Kabushiki Kaisha Toshiba

Toshiba Infrastructure Systems & Solutions Corporation

Toshiba Solutions Corporation

Fukutomo Nakanishi

Hiroyoshi Haruki

Mikio Hashimoto

Satoshi Aoki

Ryotaro Hayashi

Yurie Fujimatsu

Tatsuyuki Matsushita

Takeshi Kawabata

Jun Kanai

Toshinari Takahashi

Fangming Zhao

Tomohide Jokan

Tomonori Maeda

Daiki Ishihara

Fumihiko Sano

Naoki Ogura

Yurie Shinke

Toshiharu Ooya

According to one embodiment, an information processing device includes a memory and one or more processors coupled to the memory. The one or more processors are configured to: acquire a violation log violating a normal list from a plurality of logs, and specify, as a head process, a process that has caused a phenomenon a history of which is described in the violation log; acquire a log sequence including a log of the head process and respective logs of processes of multiple generations successively tracing a generation source of the head process back to the past; detect, as a normal subsequence, a newest subsequence in which a predetermined first generation number of normal parent-child relations in the log sequence are consecutive based on a normal graph; and cause an analysis object storage device to store part of the log sequence at least from the violation log to the normal subsequence.

Information processing device, information processing system, computer program product, and information processing method

A detection systemincludes a control deviceand a monitoring devicecommunicably connected to the control device. An acquisition unitA of the control deviceacquires a target's observation value by a sensor. A first-noise-output unitB outputs a first-noise-value changing with time and less than a resolution of the sensor. An integration unitC outputs an integrated value obtained by integrating the first-noise-value and the observation value. A transmission unitD transmits the integrated value to the monitoring device. A separation unitA of the monitoring deviceseparates the integrated value from the control deviceinto the observation value and the first-noise-value. A second-noise-output unitB outputs a second-noise-value as the first-noise-value. A detection unitC detects whether the integrated value is a replay attack using the spatial distance between the first-noise-value and the second-noise-value.

Detection system, detection method, and computer program product

An attack control device according to an embodiment is provided with a storage unit and one or more hardware processors configured to function as a selection unit, a determination unit, and a calculation unit. The storage unit associates and stores a normal communication data model representing a model of communication data of a normal system, with each network segment. The selection unit specifies the network segment based on the communication prediction data predicted upon execution of the attack scenario and selects the normal communication data model associated with the network segment. The determination unit determines the similarity degree between the normal communication data represented by the normal communication data model, and the communication prediction data. The calculation unit calculates an effectiveness degree of the attack scenario to be higher as the similarity degree is higher.

Information processing device and computer program product

According to one embodiment, an information processing apparatus includes a communication amount predictor. The communication amount predictor acquires relation data in which a variation of a communication amount in a first environment including first devices of a plurality of function types is associated with a varied number of the first devices for each of the plurality of function types in a case where a number of first devices for each of the plurality of function types varies in the first environment. The communication amount predictor predicts a communication amount in a second environment including second devices of the plurality of function types on a basis of the relation data and a number of the second devices for each of the plurality of function types in the second environment.

Information processing apparatus, information processing method, and non-transitory computer readable medium

According to one embodiment, a communication device belongs to a communication network including a control device and a plurality of communication devices connected to the control device, and transmits a communication packet to a transmission destination communication device. The communication device and the transmission destination communication device are differently one of the plurality of communication devices. In the communication device, a memory stores first information for judging a normality of the communication packet. An analyzing unit judges the normality of a received communication packet based on the received communication packet and the first information. A transmission destination determining unit determines the transmission destination communication device and the control device as transmission destinations of the received communication packet when the analyzing unit judges that the received communication packet is not normal. A generating unit encrypts the communication packet to be transmitted to the transmission destinations.

Communication device, information processing system and non-transitory computer readable storage medium

According to an embodiment, an information processing device includes a processor. The processor is configured to: execute a rewriting process to rewrite some of a plurality of factors, included in data for normal operation of a target device, into a value different from a normal value; execute a correction process that is performed in a course of generating test data to be used for a test of the target device; and determine a method of generating the test data based on a rewriting part that indicates a factor serving as a target of the rewriting process and based on a correction part that indicates a factor serving as a target of the correction process.

Information processing device, information processing method and computer program product

According to an embodiment, an information processing device includes a first manager, a second manager, and a generator. The first manager loads a first class of a first object that requests execution of methods contained in a second object and a third class of a limiter configured to limit access from the first object to the methods. The second manager loads a second class of the second object. The generator generates the second object from the second class upon receiving a generation request for generating the second object from the first object, generates the limiter from the second object and the third class, and transmits the limiter to the first object.

Information processing device, information processing method, and computer program product

According to an embodiment, a code processing apparatus includes a determining unit, a concealing unit, an instructing unit, and an unconcealing unit. The determining unit is configured to determine, based on relocation information included in first code data that includes a code body and relocation information representing a portion of the code body to be relocated by a linker, a first portion including at least a part of the code body that is other than the portion. The concealing unit is configured to conceal the first portion. The instructing unit is configured to instruct the linker to process the first code data having the first portion concealed. The unconcealing unit is configured to unconceal the concealed portion of second code data that is generated from the first code data by the linker.

Code processing apparatus and computer program product

A condition determination device includes an acquiring unit, a specifying unit, a classifying unit, and a condition determining unit. The acquiring unit acquires a total execution history, which is an execution count for each component included in a program, when a test is performed by supplying a plurality of input data to a target device which executes the program. The specifying unit specifies a shortage component of which the execution count indicated by the total execution history does not satisfy test criteria among components included in the program. The classifying unit classifies each of the input data into first data, which causes the target device to execute the shortage component, and second data, which does not cause the target device to execute the shortage component. The condition determining unit determines a condition of input data having a common characteristic with the first data.

Information processing device, computer program product, and testing system with acquiring total execution history

According to an embodiment, a computer program product includes a computer-readable medium including program, when executed by a computer, to have a plurality of modules run by the computer. The computer includes a memory having a shared area, which is an area accessible to only those modules which run cooperatively and storing therein execution module identifiers. Each of the modules includes a first operation configured to store, just prior to a switchover of operations to an other module that runs cooperatively, an identifier of the other module as the execution module identifier in the shared area; and a second operation configured to execute, when the execution module identifier stored in the shared area matches with an identifier of own module immediately after a switchover of operations from the other module, a function inside the own module.

Computer program product, and information processing apparatus and method

According to an embodiment, a memory management device increments a lower value of a first counter, updates the counter by incrementing an upper value and resetting the lower value when the lower value overflows, increments to update the lower counter value when the upper value is incremented as a result of writing a second data piece having the upper value in common to a memory, recalculates a first secret value calculated using the first counter values and a root secret value in response to the first counter update, writes a first data piece and the first secret value to the memory, and at reading of the first data piece and the first secret value, calculates a second secret value using the updated first counter values and the root secret value, and compares the first secret value with the second secret value to verify the first data piece.

Memory management device and memory management method

According to one embodiment, there is provided a an information processing apparatus, including: a program acceptance portion; a program storage portion; a first function type storage portion; a function type extraction portion; a second function type storage portion; a first alternate function type storage portion; an alternate function type extraction portion; a second alternate function type storage portion; a selection portion; a judging portion; an updating portion; and a protection attribute determination portion.

Growing community of inventors

Tokyo, Japan

Fukutomo Nakanishi