Importance

Loading Importance Indicators...

Abstract

An attack detection apparatus (100) includes an attack detection unit (120), a pattern determination unit (130), and a final determination unit (140). The attack detection unit (120) executes for each of a plurality of pieces of communication data as subject data, an attack detection process to determine whether or not the subject data complies with one of rules included in an authorization list that includes a plurality of rules to each of which a unique identifier has been assigned. The pattern determination unit (130) execute a pattern determination process to determine whether or not an identifier corresponding to a rule with which the subject data complies conforms to an appearance pattern of identifiers derived from a model, using the model for determining whether the appearance pattern of the identifiers corresponding to rules each of which is complied with each of the plurality of pieces of communication data is normal or not. When the pattern determination process is executed, the final determination unit (140) determines whether the subject data is normal or not, using a determination result by the attack detection process and a determination result by the pattern determination process.

Loading the Abstract Image...

First Claim