Nippon Telegraph and Telephone Corporation

Ntt Corporation

Yukio Nagafuchi

Masaki Tanikawa

Iifan Tyou

Hiroki Nagayama

Takaaki Koyama

Koki Nomura

Bo Hu

Tetsuhiko Murata

Hideo Kitazume

Toshiharu Kishi

Yasuhiro Teramoto

Kenji Ota

Akio Mukaiyama

Takahiro Nukushina

Koji Morishita

Shingo Kashima

Tsuyoshi Kondo

Takuya Saeki

Kazunori Kamiya

Makiko Aoyagi

An analysis device includes processing circuitry configured to acquire, from each network traffic sensor that monitors communication of an Internet of Things (IoT) device, a normal communication model that is used for monitoring the communication and indicates a characteristic of normal communication of the IoT device, cluster a normal communication model group of a same feature among acquired normal communication model groups, calculate a majority cluster that is a cluster having a largest number of normal communication models by using a result of the clustering, and calculate an average model of the normal communication model group belonging to the majority cluster, and notify the network traffic sensor serving as an acquisition source of the normal communication model of attribution information indicating whether or not the normal communication model belongs to the majority cluster and the average model.

Analysis device, analysis system, analysis method, and analysis program

A communication terminal apparatus includes processing circuitry configured to collect communication of an application and control the communication of the application based on a first control condition, analyze the communication collected to determine whether the application is a communication control target, and generate the first control condition based on a normal communication range of the application that is the communication control target, and transmit at least a part of first shared information including identification information about the application and the first control condition to a second communication terminal apparatus that is different from the communication terminal apparatus.

Communication terminal device, communication control method, and communication control program

A detecting device includes a memory, and processing circuitry coupled to the memory and configured to collect communication information from a communication device, have a model learn a characteristic of the communication information by the communication device using the communication information collected for each of the communication devices, and input communication information on a detection target to the model, detect whether the communication information on the detection target indicates abnormal communication on the basis of an output result from the model, and have the model relearn at the learning when the number of detected abnormalities about the communication information during a predetermined evaluation period exceeds a first threshold value.

Sensing device, sensing method, and sensing program

A creation device includes processing circuitry configured to collect pieces of information about IoT (Internet of Things) apparatuses connected to IoT gateways, and white lists stored in the IoT gateways, the white lists specifying content of communication allowed for each of the IoT apparatuses, calculate a feature value showing communication features of IoT apparatuses for each of the IoT gateways, and degrees of similarity in the feature value among the IoT gateways, based on the collected pieces of information about the IoT apparatuses, and extract, if any of the calculated similarity degrees is equal to or above a predetermined threshold, pieces of white list information about IoT apparatuses to mutually complement white lists stored in IoT gateways, from pieces of white list information about IoT apparatuses included in the white lists.

Preparation device, preparation system, preparation method, and preparation program

An identifying device () includes a preprocessing () that extracts a communication connection pattern including a set of a communication source identifier and a communication destination identifier from traffic data, a comparing unit () that adds an ID to a communication connection pattern group including a new communication connection pattern not included in a whitelist when the new communication connection pattern is present in the communication connection pattern group, a graph feature amount generating unit () that generates a graph feature amount of the communication connection pattern group to which the ID has been added and adds this ID to the graph feature amount, an abnormality determining unit () that determines whether the generated graph feature amount is normal using a model () having learned the graph feature amount, and an identifying unit () that retrieves a new communication. connection pattern corresponding to the ID of the graph feature amount determined to have an abnormality from the communication connection pattern group including the new communication connection pattern and identifies the retrieved new communication connection pattern as communication that causes the abnormality.

Specifying device, specifying method, and specifying program

A collection unit () collects information on IoT devices connected to IoT gateways and white lists of the IoT devices, retained by the IoT gateways. An extraction unit () extracts white lists of IoT devices that satisfies a prescribed condition related to the number of the IoT devices of each model or the number of installed locations of the IoT devices of each model from the collected white lists of the IoT devices using the collected information on the IoT devices so as to create a tentative white list. A coupling unit () couples the created tentative white list and the white lists retained by the respective IoT gateways together so as to create a white list applied to the respective IoT gateways.

Creation device, creation system, creation method, and creation program

Provided is an IoT GW (), including a learning unit () configured to create, for each IoT device connected to the IoT GW (), a normal communication model () that has learned a normal communication pattern of the IoT device; and a determination unit () configured to: determine, for learning by the learning unit (), whether to interrupt, finish, continue, and resume learning based on a load of a learning environment; and control learning processing by the learning unit () based on a result of determination.

Control device, control method, and control program

A determination apparatus according to a first embodiment collects information regarding communication performed by an IoT device. The determination apparatus extracts patterns used for detecting unauthorized communication performed by the IoT device from information that has been collected. Also, the determination apparatus approximates a change in the cumulative value of the number of patterns to a function that expresses a predetermined curve, thereby calculating the degree of convergence of the change. Also, the determination apparatus determines whether or not the degree of convergence is no less than a predetermined value.

Determination device, determination method, and determination program

A communication control apparatus includes a collection control unit, an analysis unit, and a coordination unit. The collection control unit collects communication performed with a device connected to a subordinate network, and controls communication performed by the device based on a first control condition; The analysis unit analyzes the communication collected by the collection control unit to extract device identification information indicating characteristics of the communication performed by the device. The analysis unit specifies a device name of the device and the first control condition corresponding to a normal communication range extracted from the device identification information, based on the device identification information. The coordination unit transmits at least part of first shared information in which the device name and the first control condition specified by the analysis unit and the device identification information are associated with each other, to an outside of the subordinate network.

Communication control apparatus, communication control method, and communication control program

A security measure invalidation prevention device includes an acquisition unit that acquires invalidated security point information about an invalidated security point among security points each having a measure function performing a security measure on a node connected to a network. The invalidated security point has a measure function to be invalidated. The device also includes a determination unit that determines whether a security event to be addressed with the measure function of the invalidated security point is present on the basis of the invalidated security point information acquired by the acquisition unit. The device further includes an extraction unit that extracts a security point to which the measure function of the invalidated security point can be shifted when the determination unit determines that the security event is present.

Security measure invalidation prevention device, security measure invalidation prevention method, and security measure invalidation prevention program

A specifying device receives detection information from a security device that detects hacking into a network or an activity of a terminal related to infection, and specifies a state of the terminal from information of the terminal and content of activity of the terminal included in the detection information. The specifying device specifies, when specifying that the terminal is in the state of being infected with malware, a terminal that may be infected before performing the content of the activity of the terminal included in the detection information based on connection information stored in a configuration information storage device, and specifies a terminal located on a route, along which the infected terminal is likely to be used for hacking or for infection of the terminal in the future, as a candidate for an infected terminal likely to be infected.

Specifying system, specifying device, and specifying method

An optimization apparatus collects cyber attack information that is information related to a cyber attack, and system information that is information related to an entire system including a device that has received the cyber attack. Based on the collected cyber attack information and system information, the optimization apparatus identifies an attack route of the cyber attack, and extracts, as dealing point candidates, devices that are on the attack route and have an effective dealing function against the cyber attack. Subsequently, the optimization apparatus selects a dealing point from the extracted dealing point candidates by using optimization logic that has been set.

Optimization apparatus, optimization method, and optimization program

A cloud controller performs, when an attack on a VM in any of data centers in a system is detected, setting of NAT of a private IP address of a VM(A), for a boundary router of each data center other than a data center that the VM(A) belongs to, the VM(A) being a victim. Next, the cloud controller performs setting for a redirecting device in the same data center as the VM(A), such that the redirecting device redirects access from a user terminal to a host under a boundary router of any of the respective data centers other than the data center. Thereafter, the cloud controller changes a private IP address of the VM(A) in a NAT setting of a boundary router of the data center to a private IP address of the redirecting device.

Growing community of inventors

Musashino, Japan

Yukio Nagafuchi