICE, BLACKLIST GENERATION SYSTEM, BLACKLIST GENERATION METHOD, AND BLACKLIST GENERATION PROGRAM

摘要

A blacklist generation device (300) acquires a malicious communication log (301a) and a normal communication log (301b). A malicious communication profile extraction function (305) calculates the statistic value of a communication pattern included in the malicious communication log (301a), and outputs a communication pattern that satisfies a prescribed condition as a blacklist candidate (305a). A normal communication profile extraction function (306) calculates the statistic value of a communication pattern included in the normal communication log (301b), and outputs a communication pattern that satisfies a prescribed condition as a white list (306a). A blacklist creation function (307) searches for the value of the blacklist candidate (305a) by the value of the white list (306a), excludes a matching communication pattern from the blacklist candidate (305a), and creates a blacklist (307a).