Fujitsu Corporation

Satoru Torii

Masashi Mitomo

Masahiro Komura

Yoshiki Higashikado

Masahiko Takenaka

Etsuo Ono

Kazumasa Omote

Osamu Koyano

Satomi Saito

Fumie Takizawa

Seigo Kotani

Naohiro Tamura

Yasutsugu Kuroda

Takeo Murakami

Yuki Fujishima

Bintatsu Noda

Mayuko Morita

Takuya Habu

Satomi Honda

Hiroshi Tsuda

Masanobu Morinaga

Kouichi Itoh

Ikuya Morikawa

Hisashi Kojima

Takeaki Terada

Katsunari Yoshioka

Shoko Iwase

An apparatus extracts a server process from a communication in a network to generate log data in which a combination of addresses of access sources in the server process is recorded, and compares a combination of past addresses recorded in the log data with a combination of addresses in a specific target access to identify a first communication apparatus performing an abnormal communication.

Effective detection of a communication apparatus performing an abnormal communication

A method of network monitoring includes, acquiring a log including site information for identifying a web site that is previously accessed by an access source and content information for identifying a content that is requested by the access source, generating a first relationship information that includes site information for identifying the web site which provides the content, generating a second relationship information that includes content information for identifying another content that is requested by the access source requesting the content, generating a third relationship information that includes a second combination of the access source and the web site which provides both the content and the other content for the access source, and determining a group that includes the first combinations corresponding to the second combinations whose degree of similarity is no less than a threshold, based on the third relationship information.

Method of network monitoring and device

A monitoring apparatus, includes a memory configured to store history information regarding a login attempt to a system by a communication apparatus in a state in which a first address is set, the system being a target to be monitored, and set a second address, and a processor coupled to the memory and configured to extract, from the history information, at least one of a variance of a number of login attempts per unit time and a length of a time of the login attempts, determine whether an attack in which accesses are attempted while an address is changed was executed on the system, according to the at least one of the variance and the length of the time, and add the second address of the system to a list that manages systems that had the attack when it is determined that the attack was executed.

Monitoring apparatus and method

An apparatus includes a memory, and a processor coupled to the memory and configured to specify a communication source device that performs a plurality of traffic confirmations of communications with a plurality of first devices, and control to discard a plurality of first authentication requests for the plurality of first devices generated by the communication source device after performing the plurality of traffic confirmations of communications.

Apparatus and method for detecting cyber attacks from communication sources

A computer is disclosed that performs an electronic mail creation process. The computer creates an electronic mail by referring to a storage part in which received electronic mails are stored, using at least one electronic mail of the received electronic mails stored in the storage part, the at least one electronic mail selected based on a criteria being set beforehand, and changing at least one of header information and a body text of the at least one electronic mail.

Electronic mail creation recording medium, method, and information processing apparatus

A log analysis device that classifies, based on a log collected from a network device, a plurality of attack target communication devices receiving attacks from an attack source communication device includes a correlation coefficient calculation unit that calculates, based on the log, a correlation coefficient relating to the number of the attacks in a time period during which the attacks were carried out for a combination of the plurality of attack target communication devices, the time period including a detection time at which and the detection period of time during which the network device detected the attack, and an extraction unit that extracts, as a high-correlation communication device group, a combination of the plurality of attack target communication devices, for which the correlation coefficient is equal to or greater than a prescribed threshold and of which the attack source communication device is identical in the time period.

Log analysis device and method

An anti-worm program allows a computer to execute control of communication suspected as worm communication, the program allowing the computer to execute: a communication information acquisition step that acquires communication information which is information concerning communication from a target source; and a communication control step that has a control amount calculation formula for calculating the control amount of the communication from the target source using the communication information and performs control of the communication from the target source based on the communication control amount obtained using the control amount calculation formula.

Anti-worm program, anti-worm apparatus, and anti-worm method

A communication detection method in which, based on a sender and a destination of communication data recorded in a communication log that records information concerning communication data exchanged between devices linked to a network, the communication log is divided into parts corresponding to individual object devices. The communication logs divided corresponding to the individual devices are analyzed so that the communication data in which a connection request to each device has been issued is extracted, and then a response success/failure table is generated based on whether a response from the device to the connection request has been detected; and based on the response success/failure table, when a time period that no response is obtained from the device satisfies a criterion condition determined in advance, it is determined that peer-to-peer communication has been performed.

Communication detection device, method, and program for peer-to-peer communication

The apparatus analyzes management information about network information collected from a computer and a router, detects a change in the management information specific to the activity of an unauthorized access program (worm), and generates alert information including a type of apparatus whose collected management information indicates the detected change and address information about an apparatus suspected of performing the activity of a worm. When the type of apparatus in the alert information refers to a computer, the apparatus generates an instruction to delete relayed information for the computer. When the type of apparatus refers to a network connection apparatus, the apparatus generates an instruction to set a filter for cutting off the communications of a worm with the network connection apparatus. Thus, the apparatus transmits the instructions.

Unauthorized access program monitoring method, unauthorized access program detecting apparatus, and unauthorized access program control apparatus

In this system, a monitor unit monitors outbound communications through a network interface. A process designation unit designates a processX which has generated communications. A process tree obtaining unit obtains and outputs process tree information for designation of an upper process to the processX. A discrimination unit refers to an illegal rule file for definition of an illegal process by a combination of a process and an upper process which have generated communications, and determines whether or not a processX is illegal according to communications information, process information, and process tree information. A process stop unit stops a processX determined to be illegal. A notification unit notifies a user of the stop of the processX.

Network virus activity detecting system, method, and program, and storage medium storing said program

In a system for providing software maintenance service, a server includes: a storage unit that stores a determination rule for determining whether to deny a process request to the faulty software; and a transmitting unit that transmits the determination rule to the client. The client includes: a determination-rule receiving unit that receives the determination rule; a process-request receiving unit that receives the process request; and a determining unit that determines whether to deny the process request based on the determination rule.

Method and system for providing software maintenance service, and computer product

An unauthorized access prevention system that includes a search unit searching the flowing-in path of the unauthorized access to the services by a Web system disclosed by a user's ISP, a determination unit determining the place to implement a countermeasure for protecting the services from the unauthorized access based on the result of the search, and a notification unit notifying, according to a determination that that the countermeasure is implemented in the flow source that makes the unauthorized access flow into the user's communication network, the determination to the flow source.

Unauthorized access prevention system

An unauthorized access prevention system includes a countermeasure method determination unit determining a method of taking countermeasures to protect a destination against unauthorized access based on a rate indicating a probability that predetermined traffic is unauthorized access. The rate is determined by calculating a number of times that the countermeasures were taken and subtracting a number of times that countermeasures were suspended, and dividing the resultant number of times that countermeasures were taken without suspension by the number of times that countermeasures were taken, for the predetermined traffic. The system also includes a storage device storing the number of times that countermeasures were taken and the number of times that countermeasures were taken without suspension. A countermeasure execution control unit controls when to take the countermeasures in the determined method. The countermeasure method determination unit selects an appropriate method of taking countermeasures by comparing the rate to predetermined threshold values.

A malicious access-detecting apparatus which is cable of grasping the whole aspect of an attack which can occur, before it actually occurs. A monitoring information-collecting section collects monitoring information including the network events detected by the monitoring devices on networks. A malicious apparatus group-deriving section retrieves a corresponding piece of the event information from an event information storage device, and derives, based on the retrieved piece of the event information, apparatuses that are involved in relevant detected network events which belong to the predetermined type of network events and of which addresses of senders or recipients are same, as a malicious apparatus group involved in the predetermined type of malicious access. A storage section stores information on each derived malicious apparatus group. An output section outputs a list of the each derived malicious apparatus group.

Malicious access-detecting apparatus, malicious access-detecting method, malicious access-detecting program, and distributed denial-of-service attack-detecting apparatus

A recording medium recording a network shutdown control program permitting suitable preventive measures to be taken. A detector monitors each network segment to be managed, and on detecting a communication fulfilling a predetermined condition, the detector generates a detection notification and sends the notification to a quarantine manager. On acquiring the detection notification generated by the detector of the local device or a detection notification generated by a remote network shutdown device, the quarantine manager generates a shutdown operation request in accordance with quarantine policy stored in a quarantine policy storage, and sends the request to a communication shutdown unit. In accordance with the shutdown operation request, the communication shutdown unit sets shutdown data identifying a target of shutdown and controls packets to be input to and output from the network segment so that the packets may be shut off or passed.

Growing community of inventors

Kawasaki, Japan

Satoru Torii