Nec Corporation

Etsuko Ichihara

Kazuhiko Isoyama

Yoshiaki Sakae

Koji Kida

Yuji Kobayashi

Junpei Kamimura

Jun Nishioka

Takashi Nomura

Hiroki Tagato

Kosuke Yoshida

Kenichiro Fujiyama

A warning apparatus () acquires first detected event information () representing, at a first abstraction level, an event set being a set of events having occurred in a target system. The warning apparatus () generates second detected event information () from the first detected event information (). The second detected event information () represents, at a second abstraction level, the event set represented by the first detected event information (). The warning apparatus () determines, from among a plurality of pieces of threat information () each representing a threat activity, the threat information () having a high degree of relevance to at least either of the first detected event information () and the second detected event information (). The warning apparatus () generates warning information () relating to a threat being occurring in the target system, based on the determined threat information () and a matching level being an abstraction level associated with the detected event information having a high degree of relevance to the threat information ().

Warning apparatus, control method, and program

An information processing apparatus () classifies each event that occurred in a target apparatus to be determined () either as an event (event of a first class) that also occurs in a standard apparatus () or as an event (event of a second class) that does not occur in the standard apparatus (). Herein, a first model used for a determination with respect to an event that also occurs in the standard apparatus () and a second model used for a determination with respect to an event that does not occur in the standard apparatus () are used as models for determining whether an event that occurs in a target apparatus to be determined () is a target for warning. The information processing apparatus () performs learning of the first model using an event of the first class. Further, the information processing apparatus () performs learning of the second model using an event of the second class.

Information processing apparatus, control method, and program

A first information processing apparatus () determines an alternative representation () of an event sequence represented by a plurality of event histories (), by use of dictionary data (). The first information processing apparatus () outputs information including the determined alternative representation (). The dictionary data () indicate an event sequence and an alternative representation () relating to the event sequence in association with each other.

To enable a user to easily recognize temporal order of elements included in a retrieval sentence, a retrieval sentence utilization deviceincludes: a retrieval sentence division unitfor dividing a retrieval sentence into a plurality of retrieval contents each of which includes an event; and a directed graph generation unitfor generating, from each of the retrieval contents, a subtree in which the event is an edge and a source of the event and an object of the event are nodes, and integrating a plurality of subtrees generated from the retrieval contents to generate a directed graph, wherein the directed graph generation unitplaces the plurality of subtrees in the directed graph according to occurrence order of events corresponding to the plurality of subtrees.

Retrieval sentence utilization device and retrieval sentence utilization method

An information processing apparatusexecutes analysis for an event history set (). The event history set () is a set of a plurality of event histories (). The event history () is information relating to an event generated in a target computer system. The information processing apparatusselects, based on a result of the analysis, an event history () to be excluded from deletion targets. The information processing apparatus () deletes, from the event history set (), an event history () other than the event history () excluded from the deletion targets.

Information processing apparatus, control method, and program for flexibly managing event history

An information processing apparatus generates a graph that represents an action of a program. On the graph, an edge represents action contents of a process in an event. Further, two nodes connected by the edge respectively represent a subject and an object of the event. The information processing apparatus outputs the generated graph. Further, the information processing apparatus also alters the generated graph. When an index value of an event satisfies a first predetermined condition which index value is based on the number of occurrences or the frequency of occurrences of the event, the information processing apparatus alters the graph with respect to an edge representing the event.

The purpose of the present invention is to provide a technology which assists a verifying party in ascertaining an anomaly in an event of which notification has been made. Provided is an assistance device, comprising: an acquisition unit which acquires as an associated event, from among events which take place among a plurality of elements, and with respect to elements which have been associated with an event which has been detected as an anomalous event, an event other than the anomalous event which has been associated with the elements; and a generating unit which, on the basis of the anomalous event and the associated event, generates a relational graph in which the elements are vertices, the relations among the elements are edges, the anomalous event and the associated event are respectively represented, and the associated event is displayed in a display screen in a different manner from the manner in which the anomalous event is displayed.

Anomalous event confirmation assistance apparatus, anomalous event confirmation assistance meithod, and recording medium

The present invention provides an information processing system for more appropriately classifying elements that constitute an information processing device or the like. This information processing system is provided with: a means that, on the basis of information indicating the relationship between a plurality of elements that constitute a system, acquires, for first elements to be classified, a set of second elements capable of arriving at the first elements via a relationship of arbitrary numbers; and a means that, on the basis of the set corresponding to the first elements, classifies each of the first elements in any of a plurality of roles.

Information processing system and classification method

Provided is, for example, a display control apparatus that generates display information with which an event having occurred in an information processing system can be easily determined. This display control apparatuscomprises a display control unitthat, on the basis of device information indicating a device detected by a first information processing apparatus in an information processing system and communication information indicating communication executed between a second information processing apparatus in the information processing system and a third information processing apparatus in the information processing system: performs displaying on a display apparatus in a manner such that said device and said first information processing apparatus are associated with one another; and performs displaying on said display apparatus in a manner such that said second information processing apparatus and said third information processing apparatus are associated with one another.

Display control apparatus, display control method, and recording medium on which display control program is recorded

The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.

Diagnosis device, diagnosis method, and non-volatile recording medium

Provided is, for example, a display control apparatus that generates display information for specifying an event occurred in an information processing system easily. The display control apparatus comprising displays, on a display apparatus, information representing an information processing apparatus and information representing a device in accordance with a display mode of arranging the pieces of information around a first area, displays, on the display apparatus, information indicating that a communication is executed between a plurality of the information processing apparatuses in accordance with a display mode of linking information representing the plurality of information processing apparatuses inside the first area, and displays, on the display apparatus, information indicating that processing is executed between the information processing apparatus and the device in accordance with a display mode of linking information representing the information processing apparatus and information representing the device inside the first area.

Disclosed are a display control device, etc., with which information is displayed according to a display mode having high visibility. Provided is a display control device (), comprising: a first identification information creation unit () with which a plurality of communication bodies which are capable of communication are classified into a plurality of groups, said unit creating first identification information which represents at least a portion of the communication bodies which are included in one of the groups; a second identification information creation unit () which creates second identification information which collectively represents a group set which represents two or more groups of the plurality of groups; and a control unit () which, on the basis of the size of a region which is displayed in a display means, selects specified identification information from the first identification information or the second identification information, and controls to display, in the display means, device identification information which represents the communication bodies which are not included in the specified identification information and/or the group identification information which represents the groups which are not included in the specified identification information, along with the specified identification information.

Display monitoring status of information processing devices

Disclosed are a display device, etc. which display information in a display format that provides high visibility. The display devicecomprises a display unitwhich displays first nodes, each representing a different communication entity with communication capabilities, or second nodes, each representing a different group of a plurality of communication entities, around a first region, and which shows communications being carried out between first and second nodes, between a plurality of first nodes, or between a plurality of second nodes, in a display format in which the connections between these communicating nodes are indicated within the first region.

Display device, display method, and recording medium having display program stored thereon

Information regarding moving bodies () that are in danger of colliding is collected at an appropriate frequency in accordance with the degree of danger. This information-collecting device has a risk calculation unit and a transmission-interval determination unit. The risk calculation unit receives, from a plurality of moving bodies, state information that includes locations and velocities and is transmitted at provided time intervals. The risk calculation unit also computes the distance between and relative velocities of two moving bodies. The transmission-interval determination unit computes an interval such that the higher the relative velocities of two moving bodies are relative to the distance therebetween, the shorter the interval is, and provides the computed interval to the moving bodies.

Growing community of inventors

Tokyo, Japan

Etsuko Ichihara