Nippon Telegraph and Telephone Corporation

Hiroshi Asakura

Shingo Orihara

Yang Zhong

Yasushi Okano

Yoshihito Oshima

Kazufumi Aoki

Masaki Tanikawa

Tohru Sato

Atsutoshi Kumagai

Tetsuya Abe

A detection apparatus extracts an account and a source address of the account from authentication information obtained from an authentication apparatus configured to perform user authentication, groups accounts for each of time slots at predetermined time intervals and each of source addresses in accordance with a timestamp and the source address of the account, and extracts an account group from which duplication of an identical account in an identical group has been excluded. Subsequently, the detection apparatus calculates the number of duplicate accounts among the extracted account groups. The detection apparatus determines that an identical source address is an address of an attacker in a case where the number of account groups of the identical source address in which the number of calculated accounts exceeds a first threshold exceeds a second threshold.

Detection system, detection apparatus, detection method, and detection program

A user estimator includes an extractor extracting at least either order of page transitions on a website by a user or a time interval of transition to each page, as a feature amount of page browsing by the user, from data to be learned and representing a request by the user to the website, and extracting at least either order of page transitions on the website or a time interval of transition to each page, as a feature amount of page browsing by any user, from data to be estimated and representing requests by the users to the website, a learning unit creating a model indicating a feature of page browsing for each user, by learning the extracted feature amount, to be learned, of page browsing by each user, and an estimation unit referring to the feature amount, to be estimated, and the model, and estimating the user among users.

User estimation apparatus, user estimation method, and user estimation program

In a security information management device (), security information, which is information related to security, is collected. The security information management device () extracts, by referring to a security dictionary storing therein a keyword related to security for each attribute, a keyword from referrer security information that becomes a source to be compared with security information for relevance thereto, and calculates, by comparing the extracted keyword with a keyword included in the collected security information, relevance between the referrer security information and the security information. The security information management device () then output security information having higher calculated relevance more preferentially.

Security information management system and security information management method

In order to detect an attack to a web application accurately by accurately correlating different types of events having occurred in the same server, an event acquiring unit acquires a log of events containing a HTTP request to a server, an event correlator creates a set of the request and events relevant to the request as an event block by using process IDs of processes having processed events contained in the log, and an attack detector contrasts the event block that is created from the log of events in which an attack is to be detected with an event block that is created from normal events to calculate a degree of similarity and, when the degree of similarity is equal to or lower than a threshold, detects the event block as an event block containing an event that is abnormal due to an attack.

Analysis method, analysis device and analysis program

A malware determination device, in which, upon input of an attribute name and an attribute value of an attribute of an executable file, a feature-selection setting unit registers the attribute with the attribute name in an attribute table as an attribute to be extracted, and registers the attribute value as an attribute value to be deleted in an attribute value table. Upon input of an executable file to be learned or to be determined, a feature extraction unit extracts an attribute value of an attribute registered as an attribute to be extracted in the attribute table from the executable file, to generate a feature vector including the extracted attribute value as a feature. A feature selection unit performs deletion of an attribute value registered as an attribute value to be deleted in the attribute value table from the feature vector.

Malware determination device, malware determination system, malware determination method, and program

An analysis apparatus analyzes access logs including authentication results and authentication information of users, and includes: a calculation unit that calculates a similarity between pieces of authentication information in two consecutive access logs when access logs of the same access source, from the access logs, are chronologically arranged, and presumes that a piece of authentication information of the access logs of the user has been input by a human if the calculated similarity is equal to or greater than a predetermined value; and a risk determination unit that determines that there is a possibility that the access source in the access logs is being an attack source if an authentication result of any of the two access logs is authentication failure and the calculation unit presumes that any piece of authentication information of the two access logs has not been input by a human.

Analysis apparatus, analysis system, analysis method, and analysis program

A device including: a parameter extracting unit that extracts each parameter from an access request, a character-string class converting unit that, with regard to each parameter, compares each part of a parameter value with a previously defined character string class, replaces the part with a longest matching character string class, and conducting conversion for a class sequence that is sequentially arranged in order of replacement, a profile storing unit that stores, as a profile in a storage unit, a class sequence with the appearance frequency of equal to or more than a predetermined value in the above-described group of class sequences with regard to the access request of the normal data as learning data, and a failure detecting unit that determines the presence or absence of an attack in accordance with the degree of similarity between the above-described class sequence and the profile with regard to the access request.

Growing community of inventors

Musashino, Japan

Hiroshi Asakura