Nec Corporation

Tomohiko Yagyu

Masahiro Jibiki

Hirofumi Ueda

Atsushi Iwata

Takaaki Suzuki

Kazuya Suzuki

Norio Yamagaki

Masaki Inokuchi

Yoshinobu Ohta

Ryo Mizushima

Yui Ikuma

Yoshitomo Warashina

A display apparatus () includes an acquiring unit () configured to acquire configuration information of an information system that includes a plurality of nodes; a determining unit () configured to determine a display method of displaying an object of security information display concerning a node in the acquired configuration information, based on a security characteristic of an attackable element used to attack the object of security information display and a security characteristic of a preventive measure element preventing an attack on the object of security information display; and a display unit () configured to, when displaying a system configuration of the information system, display the object of security information display in accordance with the determined display method.

Display apparatus, display system, display method, and non-transitory computer-readable medium

Attack path information includes information about an attack path including at least one attack step including an attack source, an attack destination, and an attack method. Vulnerability specification means refers to the attack path information and thereby specifies vulnerabilities exploitable by an attack on the attack destination in the attack step. In the vulnerability information DB, vulnerabilities and presence/absence of exploit codes for the vulnerabilities are stored and associated with each other. Diagnosis evaluation generation means refers to the vulnerability information DB, and thereby examines whether or not there is an exploit code for the specified vulnerability and generates, for the attack step, a risk diagnosis evaluation including the number of specified vulnerabilities and the presence/absence of the exploit codes therefor. Output means outputs the attack step and the risk diagnosis evaluation while associating them with each other.

Security risk analysis assistance device, method, and computer-readable medium

A comparison means compares a first risk analysis result with a second risk analysis result. The first risk analysis result includes a first risk evaluation value. The second risk analysis result includes a second risk evaluation value. Based on the result of the comparison, a display means displays the first risk evaluation value in such a manner that a first risk evaluation value for which there is a second risk evaluation value, in the second risk analysis result, for an attack step of which an attack destination coincides with an asset included in the first risk analysis result and an attack method coincides with an attack method included in the first risk analysis result can be distinguished from a first risk evaluation value for which there is no such second risk evaluation value.

Risk analysis result display apparatus, method, and computer readable medium

Provided is an analysis system that allows a security administrator to understand the impact of known vulnerabilities on the system to be diagnosed. The topology identification unitidentifies network topology of devices included in a system to be diagnosed. The analysis unitgenerates an attack pattern that includes an attack condition, an attack result, an attack means that is vulnerability that is used by an attack, and a segment where the attack can occur in the system to be diagnosed. The display control unitdisplays segments included in attack patterns superimposed on the network topology, on a display device. At this time, the display control unitchanges a display mode of the segment according to a type of the vulnerability that corresponds to the attack means included in the attack pattern including the segment.

Analysis system, method, and program

Provided is an analysis system that can analyze the degree of impact of vulnerability on individual systems. An analysis unitgenerates an attack pattern that includes an attack condition, an attack result, an attack means that is vulnerability that is used by an attack, and a segment where the attack can occur in a system to be diagnosed. A calculation unitcalculates an evaluation value, for each vulnerability, which indicates degree of impact of the vulnerability on the system to be diagnosed. Specifically, the calculation unitcalculates the evaluation value, for each vulnerability, based on the number of the attack patterns that include the vulnerability focused on as the attack means and the number of the segments indicated by each attack pattern that includes the vulnerability focused on as the attack means.

A rule generation apparatusis an apparatus that automatically generates rules used to analyze an attack, and includes a collection unit, an attack success condition generation unit, an attack-time history generation unit, and a rule generation unit

Rule generation apparatus, rule generation method, and computer-readable recording medium

At least one of nodes included in the second node group comprises a request means () for transmitting a request signal including verification information to at least any node of the first node group, and a verification means () for verifying response information for the request signal, the verification means determines, regarding the response information, whether or not desired information that is information requested by the request signal or a digest thereof is included, whether or not correct verification information is included, whether or not a value obtained by applying a one-way function to the response information satisfies a predetermined rule, and a response time that is the time taken between the transmission of the request signal and the obtainment of the desired information, and on the basis of the determination results thereof, assesses the presence or absence of reliability of the desired information or the degree of reliability thereof.

Information verification system, information verification device, method and program

A communication node includes: a control information sharing unit which distributes a relay node reselection request; a transmission power control unit which adjusts transmission power based on the relay node reselection request; a reselection necessity determination unit which determines whether another communication node is to become a new relay node, and, in the case of determining that the other communication node is to become the new relay node, calculating priority of the communication node in the wireless ad-hoc network; and a relay node reselection request unit which performs a relay node reselection request process for transmitting a relay node reselection request included in the control information, depending on the priority.

Communication terminal in wireless ad-hoc network, communication method, and communication program

Provided is a router to acquire a content, even when accessibility to a server is impossible due to a network failure. The router comprises: a unit for storing content data included in a content reply message transmitted from a content server; a unit for, when the content server becomes unreachable, broadcasting, to other routers, an MBC setting request message configured to set guidance information in the other routers, the guidance information being used, when a content request message which requests the content server for the content data is transmitted from a content request node, to transfer the content request message to the own router; and a unit for replying a content reply message including the stored content data, when the content request message used to request the content server for the content data is transferred in accordance with the guidance information.

Router, method for using cache when content server is unreachable, and program

Disclosed is a communication node device constituting a communication system performing multicast, which is characterized by that: when having forwarded data to a child node subordinate to it along a normal distribution path, it sets a retransmission timer also with respect to a child node on a redundant distribution path; and when having received data, it sends a reception confirmation message to both the parent node of the normal distribution path and a parent node of the redundant distribution path.

Multicast communication method, communication node device and program

A path control method includes a procedure for developing a path control message including regional information in transmission on the network. The regional information designates a path and/or a path length for transmitting the path control message. The path control message includes a regional property for instructing each node as to how to process the regional information either in a strict manner or in a flexible manner. With reference to the regional information and/or the regional property, each node is capable of selecting a destination node to which the path control message is to be transmitted, stopping the further transmission of the path control message, or discarding the path control message.

Path control method adapted to autonomous system routing protocol for communication network

The present invention provides a traffic engineering apparatus which performs traffic engineering, including: an optimal branch point determination unit which determines an optimal branch point in a network to realize a predetermined policy; and a traffic flow regulation unit which regulates a traffic flow rate into the local node during reception of traffic based on the optimal branch point determined by the optimal branch point determination unit.

Traffic engineering apparatus, network system, and traffic control method and program

In a node, a unicast route control information acquireracquires unicast route control information from the multicast information and a TC message received from another node respectively. A relay node set calculatoruses the information to calculate a sender relay node set that covers every multicast receiver node and a receiver relay node set that covers every multicast receiver node respectively, then a multicast route calculatorcalculates a multicast route between a node included in the sender relay node set and a node included in the receiver relay node set.

Radio multi-hop network, node, multicast route control method, and program thereof

A data transmission system includes a plurality of dynamic route control units each disposed for one of a plurality of interfaces provided in the data transmission system. The route control data prepared by the dynamic route control units are combined by a specified dynamic route control unit to obtain in-system route control data, which is delivered to all the dynamic route control units. Each dynamic route control unit calculates costs for the routes between the own system and other data transmission systems based on the in-system route control data and new route control data received.

Data transmission system having a plurality of dynamic route control units

A multicast packet transfer system includes a first packet transfer apparatus and a second packet transfer apparatus. The first packet transfer apparatus transmits transfer packet data relating to an IP header and a UDP header of a multicast packet when the multicast packet is received, rewrites a header section of the multicast packet to produce a unicast packet, and transmits the unicast packet. The second packet transfer apparatus receives the transfer packet data and the unicast packet, and reproduces the multicast packet based on the received unicast packet and the received transfer packet data.

Growing community of inventors

Tokyo, Japan

Tomohiko Yagyu