Nippon Telegraph and Telephone Corporation

Bo Hu

Kazunori Kamiya

Masaki Tanikawa

Yukio Nagafuchi

Hideo Kitazume

Shohei Araki

Hiroki Nagayama

Takaaki Koyama

Toshiharu Kishi

Yasuhiro Teramoto

Takahiro Hamada

Shingo Kashima

Atsutoshi Kumagai

Yuminobu Igarashi

Yuichi Murata

Masayuki Inoue

Kazuma Shinomiya

Masami Ueno

Shun Tobiyama

Shosuke Oba

Yuichi Sudo

Kenji Takahashi

An analysis device includes processing circuitry configured to generate a graph in which each IP host indicated in communication information is set as a node and communication between the each IP host is set as an edge on a basis of the communication information of a network, calculate a degree of relevance between a predetermined IP host and each IP host on the graph using the generated graph, correct the graph by adding or deleting an edge connecting each IP host on the graph on a basis of a degree of relevance between a predetermined IP host and each IP host on the graph, calculate a degree of relevance between the predetermined IP host and each IP host using the corrected graph, and output a degree of relevance between the predetermined IP host and each IP host.

Analysis device, analysis method, and analysis program

A classification apparatusacquires a communication log including a plurality of pieces of traffic data, and extracts different types of feature values from the plurality of pieces of traffic data. Subsequently, the classification apparatusclassifies the traffic data on a per IP address basis based on the extracted different types of feature values, and uses a plurality of classification results to count the number of times of appearance of a pattern having the same combination of the classification results.

Classification device and classification method

An extraction device includes processing circuitry configured to generate a first feature vector that shows a feature of traffic data for each target from a plurality of traffic data pieces aggregated for each predetermined target, sample traffic data from the traffic data for each target a plurality of times, and generate a second feature vector that shows a feature of the sampled traffic data for each sample set obtained.

Extraction device, extraction method, and extraction program

A generation apparatus includes processing circuitry configured to aggregate a plurality of traffic data for every predetermined target, sample target traffic data in which a number of traffic data aggregated exceeds a threshold, and generate a feature vector representing a feature of aggregated traffic data for a target that is not sampled, and generate a feature vector representing a feature of sampled traffic data for the target sampled.

Generation device, generation method, and generation program

A country estimation device includes processing circuitry configured to collect path information for each IP address, extract attribute information assigned to the collected path information, and estimate a country where the IP address is located by referring to attribute information indicating a country at a link destination of a path of the path information among the extracted attribute information.

Country estimation device, country estimation method and country estimation program

A detection device includes processing circuitry configured to collect communication information in a network including clients and servers, generate a matrix representing states of access from the clients to the servers using the communication information collected, aggregate a plurality of the clients accessing a target server and generate statistical information of similarities between the aggregated clients in the matrix as a feature amount of the target server, learn, with regard to the target server which is a server for which it is known whether the server is a malicious server, a model for determining whether a server is a malicious server using the feature amount generated, and determine, with regard to the target server which is a server for which it is unknown whether the server is a malicious server, whether the target server is a malicious server using the feature amount generated and the model.

Detection device, detection method, and detection program

A detection device includes processing circuitry configured to identify candidate bots using flow data, use the flow data to count a number of the candidate bots communicating with servers, for each of the servers, and determine servers communicating with a predetermined number or more of the candidate bots among the servers to be malicious servers, and detect candidate bots communicating with the malicious servers that are determined among the candidate bots to be malicious bots.

An aggregation unit () aggregates an input pulse train signal including a time-series pulse corresponding to a predetermined observation time into pulses for respective unit times. A calculation unit () calculates a time shift amount of an autocorrelation function using the aggregated pulse train signal. A detection unit () calculates an autocorrelation value and a threshold with respect to each of time shift amounts selected in ascending order from the calculated time shift amount and detects the time shift amount as a period of the aggregated pulse train signal when the autocorrelation value exceeds the threshold. A conversion unit () converts the detected period to a period of the input pulse train signal using the unit time. An exclusion unit () excludes the pulse train signal having the converted period from the input pulse train signal.

Estimation device, estimation method and estimation program

An identifying device () includes a preprocessing () that extracts a communication connection pattern including a set of a communication source identifier and a communication destination identifier from traffic data, a comparing unit () that adds an ID to a communication connection pattern group including a new communication connection pattern not included in a whitelist when the new communication connection pattern is present in the communication connection pattern group, a graph feature amount generating unit () that generates a graph feature amount of the communication connection pattern group to which the ID has been added and adds this ID to the graph feature amount, an abnormality determining unit () that determines whether the generated graph feature amount is normal using a model () having learned the graph feature amount, and an identifying unit () that retrieves a new communication. connection pattern corresponding to the ID of the graph feature amount determined to have an abnormality from the communication connection pattern group including the new communication connection pattern and identifies the retrieved new communication connection pattern as communication that causes the abnormality.

Specifying device, specifying method, and specifying program

A signature generation unit () generates a signature in which header information of packet data included in traffic data is correlated with a label representing a category for an application corresponding to the packet data. A flow data generation unit () generates flow data from the packet data. An assigning unit () assigns the label to the flow data on the basis of the signature and the header information of the flow data. A calculation unit () calculates a feature amount of the flow data. A learning unit () learns a model for predicting a label from the feature amount using the label and the feature amount of the flow data to which the label is assigned.

Identification device and identification program

A traffic characteristic information extracting device includes a memory, and processing circuitry coupled to the memory and configured to acquire traffic information satisfying a predetermined condition from network traffic data, extract characteristic information from the acquired traffic information, classify the traffic information based on the extracted characteristic information, analyze a classification result obtained at the classifying and generate signatures, and output a signature satisfying a predetermined condition among the generated signatures.

Traffic feature information extraction device, traffic feature information extraction method, and traffic feature information extraction program

A traffic anomaly sensing systemincludes a preprocessing unit, a local graph feature generation unit, a global graph feature generation unit, a learning unit, and an anomaly determination unit. The preprocessing unitgenerates a communication history graph from traffic data. The local graph feature generation unitgenerates, from the communication history graph, a local graph feature about a certain vertex. The global graph feature generation unitgenerates, from the communication history graph, a global graph feature about a vertex. The learning unitgenerates a feature vector by combining the generated local graph feature and the generated global graph feature and generates a learned model for each host identifier. The anomaly determination unitdetermines whether the traffic data is anomalous or not by inputting the graph feature to the generated learned model.

Traffic anomaly sensing device, traffic anomaly sensing method, and traffic anomaly sensing program

A security measure invalidation prevention device includes an acquisition unit that acquires invalidated security point information about an invalidated security point among security points each having a measure function performing a security measure on a node connected to a network. The invalidated security point has a measure function to be invalidated. The device also includes a determination unit that determines whether a security event to be addressed with the measure function of the invalidated security point is present on the basis of the invalidated security point information acquired by the acquisition unit. The device further includes an extraction unit that extracts a security point to which the measure function of the invalidated security point can be shifted when the determination unit determines that the security event is present.

Security measure invalidation prevention device, security measure invalidation prevention method, and security measure invalidation prevention program

A specifying device receives detection information from a security device that detects hacking into a network or an activity of a terminal related to infection, and specifies a state of the terminal from information of the terminal and content of activity of the terminal included in the detection information. The specifying device specifies, when specifying that the terminal is in the state of being infected with malware, a terminal that may be infected before performing the content of the activity of the terminal included in the detection information based on connection information stored in a configuration information storage device, and specifies a terminal located on a route, along which the infected terminal is likely to be used for hacking or for infection of the terminal in the future, as a candidate for an infected terminal likely to be infected.

Specifying system, specifying device, and specifying method

When an attack is detected, a controller samples an attack-target addressed DNS reply, received by a border router, from each of the border routers. Then, the controller adds the transmission-source IP address of the sampled DNS reply to the black list of the border router. Furthermore, upon reception of any of a target-addressed DNS reply and a target-addressed UDP subsequent fragment from the IP address that is described in the black list, the controller gives a command to the border router to discard the packet. Furthermore, the controller specifies the setting, for each of the border routers, that DNS replies to a DNS request from the target are excluded from discarding.

Growing community of inventors

Musashino, Japan

Bo Hu