Panasonic Intellectual Property Corporation of America

Tatsumi Oba

Takuji Hiramoto

Yuji Unagami

Manabu Maeda

Takeshi Kishikawa

Naohisa Nishida

Tomohiro Oda

Goichiro Hanaoka

Naoki Ochi

Nuttapong Attrapadung

Tadanori Teruya

Takahiro Matsuda

Ryo Kato

Shota Yamada

Iku Ohama

Hiroyuki Okada

This method includes: extracting, from communication in a network, a first communication triplet that is a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating the type of communication performed between devices; determining whether the first communication triplet extracted corresponds to any of a plurality of second communication triplets stored in storage in advance as a whitelist and each being a 3-tuple including information indicating a source device, information indicating a destination device, and information indicating the type of communication; and estimating, as a score, a possibility that the first communication triplet emerges as the communication, by using a model that has been trained, when the first communication triplet does not correspond to any of the plurality of second communication triplets.

Communication monitoring method and communication monitoring system

A secure authentication method includes: deriving a distributed LSH value using secret LSH, taking a first distributed feature amount which is a feature amount of user information distributed through a secret distribution method and encrypted LSH parameters as inputs; deriving a distributed hash value using a secret unidirectional function, taking the distributed LSH value and a distributed key as inputs; decoding the hash value by reversing distribution of the distributed hash value; selecting, from a secret hash table storing sets of a hash value as an index and a distributed feature amount as a data string, a set including a hash value matching the decoded hash value; computing, in secret, similarity between the distributed feature amount in the set and the first distributed feature amount; deriving, in secret, a user authentication result based on the similarity computed; and outputting the derived authentication result.

Secure authentication method and secure authentication system

In an abnormality detection method, for a detection target packet stream made up of a plurality of detection target packets that are consecutive, a plurality of distances between the plurality of detection target packets are calculated, a feature amount of the detection target packet stream is extracted using the plurality of distances calculated, and information about the degree of abnormality in the detection target packet stream is calculated using the extracted feature amount.

Abnormality detection method and abnormality detection device

An anomaly detection method includes: calculating, for a detection target data stream of consecutive detection target data, distances between the detection target data; extracting features of the detection target data stream using the calculated distances; and calculating anomaly degree information about a degree of anomaly in the detection target data stream using the extracted features. Each extracted feature is made up of L consecutive distances (L is an integer greater than or equal to 2). For each feature extracted, supplementary information for calculating the anomaly degree information is calculated using a difference in the feature. For each of one or more information calculation target windows made up of N detection target data (N is an integer greater than or equal to L+1), the anomaly degree information is calculated using all supplementary information calculated from the N detection target data.

Anomaly detection method and anomaly detection device

A communication security apparatus includes a communicator that receives a packet from a first device and transmits the received packet to a second device, a memory that retains address authentication information containing pairs of a physical address and a logical address of one or more devices, and a controller. After a learning period of receiving and transmitting packets, the controller determines whether a pair of a physical address and a logical address of the first device and the second device match any one of the pairs of the physical address and the logical address of the one or more devices in the packet, and discards the packet when the pair of the physical address and the logical address of the first device and the second device do not match any one of the pairs of the physical address and the logical address of the one or more devices.

Communication security apparatus, control method, and storage medium storing a program

A method of obtaining a shared prediction model is provided. The method includes: obtaining a prediction model as a neural network; converting each negative numerical value in a plurality of parameters included in the prediction model to a positive numerical value to obtain a converted prediction model; and sharing the converted prediction model by a secret sharing method to obtain shared prediction models while concealing an input data.

Prediction model sharing method and prediction model sharing system

An information processing method performed by an information processing system including a storage device to process a plurality of data frames flowing in an in-vehicle network including at least one electronic control unit includes a receiving step of sequentially receiving a plurality of data frames flowing in the in-vehicle network, a frame collection step of recording, in a reception log held in the storage device, reception interval information indicating reception intervals between the plurality of data frames as frame information, a feature acquisition step of acquiring, from the reception interval information, a feature relating to distribution of the reception intervals between the plurality of data frames, and an unauthorized data presence determination step of determining the presence/absence of an unauthorized data frame among the plurality of data frames.

In-vehicle information processing for unauthorized data

A secure hub as a communication security apparatus includes a port that receives a packet from a device and transmits the packet to another device. The secure hub also includes a storage area that retains address authentication information containing pairs of a physical address and a logical address of one or more devices. The secure hub further includes a transfer processing unit that determines whether the pair of the physical address and the logical address of the device, and the pair of the another device, each match any pair of the one or more devices when the address authentication information contains the physical address or the logical address of the device and the another device contained in the packet, and discards the packet when the pair of the device and the pair of the another device do not match any of the pairs of the one or more devices.

A network protection device includes a packet capture unit which captures a network packet through an intelligent switch which performs connection in a communication network or across communication networks; a network analyzer which detects a threat in the network packet; a threat remover which removes the threat in the network packet; and a switch operator which changes from a first communication path, which connects a sender node to a receiver node without the threat remover, to a second communication path, which is different from the first communication path and connects the sender node to the receiver node through the threat remover when the threat is detected in the threat detector.

Network protection device and network protection system

There is provided an anomaly diagnosis method performed by an anomaly diagnosis apparatus that diagnosis to determine whether an observed value composed of values of variables representing a state of a monitoring target obtained by observing the monitoring target is anomalous. The anomaly diagnosis apparatus includes a processor and a memory. The memory stores an anomaly detection model generated by learning using observed values. The processor acquires group information indicating one or more groups each constituted by a combination of at least two mutually-related variables, acquires the observed value, determines whether the observed value is anomalous by employing the anomaly detection model read from the memory, and in a case where the observed value is determined to be anomalous, identifies a group causing an anomaly among the one or more groups in the observed value.

Anomaly diagnosis method and anomaly diagnosis apparatus

An anomaly detection method includes: extracting, for each of a plurality of learning packets obtained, all possible combinations of N-grams in the payload included in the learning packet; counting a first number which is the number of occurrences of each combination in the payloads of the learning packets; calculating, as anomaly detection models, first probabilities by performing smoothing processing based on a plurality of the first numbers; and when the score calculated for each of a plurality of packets exceeds a predetermined threshold that is based on the anomaly detection models stored in a memory, outputting information indicating that the packet having the score has an anomaly.

Anomaly detection method, learning method, anomaly detection device, and learning device

An integration server manages production in a manufacturing line that includes a first stage and a second stage carried out after the first stage. The integration server includes a communicator that acquires a first production log and a second production log. The first production log includes a first production count of processing objects in the first stage. The second production log includes the number of processing objects in the second stage. The integration server also includes an irregularity detector that detects the presence of irregularity in the first production log and the second production log on the basis of the first production count and the number of the processing objects in the second stage.

Growing community of inventors

Osaka, Japan

Tatsumi Oba