JP2019053421A - Information processing device and program - Google Patents

Abstract

To provide an information processing device and a program that can select an engine to be operated according to capability of detecting an improper program.SOLUTION: A user terminal device 1 includes: a storage unit for storing engine feature data 115A associating communication feature data 102a indicating a feature of communication data 2a transmitted from a server device 2 with capability information indicating capability of detecting an improper program for each engine; extraction means 102 for extracting the communication feature data 102a from the communication data 2a transmitted from the server device 2; and selection means 104 for selecting an engine to be operated on the basis of the extracted communication feature data 102a and the engine feature data 115A stored in the storage unit.SELECTED DRAWING: Figure 3

Description

  The present invention relates to an information processing apparatus and a program.

  In recent years, a method for enhancing security provided with an engine for detecting an inappropriate program such as a computer virus has been provided (for example, see Patent Document 1).

  A method for realizing adaptive security described in Patent Literature 1 includes a step of monitoring a data stream related to a single engine (node) to learn engine characteristics and network environment, and learned engine characteristics and network. Determining an adaptive threshold based on the environment. According to this information processing apparatus, it is said that the engine operating state can be controlled by changing the engine threshold in accordance with the engine characteristics and the network environment.

  The secure electronic communication distribution method described in Patent Literature 2 includes one or more engines, and a plurality of tests are imposed on the engines, and abnormalities related to electronic communication are based on accumulated data obtained by accumulating the test results. It is determined whether or not exists. According to this information processing apparatus, since a white list can be created based on a plurality of test executions, it is said that false detection of an inappropriate program can be reduced.

Special table 2009-504104 JP 2005-520230 Gazette

  The subject of this invention is providing the information processing apparatus and program which can select the engine to operate | move according to the capability to detect the inadequate program in a some engine.

[1] An information processing apparatus having a plurality of engines for detecting an inappropriate program, wherein first feature information indicating characteristics of communication data transmitted from an external device and an inappropriate program for each engine A storage unit that stores second feature information that associates capability information indicating the capability to be detected; an extraction unit that extracts the first feature information from the communication data transmitted from the external device; An information processing apparatus comprising: selecting means for selecting an engine to be operated from the plurality of engines based on the first feature information and the second feature information stored in the storage means.
[2] When the extracted first feature information matches the first feature information included in the second feature information stored in the storage unit, the selection unit matches the first feature information. The information processing apparatus according to [1], wherein the engine to be operated is selected based on the capability information of the second feature information.
[3] The selection unit according to [2], wherein the selection unit selects an engine that operates an engine corresponding to the capability information that satisfies the condition when the capability information satisfies a predetermined condition. Information processing device.
[4] The information processing apparatus according to [3], wherein the capability information is the number of times the engine has detected the inappropriate program.
[5] The apparatus further comprises learning means for learning features of the plurality of engines, and the learning means updates the second feature information stored in the storage means as the learning result of the second feature information. The information processing apparatus according to any one of [1] to [4].
[6] The learning unit causes each of the plurality of engines to inspect the inappropriate program, generates aggregated data obtained by aggregating the inspection results for each engine as the capability information, and the storage unit stores the data. The information processing apparatus according to [5], wherein the capability information is updated.
[7] The information processing apparatus according to [6], wherein the inappropriate program is an inappropriate program detected by an engine selected by the selection unit.
[8] The information processing device according to any one of [1] to [4], wherein the second feature information is a learning result transmitted from a learning device that learns features of the plurality of engines. .
[9] First feature information indicating characteristics of communication data transmitted from an external device is associated with capability information indicating the ability of a plurality of engines detecting an inappropriate program to detect the inappropriate program In addition, the computer having the storage means for storing the second feature information includes the first feature information indicating the feature of the communication data transmitted from the external device and a plurality of engines for detecting an inappropriate program. Storage means for storing second feature information in association with ability information indicating the ability to detect a program; extraction means for extracting the first feature information from the communication data transmitted from the external device; Selection means for selecting an engine to be operated from among the plurality of engines based on the extracted first feature information and the second feature information stored in the storage means , The program to function as.

According to the first and ninth aspects of the invention, the engine to be operated can be selected according to the ability to detect inappropriate programs in a plurality of engines.
According to the invention which concerns on Claim 2, the engine provided with the characteristic suitable for the characteristic of communication data can be selected as an engine which operates.
According to the invention which concerns on Claim 3, the selection of the engine based on the content of each capability in a some engine can be performed.
According to the invention which concerns on Claim 4, the engine which operate | moves can be selected based on the quantitative evaluation with respect to each capability of a some engine.
According to the invention which concerns on Claim 5, the engine which operate | moves according to the learning result performed with respect to the several engine can be selected.
According to the sixth aspect of the present invention, the ability information is generated based on the aggregate data obtained by aggregating the inspection results of a plurality of engines, so that the accuracy of the learning result can be improved.
According to the invention which concerns on Claim 7, the output information by the operation | movement of the engine selected by the selection means can be utilized for the input information of a learning means.
According to the eighth aspect of the present invention, since the learning function can be built in the external device, the load on information processing can be reduced.

FIG. 1 is a diagram showing a schematic configuration example of an information processing system according to the first embodiment of the present invention. FIG. 2 is a block diagram illustrating a configuration example of the user terminal device. FIG. 3 is a flowchart showing the flow of processing in the information processing system according to the first embodiment. FIG. 4 is a diagram illustrating an example of an engine feature table. FIG. 5 is a flowchart illustrating an example of processing in the learning unit of the user terminal device. FIG. 6 is a flowchart illustrating an example of processing in the selection unit of the user terminal device. FIG. 7 is a diagram showing a schematic configuration of an information processing system according to the second embodiment of the present invention. FIG. 8 is a flowchart showing the flow of processing in the information processing system according to the second embodiment.

  Hereinafter, embodiments of the present invention will be described with reference to the drawings. In addition, in each figure, about the component which has the substantially same function, the same code | symbol is attached | subjected and the duplicate description is abbreviate | omitted.

[Summary of embodiment]
The information processing apparatus according to the present embodiment is an information processing apparatus including a plurality of engines that detect inappropriate programs, and includes first characteristic information indicating characteristics of communication data transmitted from an external device; Storage means for storing second feature information in association with capability information indicating the capability of detecting an inappropriate program for each engine, and the first feature information from the communication data transmitted from the external device. Extracting means for extracting; and selecting means for selecting an engine to be operated from the plurality of engines based on the extracted first feature information and the stored second feature information. .

  An “inappropriate program” refers to a program that performs processing not intended by the user. Examples of inappropriate programs include computer viruses, worms, Trojan horses, malware, spyware, and spam mail. “Communication data” includes Web pages, emails, documents, images, and the like. “Engine” refers to software for detecting inappropriate programs.

[First Embodiment]
(Configuration of information processing system)
FIG. 1 is a diagram showing a schematic configuration example of an information processing system according to the first embodiment of the present invention.

  The information processing system 9 includes a user terminal device 1 and a server device 2, and the user terminal device 1 and the server device 2 are connected via a network 3. The user terminal device 1 is an example of an information processing device. The server device 2 is an example of an external device.

  The user terminal device 1 is, for example, a personal computer, a multi-function phone (smart phone) or the like. The server device 2 is, for example, a web server or a mail server.

  The network 3 is a computer network such as a LAN (Local Area Network) or an intranet, and may be wired (electric cable, optical cable, etc.) or wireless (radio wave, infrared ray, etc.).

  In the information processing system 9, when a request addressed to the server device 2 is transmitted from the user terminal device 1, the request is transmitted to the server device 2 that is the destination via the network 3. Then, a response to the request is sent from the server device 2 to the user terminal device 1 via the network 3.

(Configuration of user terminal device)
FIG. 2 is a block diagram illustrating a configuration example of the user terminal device 1 according to the present embodiment. Further, the user terminal device 1 includes a plurality of engines (first to third engines 111 to 113 described later) that detect inappropriate programs such as computer viruses. These engines 111 to 113 are engines having different characteristics. For example, one is an engine that is strong against mobile or an engine that is strong against office documents. In addition, the user terminal device 1 includes a control unit 10 that controls each unit of the device 1, a storage unit 11 that stores various types of information, and a communication unit 12 that communicates with the outside via the network 3. The storage unit 11 is an example of a storage unit.

  The control unit 10 includes a CPU (Central Processing Unit), an interface, and the like. The CPU functions as the reception unit 101, the extraction unit 102, the learning unit 103, the selection unit 104, the detection unit 105, and the like by operating according to the program 110 stored in the storage unit 11. Details of each means 101-105 will be described later.

  The storage unit 11 includes a ROM (Read Only Memory), a RAM (Random Access Memory), a hard disk, and the like. The storage unit 11 stores a program 110, first to third engines 111 to 113, a file feature table 114, an engine feature table (see FIG. 4), and the like. In the present embodiment, the plurality of engines is constituted by three engines of the first to third engines 111 to 113, but the number of engines is not limited to this. For example, two or four or more engines are used. It may be configured. In this specification, recording or registration is used when information is written in the table, and memory is used when information is written in the storage unit.

  The file feature table 114 includes a “file format” field in which a file format is registered and a “header information” field in which header information is registered. The file format is information indicating a file format such as PDF or JPEG, and the header information is information indicating a header value for identifying the file format, for example. That is, data in which the header value of data and the file format of data are associated is registered in the file feature table 114.

  Next, each unit of the control unit 10 will be described with reference to FIG. FIG. 3 is a flowchart showing the flow of processing in the information processing system 9 according to the first embodiment.

  The receiving unit 101 receives the communication data 2 a sent from the server device 2.

  Based on the communication data 2a transmitted from the server device 2 and the file feature table 114, the extraction unit 102 extracts the features of the communication data 2a from the communication data 2a (hereinafter also referred to as “communication features”), and performs communication. The feature data 102a is generated. The communication feature data 102a includes the header information of the communication data 2a, the OS type of the terminal (server device 2 in this case) that is the transmission source of the communication data 2a, and the file format of the communication data 2a. The OS type and file format are examples of first feature information indicating communication features.

  Examples of the OS type include iOS and Windows (registered trademark). Examples of the file format include PDF and JPEG. However, the communication feature data is not limited to the type of OS and the file format. For example, a connection destination domain may be set as the communication feature.

  The extraction unit 102 reads header information from the header of the file of the communication data 2a, searches the file feature table 114 for header information that matches the read header information, and includes the header information of the matched file feature table 114. Get the file format of the data. Thereby, the file format of the communication data 2a can be determined. As described above, the extracting unit 102 generates the communication feature data 102a based on the communication data 2a and the file feature table 114.

  The learning unit 103 learns the characteristics of the first to third engines 111 to 113. The selection unit 104 can select an engine that operates according to the learning result learned by the learning unit 103. The learning unit 103 generates engine feature data 115A (specifically, engine feature data 115a to 115d shown in FIG. 4) based on the detection result data 105a output from the detection unit 105. Details of the learning method of the learning means 103 will be described later.

  The learning unit 103 updates the engine feature table 115 stored in the storage unit 11 using the generated engine feature data 115A as a learning result. As a result, the engine feature data 115 </ b> A is stored in the storage unit 11. The engine characteristic data 115A includes information on the engine ID, communication characteristics (OS type, file format), and number of detections.

  The detection unit 105 inputs the communication data 2 a received from the server device 2 to the engine selected by the selection unit 104. When the selected engine detects an inappropriate program, the detection unit 105 outputs detection result data 105 a including the inappropriate program, and inputs the detection result data 105 a to the learning unit 103.

  The detection result data 105a includes an engine ID indicating an engine that has detected an inappropriate program, and communication characteristics of communication data that includes the inappropriate program.

  The selection means 104 selects an engine to be operated from the first to third engines 111 to 113 based on the extracted communication feature data 102a and the stored engine feature data 115A. Details of the selection means 104 will be described later.

(Configuration of engine feature table)
FIG. 4 is a diagram illustrating an example of the engine feature table 115. The engine feature table 115 has an “engine ID” column for identifying one of the first to third engines 111 to 113, a “communication feature” column indicating the feature of the communication data 2a, and inappropriate depending on the engine. As an item, there is a “number of detections” column in which the number of detected simple programs is registered. The number of detections is an example of engine capability information.

  The “communication feature” column further includes an “OS type” column and a “file format” column. In the “OS type” column, the OS type of the transmission source terminal (here, the server apparatus 2) of the detection result data 105a input to the learning unit 103 is registered, and in the “file format” column, the detection result Information indicating the file format of the data 105a is registered.

  In the example shown in FIG. 4, engine feature data 115 a to 115 d are registered in the engine feature table 115. The engine A registered in the “engine ID” of the engine characteristic data 115 a corresponds to the first engine 111. Similarly, the engine B of the engine feature data 115b and 115c corresponds to the second engine 112, and the engine C of the engine feature data 115d corresponds to the third engine 113.

(Details of learning methods)
The learning means 103 has engine characteristic data 115A (the first characteristic information is associated with the number of detections indicating the ability of the first to third engines 111 to 113 to detect an inappropriate program). Engine characteristic data 115a to 115d) to be described later is generated. The engine feature data 115A is an example of second feature information, and the engine feature data 115A is an example of a learning result.

  The number of detections described above is, for example, the number of times that the engine has detected an inappropriate program in the past, and total data obtained by counting the number of times is registered. Thereby, the quantitative evaluation with respect to each capability of the 1st thru | or 3rd engines 111-113 is possible, and the engine which the selection means 104 mentioned later operates based on this evaluation can be selected.

  Further, the learning means 103 generates aggregated data obtained by aggregating the number of times that the first to third engines 111 to 113 have detected inappropriate programs as the number of detections, and the number of detections as capability information stored in the storage unit 11. Update. Thereby, compared with the case where the learning means 103 does not count the number of times the inappropriate program is detected, the learning accuracy is improved, so that the engine characteristics can be grasped more accurately.

  The learning unit 103 receives detection result data 105a including an inappropriate program detected by the engine selected by the selection unit 104 as input information, and uses the detection result data 105a as learning data for the first to third engines 111 to 113. Enter and inspect all engines. That is, the output information of the selection unit 104 is used as input information of the learning unit 103. Thereby, the efficiency of the data input / output in the user terminal device 1 is achieved.

(Operation of learning means)
FIG. 5 is a flowchart illustrating an example of processing in the learning unit 103 of the user terminal device 1. In the example of FIG. 5, for convenience of explanation, it is assumed that engine feature data regarding all the engines of the first to third engines 111 to 113 has already been registered in the engine feature table 115.

  The learning unit 103 selects any one of the first to third engines 111 to 113 and inputs the detection result data 105a to the target engine (step S10). As a method for selecting a target engine to which the detection result data 105a is input, for example, a “processed flag” is provided in the engine feature table 115, and one engine whose “processed flag” is unprocessed is arbitrarily selected. do it.

  Next, the learning unit 103 determines whether or not the engine to which the detection result data 105a is input in step S10 has detected an inappropriate program (step S11).

  If an inappropriate program is detected (step S11: Yes), engine characteristic data 115A is generated (step S12). On the other hand, when an inappropriate program is not detected (step S11: No), the process proceeds to step S14.

  In the process of step S12, the learning unit 103 generates engine feature data 115A. The learning unit 103 extracts the engine ID and communication feature from the detection result data 105a, and generates data obtained by adding the number of detections to the extracted engine ID and communication feature as engine feature data 115A (step S12).

  Next, the learning unit 103 determines whether or not engine feature data including a communication feature that matches the communication feature of the engine feature data 115A exists in the engine feature table 115. “+1” is added to the “number of detections” (see FIG. 4) of the engine feature data (for example, any one of the engine feature data 115a to 115d shown in FIG. 4) of the engine feature table 115, and the engine feature data is obtained. The update process for the table 115 is completed (step S13). At this time, the “processed flag” in the engine feature table 115 described above is updated from unprocessed to processed. Thereby, the process of the learning means 103 is performed for all the first to third engines 111 to 113.

  In the process of step S13, the search key for the engine feature table 115 is a communication feature. However, both the OS type and the file format may be used as the search key, and only one of the OS type or the file format is used. May be used as a search key. Alternatively, if there is no data that matches both the OS type and the file format of the engine feature data 115A in the engine feature table 115, search for data that matches only the OS type (or file format). Also good.

  On the other hand, if there is no engine feature data that matches the communication feature of the engine feature data 115A, the engine feature data 115A is newly registered in the engine feature table 115.

  Next, the learning means 103 determines whether or not there is an engine to be processed (step S14), and if it exists (step S14: Yes), the process returns to the process of step S10. On the other hand, when there is no unprocessed engine (step S14: No), the process of the learning means 103 is completed. For example, the learning unit 103 may determine whether or not there is an engine whose “processed flag” in the engine feature table 115 is unprocessed.

(Operation of selection means)
Next, details of the processing of the selection means 104 will be described with reference to FIG. FIG. 6 is a flowchart illustrating an example of processing in the selection unit of the user terminal device.

  First, the selection unit 104 compares the engine feature table 115 with the communication data 2a extracted by the extraction unit 102 (step S20).

  Then, the selecting unit 104 determines whether or not the engine feature table 115 includes data in which the communication feature of the extracted communication feature data 102a matches the communication feature included in the engine feature table 115 stored in the storage unit 11. Is determined (step S21). If the target data exists (step S21: Yes), it is determined whether the target data in the engine feature table 115 satisfies a predetermined condition (step S22).

  On the other hand, when the target data does not exist (step S21: No), all the engines are operated (step S24). Similarly, when the target data does not satisfy the condition in the process of step S22 (step S22: No), all the engines are operated (step S24). That is, when an engine to be operated cannot be selected, all engines are configured to operate in consideration of security risks.

  Here, the above-described condition may be a condition that allows a plurality of engines to evaluate relatively with respect to capability information (the number of detections in the present embodiment) for detecting an inappropriate program. It may be “the data with the largest number of detections” or “the data with the largest number of detections among the target data and the data with the next largest number of detections”.

  The engine feature table 115 shown in FIG. 4 will be described as an example. For example, when the OS type of the communication feature of the communication feature data 102a is “iOS” and the file format is “PDF”, the processing in step S20 is performed. Engine feature data 115a and engine feature data 115d in the engine feature table 115 correspond to target data. In the process of step S21, the number of detections of the engine feature data 115a (10) is larger than the number of detections of the engine feature data 115d (6) (10> 6), so that the data satisfying the condition that the number of detections is the largest. And the engine ID corresponding to the engine A is selected as the engine on which the first engine 111 operates.

  Thus, the selection means 104 selects as an engine which operates the engine corresponding to engine ID of the object data which satisfy | filled conditions (step S23). Thereby, the process of the selection means 104 is complete | finished.

  As described above, the selecting unit 104 determines the number of detected engine feature data 115A when the communication feature of the communication feature data 102a matches the communication feature of the engine feature data 115a to 115d registered in the engine feature table 115. Select the engine to be operated based on this. Thereby, the engine provided with the characteristic suitable for the characteristic of the communication data 2a can be selected as the engine to operate. Note that the number of engines selected by the selection unit 104 is not limited. For example, two engines may be selected.

  As described above, when the capability information satisfies a predetermined condition, the selection unit 104 selects the engine that operates the engine corresponding to the capability information that satisfies the condition. Thereby, the engine can be selected based on the contents of the respective capacities of the plurality of engines.

[Second Embodiment]
FIG. 7 is a diagram showing a schematic configuration of an information processing system according to the second embodiment of the present invention. In the present embodiment, the learning device 4 having the function of the learning means 103 is configured as an external device in the first embodiment. The following description will focus on differences from the first embodiment.

  As illustrated in FIG. 7, the information processing system 90 according to the present embodiment includes a user terminal device 1, a server device 2, and a learning device 4, and the user terminal device 1, the server device 2, and learning A device 4 is connected via a network 3.

  FIG. 8 is a flowchart showing the flow of processing in the information processing system 90 according to the second embodiment. As illustrated in FIG. 8, the user terminal device 1 includes a reception unit 101, an extraction unit 102, a selection unit 104, and a detection unit 105. The selection means 104 selects an engine to operate based on the communication feature data 102a and the engine feature data 410a as the second feature information sent from the learning device 4.

  The learning device 4 includes learning means 401, engine feature data generation means 402, and first to third engines 411 to 413. The learning unit 401 generates engine feature data 410 a from the detection result data 105 a sent from the user terminal device 1, and registers the engine feature data 410 a in the engine feature table 410. The learning unit 401 transmits the generated engine feature data 410 a to the user terminal device 1.

  The learning unit 401 inputs the detection result data 105a to the first to third engines 411 to 413, and executes inspection for all the engines. Then, the learning unit 401 acquires the inspection result of each engine, and generates engine feature data 410a based on the inspection result by the same method as the engine feature data 115A described in the first embodiment.

  As described above, since the learning function for learning the features of the engine can be constructed in the external device, the learning function of the user terminal device 1 is compared with the first embodiment in which the learning function is implemented in the user terminal device 1. The processing load is reduced.

  In the first embodiment, the case where the user terminal device 1 is an example of the information processing device according to the present invention has been described. However, the present invention is not limited to this, and for example, between the user terminal device 1 and the server device 2. An example of the information processing apparatus according to the present invention may be a gateway device that relays the communication. That is, in this case, the gateway device includes the units 101 to 105 of the control unit 10 described in FIG. 2, the storage unit 11, and the communication unit 12.

  Although the embodiments of the present invention have been described above, the embodiments of the present invention are not limited to the above-described embodiments, and various modifications and implementations are possible without departing from the scope of the present invention. is there.

  Each part of the control unit 10 may be partially or entirely configured by a hardware circuit such as a reconfigurable circuit (FPGA: Field Programmable Gate Array) or an application specific integrated circuit (ASIC). Good.

  In the above embodiment, the selection unit 104 selects the engine to be operated when the communication feature of the communication data 2a matches the communication feature of the engine feature data 115A. However, the selection unit 104 is not limited to this. When the communication feature 2a is a specific communication feature (for example, a communication feature with high risk), the operation mode of the engine may be set. As an operation mode, for example, a careful mode in which all engines are operated can be cited. This improves security.

  In the second embodiment, the case where there is one user terminal device 1 has been described. However, the present invention is not limited to this. For example, a plurality of user terminal devices may be provided. In this case, since the detection result data 105a is sent from each of the plurality of user terminal devices to the learning device 4, the learning data of the learning device 4 increases. Thereby, the learning efficiency of the learning device 4 is improved, and the selection unit 104 can select a more optimal engine.

  Further, it is possible to omit or change some of the constituent elements of the above-described embodiment within a range not changing the gist of the present invention. In addition, steps can be added, deleted, changed, replaced, and the like in the flow of the above-described embodiment without departing from the scope of the present invention. The program used in the above embodiment can be provided by being recorded on a computer-readable recording medium such as a CD-ROM. The program used in the above embodiment can be stored in an external server such as a cloud server and used via a network.

DESCRIPTION OF SYMBOLS 1 ... User terminal device 2 ... Server apparatus 2a ... Communication data 3 ... Network 4 ... Learning apparatus 9 ... Information processing system 10 ... Control part 11 ... Storage | storage part 12 ... Communication part 90 ... Information processing system 101 ... Reception means 102 ... Extraction means 102a ... communication feature data 103 ... learning means 104 ... selection means 105 ... detection means 105a ... detection result data 110 ... program 111 ... first engine 112 ... second engine 113 ... third engine 114 ... file feature tables 115, 410 ... engine Feature tables 115A, 410a ... engine feature data 115a to 115d ... engine feature data 401 ... learning means 402 ... engine feature data generating means

Claims (9)

An information processing apparatus having a plurality of engines for detecting inappropriate programs,
Storage means for storing second feature information in which first feature information indicating features of communication data transmitted from an external device is associated with capability information indicating the capability of detecting an inappropriate program for each engine; ,
Extraction means for extracting the first feature information from the communication data transmitted from the external device;
Selecting means for selecting an engine to be operated from the plurality of engines based on the extracted first feature information and the second feature information stored in the storage means;
An information processing apparatus comprising: The selection unit is configured to detect the second feature when the extracted first feature information matches the first feature information included in the second feature information stored in the storage unit. Selecting the engine to be operated based on the capability information of the information;
The information processing apparatus according to claim 1. The selection means is selected as an engine for operating an engine corresponding to the capability information that satisfies the condition when the capability information satisfies a predetermined condition.
The information processing apparatus according to claim 2. The capability information is the number of times the engine has detected the inappropriate program.
The information processing apparatus according to claim 3. Learning means for learning features of the plurality of engines;
The learning unit updates the second feature information stored in the storage unit as a learning result of the second feature information;
The information processing apparatus according to any one of claims 1 to 4. The learning unit causes the plurality of engines to inspect the inappropriate program, generates aggregated data obtained by aggregating the inspection results for each engine as the capability information, and the capability information stored in the storage unit Update,
The information processing apparatus according to claim 5. The inappropriate program is an inappropriate program detected by the engine selected by the selection means.
The information processing apparatus according to claim 6. The second feature information is a learning result transmitted from a learning device that learns features of the plurality of engines.
The information processing apparatus according to any one of claims 1 to 4. Second feature in which first feature information indicating characteristics of communication data transmitted from an external device is associated with capability information indicating the ability of a plurality of engines that detect inappropriate programs to detect the inappropriate programs A computer having storage means for storing the feature information of
Extraction means for extracting the first feature information from the communication data transmitted from the external device;
Selection means for selecting an engine to be operated from the plurality of engines based on the extracted first feature information and the second feature information stored in the storage means;
Program to function as.

Images