US 11,722,493 B2
Access analysis system and access analysis method
Yusuke Urata, Musashino (JP); Nobuya Shirai, Musashino (JP); and Yoshiko Sueda, Musashino (JP)
Assigned to Nippon Telegraph and Telephone Corporation, Tokyo (JP)
Appl. No. 16/969,263
Filed by Nippon Telegraph and Telephone Corporation, Tokyo (JP)
PCT Filed Feb. 7, 2019, PCT No. PCT/JP2019/004453
§ 371(c)(1), (2) Date Aug. 12, 2020,
PCT Pub. No. WO2019/159809, PCT Pub. Date Aug. 22, 2019.
Claims priority of application No. 2018-026324 (JP), filed on Feb. 16, 2018.
Prior Publication US 2021/0006565 A1, Jan. 7, 2021
Int. Cl. H04L 9/40 (2022.01); H04L 41/14 (2022.01); G06F 21/31 (2013.01)
CPC H04L 63/105 (2013.01) [H04L 41/14 (2013.01); H04L 63/1425 (2013.01); H04L 63/1483 (2013.01)] 18 Claims
OG exemplary drawing
 
1. An access analysis system comprising one or more processors and a memory configured to:
detect one or more requests from a terminal to access a server over a network;
analyze a first characteristic of the one or more requests;
based on the analyzed first characteristic of the one or more requests, determine a first score indicative of a validity of a user at the terminal that transmitted the one or more requests to the server;
analyze a second characteristic of the one or more requests;
based on the analyzed second characteristic, determine data indicative of a normality of the one or more requests;
in response, generate a second score based on (i) the first score and (ii) the data indicative of the normality of the one or more requests, the second score indicative of a classification of the validity of the terminal's access to the server, wherein the second score is generated by applying, to a matrix table, (i) the first score indicative of the validity of the user at the terminal that transmitted the one or more requests and (ii) the data indicative of the normality of the one or more requests, the matrix table showing validity of access via the network according to a combination of i) a level at which the user is valid and ii) a level at which the communication is normal; and
in response to analyzing the second score, transmit a notification to a device that monitors communications with the server over the network, the notification indicating that the one or more requests from the terminal (i) are unauthorized and (ii) to block subsequent requests transmitted by the terminal to the server over the network.