Nippon Telegraph and Telephone Corporation

Ntt Corporation

Mitsuaki Akiyama

Takeshi Yagi

Yuta Takata

Daiki Chiba

Toshiki Shibahara

Takeo Hariu

Kunio Hato

Eitaro Shioji

Takuya Watanabe

Fumihiro Kanei

Tatsuya Mori

Kazufumi Aoki

Makoto Iwamura

Tomonori Ikuse

Takashi Koide

Takeshi Yada

Asuka Nakajima

Hirokazu Kodera

Takaaki Nagumo

Ayako Hasegawa

Satoshi Furutani

A data classification device includes: a known data input unit that receives an input of known data, the known data being data already classified into a class and a subclass subordinate to the class; a feature extraction unit that extracts, from features included in the known data, a feature that causes classification of the known data belonging to the same class into a subclass using the feature to fail; and a classification unit that classifies classification target data into a class using the feature extracted by the feature extraction unit.

Data classification device, data classification method, and data classification program

A generation device includes generation circuitry configured to acquire information on software, extract a feature quantity of the software from the information of the software acquired, generate a cluster for each software on the basis of the feature quantity extracted, calculate a clustering result including a center of gravity of the cluster, match the clustering result calculated with the past clustering result when a distance between a center of gravity of a cluster included in the past clustering result calculated from information on malware is equal to or less than a predetermined value, and generate a graph representing a relationship between the software and the malware on the basis of a result of matching.

Generation device, generation method, and generation program

A specifying device receives an input of time-series information indicating an operation form of a domain name up to a predetermined date and time in time series. Then, the specifying device specifies a pattern of a time-series change in operation form of a domain name on the basis of pattern information indicating patterns of time-series change in operation form of the domain name and time-series information of an input domain name. The specifying device specifies candidates for the operation form of the domain name since the predetermined date and time using a result of the specifying. Thereafter, the specifying device determines whether or not the domain name is a target of a re-determination as to whether or not the domain name is a malicious domain name on the basis of the specified candidates for the operation form of the domain name since the predetermined date and time.

Determination device, determination method, and determination program

In a vulnerability inspection device, an acquisition unit acquires system messages that are displayed in response to input for multiple types of service registration statuses of a user ID that is input to a login-related screen that requires input of the user ID in an account-based online service that issues the user ID. A determination unit uses the system messages that were acquired for the types to determine whether or not the login-related screen has a vulnerability regarding the leakage of user registration status.

Vulnerability inspection device, vulnerability inspection method, and vulnerability inspection program

A level estimation apparatus includes processing circuitry configured to receive event logs of events detected by a device or software, and calculate degrees of similarity among the events indicated by the event logs with use of the event logs, and estimate a level of a predetermined event based on the calculated degrees of similarity among the events and a level of at least one of the events, wherein in the calculation of the degrees of similarity among the events, when a degree of similarity between events detected by different devices or items of software is calculated, a degree of similarity to a common event is used, the common event being an event that has been detected mutually by the different devices or items of software.

Level estimation device, level estimation method, and level estimation program

The detection device () has the signal processing unit () and the estimation unit (). The signal processing unit () updates the evaluation value of the vertex of the graph by belief propagation, on the basis of the matrix generated using the argument on the complex plane expressing the direction of the side of the graph in which at least some vertices are labeled. The estimation unit () estimates a label of a vertex of the graph on the basis of the evaluation value.

Detection device, detection method, and detection program

An identification device includes processing circuitry configured to collect response information of a device by performing network scanning on a target network address group, accumulate the response information collected, compare pieces of response information having different scanning times with each other among pieces of the response information accumulated and calculate a degree of similarity between contents of responses, and identify that devices that transmit most similar pieces of response information are identical, based on the degree of similarity calculated.

Specifying device, specifying method, and specifying program

A calculation device receives input of a plurality of pieces of training data including a communication destination known to be malignant as data. The calculation device generates a model that calculates a malignant degree of an input communication destination from each piece of the training data. The calculation device gives weight to each of the models, and generates a mixed model using the model and the weight. The calculation device calculates a malignant degree of a communication destination unknown whether the communication destination is malignant using the mixed model.

Calculation device, calculation method, and calculation program

An analysis device includes an input unit that receives input of communication destination information to be analyzed, a conversion unit that converts a partial character string included in the communication destination information into an image, a search unit that obtains a character string that is visually similar to an image converted by the conversion unit and searches for known communication destination information that is visually similar to the communication destination information based on the character string obtained, and an output unit that outputs a combination of the communication destination information and the known communication destination information that is visually similar to the communication destination information.

Analysis device, analysis method, and analysis program

An identification apparatus includes processing circuitry configured to determine whether or not a first image and a second image are similar based on feature points extracted from each of the first image and the second image, and determine whether or not the first image and the second image are similar by comparing neighborhood graphs generated for each of the first image and the second image, the feature points being as nodes.

Identification device, identification method, and identification program

An attack countermeasure determination includes a domain name input unit that receives any domain name as input, and acquires setting information corresponding to the domain name, registration information corresponding to the domain name, and external information corresponding to an internet protocol (IP) address corresponding to the domain name, as feature information on the domain name, an attack countermeasure determination unit that specifies a pre-designated category for the domain name on the basis of the feature information and determines, in a stepwise manner, an attack countermeasure against the domain name in accordance with the specified category, and an attack countermeasure information output unit that outputs attack countermeasure information corresponding to the attack countermeasure.

Attack countermeasure determination apparatus, attack countermeasure determination method, and attack countermeasure determination program

An inference method includes acquiring similarities between a domain name serving as an analysis object and each domain name indicated in a legitimate domain name list as feature amounts, and inferring a degree that the domain name serving as the analysis object is wrongly recognized as a legitimate domain name based on the feature amounts acquired at the acquiring and a training model that outputs, as a response to input of the feature amounts, a degree that the domain name serving as the analysis object is wrongly recognized as the legitimate domain name, by processing circuitry.

Inference method, inference device, and recording medium

A feature extraction unit extracts, from an advertising request to view an online advertisement, client information on a client as a transmission source of the advertising request and publisher information on a website of a publisher who displays advertising, and calculates a predetermined feature amount using the client information and the publisher information with respect to a plurality of advertising requests including at least a benign advertising request, and a determiner generation unit generates a determiner that determines whether an advertising request is malignant or not by using the calculated feature amount.

Detector, detection method, and detection program

A classification apparatus includes: a crawler unit that acquires access result data for a website, the access result data including website application information, web server information, and the like that are updated by an administrator of the website; an update history generation unit that generates an update history of the website by making comparison in chronological order between pieces of information included in the access result data for the website; a classifier generation unit that generates a classifier that classifies a website having a possibility of being abused in the future, by using, as a feature value, the update history of the website; and a classification unit that classifies, through the classifier generated, the website having the possibility of being abused in the future.

Classification apparatus, classification method, and classification program

An extracting unit randomly extracts a block from among the blocks of instruction strings constituting the byte code of a first program and, at the time of execution of the first program, extracts the blocks which are invariably executed before the randomly-extracted block. A dividing unit randomly divides, into a plurality of blocks, the instruction strings constituting the byte code of a second program which enables detection of tampering of the first program. An inserting unit inserts the plurality of blocks, which are obtained by division by the dividing unit, at different positions in the block extracted by the extracting unit, while maintaining the execution sequence written in the second program.

Growing community of inventors

Musashino, Japan

Mitsuaki Akiyama