INFORMATION PROCESSING APPARATUS, METHOD FOR DETERMINING UNAUTHORIZED ACTIVITY AND COMPUTER-READABLE MEDIUM

摘要

An information processing apparatus is provided with: a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluation value indicating an extent to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase of unauthorized activity, in accordance with a comparison result; a holding unit that holds a maximum value of the evaluation value, for each phase, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluation value for each of the phases.

主权项

1. An information processing apparatus, comprising:
a comparison unit that compares a communication by a terminal connected to a network with a pattern held in advance; a specification unit that specifies an evaluation value indicating an extent to which it is inferred that the terminal is used to conduct unauthorized activity, and a phase from among plural phases of unauthorized activity, in accordance with a comparison result of comparison by the comparison unit; a holding unit that holds a maximum value of the evaluation value, for each of the phases, and for each terminal; and a determination unit that determines whether or not the terminal is used to conduct unauthorized activity, based on the maximum value of the evaluation value for each of the phases.