Nippon Telegraph and Telephone Corporation

Hiroki Nagayama

Masaki Tanikawa

Shingo Kashima

Yukio Nagafuchi

Tetsuhiko Murata

Iifan Tyou

Koki Nomura

Kenji Ota

Akio Mukaiyama

Kazunori Kamiya

Bo Hu

Takahiro Nukushina

Koji Morishita

Masahiro Shiraishi

Asami Miyajima

Tsuyoshi Kondo

Tomoaki Washio

Takuya Saeki

A communication terminal apparatus includes processing circuitry configured to collect communication of an application and control the communication of the application based on a first control condition, analyze the communication collected to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

Communication terminal device, communication control method, and communication control program

A communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, the communication system including a computer including a memory and a processor configured to receive communication data among the plurality of nodes; based on the communication data, create first relationship information indicating a relationship among the nodes regarding transmission and reception of the communication data, second relationship information indicating a relationship among the nodes regarding a belonging domain and whether the nodes are on a publisher side or on a subscriber side, and third relationship information indicating a relationship among the nodes regarding a topic to be published and subscribed; and create configuration information indicating a network configuration of the communication system by associating the first relationship information, the second relationship information, and the third relationship information.

Communication system, configuration management apparatus, configuration management method, and program

A communication system that performs communication among a plurality of nodes by a broker-less type publishing/subscribing model, includes: a computer including a memory and a processor configured to detect distribution of unauthorized data from one application that is handled with priority on a subscriber side among one or more applications that are redundant on one or more of the nodes and functioning as a publisher side; and switch an application handled with priority on the subscriber side to another application different from the one application among the one or more applications in a case where distribution of the unauthorized data is detected.

Communication system, inspection apparatus, inspection method, and program

An aggregation unit () aggregates an input pulse train signal including a time-series pulse corresponding to a predetermined observation time into pulses for respective unit times. A calculation unit () calculates a time shift amount of an autocorrelation function using the aggregated pulse train signal. A detection unit () calculates an autocorrelation value and a threshold with respect to each of time shift amounts selected in ascending order from the calculated time shift amount and detects the time shift amount as a period of the aggregated pulse train signal when the autocorrelation value exceeds the threshold. A conversion unit () converts the detected period to a period of the input pulse train signal using the unit time. An exclusion unit () excludes the pulse train signal having the converted period from the input pulse train signal.

Estimation device, estimation method and estimation program

A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.

Preparation device, preparation system, preparation method, and preparation program

An identifying device () includes a preprocessing () that extracts a communication connection pattern including a set of a communication source identifier and a communication destination identifier from traffic data, a comparing unit () that adds an ID to a communication connection pattern group including a new communication connection pattern not included in a whitelist when the new communication connection pattern is present in the communication connection pattern group, a graph feature amount generating unit () that generates a graph feature amount of the communication connection pattern group to which the ID has been added and adds this ID to the graph feature amount, an abnormality determining unit () that determines whether the generated graph feature amount is normal using a model () having learned the graph feature amount, and an identifying unit () that retrieves a new communication. connection pattern corresponding to the ID of the graph feature amount determined to have an abnormality from the communication connection pattern group including the new communication connection pattern and identifies the retrieved new communication connection pattern as communication that causes the abnormality.

Specifying device, specifying method, and specifying program

A period estimation apparatus includes processing circuitry configured to extract candidate periods being a target of period determination from an input pulse train, use at least one of the candidate periods extracted to determine whether the at least one of the candidate periods exists as an actual period, and, when determining that the at least one of the candidate periods does not exist as the actual period, suspend the period determination for the at least one of the candidate periods, perform the period determination for the at least one of the candidate periods determined to exist as the actual period, generate a pseudo periodic pulse train, adjust, based on a differential value between the pseudo periodic pulse train generated and the input pulse train, a pulse position of the pseudo periodic pulse train, and detect a periodic pulse train according to results of the period determination and adjustment.

Pulse train signal cycle estimation device, pulse train signal cycle estimation method, and pulse train signal cycle estimation program

Provided is an IoT GW (), including a learning unit () configured to create, for each IoT device connected to the IoT GW (), a normal communication model () that has learned a normal communication pattern of the IoT device; and a determination unit () configured to: determine, for learning by the learning unit (), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit () based on a result of determination.

Control device, control method, and control program

An extraction unitextracts predetermined pieces of information from each of a plurality of packets and sent from equipmentThen, an inference unitinfers a piece of equipment information that is information on the equipmentfor each of the plurality of packets on the basis of the pieces of information extracted by the extraction unitThen, the first selection unitselects a predetermined piece of equipment information for each packet type from among pieces of equipment information on the basis of a level of detail of each piece of equipment information. Then, the second selection unitselects, on the basis of a level of reliability predefined according to each packet type, a predetermined piece of equipment information corresponding to the equipmentfrom among pieces of equipment information inferred by the first selection unit

Estimation device, estimation method, and estimation program

A communication control apparatus includes a collection control unit, an analysis unit, and a coordination unit. The collection control unit collects communication performed with a device connected to a subordinate network, and controls communication performed by the device based on a first control condition; The analysis unit analyzes the communication collected by the collection control unit to extract device identification information indicating characteristics of the communication performed by the device. The analysis unit specifies a device name of the device and the first control condition corresponding to a normal communication range extracted from the device identification information, based on the device identification information. The coordination unit transmits at least part of first shared information in which the device name and the first control condition specified by the analysis unit and the device identification information are associated with each other, to an outside of the subordinate network.

Communication control apparatus, communication control method, and communication control program

A cycle estimation device () includes: a candidate cycle extraction unit () which extracts a candidate cycle that is a cycle determination target from an input time-series pulse train; a pulse train shape analysis unit () which converts arrangement of the time-series pulse train into numerical values on the basis of the extracted candidate cycle and outputs a constant that adjusts a random noise threshold value of pulse repetition interval (PRI) conversion in response to an index indicating a degree of concentration of calculated numerical values; and a cycle detection unit () which executes PRI conversion using a value of the candidate cycle and the constant and performs cycle determination and cycle value detection.

Cycle estimation device for pulse train signal, cycle estimation method for pulse train signal, and cycle estimation program for pulse train signal

A traffic anomaly sensing systemincludes a preprocessing unit, a local graph feature generation unit, a global graph feature generation unit, a learning unit, and an anomaly determination unit. The preprocessing unitgenerates a communication history graph from traffic data. The local graph feature generation unitgenerates, from the communication history graph, a local graph feature about a certain vertex. The global graph feature generation unitgenerates, from the communication history graph, a global graph feature about a vertex. The learning unitgenerates a feature vector by combining the generated local graph feature and the generated global graph feature and generates a learned model for each host identifier. The anomaly determination unitdetermines whether the traffic data is anomalous or not by inputting the graph feature to the generated learned model.

Growing community of inventors

Musashino, Japan

Hiroki Nagayama