UNAUTHORIZED COMMUNICATION DETECTION DEVICE, CYBER ATTACK DETECTION SYSTEM, COMPUTER PROGRAM AND UNAUTHORIZED COMMUNICATION DETECTION METHOD

摘要

PROBLEM TO BE SOLVED: To prevent confidential information from leaking due to a target-type cyber attack by detecting an unauthorized communication on the basis of a characteristic value of the communication.SOLUTION: The unauthorized communication detection device includes: a communication acquisition unit 31 for acquiring HTTP requests 310 through a network; a characteristic value calculation unit 32 for calculating a characteristic value 320 by analyzing the HTTP requests 310 acquired by the communication acquisition unit 31; a statistic calculation unit 33 for calculating a statistic 330 for the one or more HTTP requests 310 on the basis of the characteristic value 320 calculated by the characteristic value calculation unit 32; and an unauthorization determination unit 37 for determining whether the characteristic value 320 calculated by the characteristic value calculation unit 32 is an abnormal value on the basis of the statistic 330 calculated by the statistic calculation unit 33 and, and when it is determined that the characteristic value 320 is an abnormal value, determining there is a possibility of an unauthorized communication.