| 摘要 |
PROBLEM TO BE SOLVED: To perform abnormality (bot account) detection using distribution as a featured value which can be generally used for log data, and which can be obtained from a small data amount, and to perform the distribution estimation of a numerical value aggregate even when the number of samples is small.SOLUTION: The bot determination device including numerical value aggregate storage means for storing the numerical value aggregate of contribution intervals extracted from contribution and the numerical value aggregate of the use frequency of words is configured to acquire a numerical value aggregate from the numerical value aggregate storage means, and to calculate the distribution of the most significant digits of the numerical value aggregate, and to determine whether or not the distribution of the most significant digits of the numerical value aggregate follows predetermined conditions for bot determination, and to acquire the numerical value aggregate from the numerical value aggregate storage means, and to calculate distribution A of the most significant digits, and to determine whether or not the distribution A of the most significant digits is pertinent to predetermined distribution by using a determiner which has learned a correct answer by preliminarily giving the determination result of whether or not the distribution of the most significant digits of a plurality of numerical value aggregates is pertinent to the predetermined distribution. |
