Nippon Telegraph and Telephone Corporation

Preferred Networks, Inc.

Yuminobu Igarashi

Takahiro Hamada

Bo Hu

Yuki Yamanaka

Hideo Kitazume

Shohei Hido

Masanori Yamada

Yuichi Murata

Masami Ueno

Yuichi Sudo

A detecting device obtains a network log and a host log of a device. The detecting device converts the network log into a network feature value in a form which is inputtable to a multimodal generative model which generates output data on the basis of multiple latent variables represented by random variables. The detecting device converts the host log into a host feature value in a form which is inputtable to the generative model. The detecting device also inputs at least one of the network feature value and the host feature value to the generative model and calculates output data. The detecting device detects an abnormality about the device using an anomaly score calculated on the basis of the output data.

Detection device and detection method

When an attack is detected, a controller samples an attack-target addressed DNS reply, received by a border router, from each of the border routers. Then, the controller adds the transmission-source IP address of the sampled DNS reply to the black list of the border router. Furthermore, upon reception of any of a target-addressed DNS reply and a target-addressed UDP subsequent fragment from the IP address that is described in the black list, the controller gives a command to the border router to discard the packet. Furthermore, the controller specifies the setting, for each of the border routers, that DNS replies to a DNS request from the target are excluded from discarding.

Control device, border router, control method, and control program

A control apparatus performs analysis by using partial information and determines whether or not communication is abnormal. If the communication is determined to be abnormal, the control apparatus controls a communication route for a communication control device such that the communication is transmitted from a communication apparatus to the control apparatus. Further, the control apparatus determines whether or not the communication transmitted by the control of the communication route is malicious communication. As a result, if the communication is determined to be malicious communication, the control apparatus controls the communication control device to restrict the malicious communication.

Network system, control apparatus, communication apparatus, communication control method, and communication control program

Network system

Growing community of inventors

Musashino, Japan

Yuminobu Igarashi