Abstract: A system includes a monitoring management server, a monitoring target server, and one or more monitoring clients. The management server determines monitoring parameters for each client. The monitoring parameters specify at least when a client is to begin a monitoring session with the target server and when the client is to end the session with the target server. The management server determines the monitoring parameters for each client such that a predetermined maximum number of monitoring sessions performed within each time period is never exceeded by the target server. Each client receives monitoring parameters from the management server in response to a request initiated by the client, initiates a monitoring session with the target server in accordance with the monitoring parameters, and reports results of the monitoring session to the management server upon the monitoring session ending.

Abstract: A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing anode activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.

Abstract: A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing anode activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.

Abstract: A system includes a monitoring management server, a monitoring target server, and one or more monitoring clients. The management server determines monitoring parameters for each client. The monitoring parameters specify at least when a client is to begin a monitoring session with the target server and when the client is to end the session with the target server. The management server determines the monitoring parameters for each client such that a predetermined maximum number of monitoring sessions performed within each time period is never exceeded by the target server. Each client receives monitoring parameters from the management server in response to a request initiated by the client, initiates a monitoring session with the target server in accordance with the monitoring parameters, and reports results of the monitoring session to the management server upon the monitoring session ending.

Abstract: Systems, apparatus and methods to monitor communications conducted via a host computer placed under the management of security measures such as firewalls or routers' filtering capabilities. A communications monitoring system which includes a packet input means for connecting to predetermined points on a network via a network interface and receiving communications packets flowing at the points; and matching means for performing real-time matching between two packet streams composed of received communications packets each time a communications packet is received. If the two packet streams are highly similar, it is highly likely that an attack or intrusion is being made and an alert is issued.

Abstract: A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing a node activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.

Abstract: Log data for a packet that is exchanged across a network are recorded in a log box. At this time, the data size of the packet and the detection time are recorded. When an illegal access has occurred at a target computer, the tracing of an access chain is performed on the log information. The tracing of the access chain is performed as follows. A change in the size of the data in a packet in accordance with the time of the first connection, and a change in the size of the data in a packet in accordance with the time of the second connection are calculated using the log data, and then the shapes of the graphs formed by these packet series are compared. When the shapes of the graphs are similar, it is ascertained that the pertinent connections are included in the same chain.

Abstract: For determination as to whether there is a possibility that temperature control satisfying conditions according to an upper limit LH_i and a lower limit LL_i of the annealing control temperatures of annealing object steel sections i will be realized under restrictions on limit values U and D of the control temperature increase and decrease rates, computation is performed without using dynamic programming requiring an enormous amount of data on a continuous annealing line of a steelwork. Annealing object steel sections in an annealing object steel band 12 to be computed are assigned numbers 1, 2, . . . , n in order from the first time division in the direction of movement. T_i is a time required to pass the annealing object steel section i through a predetermined point at which the steel section undergoes temperature control. LH_1=LL_1=b is given. X_i=[IL_i?D*T_i, IH_i+U*T_i] is computed. When X_L_i1f, Y_i=X_iL_i. When X_i L_i=f, Y_i=X_i. Y—i is computed from i=1 to i=n in ascending order.

Abstract: A memory device is provided that is used by a computer system and that has a memory pattern obtained after a function is called when the computer system executes a program, the memory pattern comprising: a return address storage area for storing a return address 230 for the source of a call for the execution of a currently active function; a previous frame pointer storage area for storing a previous frame pointer 220 to the calling source for the execution of a currently active function; and a local variable storage area to be located below the return address storage area 230 and the previous frame pointer storage area 22, wherein when a data array 211 is stored in the local variable area, a guard variable 212 is stored in a location preceding the data array 211, and wherein the guard variable is used as a target to confirm whether the return address has been destroyed.

Abstract: A system such as a Web-based system in which a plurality of computers interact with each other is monitored to detect online an anomaly. Transactions of a service provided by each of a plurality of computers to another computer are collected, a matrix of correlations between nodes in the system is calculated from the transactions, and a feature vector representing anode activity balance is obtained from the matrix. The feature vector is monitored using a probability model to detect a transition to an anomalous state.

Abstract: For determination as to whether there is a possibility that temperature control satisfying conditions according to an upper limit LH_i and a lower limit LL_i of the annealing control temperatures of annealing object steel sections i will be realized under restrictions on limit values U and D of the control temperature increase and decrease rates, computation is performed without using dynamic programming requiring an enormous amount of data on a continuous annealing line of a steelwork.

Abstract: Systems, apparatus and methods to monitor communications conducted via a host computer placed under the management of security measures such as firewalls or routers' filtering capabilities. A communications monitoring system which includes a packet input means for connecting to predetermined points on a network via a network interface and receiving communications packets flowing at the points; and matching means for performing real-time matching between two packet streams composed of received communications packets each time a communications packet is received. If the two packet streams are highly similar, it is highly likely that an attack or intrusion is being made and an alert is issued.

Abstract: Log data for a packet that is exchanged across a network are recorded in a log box. At this time, the data size of the packet and the detection time are recorded. When an illegal access has occurred at a target computer, the tracing of an access chain is performed on the log information. The tracing of the access chain is performed as follows. A change in the size of the data in a packet in accordance with the time of the first connection, and a change in the size of the data in a packet in accordance with the time of the second connection are calculated using the log data, and then the shapes of the graphs formed by these packet series are compared. When the shapes of the graphs are similar, it is ascertained that the pertinent connections are included in the same chain.

Abstract: A memory device is provided that is used by a computer system and that has a memory pattern obtained after a function is called when the computer system executes a program, the memory pattern comprising: a return address storage area for storing a return address 230 for the source of a call for the execution of a currently active function; a previous frame pointer storage area for storing a previous frame pointer 220 to the calling source for the execution of a currently active function; and a local variable storage area to be located below the return address storage area 230 and the previous frame pointer storage area 22, wherein when a data array 211 is stored in the local variable area, a guard variable 212 is stored in a location preceding the data array 211, and wherein the guard variable is used as a target to confirm whether the return address has been destroyed.

Abstract: The present application discloses a method and apparatus for extracting association rules from data having two or more numeric attributes and a true-false attribute, and for presenting the rules in an easily understandable form. The method comprises the steps of: (i) storing numbers u(i,j) and v(i,j) of data in each pixel whose true-false attribute is true, so as to correspond to each pixel in a plane; (ii) inputting a condition .theta.; (iii) segmenting from the plane a rectilinear region S of the pixels to maximize the equation ##EQU1## ;and (iv) outputting data included in the segmented rectilinear region S. The invention also allows regions to be derived which satisfy a desired support maximization rule, confidence maximization rule, optimized entropy rule, and optimized interclass variance rule.