Title:
DETECTION RULE GROUP ADJUSTMENT DEVICE AND DETECTION RULE GROUP ADJUSTMENT PROGRAM
Document Type and Number:
WIPO Patent Application WO/2020/170500
Kind Code:
A1
Abstract:
According to the present invention, an erroneous detection amount acquisition unit (110) acquires an erroneous detection amount of each phase when attack detection is performed using a whole detection rule group corresponding to a whole phase group which constitutes a series of attack activities. An end-stage determination unit (121) determines whether the erroneous detection amount of the end-stage phase group satisfies an end-stage constraint. A whole determination unit (123) determines whether the erroneous detection amount of the overall phase group satisfies the overall constraint. When the erroneous detection amount of the end-stage phase group does not satisfy the end-stage constraint, the end-stage adjustment unit (122) adjusts the parameter value of each detection rule of the end-stage detection rule group. When the erroneous detection amount of the end-stage phase group satisfies the end-stage constraint and the erroneous detection amount of the overall phase group does not satisfy the overall constraint, the whole adjustment unit (124) adjusts the parameter value of each detection rule other than the end-stage detection rule group.
More Like This:
Inventors:
IWASAKI AIKO (JP)
KAWAUCHI KIYOTO (JP)
ONO KAZUHIRO (JP)
SHOYA TAKUYA (JP)
SHIRAI HIROMITSU (JP)
IJIRO HIDEAKI (JP)
KAWAUCHI KIYOTO (JP)
ONO KAZUHIRO (JP)
SHOYA TAKUYA (JP)
SHIRAI HIROMITSU (JP)
IJIRO HIDEAKI (JP)
Application Number:
PCT/JP2019/040619
Publication Date:
August 27, 2020
Filing Date:
October 16, 2019
Export Citation:
Assignee:
MITSUBISHI ELECTRIC CORP (JP)
International Classes:
G06F21/55
Domestic Patent References:
| WO2015141630A1 | 2015-09-24 |
Attorney, Agent or Firm:
MIZOI INTERNATIONAL PATENT FIRM (JP)
Download PDF: