black list expansion device, black list expansion method and black list expansion program

摘要

PROBLEM TO BE SOLVED: To efficiently and precisely extend a black list and improve protection performance using black list.;SOLUTION: The black list extending apparatus includes: a log acquisition section; a log analysis section; a preprocessing section; and a mal-URL list creation section. The log acquisition section acquires a communication log. The log analysis section extracts a mal-URL candidate which is a URL satisfying a first reference included in the communication log based on the communication log acquired by the log acquisition section. The preprocessing section extracts a piece of statistical information of an object network based on the communication log acquired by the log acquisition section. The mal-URL list creation section integrates the mal-URL candidates extracted by the log analysis section, and excludes mal-URL candidates which satisfy a second reference while referring to the statistical information extracted by the preprocessing section from the integrated mal-URL candidates to create a mal-URL list.;COPYRIGHT: (C)2016,JPO&INPIT