BLACKLIST GENERATION DEVICE, BLACKLIST GENERATION SYSTEM, BLACKLIST GENERATION METHOD, AND BLACKLIST GENERATION PROGRAM

摘要

A blacklist generating device (300) acquires a malicious communication log (301a) and a normal communication log (301b). A malicious communication profile extracting function (305) calculates statistics on communication patterns included in the malicious communication log (301a) and outputs a communication pattern satisfying a certain condition to a potential blacklist (305a). A normal communication profile extracting function (306) calculates statistics on communication patterns included in the normal communication log (301b) and outputs a communication pattern satisfying a certain condition to a whitelist (306a). A blacklist creating function (307) searches the potential blacklist (305a) for a value with the value on the whitelist (306a), excludes a coincident communication pattern from the potential blacklist (305a), and creates a blacklist (307a).