Nec Corporation

Sumitomo Rubber Industries Limited

Kabushiki Kaisha Raser

Hirofumi Ueda

Norihito Fujita

Norio Yamagaki

Tomohiko Yagyu

Shunichi Kinoshita

Yoshinobu Ohta

Ryo Mizushima

Masafumi Watanabe

Kazumine Ogura

Taniya Singh

Attack path information includes information about an attack path including at least one attack step including an attack source, an attack destination, and an attack method. Vulnerability specification means refers to the attack path information and thereby specifies vulnerabilities exploitable by an attack on the attack destination in the attack step. In the vulnerability information DB, vulnerabilities and presence/absence of exploit codes for the vulnerabilities are stored and associated with each other. Diagnosis evaluation generation means refers to the vulnerability information DB, and thereby examines whether or not there is an exploit code for the specified vulnerability and generates, for the attack step, a risk diagnosis evaluation including the number of specified vulnerabilities and the presence/absence of the exploit codes therefor. Output means outputs the attack step and the risk diagnosis evaluation while associating them with each other.

Security risk analysis assistance device, method, and computer-readable medium

An analysis unitgenerates one or more pairs of a start point fact which is a fact representing possibility of the attack in a device that is a start point and an end point fact which is a fact representing possibility of the attack in the device that is an end point, analyzes, for each pair, whether or not it is possible to derive the end point fact from the start point fact, based on facts representing states of the devices generated based on information regarding the device that is the start point and information regarding the device that is the end point, the start point fact, and one or more analysis rules for analyzing the attack, and generates an attack scenario in a case where it is possible to derive the end point fact from the start point fact.

Analysis system, method, and program

A comparison means compares a first risk analysis result with a second risk analysis result. The first risk analysis result includes a first risk evaluation value. The second risk analysis result includes a second risk evaluation value. Based on the result of the comparison, a display means displays the first risk evaluation value in such a manner that a first risk evaluation value for which there is a second risk evaluation value, in the second risk analysis result, for an attack step of which an attack destination coincides with an asset included in the first risk analysis result and an attack method coincides with an attack method included in the first risk analysis result can be distinguished from a first risk evaluation value for which there is no such second risk evaluation value.

Risk analysis result display apparatus, method, and computer readable medium

Provided is an analysis system that allows a security administrator to understand the impact of known vulnerabilities on the system to be diagnosed. The topology identification unitidentifies network topology of devices included in a system to be diagnosed. The analysis unitgenerates an attack pattern that includes an attack condition, an attack result, an attack means that is vulnerability that is used by an attack, and a segment where the attack can occur in the system to be diagnosed. The display control unitdisplays segments included in attack patterns superimposed on the network topology, on a display device. At this time, the display control unitchanges a display mode of the segment according to a type of the vulnerability that corresponds to the attack means included in the attack pattern including the segment.

Provided is an analysis system that can analyze the degree of impact of vulnerability on individual systems. An analysis unitgenerates an attack pattern that includes an attack condition, an attack result, an attack means that is vulnerability that is used by an attack, and a segment where the attack can occur in a system to be diagnosed. A calculation unitcalculates an evaluation value, for each vulnerability, which indicates degree of impact of the vulnerability on the system to be diagnosed. Specifically, the calculation unitcalculates the evaluation value, for each vulnerability, based on the number of the attack patterns that include the vulnerability focused on as the attack means and the number of the segments indicated by each attack pattern that includes the vulnerability focused on as the attack means.

The present disclosure provides a security assessment apparatus, a method, and a program capable of making an assessment of a security risk simply and appropriately. The security assessment apparatus according to the present disclosure is a security assessment apparatus of a facility to be controlled using a controller, including: an identification unit () configured to identify a compromised component which puts the facility into an unsafe situation based on data regarding a plurality of components provided in the facility and control program code of the controller, thereby generating a list of the compromised component; and a compromised behavior generating unit () configured to generate a compromised behavior of a selected component selected from the list of the compromised component.

Security assessment apparatus, security assessment method, and non-transitory computer readable medium

Provided are a communications state determination device, etc., capable of improving the accuracy of network state specification. This communications state estimation device comprises: a setting means that, in accordance with given communications parameters, applies the communications parameters to a communications device that determines the occurrence of communications errors in communications with a communications destination device; a detection means that sends communications instructions to the communications device that performs communications, in accordance with received communications instructions, and detects the occurrence of communications errors that have been determined in the communications that are in accordance with the instructions; and an estimation means that estimates whether or not the communications device can perform the communications, on the basis of the communications parameters and the existence or otherwise of communications errors.

Communications state estimation device, communications state estimation method, and storage medium that stores communications state estimation program

A node device has a delivery predictability management part, a DTN communication part, and a user interface part. The delivery predictability management part stores, for each destination node, delivery predictabilities including a delivery predictability for the destination node calculated by a local node and a delivery predictability for the destination node calculated by a neighboring node. The DTN communication part refers to the delivery predictabilities for each destination node and selects a next hop node in transferring transfer data from the local node to the destination node. The user interface part allows selection of a destination node for DTN communication with the local node as a source node on a basis of the delivery predictabilities for each destination node.

Delay tolerant network (DTN) and ad-hoc node device

A data-storing-terminal counting unit counts the number of communication terminals in which each of a number of data are stored. Based on the results of the counts, a communication terminal count estimation unit estimates the number of communication terminals that will transmit data with the same timing. An adjustment reference value calculation unit computes an adjustment reference value for constraining the number of communication terminals estimated by the communication terminal count estimation unit to be less than or equal to a preset allowable number. On the basis of the adjustment reference value computed by the adjustment reference value calculation unit, a determination unit determines whether or not to permit transmission of data stored by a storing means. If the determination unit permits the transmission of said data, a data transmission unit transmits the data to a communication terminal in which said data is not stored.

Communication terminal, communication method, storage medium on which communication program is stored, and communication system

The purpose of the present application is to provide a technique for the exchange of path information between different routing domains, which, while reducing the exchange of useless path information in the stage for constructing a hierarchical structure, can maintain robustness of path recognition that tolerates network partition. Of the management communication node identifiers which are described in hierarchical information included in a path control message received from a neighboring communication node and in hierarchical information held by the local communication node and which indicate a communication node that manages each level of the hierarchicalized network structure, the identifier indicating the highest level communication node and the identifier indicating the transmission source communication node are used to identify whether the routing domain to which the aforementioned neighboring communication node belongs is the same as the routing domain of the local communication node, and if the routing domain to which the aforementioned neighboring communication node belongs is different from the routing domain of the local communication node, the path information held by the local communication node is made known.

Path information exchange method, communication node, communication system, and communication node program

A request possibility determination unitfor a communications terminal-determines whether or not communications time required for obtaining data from a communications terminal-can be secured, between the communications terminal-and the communications terminal-. A data acquisition unit: determines data that has not been stored in a data storage unit, among data on a list received as a result of a communications message from another communications terminal-; and requests the determined data from the communications terminal-, by using a communications message on the condition that the request possibility determination unithas determined that communications time can be secured.

Data sharing system

A communication terminal, comprises: a wireless communication unit to which a plurality of channels are allocated; a channel status calculation unit that calculates, when one of the plurality of channels is set as a forwarding channel, a capacity that can be used in the one channel by the communication terminal and a capacity that can be used in the one channel by another communication terminal; and a channel selection unit that determines, when one of the plurality of channels is set as a forwarding channel, whether a capacity that can be used in the one channel by the communication terminal satisfies a required bandwidth and determines, when another communication terminal has set the one channel as a forwarding channel, whether a capacity that can be used in the one channel by the another communication terminal satisfies the required bandwidth.

Communication terminal, channel selection method, and program

Upon sensing an update of any routing information entry held in a routing information storage unit (A), an information exchange coordination unit (A) references a node information storage unit (A), and if a node information entry corresponding to the updated routing information entry does not exist, acquires the corresponding node information entry from another communication terminal (A). Alternatively, upon sensing an update of any node information entry held in the node information storage unit (A), the information exchange coordination unit (A) references the routing information storage unit (A), and if a routing information entry corresponding to the updated node information entry does not exist, acquires the corresponding routing information entry from another communication terminal (A). This provides a communication terminal for acquiring both the node information entry and the routing information entry relating to a specific communication terminal substantially at the same time.

Method for exchanging information between communication terminals, and communication terminal

Upon receiving a routing control message from another communication terminal (B), a communication terminal (A) uses a MANET routing control unit (A) to update and manage route information when a routing domain described in the routing control message matches the routing domain of the communication terminal (A) itself. When the communication terminal itself does not belong to the routing domain, the communication terminal uses a DTN routing control unit (A) to update and manage route information to another routing domain, and uses a route information advertisement unit (A) to advertise the route information to another routing domain and the routing domain to which the communication terminal (A) itself belongs, for another communication terminal (B).

Route information exchange method, communication terminal, and non-transitory computer-readable medium storing route information exchange program

An information sharing system is provided with multiple communication devices that wirelessly connect with other communication devices in order to communicate with them without going through an access point. Each communication device has: an internal deduction portion that, using a reception history of notification messages received from the other communication devices, deduces which information is currently being held by each of the other communication devices; a duplication determination portion that determines whether or not the information that is currently being held by another communication device and that was deduced by the internal deduction portion matches information held by its own host device; and an information exchange portion that, when the duplication determination portion determines that the information does not match, transmits a notification message that contains the information held by its own host communication device.

Growing community of inventors

Tokyo, Japan

Hirofumi Ueda