Fujitsu Corporation

Masashi Mitomo

Satoru Torii

Masahiro Komura

Yoshiki Higashikado

Fumie Takizawa

Bintatsu Noda

Osamu Koyano

Kazumasa Omote

Seigo Kotani

Etsuo Ono

According to an aspect of an embodiment, a method for controlling an apparatus for transferring data from a plurality of first devices to a second device via a network, the data being transferred by using a packet, comprises the steps of: extracting type information identifying type of software conveyed by a packet and destination information identifying destination of the packet transmitted from one of the first devices; counting the number of kinds of the type information extracted from packets associated with the same destination information, respectively; and determining an unauthorized communication when the number of kinds of the type information is less than a predetermined value.

Unauthorized communication detection method

An anti-worm program allows a computer to execute control of communication suspected as worm communication, the program allowing the computer to execute: a communication information acquisition step that acquires communication information which is information concerning communication from a target source; and a communication control step that has a control amount calculation formula for calculating the control amount of the communication from the target source using the communication information and performs control of the communication from the target source based on the communication control amount obtained using the control amount calculation formula.

Anti-worm program, anti-worm apparatus, and anti-worm method

A communication detection method in which, based on a sender and a destination of communication data recorded in a communication log that records information concerning communication data exchanged between devices linked to a network, the communication log is divided into parts corresponding to individual object devices. The communication logs divided corresponding to the individual devices are analyzed so that the communication data in which a connection request to each device has been issued is extracted, and then a response success/failure table is generated based on whether a response from the device to the connection request has been detected; and based on the response success/failure table, when a time period that no response is obtained from the device satisfies a criterion condition determined in advance, it is determined that peer-to-peer communication has been performed.

Communication detection device, method, and program for peer-to-peer communication

According to an aspect of an embodiment, a method for controlling an apparatus for transferring data from a plurality of first devices to a second device via a network, the data being transferred by using a packet, the method comprises the steps of: extracting encryption information identifying method of encryption conveyed by a packet and destination information identifying destination of the packet transmitted from one of the first devices; counting the number of kinds of the destination information extracted from packets associated with the same encryption information, respectively; and determining an unauthorized communication when the number of kinds of the encryption information is less than a predetermined value.

In a system for providing software maintenance service, a server includes: a storage unit that stores a determination rule for determining whether to deny a process request to the faulty software; and a transmitting unit that transmits the determination rule to the client. The client includes: a determination-rule receiving unit that receives the determination rule; a process-request receiving unit that receives the process request; and a determining unit that determines whether to deny the process request based on the determination rule.

Method and system for providing software maintenance service, and computer product

A malicious access-detecting apparatus which is cable of grasping the whole aspect of an attack which can occur, before it actually occurs. A monitoring information-collecting section collects monitoring information including the network events detected by the monitoring devices on networks. A malicious apparatus group-deriving section retrieves a corresponding piece of the event information from an event information storage device, and derives, based on the retrieved piece of the event information, apparatuses that are involved in relevant detected network events which belong to the predetermined type of network events and of which addresses of senders or recipients are same, as a malicious apparatus group involved in the predetermined type of malicious access. A storage section stores information on each derived malicious apparatus group. An output section outputs a list of the each derived malicious apparatus group.

Malicious access-detecting apparatus, malicious access-detecting method, malicious access-detecting program, and distributed denial-of-service attack-detecting apparatus

A recording medium recording a network shutdown control program permitting suitable preventive measures to be taken. A detector monitors each network segment to be managed, and on detecting a communication fulfilling a predetermined condition, the detector generates a detection notification and sends the notification to a quarantine manager. On acquiring the detection notification generated by the detector of the local device or a detection notification generated by a remote network shutdown device, the quarantine manager generates a shutdown operation request in accordance with quarantine policy stored in a quarantine policy storage, and sends the request to a communication shutdown unit. In accordance with the shutdown operation request, the communication shutdown unit sets shutdown data identifying a target of shutdown and controls packets to be input to and output from the network segment so that the packets may be shut off or passed.

Recording medium recording a network shutdown control program, and network shutdown device

The system includes the monitor agent that analyzes log of an entity. When an abnormality is detected, the monitor agent notifies about the abnormality to the control manager. The control manager decides a countermeasure and a countermeasure request party from the database and informs them to the action agent which the countermeasure request party. The action agent implements the countermeasure.

Method of and system for managing information, and computer product

An unauthorized access detection device capable of detecting unauthorized accesses which are made through preparation, in real time. When a packet travels on a network, a key data extractor obtains the packet and obtains key data. Next an ongoing scenario detector searches an ongoing scenario storage unit for an ongoing scenario with the key data as search keys. A check unit determines whether the execution of the process indicated by the packet after the ongoing scenario detected by the ongoing scenario detector follows an unauthorized access scenario being stored in an unauthorized access scenario storage unit. Then a report output unit outputs an unauthorized access report depending on the check result of the check unit.

Growing community of inventors

Kawasaki, Japan

Masashi Mitomo