Nec Corporation

Daichi Hasumi

Satoshi Ikeda

Shigeyoshi Shima

Keigo Kimura

A log generation apparatus includes an input operation log collection unit that collects input operation logs in which an operation event of an input device is recorded; an information log collection unit that collects information logs in which a process event related to processing performed by an information apparatus connected to the input device is recorded, the information logs being different from the input operation logs; and a generation unit that generates, based on the information logs and the input operation logs, a user operation log including identification information of an application, the application being one which is inferred from the input operation logs and for which the processing is performed, and generates, as a log group for detecting an abnormality, a user operation log group including the user operation logs arranged in an order according to times of occurrences of operation events or process events.

Log generation apparatus, abnormality detection system, log generation method, and non-transitory computer readable medium

The communication terminal detect a functional module of anomalous operating state, and to notify the edge server of the anomalous operating state. The edge server generates respective disk images corresponding to the functional module and a related functional module, generates a plurality of divided disk images obtained by dividing the generated disk image, and sends the plurality of divided disk images to the storage device. The storage device stores the divided disk images, and sends divided disk images corresponding to the functional module and the related functional module to the communication terminal in response to request from the communication terminal. The communication terminal generates the disk image by coupling the plurality of divided disk images acquired from the storage device, and turns on the functional module and the related functional module based on the generated disk image.

Turn on functional module and related functional module based on generated disk image

Provided is a communication information integration systemin which a communication information integration apparatusclassifies collected first communication information for each terminal apparatus, generates summary information summarizing the classified communication information corresponding to the terminal, and transmits the generated summary information to the corresponding terminal apparatus, the terminal apparatus, upon receiving the summary information, extracts a difference between the first communication information and second communication information collected by the terminal apparatus, using the second communication information and the summary information, generates difference communication information based on the extracted difference, and transmits the generated difference communication information to the communication information integration apparatus, and the communication information integration apparatus, upon receiving the difference communication information from the terminal apparatus, integrates the difference communication information into the first communication information.

Communication information integration system, communication information integration method, communication information integration apparatus, terminal apparatus, and computer readable recording medium

An impact range estimation apparatusestimates a range of impact due to infection by malware in a network system with a plurality of nodes. The impact range estimation apparatusincludes: a reverse propagation probability calculation unitconfigured to, when a specific node is infected with the malware, based on scenario information that specifies a pattern of attack by the malware and a communications log in the network system before infection by the malware, for each node other than the specific node, calculate a probability that the malware propagates from that other node to the specific node; and a simulation execution unitconfigured to, using the calculated probability, execute a plurality of times a simulation in which the malware is propagated to the specific node, and for each other node, calculate a number of times that that node becomes a propagation source of the malware.

Impact range estimation apparatus, impact range estimation method, and computer-readable recording medium

Provided is a network control devicefor controlling a network where a plurality of terminals and countermeasure devices are connected, the network control deviceincluding: a clustering unitthat divides terminals including an incident-detected terminal and the related terminal group into a plurality of zones, on the basis of terminal information including information with which an incident-detected terminal is able to be identified, information with which a related terminal group suspected of being related to an incident is able to be identified among the plurality of terminals, and an inter-terminal communication history; and a communication control setting unitthat sets communication control relating to the terminals and the countermeasure devices for each of the plurality of zones.

Network control device and network control method

Provided is an incident effect range estimation device which estimates the range of the effect of an incident and shortens incident handling time. This incident effect range estimation device is provided with an incident origin log acquisition unit which acquires log information for the incident-originating device which is related to the occurrence of the incident, a communication destination log acquisition unit which acquires, on the basis of the log information for the incident-originating device, log information for a communication destination device which is the communication destination of the incident-originating device, and an effect range estimation unit which estimates the range of the effect of the incident on the basis of the communication destination device. The range of the effect of the incident can thereby be estimated automatically, and thus incident handling time can be shortened significantly.

Growing community of inventors

Tokyo, Japan

Daichi Hasumi