International Business Machines Corporation

Kunikazu Yoda

Hiroaki Etoh

Tsuyoshi Ide

Hisashi Kashima

Ryo Hirade

Takayuki Kushida

Takeshi Fukuda

Takeshi Tokuyama

Hiroyuki Okano

Shinichi Morishita

A system includes a monitoring management server, a monitoring target server, and one or more monitoring clients. The management server determines monitoring parameters for each client. The monitoring parameters specify at least when a client is to begin a monitoring session with the target server and when the client is to end the session with the target server. The management server determines the monitoring parameters for each client such that a predetermined maximum number of monitoring sessions performed within each time period is never exceeded by the target server. Each client receives monitoring parameters from the management server in response to a request initiated by the client, initiates a monitoring session with the target server in accordance with the monitoring parameters, and reports results of the monitoring session to the management server upon the monitoring session ending.

Management of monitoring sessions between monitoring clients and monitoring target server

A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing anode activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.

Anomaly detection

Systems, apparatus and methods to monitor communications conducted via a host computer placed under the management of security measures such as firewalls or routers' filtering capabilities. A communications monitoring system which includes a packet input means for connecting to predetermined points on a network via a network interface and receiving communications packets flowing at the points; and matching means for performing real-time matching between two packet streams composed of received communications packets each time a communications packet is received. If the two packet streams are highly similar, it is highly likely that an attack or intrusion is being made and an alert is issued.

Communications monitoring, processing and intrusion detection

A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing a node activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.

Log data for a packet that is exchanged across a network are recorded in a log box. At this time, the data size of the packet and the detection time are recorded. When an illegal access has occurred at a target computer, the tracing of an access chain is performed on the log information. The tracing of the access chain is performed as follows. A change in the size of the data in a packet in accordance with the time of the first connection, and a change in the size of the data in a packet in accordance with the time of the second connection are calculated using the log data, and then the shapes of the graphs formed by these packet series are compared. When the shapes of the graphs are similar, it is ascertained that the pertinent connections are included in the same chain.

Access chain tracing system, network system, and storage medium

For determination as to whether there is a possibility that temperature control satisfying conditions according to an upper limit LH_i and a lower limit LL_i of the annealing control temperatures of annealing object steel sections i will be realized under restrictions on limit values U and D of the control temperature increase and decrease rates, computation is performed without using dynamic programming requiring an enormous amount of data on a continuous annealing line of a steelwork. Annealing object steel sections in an annealing object steel bandto be computed are assigned numbers 1, 2, . . . , n in order from the first time division in the direction of movement. T_i is a time required to pass the annealing object steel section i through a predetermined point at which the steel section undergoes temperature control. LH_1=LL_1=b is given. X_i=[IL_i&#x2212;D*T_i, IH_i+U*T_i] is computed. When X_L_if, Y_i=X_iL_i. When X_iL_i=f, Y_i=X_i. Yis computed from i=1 to i=n in ascending order.

Apparatus, method and program for physical state controller

A memory device is provided that is used by a computer system and that has a memory pattern obtained after a function is called when the computer system executes a program, the memory pattern comprising: a return address storage area for storing a return addressfor the source of a call for the execution of a currently active function; a previous frame pointer storage area for storing a previous frame pointerto the calling source for the execution of a currently active function; and a local variable storage area to be located below the return address storage areaand the previous frame pointer storage area, wherein when a data arrayis stored in the local variable area, a guard variableis stored in a location preceding the data array, and wherein the guard variable is used as a target to confirm whether the return address has been destroyed.

Memory device, stack protection system, computer system, compiler, stack protection method, storage medium and program transmission apparatus

The present application discloses a method and apparatus for extracting association rules from data having two or more numeric attributes and a true-false attribute, and for presenting the rules in an easily understandable form. The method comprises the steps of: (i) storing numbers u(i,j) and v(i,j) of data in each pixel whose true-false attribute is true, so as to correspond to each pixel in a plane; (ii) inputting a condition .theta.; (iii) segmenting from the plane a rectilinear region S of the pixels to maximize the equation ##EQU1## ;and (iv) outputting data included in the segmented rectilinear region S. The invention also allows regions to be derived which satisfy a desired support maximization rule, confidence maximization rule, optimized entropy rule, and optimized interclass variance rule.

Growing community of inventors

Yamato, Japan

Kunikazu Yoda