Nippon Telegraph and Telephone Corporation

Atsutoshi Kumagai

Shingo Orihara

Tomoharu Iwata

Tetsuya Abe

Kazunori Kamiya

Yasushi Okano

Bo Hu

Hiroshi Asakura

An extraction device includes processing circuitry configured to generate a first feature vector that shows a feature of traffic data for each target from a plurality of traffic data pieces aggregated for each predetermined target, sample traffic data from the traffic data for each target a plurality of times, and generate a second feature vector that shows a feature of the sampled traffic data for each sample set obtained.

Extraction device, extraction method, and extraction program

In a classifier whose classification accuracy is maintained without frequently collecting labeled learning data, a learning unit learns a classification criterion of a classifier at each time point in the past until the present and learns a time series change of the classification criterion by using data for learning to which a label is given and that is collected until the present. A classifier creating unit predicts a classification criterion of a future classifier and creates a classifier that outputs a label representing an attribute of input data by using the learned classification criterion and time series change.

Creating apparatus, creating method, and creating program

To create a classifier whose classification accuracy is maintained in consideration of temporal changes in a generation distribution of a sample and a new feature that has not appeared in learning data, a classifier is created in which a feature correlation learning unit learns a correlation between a feature of a sample of labeled learning data, and a feature appearing only in a sample of unlabeled learning data, and a classifier creating unit adds the feature appearing only in the sample of the unlabeled learning data to the feature of the sample of the labeled learning data by using the correlation, and outputs a label associated with an input sample by using the sample of the labeled learning data to which the feature appearing only in the sample of the unlabeled learning data is added.

Creating device, creating program, and creating method

A malware determination device, in which, upon input of an attribute name and an attribute value of an attribute of an executable file, a feature-selection setting unit registers the attribute with the attribute name in an attribute table as an attribute to be extracted, and registers the attribute value as an attribute value to be deleted in an attribute value table. Upon input of an executable file to be learned or to be determined, a feature extraction unit extracts an attribute value of an attribute registered as an attribute to be extracted in the attribute table from the executable file, to generate a feature vector including the extracted attribute value as a feature. A feature selection unit performs deletion of an attribute value registered as an attribute value to be deleted in the attribute value table from the feature vector.

Malware determination device, malware determination system, malware determination method, and program

An information analysis system includes a remark analysis unit, a thread analysis unit, and a storing unit. The remark analysis unit analyzes importance of a remark included in a thread serving as a group of remarks posted on a network, based on remark data serving as data relating to the remark, for each of the remarks. The thread analysis unit analyzes which of a plurality of preset categories the thread belongs to, based on thread data serving as data relating to the thread. The storing unit stores the remark, the importance of the remark, and a category of the thread including the remark in association with each other for each of the remarks, in a predetermined storage unit.

Growing community of inventors

Musashino, Japan

Atsutoshi Kumagai