Mitsubishi Electric Corporation

Aiko Iwasaki

Kiyoto Kawauchi

Takumi Yamamoto

Hiroyuki Sakakibara

Hisashi Fukuda

Kenta Fukami

Hiroki Nishikawa

An attribute-value extraction unit () extracts as a plurality of model-generation attribute values, a plurality of attribute values belonging to an attribute associated with a monitoring subject for anomaly detection. A division-data generation unit () extracts for each model-generation attribute value, a normal event associated with the model-generation attribute value from normal data indicating a plurality of normal events each of which is found out to be normal, each of which is associated with one attribute value of the plurality of attribute values, and each of which includes a plurality of characteristics, and generates for each model-generation attribute value, division data indicating the extracted normal event. A characteristic selection unit () selects a combination of characteristics to be used for generation of a normal model to be used for anomaly detection, from a plurality of characteristics included in a plurality of normal events indicated in a plurality of pieces of division data. A normal-model generation unit () generates the normal model for each model-generation attribute value, using the combination of characteristics selected.

Model generation apparatus, model generation method, and computer readable medium

The incident response assisting device includes: an incident extraction unit, a response procedure creation unit, and a screen display unit. The incident extraction unit performs an incident extraction process on an alert indicating that an incident has occurred in a monitored object and on log data of the monitored object, to extract incident information. The response procedure creation unit creates an incident response procedure corresponding to the incident on the basis of the incident information and a response procedure template. The screen display unit selects a display range from the incident response procedure in accordance with a progress status of response and displays the display range as a display response procedure. The incident extraction process is composed of a series of comparison processes in which a content of a comparison process to be subsequently performed is changed in accordance with a result of a previously performed comparison process.

Incident response assisting device

Growing community of inventors

Tokyo, Japan

Aiko Iwasaki