US 12,335,302 B2
Suspicious communication detection apparatus, suspicious communication detection method, and suspicious communication detection program
Shohei Hiruta, Tokyo (JP)
Assigned to NEC CORPORATION, Tokyo (JP)
Filed by NEC Corporation, Tokyo (JP)
Filed on Mar. 17, 2023, as Appl. No. 18/123,075.
Claims priority of application No. 2022-138554 (JP), filed on Aug. 31, 2022.
Prior Publication US 2024/0073240 A1, Feb. 29, 2024
Int. Cl. H04L 9/40 (2022.01)
CPC H04L 63/1441 (2013.01) [H04L 63/1416 (2013.01); H04L 63/1425 (2013.01); H04L 63/1433 (2013.01)] 15 Claims
OG exemplary drawing
 
1. A suspicious communication detection apparatus comprising:
a memory storing:
a database in which information extracted from encrypted communications is managed separately as communications from an outside of an organization to an inside of the organization and as communications from the inside of the organization to the outside of the organization;
a machine learning model that receives features of an encrypted communication and that determines whether the encrypted communication is a suspicious communication; and
instructions; and
a processor configured to execute the instructions to:
refer to the database by using information about a received encrypted communication;
enter obtained features about the received encrypted communication to the machine learning model;
determine whether the received encrypted communication is a suspicious communication;
store the determination result for the suspiciousness in the database; and
perform, based on a determination result of an encrypted communication from the inside of the organization to the outside of the organization, a redetermination on a determination result of an encrypted communication from the outside of the organization to the inside of the organization, the determination result being stored in the database,
wherein the database includes an encrypted communication information management table that manages session information about encrypted communications, an encrypted communication feature management table that manages features generated from encrypted communications, and an encrypted communication flag management table that manages flags of encrypted communications determined as suspicious communications.