Fujitsu Corporation

Yuki Fujishima

Masanobu Morinaga

Masahiko Takenaka

Kazuyoshi Furukawa

Satoru Torii

Masahiro Yamada

Mebae Yamaoka

Nobuyuki Kanaya

Satomi Saito

Takanori Oikawa

Satomi Honda

An apparatus extracts a server process from a communication in a network to generate log data in which a combination of addresses of access sources in the server process is recorded, and compares a combination of past addresses recorded in the log data with a combination of addresses in a specific target access to identify a first communication apparatus performing an abnormal communication.

Effective detection of a communication apparatus performing an abnormal communication

An information processing apparatus includes: a memory; and a processor coupled to the memory and configured to: specify, from among packets which are captured in a network, a head packet for transmitting a response related to remote control; extract a total size of the response from the head packet; calculate an area size which is assigned for the response in the head packet; and determine, based on the total size and the area size, that the remote control succeeds.

Information processing apparatus, recording medium recording network monitoring program, and network monitoring method

There is provided a network monitoring apparatus including a memory in which information of a remote operation and a combination of one or more command codes are associated with each other, and a processor coupled to the memory and the processor configured to acquire a command code of the one or more commands codes from a header of an encrypted execution request packet for executing the one or more commands for implementing a remote operation, determine whether or not there exists the combination included in a command code list in which acquired command codes are sequentially indicated, by referring the memory, and determine that the remote operation associated with the combination is successful when it is determined that there exists the combination included in the command code list.

Network monitoring apparatus and network monitoring method

A system includes at least one of first devices respectively including a first memory and a first processor, and a second device including a second memory and a second processor. The first processor is configured to extract a credential from first communication data between a terminal device and an issuing device which issues the credential to the terminal device, and store the credential and a user account of the credential in the first memory. The second processor is configured to obtain, from the first device, the user account corresponding to the credential extracted from second communication data, the second communication data corresponding to an authentication request from the terminal device to a providing device which processes a remote operation by the terminal device, and record remote operation data extracted from third communication data from the terminal device to the providing device and the user account in the second memory.

Network monitoring method and device

A method includes executing a determination process that determines that a setting value is a search key, the setting value being for an item from among a plurality of items in a record identified in a plurality of records, the plurality of records relating to a plurality of pieces of log information that are collected from a plurality of computers; executing a first identification process that identifies, as the record, another record including the search key from among the plurality of records; executing a second identification process that identifies, as the item, a new item from among the plurality of items, the new item being different from an item used to identify the another record in the executing of the first identification process; repeating executing of the processes; and outputting information on at least one computer that is suspected of a cyber-attack, based on the identified records.

Identification method and information processing device

A system includes first circuitry in a first computing device configured to issue a credential, second circuitry in a second computing device configured to perform an operation corresponding to content at a third computing device based on the credential, third circuitry in the third computing device configured to receive a request to perform the operation corresponding to the content from the second computing device, and fourth circuitry in a fourth computing device configured to monitor communication between the first computing device, the second computing device and the third computing device.

System, device and method for monitoring network

A device includes a processor configured to accumulate a plurality of logs in the memory, by repeating a capturing process and a logging process, the logging process including extracting a source identifier of a source computer, a destination identifier of a destination computer, and an attribute parameter which is set in an attribute item regarding an operation for the destination computer by the source computer, execute a detection process of detecting a target computer and another infected computer, the detection process including extracting a first destination identifier and a first attribute parameter, from a first log having an identifier of the infected computer in the source identifier, and extracting a second source identifier and a second destination identifier, from a second log having the first attribute parameter in the attribute parameter, and output the first destination identifier, the second source identifier, and the second destination identifier.

Network monitoring method and network monitoring device

An apparatus acquires a packet transmitted according to a protocol employing block access, from a communication network, and determines which one of a system attribution block storing stores file system attribution data, a file attribution block storing file attribution data, and a file name block storing file name data the packet is related to. The apparatus calculates a block number of the file attribution block, based on addresses provided to the system and file attribution blocks, when the packet is determined to be related to the file attribution block. The apparatus calculates an identification number of each piece of the file attribution data, based on the system attribution data and the calculated block number, and associates file attribution data stored in the file attribution block with file name data stored in the file name block, based on the calculated identification numbers and identification numbers provided to the file name data.

Apparatus and method for monitoring communication

When obtained communication data corresponds to an external communication from the outside of the network to the inside, external communication data is stored. When the obtained communication data corresponds to a service start, external communication data associated with the service start is extracted, and service start data is stored in correlation with the extracted external communication data. When the obtained communication data corresponds to an operation end, operation end data is stored. When the obtained communication data corresponds to a communication from the inside to the outside of the network, operation end data associated with the obtained communication data is extracted. Then, it is determined that a condition is satisfied that external communication data associated with the obtained communication data is stored in correlation with the service start data associated with the extracted operation end data. When the condition is satisfied, an attack for the system is detected.

Network monitoring apparatus and method

A log analysis device that classifies, based on a log collected from a network device, a plurality of attack target communication devices receiving attacks from an attack source communication device includes a correlation coefficient calculation unit that calculates, based on the log, a correlation coefficient relating to the number of the attacks in a time period during which the attacks were carried out for a combination of the plurality of attack target communication devices, the time period including a detection time at which and the detection period of time during which the network device detected the attack, and an extraction unit that extracts, as a high-correlation communication device group, a combination of the plurality of attack target communication devices, for which the correlation coefficient is equal to or greater than a prescribed threshold and of which the attack source communication device is identical in the time period.

Log analysis device and method

A method for detecting unauthorized access is executed by a network monitoring apparatus connected to a network in which packets are transmitted between a plurality of information processing apparatuses. The method includes obtaining, by the network monitoring apparatus, packets regarding at least one access performed from a first information processing apparatus to a second information processing apparatus. The method includes selecting at least one condition from among predefined at least two conditions. The selection is performed according to a combination between the first information processing apparatus as an access source and the second information processing apparatus as an access destination. The method includes determining whether each of the obtained packets satisfies the selected at least one condition. The method includes determining a possibility that unauthorized access has been performed on the second information processing apparatus, based on a number of conditions determined to be satisfied.

Method for detecting unauthorized access and network monitoring apparatus

Upon acquiring first data transmitted from an outside of a predetermined range in a network, an apparatus stores, in a memory, first information including transmission source and destination addresses of the first data. Upon acquiring second data addressed to an inside of the predetermined range and indicating predetermined communication data of service initiation, the apparatus extracts the first information including as the transmission source address a source address of the second data, and stores, in the memory, second information indicating a service initiation and including a destination address of the second data, in association with the first information. When the second information including as the transmission destination address a source address of the second data is stored in the memory and a destination address of the second data coincides with the transmission source address in the first information associated with the second information, the apparatus notifies detection of an attack.

Apparatus and method for detecting an attack in a computer network

A privilege violation detecting program stored on a computer-readable medium causes a computer to detect a privilege violation of an test target program by receiving an authority request API from an authority request API trace log storing unit; reading out, from an object access rule storing unit, an assumed access API assumed to be output in response to the received authority request API; determining an actual access API returned in response to the received authority request API from the actual access API trace log storing unit; and storing, into a least privilege violation data storing unit, data of the received authority request API when the actual access API returned in response received authority request API does not match the read out assumed access API.

Growing community of inventors

Yokohama, Japan

Yuki Fujishima