Nippon Telegraph and Telephone Corporation

Toshiki Shibahara

Mitsuaki Akiyama

Daiki Chiba

Takeshi Yagi

Yuta Takata

Kunio Hato

Hirokazu Kodera

Kazufumi Aoki

Yasushi Okano

Takuma Koyama

Asuka Nakajima

Eitaro Shioji

Satoshi Furutani

A data classification device includes: a known data input unit that receives an input of known data, the known data being data already classified into a class and a subclass subordinate to the class; a feature extraction unit that extracts, from features included in the known data, a feature that causes classification of the known data belonging to the same class into a subclass using the feature to fail; and a classification unit that classifies classification target data into a class using the feature extracted by the feature extraction unit.

Data classification device, data classification method, and data classification program

A level estimation apparatus includes processing circuitry configured to receive event logs of events detected by a device or software, and calculate degrees of similarity among the events indicated by the event logs with use of the event logs, and estimate a level of a predetermined event based on the calculated degrees of similarity among the events and a level of at least one of the events, wherein in the calculation of the degrees of similarity among the events, when a degree of similarity between events detected by different devices or items of software is calculated, a degree of similarity to a common event is used, the common event being an event that has been detected mutually by the different devices or items of software.

Level estimation device, level estimation method, and level estimation program

The detection device () has the signal processing unit () and the estimation unit (). The signal processing unit () updates the evaluation value of the vertex of the graph by belief propagation, on the basis of the matrix generated using the argument on the complex plane expressing the direction of the side of the graph in which at least some vertices are labeled. The estimation unit () estimates a label of a vertex of the graph on the basis of the evaluation value.

Detection device, detection method, and detection program

A phishing site detection device extracts, from a phishing kit, a condition of access sources with which the access to a phishing site is blocked. Then, the phishing site detection device accesses a phishing site constructed by the phishing kit using one or more extracted conditions of access sources, and stores an access result for each condition of access sources in an access result storage module. Thereafter, the phishing site detection device sets a condition of access sources with which the access to the phishing site constructed by the phishing kit is blocked, accesses a website to be detected, and determines whether the website is a phishing site on the basis of the access result.

Phishing site detection device, phishing site detection method and phishing site detection program

An identification apparatus includes processing circuitry configured to determine whether or not a first image and a second image are similar based on feature points extracted from each of the first image and the second image, and determine whether or not the first image and the second image are similar by comparing neighborhood graphs generated for each of the first image and the second image, the feature points being as nodes.

Identification device, identification method, and identification program

A detection device includes: an object data extraction unit that extracts, from one or more pieces of communication data which are transmitted from one or more electronic control units, at least part of a payload contained in communication data that satisfies a predetermined condition, information by which the communication interval between the communication data can be calculated, and a serial number of the communication data as object data; a partial sequence creation unit that creates, using the extracted object data, a partial sequence containing information corresponding to at least part of a payload and information indicating a communication interval from two or more pieces of object data with the same serial number; and a detection unit that detects, using the created partial sequence, predetermined communication data based on the order relation between at least part of a payload and the corresponding part of another payload and a communication interval. The predetermined condition is a condition for extracting only communication data which is transmitted periodically and also in conjunction with a predetermined event.

Detection device, detection method, and program

A classification apparatus that classifies sequential data, in which input communication destinations in a plurality of communications are recorded in order of occurrence of the communications, into a class that has a similar feature. There is a numerical vector calculation unit-configured to calculate numerical vectors that represent characteristics of communication destinations for each of the communication destinations, on the basis of sequential data in which the communication destinations in a plurality of communications are recorded in order of occurrence of the communications, and a classification unit-configured to classify the sequential data into a class that has a similar feature, on the basis of order relation of the communication destinations of the numerical vectors.

Classification apparatus, classification method, and classification program

An access classification device includes: a processor configured to: construct a plurality of trees in each of which at least a first destination and a second destination are set as nodes, content information corresponding to the nodes is added to the nodes, and an instruction to transfer an access from the first destination to the second destination is set as an edge; associate nodes of the plurality of trees with each other for the plurality of trees constructed, based on similarity between local structures of the trees; calculate similarity between the nodes associated with each other in the plurality of trees, based on the content information added to the nodes, and calculate similarity between the plurality of trees using the calculated similarity between the nodes associated with each other; and classify the access into a set with similar features, based on the similarity calculated.

Access classification device, access classification method, and recording medium

A classification device constructs tree structure data in which attribute information relating to a single communication or multiple communications serves as a terminal node, from a series of communications with a single communication destination or multiple communication destinations that take place when software is executed, calculates attribute information on a higher node on the basis of attribute information on the terminal node, and classifies the software by specifying the type of the software on the basis of attribute information on the highest node.

Classification method, classification device, and classification program

An access classifying device includes a tree building unit, a similarity-degree calculating unit, and a classifying unit. The tree building unit generates multiple trees, in which a first server and multiple second servers are nodes and commands for automatically transferring the sequence of accesses from the above-described first server to the above-described second servers are edges. The similarity-degree calculating unit calculates the degree of similarity between the above-described trees in accordance with the degree of matching between partial trees included in each of the above-described trees generated. The classifying unit classifies the above-described access in accordance with the above-described degree of similarity calculated.

Growing community of inventors

Musashino, Japan

Toshiki Shibahara