Nippon Telegraph and Telephone Corporation

Takeaki Nishioka

Yuhei Hayashi

Hiroshi Osawa

Ichiro Kudo

Yuki Miyoshi

Hiroshi Suzuki

Satomi Inoue

Hiroyuki Onishi

Hiroki Inoue

Katsuhiko Sakai

Shohei Kamamura

Chiharu Morioka

A registration device () includes an extracting unit () that extracts inner header information and outer header information of an encapsulated packet, a filter unit () that calculates a hash value of the inner header information and the outer header information as an address of a hash table in which arrival information indicating whether a first packet of a series of flow has arrived is registered for each address and causes, based on the hash table, inner header information and outer header information of the first packet of the series of flow to pass, and a registering unit () that registers the inner header information and the outer header information of the first packet, which the filter unit () has caused to pass, in a database in association with each other.

Registration system, registration method, and registration program

A conversion device analyzes an input packet and acquires header information included in the packet. Furthermore, the conversion device classifies packets into one of a plurality of groups on the basis of the acquired header information and set grouping conditions. Subsequently, the conversion device generates packets for analysis on the basis of the processing corresponding to the classified groups.

Conversion device, conversion method, and conversion program

when packets are received via any one of the plurality of inflow VRFs provided for respective route patterns, a chaining edge router () redirects the packets to a chain VRF corresponding to the inflow VRF. The chaining edge router () transfers the packets redirected to the chain VRF to respective functions via a communication path constructed using a VLAN in advance according to a route pattern corresponding to the chain VRF.

Communication system and communication method

A feature calculation unit calculates a feature of header information of a packet. A classification unit classifies the packet as a normal packet or an abnormal packet by using the calculated feature. An adding unit adds a label indicating a tool name of a known attack tool to header information of a packet attacked using the attack tool. A learning unit learns the addition of the label by using the label and the feature calculated for the packet to which the label has been added as teacher data.

Detection device and detection method

A detection device includes: a statistic unit that acquires statistical value data on 5-tuple flows in a certain time period; a degree centrality calculation unit that calculates a degree centrality of a node including an indegree, which is a total sum of a weight of each edge flowing into the node, and an outdegree, which is a total sum of a weight of each edge flowing out of the node, based on the statistical value data on the 5-tuple flows in the certain time period; and a degree centrality impartation unit that imparts the degree centrality, as a feature, to the statistical value data on the 5-tuple flows in the certain time period.

Imparting device, imparting method, and imparting program

A continuity checking apparatus generates a continuity checking packet to which a predetermined flag and user attributes are assigned and transmits the generated continuity checking packet to an edge router connected to a service that is an entrance of a service chain. Each service transmits an arrival message with respect to the continuity checking packet to the continuity checking apparatus upon reception of the continuity checking packet to which the predetermined flag is assigned. In addition, each service transfers the continuity checking packet to a next service device of the service chain on the basis of the user attributes assigned to the received continuity checking packet. The continuity checking apparatus identifies a path representing service devices through which the continuity checking packet passes on the basis of the arrival message transmitted from each service, and determines whether the identified path is the same as a path of the service chain that is a continuity checking target.

Communication system and method of verifying continuity

The controller () acquires information about the band of the flow within the tunnel and the band of each flow after policing or shaping, calculates the ratio of the traffic volume after policing or shaping to the traffic volume before policing or shaping by using the acquired information about the band, and estimates the traffic volume of the flow to be monitored within the tunnel by using the calculated ratio and the band of each flow after policing or shaping.

Estimation method, estimation device, and estimation program

A collection device () collects traffic from a core network (N) connected to a plurality of operator networks (N). Further, an analysis device has a plurality of functions of analyzing traffic. Further, a setting device sets a scenario that designates at least one of the plurality of functions. Further, a pre-processing device converts the traffic collected by the collection device () to traffic of a format suitable for the function designated by the scenario. Further, a distribution device distributes the traffic converted by the pre-processing device to a designated function.

Analysis system and analysis method

A handling apparatus () handles a server attack taking place on a network (Na) or handles a server attack as requested by a security system provided on another network. In accordance with a determination that it is not possible to handle the server attack by the handling apparatus (), the control determination apparatus () makes a request to another security system (Sb) capable of handling the server attack to handle the server attack. A centralized control apparatus () determines whether the server attack taking place on the network (Na) can be handled on another network.

Growing community of inventors

Tokyo, Japan

Takeaki Nishioka