Abstract: A dark current cutoff device (1) includes: a battery (10) configure to perform electrical power supply to a load (20); a cutoff switch (32), which is provided between the battery (10) and the load (20), cuts off the electrical power supply to the load (20) at a time of being opened, and supplies electrical power to the load (20) at a time of being closed; a failure recording unit (21) that determines and records a case where the load (20) does not operate as a failure of the load (20); and an open/close determining unit (41) that determines that the cutoff switch (32) is opened; and a recording prohibiting unit (22) configure to prohibit, in a case where the cutoff switch (32) is determined to be opened by the open/close determining unit (41), the failure recording unit (21) from determining and recording the failure.

Abstract: An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

Abstract: A computer system, method, and computer program product for mitigating TOCTOU attacks, which includes: as processor requesting measurements representing operation of a first process on a host that is untrusted and based on the requesting, obtaining the measurements, which include a checksum that is a result of a second process executing checksum code to verify at least one last branch record on the host. A processor also determined, based on the measurements, whether the first process was compromised.

Abstract: A system and a method for detecting anomalous attacks in Internet network flow operate by counting a number of Internet traffic messages that are detected as anomalous attacks to provide a count; computing a running average of the number of messages that are detected as anomalous attacks; and comparing the count to the running average to provide an anomalous attack alarm if the count is greater than a multiple of the running average. The attacks can include at least one of spoofing attacks or denial of service attacks. A computer readable storage medium stores instructions of a computer program, which when executed by a computer system, results in performance of steps of the method.

Abstract: An inventive system and method for creating source profiles to detect spoofed traffic comprises obtaining a routing path for data to traverse nodes using traffic profiles, each routing path comprising at least a target AS, initializing one or more AS sets with last hop ASes, enhancing the AS sets by connecting the AS sets to routers, for each enhanced AS set, filtering observed traffic flows, and using the filtered flows to associate enhanced AS sets with network monitoring points to create the source profiles. In one aspect, filtering flows comprise TCP session filtering and/or destination bogon filtering. In one aspect, the routers are border gateway protocol routers. In one aspect, the last hop ASes are one hop away from the target AS.

Abstract: A method, an apparatus and a program for detecting spoofed Internet Protocol (IP) traffic directed to a network having a plurality of autonomous systems (AS) is provided. The method comprises receiving an incoming packet through an AS, the incoming packet containing a source IP address and a destination IP address, acquiring a corresponding source and destination IP address prefixes, converting the corresponding source and destination IP address prefixes into a source AS number and a destination AS number, determining if the incoming packet arrived from an unexpected source based upon the corresponding destination IP address prefix and the converted source and destination AS number using an unexpected pair tuple table generated from network routing information and generating an alert indicating that the incoming packet is not allowed to enter the network.

Abstract: A system and method for spammer host detection from network flow data profiles comprises constructing one or more cluster profiles and detecting spammer hosts. Construction cluster profiles comprises observing network flow data from one or more hosts; for each host, representing the network flow data associated with the host as a multidimensional vector; clustering the vectors of the hosts into the plurality of cluster profiles; annotating each cluster profile using at least one of black lists and white lists; and calculating a confidence in each cluster profile annotation. Detecting spammer hosts comprises observing the network flow data from a new host; representing the network flow data associated with the new host as a multidimensional vector, and placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.

Abstract: An apparatus and method predict and detect network attacks by using a diverse set of indicators to measure aspects of the traffic and by encoding traffic characteristics using these indicators of potential attacks or anomalous behavior. The set of indicators is analyzed by supervised learning to automatically learn a decision rule which examines the temporal patterns in the coded values of the set of indicators to accurately detect and predict network attacks. The rules automatically evolve in response to new attacks as the system updates its rules periodically by analyzing new data and feedback signals about attacks associated with that data. To assist human operators, the system also provides human interpretable explanations of detection and prediction rules by pointing to indicators whose values contribute to a decision that there is an existing network attack or an imminent network attack. When such indictors are detected, an operator can take remediation actions.

Abstract: A dark current cutoff device (1) includes: a battery (10) configure to perform electrical power supply to a load (20); a cutoff switch (32), which is provided between the battery (10) and the load (20), cuts off the electrical power supply to the load (20) at a time of being opened, and supplies electrical power to the load (20) at a time of being closed; a failure recording unit (21) that determines and records a case where the load (20) does not operate as a failure of the load (20); and an open/close determining unit (41) that determines that the cutoff switch (32) is opened; and a recording prohibiting unit (22) configure to prohibit, in a case where the cutoff switch (32) is determined to be opened by the open/close determining unit (41), the failure recording unit (21) from determining and recording the failure.

Abstract: An inventive system and method for creating source profiles to detect spoofed traffic comprises obtaining a routing path for data to traverse nodes using traffic profiles, each routing path comprising at least a target AS, initializing one or more AS sets with last hop ASes, enhancing the AS sets by connecting the AS sets to routers, for each enhanced AS set, filtering observed traffic flows, and using the filtered flows to associate enhanced AS sets with network monitoring points to create the source profiles. In one aspect, filtering flows comprise TCP session filtering and/or destination bogon filtering. In one aspect, the routers are border gateway protocol routers. In one aspect, the last hop ASes are one hop away from the target AS.

Abstract: A system and method for spammer host detection from network flow data profiles comprises constructing one or more cluster profiles and detecting spammer hosts. Construction cluster profiles comprises observing network flow data from one or more hosts; for each host, representing the network flow data associated with the host as a multidimensional vector; clustering the vectors of the hosts into the plurality of cluster profiles; annotating each cluster profile using at least one of black lists and white lists; and calculating a confidence in each cluster profile annotation. Detecting spammer hosts comprises observing the network flow data from a new host; representing the network flow data associated with the new host as a multidimensional vector, and placing the new multidimensional vector of the new host into one cluster profile of the one or more cluster profiles.

Abstract: A system and a method for detecting anomalous attacks in Internet network flow operate by counting a number of Internet traffic messages that are detected as anomalous attacks to provide a count; computing a running average of the number of messages that are detected as anomalous attacks; and comparing the count to the running average to provide an anomalous attack alarm if the count is greater than a multiple of the running average. The attacks can include at least one of spoofing attacks or denial of service attacks. A computer readable storage medium stores instructions of a computer program, which when executed by a computer system, results in performance of steps of the method.

Abstract: A method, an apparatus and a program for detecting spoofed Internet Protocol (IP) traffic directed to a network having a plurality of autonomous systems (AS) is provided. The method comprises receiving an incoming packet through an AS, the incoming packet containing a source IP address and a destination IP address, acquiring a corresponding source and destination IP address prefixes, converting the corresponding source and destination IP address prefixes into a source AS number and a destination AS number, determining if the incoming packet arrived from an unexpected source based upon the corresponding destination IP address prefix and the converted source and destination AS number using an unexpected pair tuple table generated from network routing information and generating an alert indicating that the incoming packet is not allowed to enter the network.

Abstract: An electrical load drive control apparatus includes: a plurality of drive units, each of which drives one of a plurality of electrical loads; an instruction unit that issues a drive switch instruction to switch drive among the plurality of electrical loads; a detection unit that detects a non-operating state of the plurality of electrical loads; and a control unit that controls the plurality of drive units based upon the drive switch instruction issued by the instruction unit and results of a detection by the detection unit.

Abstract: An electrical load drive control apparatus includes: a plurality of drive units, each of which drives one of a plurality of electrical loads; an instruction unit that issues a drive switch instruction to switch drive among the plurality of electrical loads; a detection unit that detects a non-operating state of the plurality of electrical loads; and a control unit that controls the plurality of drive units based upon the drive switch instruction issued by the instruction unit and results of a detection by the detection unit.

Abstract: Two motor fans are driven by two 4-pole direct current motors, respectively. Rotational speed of the two motors is controlled in three stages, namely low speed, intermediate speed and high speed. Specifically, at the time of low speed operation the two motors are connected in series with four poles, at the time of intermediate speed operation the two motors are connected in parallel with three poles, and at the time of high speed operation the two motors are connected in parallel with four poles.

Abstract: Two motor fans are driven by two 4-pole direct current motors, respectively. Rotational speed of the two motors is controlled in three stages, namely low speed, intermediate speed and high speed. Specifically, at the time of low speed operation the two motors are connected in series with four poles, at the time of intermediate speed operation the two motors are connected in parallel with three poles, and at the time of high speed operation the two motors are connected in parallel with four poles.