Abstract: An analysis condition for security risk for a data flow in a system to be analyzed is automatically generated. An analysis condition generating apparatus lA generates from a natural sentence, using ontology in which a relationship is described between one or more nodes on a data flow graph that indicates a data flow in a system to be analyzed and one or more edges that indicate an event related to the nodes, graph structural data indicating the relationship between the nodes and the edges, and generates an analysis condition for analyzing security risk for the system to be analyzed based on the graph structural data.

Abstract: It is determined whether to involve the security risk based on the data flow in the system to be analyzed. An analysis apparatus 1A a historical information collecting unit 220A configured to collect historical information on an operational history for a program executed in a system to be analyzed, an information adding unit 230 configured to add to the historical information, external information obtained from an information resource other than an information processing apparatus that executes the program, and a risk determining unit 180A configured to perform a risk determining processing for determining based on preset determining condition, whether to involve security risk in the historical information to which the external information is added.

Abstract: A system monitoring apparatus comprising: a complementing unit that generates complemented node information by complementing, based on a complementing model trained using information collected in a testing system using a monitoring command and an agent, first node information collected in an operated system using the monitoring command; and an estimating unit that estimates the probability of a link being present between nodes by inputting the complemented node information to a link estimating model trained using the information collected in the testing system using the monitoring command and the agent.

Abstract: In order to determine whether or not there is a security risk, based on an actual data flow in a system to be analyzed, an analysis apparatus includes: a receiving unit configured to receive history information related to operation history of a program operating in a system to be analyzed; a generating unit configured to generate data flow information indicating a path of data exchanged in the system to be analyzed, based on the history information; and a risk determining unit configured to perform a risk determining process for determining whether or not there is a security risk in the data flow information, based on a preset determination condition.

Abstract: The purpose of the present invention is to provide a technology which assists a verifying party in ascertaining an anomaly in an event of which notification has been made. Provided is an assistance device, comprising: an acquisition unit which acquires as an associated event, from among events which take place among a plurality of elements, and with respect to elements which have been associated with an event which has been detected as an anomalous event, an event other than the anomalous event which has been associated with the elements; and a generating unit which, on the basis of the anomalous event and the associated event, generates a relational graph in which the elements are vertices, the relations among the elements are edges, the anomalous event and the associated event are respectively represented, and the associated event is displayed in a display screen in a different manner from the manner in which the anomalous event is displayed.

Abstract: The present invention provides an information processing system for more appropriately classifying elements that constitute an information processing device or the like. This information processing system is provided with: a means that, on the basis of information indicating the relationship between a plurality of elements that constitute a system, acquires, for first elements to be classified, a set of second elements capable of arriving at the first elements via a relationship of arbitrary numbers; and a means that, on the basis of the set corresponding to the first elements, classifies each of the first elements in any of a plurality of roles.

Abstract: Provided is, for example, a display control apparatus that generates display information with which an event having occurred in an information processing system can be easily determined. This display control apparatus 101 comprises a display control unit 102 that, on the basis of device information indicating a device detected by a first information processing apparatus in an information processing system and communication information indicating communication executed between a second information processing apparatus in the information processing system and a third information processing apparatus in the information processing system: performs displaying on a display apparatus in a manner such that said device and said first information processing apparatus are associated with one another; and performs displaying on said display apparatus in a manner such that said second information processing apparatus and said third information processing apparatus are associated with one another.

Abstract: An information processing apparatus includes: a reach-extent extraction unit configured to extract, with use of a relationship graph representing relationships between a plurality of elements included in a system and location information that indicates, on the relationship graph, a plurality of locations in the system where anomalies have been detected, paths in the relationship graph as being reach extents, the path including a set of the elements that are directly or indirectly related to each of the plurality of locations as a source; and a shared-extent extraction unit configured to extract an influence process of an anomaly by extracting an extent that is shared in at least a prescribed number of paths among paths in the relationship graph that have been extracted as the reach extents.

Abstract: The present invention provides an information processing device that outputs information including the data transmission relationship between elements constituting an information processing system, the information indicating the state of the information processing system. The information processing device includes a graphing means for generating a relationship graph based on an event log indicating the behavior of each of a plurality of processes operating in the system, the relationship graph having the processes as the vertices thereof and having the data transmission relationship between the vertices as the sides thereof; and a graph output means for outputting the generated relationship graph.

Abstract: The present invention provides an information processing device that improves the detectability of system errors. This information processing device includes: a means that generates a state graph based on relationship change information indicating a change in the relationship between a plurality of elements included in a system, the state graph having the elements as the vertices thereof and the relationship between the elements as the sides thereof; a means that generates a normal model having the state graph as a set of conditions to be fulfilled during normal system operation, based on the relationship change information; and a means that detects system errors and outputs error information indicating detected errors, based on the state graph and the normal model.

Abstract: The purpose of the present invention is to provide a technology which assists a verifying party in ascertaining an anomaly in an event of which notification has been made. Provided is an assistance device, comprising: an acquisition unit which acquires as an associated event, from among events which take place among a plurality of elements, and with respect to elements which have been associated with an event which has been detected as an anomalous event, an event other than the anomalous event which has been associated with the elements; and a generating unit which, on the basis of the anomalous event and the associated event, generates a relational graph in which the elements are vertices, the relations among the elements are edges, the anomalous event and the associated event are respectively represented, and the associated event is displayed in a display screen in a different manner from the manner in which the anomalous event is displayed.

Abstract: The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.

Abstract: Provided is, for example, a display control apparatus that generates display information with which an event having occurred in an information processing system can be easily determined. This display control apparatus 101 comprises a display control unit 102 that, on the basis of device information indicating a device detected by a first information processing apparatus in an information processing system and communication information indicating communication executed between a second information processing apparatus in the information processing system and a third information processing apparatus in the information processing system: performs displaying on a display apparatus in a manner such that said device and said first information processing apparatus are associated with one another; and performs displaying on said display apparatus in a manner such that said second information processing apparatus and said third information processing apparatus are associated with one another.

Abstract: Provided is, for example, a display control apparatus that generates display information for specifying an event occurred in an information processing system easily.

Abstract: Disclosed are a display control device, etc., with which information is displayed according to a display mode having high visibility.

Abstract: Disclosed are a display device, etc. which display information in a display format that provides high visibility. The display device 201 comprises a display unit 202 which displays first nodes, each representing a different communication entity with communication capabilities, or second nodes, each representing a different group of a plurality of communication entities, around a first region, and which shows communications being carried out between first and second nodes, between a plurality of first nodes, or between a plurality of second nodes, in a display format in which the connections between these communicating nodes are indicated within the first region.

Abstract: The purpose of the present invention is to provide a software analysis device which efficiently analyzes a computer environment in which software is capable of running. The software analysis system determines an order of detection devices, generates order information representing the order, and calculate a progression degree of abnormality based on how degree a predetermined order include the order in the order information.

Abstract: Provided is, for example, a display control apparatus that generates display information for specifying an event occurred in an information processing system easily.

Abstract: The diagnosis device specifies a progression degree relating to a first information processing device for output information output by a first detection device at a first timing with respect to the first information processing device, based on device information indicates a progression degree that represents a degree to which the information processing device is abnormal with respect to the information processing device, determines whether or not information in which a first detection device identifier of the first detection device and the specified progression degree are associated with each other is included in progression-degree information in which a detection device identifier capable of identifying a detection device and the progression degree are associated with each other; and calculates the progression degree relating to the first information processing device according to the specified progression degree when the information is determined to be included in the progression-degree information.

Abstract: The present invention provides an information processing system for more appropriately classifying elements that constitute an information processing device or the like. This information processing system is provided with: a means that, on the basis of information indicating the relationship between a plurality of elements that constitute a system, acquires, for first elements to be classified, a set of second elements capable of arriving at the first elements via a relationship of arbitrary numbers; and a means that, on the basis of the set corresponding to the first elements, classifies each of the first elements in any of a plurality of roles.