Nippon Telegraph and Telephone Corporation

Masaki Tanikawa

Yukio Nagafuchi

Hiroki Nagayama

Iifan Tyou

Koki Nomura

Kazunori Kamiya

Bo Hu

Shingo Kashima

Tetsuhiko Murata

Kenji Ota

Akio Mukaiyama

Takahiro Nukushina

Shohei Araki

Koji Morishita

Yang Zhong

Tsuyoshi Kondo

Takuya Saeki

Shingo Orihara

Tohru Sato

Yuta Iwaki

Hiroshi Asakura

Shun Tobiyama

A communication terminal apparatus includes processing circuitry configured to collect communication of an application and control the communication of the application based on a first control condition, analyze the communication collected to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

Communication terminal device, communication control method, and communication control program

A classification apparatusacquires a communication log including a plurality of pieces of traffic data, and extracts different types of feature values from the plurality of pieces of traffic data. Subsequently, the classification apparatusclassifies the traffic data on a per IP address basis based on the extracted different types of feature values, and uses a plurality of classification results to count the number of times of appearance of a pattern having the same combination of the classification results.

Classification device and classification method

A detecting device includes a memory, and processing circuitry coupled to the memory and configured to collect communication information from a communication device, have a model learn a characteristic of the communication information by the communication device using the communication information collected for each of the communication devices, and input communication information on a detection target to the model, detect whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model, and have the model relearn at the learning when the number of detected abnormalities about the communication information during a predetermined evaluation period exceeds a first threshold value.

Sensing device, sensing method, and sensing program

A detection device includes processing circuitry configured to identify candidate bots using flow data, use the flow data to count a number of the candidate bots communicating with servers, for each of the servers, and determine servers communicating with a predetermined number or more of the candidate bots among the servers to be malicious servers, and detect candidate bots communicating with the malicious servers that are determined among the candidate bots to be malicious bots.

Detection device, detection method, and detection program

A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.

Preparation device, preparation system, preparation method, and preparation program

An input unit receives an input of data, as learning purpose data and determination target data, in which requests made to a server by a user are represented in a time series. Then, a shaping unit shapes the received data. A classifying unit classifies the shaped data for each user who made the requests. Then, a learning unit extracts, from the classified learning purpose data, consecutive n requests as feature values of the learning purpose data, performs learning by using the feature values of the learning purpose data, and creates a profile for each user. A determination unit extracts, from the classified determination target data, consecutive n requests as feature values of the determination target data and performs determination of the determination target data based on the feature values of the determination target data and based on the profiles created by the learning unit.

Analysis device, analysis method, and analysis program

A period estimation apparatus includes processing circuitry configured to extract candidate periods being a target of period determination from an input pulse train, use at least one of the candidate periods extracted to determine whether the at least one of the candidate periods exists as an actual period, and, when determining that the at least one of the candidate periods does not exist as the actual period, suspend the period determination for the at least one of the candidate periods, perform the period determination for the at least one of the candidate periods determined to exist as the actual period, generate a pseudo periodic pulse train, adjust, based on a differential value between the pseudo periodic pulse train generated and the input pulse train, a pulse position of the pseudo periodic pulse train, and detect a periodic pulse train according to results of the period determination and adjustment.

Pulse train signal cycle estimation device, pulse train signal cycle estimation method, and pulse train signal cycle estimation program

A signature generation unit () generates a signature in which header information of packet data included in traffic data is correlated with a label representing a category for an application corresponding to the packet data. A flow data generation unit () generates flow data from the packet data. An assigning unit () assigns the label to the flow data on the basis of the signature and the header information of the flow data. A calculation unit () calculates a feature amount of the flow data. A learning unit () learns a model for predicting a label from the feature amount using the label and the feature amount of the flow data to which the label is assigned.

Identification device and identification program

A collection unit () collects information on IoT devices connected to IoT gateways and white lists of the IoT devices, retained by the IoT gateways. An extraction unit () extracts white lists of IoT devices that satisfies a prescribed condition related to the number of the IoT devices of each model or the number of installed locations of the IoT devices of each model from the collected white lists of the IoT devices using the collected information on the IoT devices so as to create a tentative white list. A coupling unit () couples the created tentative white list and the white lists retained by the respective IoT gateways together so as to create a white list applied to the respective IoT gateways.

Creation device, creation system, creation method, and creation program

Provided is an IoT GW (), including a learning unit () configured to create, for each IoT device connected to the IoT GW (), a normal communication model () that has learned a normal communication pattern of the IoT device; and a determination unit () configured to: determine, for learning by the learning unit (), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit () based on a result of determination.

Control device, control method, and control program

A determination apparatus according to a first embodiment collects information regarding communication performed by an IoT device. The determination apparatus extracts patterns used for detecting unauthorized communication performed by the IoT device from information that has been collected. Also, the determination apparatus approximates a change in the cumulative value of the number of patterns to a function that expresses a predetermined curve, thereby calculating the degree of convergence of the change. Also, the determination apparatus determines whether or not the degree of convergence is no less than a predetermined value.

Determination device, determination method, and determination program

A communication control apparatus includes a collection control unit, an analysis unit, and a coordination unit. The collection control unit collects communication performed with a device connected to a subordinate network, and controls communication performed by the device based on a first control condition; The analysis unit analyzes the communication collected by the collection control unit to extract device identification information indicating characteristics of the communication performed by the device. The analysis unit specifies a device name of the device and the first control condition corresponding to a normal communication range extracted from the device identification information, based on the device identification information. The coordination unit transmits at least part of first shared information in which the device name and the first control condition specified by the analysis unit and the device identification information are associated with each other, to an outside of the subordinate network.

Communication control apparatus, communication control method, and communication control program

A cycle estimation device () includes: a candidate cycle extraction unit () which extracts a candidate cycle that is a cycle determination target from an input time-series pulse train; a pulse train shape analysis unit () which converts arrangement of the time-series pulse train into numerical values on the basis of the extracted candidate cycle and outputs a constant that adjusts a random noise threshold value of pulse repetition interval (PRI) conversion in response to an index indicating a degree of concentration of calculated numerical values; and a cycle detection unit () which executes PRI conversion using a value of the candidate cycle and the constant and performs cycle determination and cycle value detection.

Cycle estimation device for pulse train signal, cycle estimation method for pulse train signal, and cycle estimation program for pulse train signal

A traffic anomaly sensing systemincludes a preprocessing unit, a local graph feature generation unit, a global graph feature generation unit, a learning unit, and an anomaly determination unit. The preprocessing unitgenerates a communication history graph from traffic data. The local graph feature generation unitgenerates, from the communication history graph, a local graph feature about a certain vertex. The global graph feature generation unitgenerates, from the communication history graph, a global graph feature about a vertex. The learning unitgenerates a feature vector by combining the generated local graph feature and the generated global graph feature and generates a learned model for each host identifier. The anomaly determination unitdetermines whether the traffic data is anomalous or not by inputting the graph feature to the generated learned model.

Traffic anomaly sensing device, traffic anomaly sensing method, and traffic anomaly sensing program

A device and method to accurately detect list-based attacks without reducing the convenience for authorized users. An acquirer acquires information on accounts used for log-in trials to a plurality of websites. An analyzer calculates the degree of use of each account used in common for log-in trials to different websites in a predetermined period of time out of the accounts acquired by the acquirer and determine the log-in trials using the account to be attacks when the degree of use exceeds a predetermined threshold. A detector detects, as an attack, a log-in trial to the website using the same account as the account used for the log-in trials determined to be attacks by the analyzer.

Growing community of inventors

Musashino, Japan

Masaki Tanikawa